30 Free GCP GCP-PCA Practice Questions

GCP-PCA Practice Questions

1. Question 1.Case Study: Cymbal Retail. Cymbal wants to modernize its operations by generating product attributes and images from supplier-provided information using Generative AI. They must incorporate a Human-in-the-Loop (HITL) review process before the live catalog (stored in Cloud SQL for MySQL) is updated. Which architecture provides the most scalable, cost-effective, and serverless approach while meeting these exact requirements?

   • A.Use Vertex AI Gemini for text and Imagen for image generation. Store intermediate results in Firestore. Deploy a Cloud Run web app for the HITL UI, which upon approval, triggers an Eventarc event to a Cloud Run function to update Cloud SQL.(correct answer)
   • B.Use the Cloud Vision API and Cloud Natural Language API. Store the generated content in Cloud Storage. Deploy an App Engine standard app for associates to review content, writing approved changes via Datastream to Cloud SQL.
   • C.Run open-source LLMs on a GKE Standard cluster with attached GPUs. Store intermediate generated assets locally on Persistent Disks. Expose a Kubernetes service for associates to review and directly update Cloud SQL via JDBC.
   • D.Ingest supplier data into BigQuery. Use BigQuery ML to generate text attributes and call Vertex AI Imagen remotely. Use Looker as the HITL UI to review data, and scheduled queries to push approved data to Cloud SQL.
   Show answer & explanationHide answer

   Correct answer: A

   Use Vertex AI Gemini for text and Imagen for image generation. Store intermediate results in Firestore. Deploy a Cloud Run web app for the HITL UI, which upon approval, triggers an Eventarc event to a Cloud Run function to update Cloud SQL.

   Explanation

   Vertex AI provides the foundational models (Gemini for text, Imagen for images) needed. Storing intermediate, unapproved state in a fast NoSQL DB like Firestore is highly efficient. Cloud Run offers a scalable, serverless platform for the custom HITL UI. Once approved, using event-driven architectures (Eventarc + Cloud Run functions) to update the relational Cloud SQL database ensures decoupling, high scalability, and minimal operational overhead.

2. Question 2.Case Study: KnightMotives Automotive. KnightMotives plans to monetize the vast amounts of telemetry data generated by its autonomous vehicle fleet to finance new technology investments. They need to securely ingest this data from global locations (including rural areas with intermittent connectivity), process it in real-time, and expose specific aggregated datasets to external automotive partners without moving the data. Which combination of services should they implement? (Select 2)

   • A.Use Cloud IoT Core with MQTT protocol to buffer data locally on the vehicles during rural disconnects, securely transmitting to Cloud Pub/Sub upon reconnection.
   • B.Deploy a global external Application Load Balancer in front of Cloud Run services to act as an ingestion gateway, writing validated payloads directly to Cloud Storage.
   • C.Publish the aggregated datasets to BigQuery and securely share them with external partners using Analytics Hub, granting subscribe access to authorized external identities.(correct answer)
   • D.Use Pub/Sub to ingest the telemetry data stream and Dataflow to process and clean the data in real-time before writing the aggregated results to BigQuery.(correct answer)
   • E.Configure VPC Service Controls perimeters around BigQuery and export the aggregated data via Cloud Storage signed URLs to external partners.
   Show answer & explanationHide answer

   Correct answer: C, D

   Publish the aggregated datasets to BigQuery and securely share them with external partners using Analytics Hub, granting subscribe access to authorized external identities. / Use Pub/Sub to ingest the telemetry data stream and Dataflow to process and clean the data in real-time before writing the aggregated results to BigQuery.

   Explanation

   Pub/Sub is the standard Google Cloud entry point for high-throughput, globally distributed telemetry streaming, and Dataflow handles real-time stream processing and aggregation into BigQuery. To monetize and share this data securely with external partners without duplicating or moving the data, BigQuery Analytics Hub is the precise enterprise solution. Cloud IoT Core is deprecated and no longer an active Google-recommended pattern.

3. Question 3.Guided by the Performance Optimization pillar of the Google Cloud Well-Architected Framework, your enterprise is migrating an intensive high-performance computing (HPC) application. The workload consists of tightly coupled MPI (Message Passing Interface) nodes that require single-digit microsecond latency between instances. The job runs predictably at the end of each month for exactly 48 hours. Which compute deployment strategy guarantees the necessary network performance while optimizing costs?

   • A.Deploy the nodes on GKE Autopilot in a single region to ensure dynamic scaling, utilizing Spot Pods to minimize the 48-hour compute costs.
   • B.Deploy Compute Engine C2 (Compute-optimized) instances within a single zone using a Compact Placement Policy, and leverage 1-year Committed Use Discounts (CUDs).
   • C.Deploy Compute Engine instances using a Spread Placement Policy across multiple zones within the same region to balance high availability and low latency.
   • D.Deploy Compute Engine C2 (Compute-optimized) instances within a single zone using a Compact Placement Policy, and provision them on-demand without CUDs.(correct answer)
   Show answer & explanationHide answer

   Correct answer: D

   Deploy Compute Engine C2 (Compute-optimized) instances within a single zone using a Compact Placement Policy, and provision them on-demand without CUDs.

   Explanation

   For tightly coupled HPC workloads requiring microsecond latency, instances must be placed as physically close to each other as possible. A Compact Placement Policy in a single zone guarantees this proximity. Compute-optimized (C2) machine types are specifically designed for HPC. Because the workload only runs 48 hours a month, purchasing a 1-year or 3-year Committed Use Discount (CUD) would be highly cost-inefficient; paying on-demand for those 48 hours is vastly cheaper.

4. Question 4.Your organization is provisioning a multi-cloud network architecture linking Google Cloud with AWS. You need to establish highly available, secure connectivity with a guaranteed throughput of 2 Gbps. You want to minimize hardware procurement lead times and physical cross-connect management overhead. Which provisioning approach best satisfies these requirements?

   • A.Provision a Dedicated Interconnect circuit using a colocation facility, configuring BGP over two 10 Gbps physical links.
   • B.Deploy a Partner Interconnect connection through a supported service provider, provisioning two 1 Gbps VLAN attachments for high availability.
   • C.Configure an HA VPN over the public internet between Google Cloud Router and AWS Transit Gateway, utilizing multiple aggregated tunnels to achieve the 2 Gbps throughput.(correct answer)
   • D.Use Cross-Cloud Network with Network Connectivity Center to automatically provision private fiber lines between the cloud providers without third-party ISPs.
   Show answer & explanationHide answer

   Correct answer: C

   Configure an HA VPN over the public internet between Google Cloud Router and AWS Transit Gateway, utilizing multiple aggregated tunnels to achieve the 2 Gbps throughput.

   Explanation

   HA VPN provides a highly available (99.99% SLA), secure IPsec connection over the public internet. Since the bandwidth requirement is 2 Gbps, you can easily achieve this by aggregating multiple VPN tunnels (each tunnel supports up to 3 Gbps). This approach avoids the significant physical overhead, lead time, and long-term contracts associated with Dedicated or Partner Interconnect, which are generally meant for much higher throughputs or strict on-premise physical compliance needs.

5. Question 5.A retail client is managing their expanding global inventory database on Cloud Spanner. The database has grown to 50 TB, but they are observing severe read latency hotspots during flash sales when millions of users repeatedly query the exact same top 10 trending items simultaneously. Which two architectural provisioning strategies should you apply to alleviate these hotspots while maintaining horizontal scalability? (Select 2)

   • A.Implement a Memorystore for Redis cache cluster in front of Cloud Spanner to absorb high-frequency read requests for the trending items.(correct answer)
   • B.Redesign the Spanner schema to monotonically increase the primary keys of the products table to ensure sequential data distribution.
   • C.Use a Spanner bit-reverse sequence or UUID (Universally Unique Identifier) for the primary key of the products table to prevent write hotspots.
   • D.Provision a Cloud SQL for PostgreSQL read replica in each region to offload the analytical read queries from the primary Spanner instances.
   • E.Utilize Cloud Spanner's built-in query statistics and Key Visualizer to continuously monitor and pinpoint the exact row keys causing the read hotspots.(correct answer)
   Show answer & explanationHide answer

   Correct answer: A, E

   Implement a Memorystore for Redis cache cluster in front of Cloud Spanner to absorb high-frequency read requests for the trending items. / Utilize Cloud Spanner's built-in query statistics and Key Visualizer to continuously monitor and pinpoint the exact row keys causing the read hotspots.

   Explanation

   Read hotspots occur when a massive volume of traffic targets a specific row or narrow key range (like the top 10 trending items). A caching layer like Memorystore for Redis is the standard architecture to absorb massive read spikes on a tiny subset of data. Using Key Visualizer allows the team to visually monitor access patterns and definitively identify these hotspots. Monotonically increasing keys actually *cause* hotspots. UUIDs fix *write* hotspots but do not solve single-row *read* hotspots for popular items.

6. Question 6.Case Study: EHR Healthcare. EHR Healthcare hosts highly sensitive Electronic Health Records (EHR) on GKE. To maintain stringent regulatory compliance (HIPAA), they must ensure that pods processing patient records cannot make unauthorized outbound connections to the public internet, while still allowing egress to specific managed Google APIs (e.g., Cloud Storage) without routing over the public internet. How should you design this security control?

   • A.Deploy a NAT Gateway on the VPC and configure Kubernetes egress Network Policies to deny all internet-bound traffic except to the NAT IP.
   • B.Configure Private Google Access on the VPC subnet housing the GKE cluster, and implement Kubernetes Network Policies to block all pod egress traffic except to the private.googleapis.com IP range.(correct answer)
   • C.Enable VPC Service Controls to create a service perimeter around the GKE cluster, and configure Cloud Armor egress rules to filter malicious outbound requests.
   • D.Assign public IP addresses to the GKE nodes but use Google Cloud Next Generation Firewall (NGFW) policies to drop all packets with an external destination.
   Show answer & explanationHide answer

   Correct answer: B

   Configure Private Google Access on the VPC subnet housing the GKE cluster, and implement Kubernetes Network Policies to block all pod egress traffic except to the private.googleapis.com IP range.

   Explanation

   Private Google Access allows resources without external IP addresses (like nodes in a private GKE cluster) to reach Google APIs and services using Google's internal network infrastructure. By coupling this with Kubernetes Network Policies that explicitly drop all egress traffic *except* to the IP range used by Private Google Access (`private.googleapis.com` VIPs), you achieve the strict isolation required by HIPAA while seamlessly allowing integration with essential GCP services.

7. Question 7.Based on the 'Implement Zero Trust' and 'Least Privilege' principles of the Google Cloud Well-Architected Framework, your security team needs to audit and restrict elevated access in your production environment. Developers currently have persistent `roles/editor` access to troubleshoot live issues, leading to compliance violations. Which combination of actions should you take to design a secure, compliant access model? (Select 2)

   • A.Revoke the persistent `roles/editor` access and implement Privileged Access Manager (PAM) to grant just-in-time, time-bound elevated access based on manual approvals.(correct answer)
   • B.Create a custom IAM role that duplicates the exact permissions of `roles/editor` but restrict its usage geographically using VPC Service Controls.
   • C.Utilize IAM Recommender (Policy Intelligence) to analyze access patterns over the last 90 days and apply the auto-generated least-privilege custom roles.(correct answer)
   • D.Grant developers the `roles/viewer` role globally and require them to SSH into production Compute Engine VMs to execute write operations via local service accounts.
   • E.Implement Identity-Aware Proxy (IAP) on the Google Cloud Console to restrict access strictly to users within the corporate office network.
   Show answer & explanationHide answer

   Correct answer: A, C

   Revoke the persistent `roles/editor` access and implement Privileged Access Manager (PAM) to grant just-in-time, time-bound elevated access based on manual approvals. / Utilize IAM Recommender (Policy Intelligence) to analyze access patterns over the last 90 days and apply the auto-generated least-privilege custom roles.

   Explanation

   To enforce least privilege and zero trust, developers should not have persistent broad access (like Editor). IAM Recommender analyzes actual usage to suggest minimal roles tailored to developer activity. For necessary break-glass or elevated troubleshooting scenarios, Privileged Access Manager (PAM) provides just-in-time, auditable, and time-bound access. Using custom roles to duplicate Editor permissions or bypassing IAM via SSH violates compliance and auditing best practices.

8. Question 8.A government agency mandates that all highly sensitive data processed in Google Cloud must be encrypted at rest using keys that the agency retains ultimate physical control over within their own on-premises Hardware Security Modules (HSMs). They need to use these keys seamlessly with BigQuery for analytics. Which cryptographic architecture meets this regulatory need?

   • A.Customer-Managed Encryption Keys (CMEK) via Cloud KMS backed by a Google Cloud HSM.
   • B.Customer-Supplied Encryption Keys (CSEK) dynamically provided in API requests to BigQuery.
   • C.Cloud External Key Manager (Cloud EKM) configured to communicate over a secure connection to the agency's on-premises HSM.(correct answer)
   • D.Default Google-managed encryption keys, supplemented with client-side application encryption before loading data into BigQuery.
   Show answer & explanationHide answer

   Correct answer: C

   Cloud External Key Manager (Cloud EKM) configured to communicate over a secure connection to the agency's on-premises HSM.

   Explanation

   Cloud External Key Manager (Cloud EKM) allows organizations to use keys stored in an external key management system (like an on-prem HSM) to protect data at rest in supported Google Cloud services, including BigQuery. This ensures the agency retains ultimate physical control over the keys. Cloud KMS HSM uses Google's hardware. CSEK does not seamlessly integrate with BigQuery table encryption in the same way, and client-side encryption breaks BigQuery's native analytical capabilities.

9. Question 9.Case Study: Altostrat Media. Altostrat’s operations team complains of alert fatigue. Their current open-source monitoring systems generate hundreds of email notifications daily for minor CPU spikes during scheduled video transcoding jobs, causing critical database failures to go unnoticed. To optimize this technical process and align with SRE best practices, what should they do?

   • A.Write a script to automatically delete all alerts that originate from the video transcoding instances to reduce inbox clutter.
   • B.Define Service Level Objectives (SLOs) tied to user journeys, configure alerts to trigger only when the Error Budget burn rate exceeds a critical threshold, and route them to an incident management platform.(correct answer)
   • C.Migrate from Prometheus to Cloud Monitoring, and lower the CPU utilization alert thresholds so they only trigger when an instance hits 100% capacity for 1 hour.
   • D.Hire a dedicated Tier 1 support team to manually review all emails and escalate only the critical database alerts to the core SRE team.
   Show answer & explanationHide answer

   Correct answer: B

   Define Service Level Objectives (SLOs) tied to user journeys, configure alerts to trigger only when the Error Budget burn rate exceeds a critical threshold, and route them to an incident management platform.

   Explanation

   A core SRE practice to combat alert fatigue is to alert on symptoms that impact the user, not isolated causes (like temporary CPU spikes). By defining SLOs (e.g., successful transcoding jobs within a timeframe) and alerting on the Error Budget burn rate, the team is only notified when a systemic issue genuinely threatens the business agreement, allowing them to ignore transient noise and focus on critical failures.

10. Question 10.Following the Cost Optimization pillar of the Google Cloud Well-Architected Framework, your enterprise is analyzing their monthly BigQuery spend. They notice costs have skyrocketed due to a mix of automated dashboard queries and unpredictable ad-hoc queries from data scientists analyzing petabytes of raw data. Which combination of optimizations should you apply to analyze and reduce these business costs? (Select 2)

    • A.Transition the predictable automated dashboard workloads to BigQuery Editions (capacity-based pricing) to establish a baseline cost structure.(correct answer)
    • B.Enforce a BigQuery custom quota setting a maximum bytes billed per query specifically for the data scientists' projects.(correct answer)
    • C.Convert all raw data tables to JSON format to compress storage sizes, drastically reducing the cost of full table scans.
    • D.Disable BigQuery result caching, as storing cached results incurs high regional persistent disk storage fees.
    • E.Move all data scientists' workloads to Cloud SQL, as relational databases inherently prevent large analytical table scans.
    Show answer & explanationHide answer

    Correct answer: A, B

    Transition the predictable automated dashboard workloads to BigQuery Editions (capacity-based pricing) to establish a baseline cost structure. / Enforce a BigQuery custom quota setting a maximum bytes billed per query specifically for the data scientists' projects.

    Explanation

    BigQuery Editions (capacity/flat-rate pricing) is ideal for predictable, steady-state workloads like automated dashboards, providing cost certainty and reducing on-demand spikes. For unpredictable ad-hoc queries, setting a custom quota for 'maximum bytes billed per query' serves as a technical guardrail, preventing a single poorly written query (e.g., `SELECT *` on a petabyte table) from causing massive billing spikes. Caching in BigQuery is actually free and drastically reduces query costs.

11. Question 11.Your team is managing the deployment of a microservices application using Terraform. To comply with auditing policies, the security team needs an automated way to verify that no infrastructure drift has occurred (i.e., manual changes made via the Cloud Console overriding the Terraform configuration) and automatically notify the security Slack channel if drift is detected. How should you manage this implementation process?

    • A.Configure VPC Flow Logs to monitor all API calls made to the cloudresourcemanager.googleapis.com endpoint and filter for manual edits.
    • B.Implement a scheduled CI/CD pipeline using Cloud Build that runs `terraform plan -detailed-exitcode`. Use a Cloud Run function to send the results to Slack if the exit code is non-zero.(correct answer)
    • C.Use the Cloud Asset Inventory API to export the state to BigQuery every hour and compare the hash with the Terraform terraform.tfstate file stored in Cloud Storage.
    • D.Set up an Organization Policy constraint that strictly denies any user access to the Google Cloud Console UI, forcing all interactions through the CLI.
    Show answer & explanationHide answer

    Correct answer: B

    Implement a scheduled CI/CD pipeline using Cloud Build that runs `terraform plan -detailed-exitcode`. Use a Cloud Run function to send the results to Slack if the exit code is non-zero.

    Explanation

    Running `terraform plan -detailed-exitcode` checks the real-world infrastructure against the defined configuration. If drift exists, the command exits with a specific non-zero code. Scheduling this in a CI/CD pipeline (like Cloud Build) and triggering a notification via Pub/Sub and Cloud Run functions is the industry-standard way to monitor and manage infrastructure-as-code drift.

12. Question 12.Case Study: KnightMotives Automotive. KnightMotives is heavily fragmented with multiple codebases across its vehicle lines. To modernize their IT infrastructure, they are migrating to Google Cloud and want to establish a robust API management platform to safely expose their legacy ERP backend systems to modern mobile applications and third-party dealer portals. Which implementation steps are necessary using Apigee? (Select 2)

    • A.Deploy an Apigee API proxy to decouple the modern mobile applications from the backend legacy ERP systems.(correct answer)
    • B.Configure Apigee to route all API calls over the public internet directly to the on-premises mainframe to avoid VPN tunneling costs.
    • C.Implement OAuth 2.0 and API key verification policies within Apigee to secure access for third-party dealer portals.(correct answer)
    • D.Use API Gateway instead of Apigee, as Apigee is not designed for hybrid architectures involving on-premises mainframes.
    • E.Refactor the entire legacy ERP system into microservices before attempting to configure Apigee routing policies.
    Show answer & explanationHide answer

    Correct answer: A, C

    Deploy an Apigee API proxy to decouple the modern mobile applications from the backend legacy ERP systems. / Implement OAuth 2.0 and API key verification policies within Apigee to secure access for third-party dealer portals.

    Explanation

    Apigee is Google Cloud's premier enterprise API management platform. Deploying API proxies acts as a facade, successfully decoupling modern frontend clients from legacy backend systems without requiring immediate, high-risk refactoring. Apigee provides robust built-in policies to enforce security, such as OAuth 2.0 and API keys, strictly managing who (e.g., external dealers) can securely access the internal ERP data.

13. Question 13.You have deployed a critical, globally distributed web application on Compute Engine Managed Instance Groups (MIGs) behind a Global External Application Load Balancer. To ensure operations reliability, you want the load balancer to automatically route traffic to a custom static 'Maintenance' page hosted on Cloud Storage if all backend MIGs fail their health checks simultaneously. How should you ensure this solution reliability?

    • A.Set up a Cloud DNS routing policy with a health check that redirects to the Cloud Storage bucket URL on failure.
    • B.Configure custom error handling within the backend MIG template to serve a local HTML file if the application crashes.
    • C.Add a backend bucket containing the maintenance page to the existing URL map, and configure a custom error response policy on the load balancer to route 5xx errors to this backend bucket.(correct answer)
    • D.Use Cloud Armor to detect backend timeouts and inject a custom HTML response payload using an edge security policy.
    Show answer & explanationHide answer

    Correct answer: C

    Add a backend bucket containing the maintenance page to the existing URL map, and configure a custom error response policy on the load balancer to route 5xx errors to this backend bucket.

    Explanation

    Global External Application Load Balancers natively support custom error responses. You can configure the load balancer to intercept specific HTTP status codes (like 502 Bad Gateway if backends are unhealthy) and return a custom error page stored in an attached backend bucket (Cloud Storage). This ensures users see a friendly, branded maintenance page rather than a raw browser error, maintaining operational trust.

14. Question 14.Guided by the Reliability pillar of the Google Cloud Well-Architected Framework, your organization is designing a disaster recovery strategy for a mission-critical transactional workload on Cloud SQL. The business demands an RPO (Recovery Point Objective) of zero and an RTO (Recovery Time Objective) of under 2 minutes for a zonal failure within the primary region. What architecture pattern must you deploy?

    • A.A Cloud SQL instance configured with automated daily backups and point-in-time recovery (PITR) enabled.
    • B.A Cloud SQL instance with Regional High Availability (HA) enabled, providing synchronous replication to a standby instance in a different zone.(correct answer)
    • C.A single Cloud SQL instance paired with Datastream to replicate data asynchronously to a separate disaster recovery region.
    • D.A Cloud SQL instance configured with an external read replica in a different region, triggering a manual promotion via Cloud Run functions upon failure.
    Show answer & explanationHide answer

    Correct answer: B

    A Cloud SQL instance with Regional High Availability (HA) enabled, providing synchronous replication to a standby instance in a different zone.

    Explanation

    Regional High Availability (HA) in Cloud SQL provides synchronous replication between a primary instance and a standby instance located in different zones within the same region. This synchronously guarantees an RPO of 0 (no committed transactions are lost) and an RTO of typically 1-2 minutes (the time it takes for the automatic failover to detect the issue and promote the standby). Cross-region replicas rely on asynchronous replication, which cannot guarantee an exact RPO of 0.

15. Question 15.Case Study: Cymbal Retail. Cymbal Retail relies on a hybrid environment with massive volumes of daily product inventory updates originating from an on-premises Microsoft SQL Server. They want to modernize their stack by streaming these updates continuously into BigQuery to power real-time dashboards for their Conversational Commerce agents, without writing custom extract/load code. Which combination of services provisions this pipeline? (Select 2)

    • A.Provision a Datastream connection to capture Change Data Capture (CDC) events directly from the on-premises Microsoft SQL Server.(correct answer)
    • B.Deploy Cloud Data Fusion to execute hourly batch scripts via a JDBC driver to poll the on-premises database for changes.
    • C.Configure Datastream with a native BigQuery destination to seamlessly replicate the CDC events into BigQuery tables.(correct answer)
    • D.Deploy a custom Dataflow pipeline utilizing the Apache Beam JDBC IO connector to continuously query the database and stream into BigQuery.
    • E.Use Dataflow with a Google-provided template to read the Datastream CDC stream from Cloud Storage and write it to BigQuery.
    Show answer & explanationHide answer

    Correct answer: A, C

    Provision a Datastream connection to capture Change Data Capture (CDC) events directly from the on-premises Microsoft SQL Server. / Configure Datastream with a native BigQuery destination to seamlessly replicate the CDC events into BigQuery tables.

    Explanation

    Datastream is Google Cloud's serverless Change Data Capture (CDC) and replication service, natively supporting source databases like Microsoft SQL Server. To seamlessly load this data into BigQuery without writing custom Dataflow code or heavy ETL pipelines, you can directly configure Datastream with a native BigQuery destination, which continuously replicates the CDC events into analytics-ready tables.

16. Question 16.Your company operates a multicloud environment spanning Google Cloud and AWS. You need to deploy a highly available, high-bandwidth (10 Gbps) private connection between the two cloud providers without routing traffic over the public internet or utilizing a third-party colocation facility. Which Google Cloud networking solution directly fulfills this architecture requirement?

    • A.Cross-Cloud Interconnect.(correct answer)
    • B.Dedicated Interconnect.
    • C.HA VPN over Cloud Router.
    • D.Partner Interconnect via a supported ISP.
    Show answer & explanationHide answer

    Correct answer: A

    Cross-Cloud Interconnect.

    Explanation

    Cross-Cloud Interconnect enables organizations to establish high-bandwidth (10 Gbps or 100 Gbps), dedicated private connections directly between Google Cloud and other supported cloud providers (like AWS, Azure) without requiring a physical footprint in a colocation facility or routing sensitive traffic over the public internet.

17. Question 17.You are setting up a secure continuous integration (CI) pipeline using Cloud Build. The build process must access internal source code repositories hosted on-premises via Cloud VPN, and the build workers must not have external public IP addresses. Which configurations are required? (Select 2)

    • A.Configure Cloud Build to use private pools assigned to a VPC network peered with the on-premises network.(correct answer)
    • B.Enable the Google Kubernetes Engine (GKE) integration and run the Cloud Build workers as custom pods within a private cluster.
    • C.Disable the default global public pool execution by setting an Organization Policy constraint.(correct answer)
    • D.Assign external IP addresses temporarily during the build phase via a Cloud Nat gateway, then immediately destroy them.
    • E.Route all Cloud Build traffic through a Cloud Armor security policy designed to drop external ingress.
    Show answer & explanationHide answer

    Correct answer: A, C

    Configure Cloud Build to use private pools assigned to a VPC network peered with the on-premises network. / Disable the default global public pool execution by setting an Organization Policy constraint.

    Explanation

    To access resources on a private network (like an on-premises network via VPN) and ensure workers do not have external public IPs, Cloud Build private pools must be used and peered directly to your VPC. To strictly enforce this security posture and prevent developers from accidentally using the public shared pool, you must implement the 'constraints/cloudbuild.allowedWorkerPools' Organization Policy constraint.

18. Question 18.Case Study: EHR Healthcare. EHR is migrating massive volumes of legacy relational databases to Cloud SQL and BigQuery. Before the migration begins, the compliance team requires an automated way to discover, classify, and report on the presence of unencrypted Patient Health Information (PHI) across their entire organizational footprint in Google Cloud. What is the most efficient technical approach?

    • A.Enable Sensitive Data Protection (DLP) discovery at the organization or folder level to automatically profile data across BigQuery, Cloud SQL, and Cloud Storage.(correct answer)
    • B.Export all data to Cloud Storage and configure a Cloud Run function to scan every object using the Cloud Natural Language API.
    • C.Provision a Dataproc cluster running Apache Spark to crawl all database tables nightly and execute regex pattern matching for PHI formats.
    • D.Use Security Command Center Premium to run Container Threat Detection on the databases to flag plaintext PHI.
    Show answer & explanationHide answer

    Correct answer: A

    Enable Sensitive Data Protection (DLP) discovery at the organization or folder level to automatically profile data across BigQuery, Cloud SQL, and Cloud Storage.

    Explanation

    Sensitive Data Protection (formerly Cloud DLP) provides automated, organization-wide discovery and profiling capabilities. By enabling it at the org or folder level, it continuously scans and creates security data profiles across BigQuery, Cloud SQL, and Cloud Storage without requiring custom data pipelines, expensive exports, or complex regex scripts.

19. Question 19.Following the Reliability pillar of the Google Cloud Well-Architected Framework, your e-commerce application is facing unprecedented traffic during a major holiday sale. The product recommendation microservice is severely overloaded and crashing, threatening to bring down the entire checkout pipeline. What architectural pattern should you implement to analyze and mitigate this process bottleneck?

    • A.Implement graceful degradation by catching timeouts from the recommendation service and returning a default, static list of popular products to the user instead of failing the request.(correct answer)
    • B.Configure the recommendation service to retry failing database queries indefinitely until a successful response is received.
    • C.Use Cloud Load Balancing to immediately terminate the user sessions of clients originating from high-latency geographical regions.
    • D.Provision a massive Redis cache and load the entire product database into memory, disabling the primary recommendation engine completely.
    Show answer & explanationHide answer

    Correct answer: A

    Implement graceful degradation by catching timeouts from the recommendation service and returning a default, static list of popular products to the user instead of failing the request.

    Explanation

    Graceful degradation is a core cloud reliability pattern. Instead of allowing a non-critical feature (like personalized recommendations) to cause a hard failure for the entire page or critical path (checkout), the system catches the error/timeout and falls back to a simpler, less resource-intensive alternative (like a static list). Retrying indefinitely causes cascading resource exhaustion.

20. Question 20.An enterprise operates dozens of Kubernetes clusters across Google Cloud, on-premises data centers, and AWS. They need to manage configuration consistently across all environments, enforcing RBAC and security policies dynamically without manually applying manifests to individual clusters. Which components of GKE Enterprise manage this implementation? (Select 2)

    • A.Connect all clusters to a unified GKE Fleet.(correct answer)
    • B.Use Config Sync to apply and continuously reconcile configurations from a central Git repository to all fleet clusters.(correct answer)
    • C.Deploy Cloud Service Mesh gateways explicitly on the on-premises hardware load balancers.
    • D.Utilize Google Cloud Deploy to push bash scripts executing `kubectl apply` iteratively across the multicloud nodes.
    • E.Install the Binary Authorization admission controller directly onto the AWS EKS nodes using a custom Helm chart.
    Show answer & explanationHide answer

    Correct answer: A, B

    Connect all clusters to a unified GKE Fleet. / Use Config Sync to apply and continuously reconcile configurations from a central Git repository to all fleet clusters.

    Explanation

    A GKE Fleet is a logical grouping of Kubernetes clusters that can be managed together, establishing a boundary for policy and configuration regardless of the underlying cloud provider. Config Sync, a core component of GKE Enterprise, utilizes a GitOps approach to continuously apply, manage, and reconcile RBAC, security policies, and configurations across all clusters in the fleet from a centralized Git repository.

21. Question 21.Case Study: EHR Healthcare. EHR Healthcare needs to securely share anonymized, aggregated patient trend data with third-party medical researchers globally. The researchers use various analytical tools natively within Google Cloud. EHR wants to manage access centrally, revoke access instantly if needed, and strictly avoid the costs and risks of duplicating data across projects. How should this architecture be designed?

    • A.Export the data to Cloud Storage in Parquet format and generate cryptographically signed URLs with strict expiration times.
    • B.Use BigQuery Analytics Hub to create an exchange and publish a shared dataset, granting the researchers subscriber access.(correct answer)
    • C.Create a VPC Service Controls perimeter around the EHR data warehouse and configure an ingress bridge to the researchers' projects.
    • D.Provision a Datastream pipeline to replicate the required rows directly into the researchers' individual Cloud SQL databases.
    Show answer & explanationHide answer

    Correct answer: B

    Use BigQuery Analytics Hub to create an exchange and publish a shared dataset, granting the researchers subscriber access.

    Explanation

    BigQuery Analytics Hub is purpose-built for secure, cross-organizational data sharing without requiring data movement or duplication. It allows the publisher to maintain a single source of truth, enforce strict access controls, and easily revoke access, perfectly satisfying EHR's need to share data securely and cost-effectively.

22. Question 22.Following the Reliability pillar of the Google Cloud Well-Architected Framework, your e-commerce application requires mechanisms to survive severe traffic spikes during flash sales without suffering cascading failures. The backend relies on a Compute Engine Managed Instance Group (MIG) that occasionally hits its absolute scaling limits. Which two architectural patterns should you implement to protect the backend? (Select 2)

    • A.Deploy Cloud Tasks to decouple and buffer asynchronous requests, smoothing out traffic spikes before they reach the backend.(correct answer)
    • B.Implement synchronous retries on the frontend with no exponential backoff to ensure requests eventually succeed.
    • C.Utilize Cloud Service Mesh to implement a Circuit Breaker pattern that fast-fails requests when the backend is overwhelmed.(correct answer)
    • D.Decrease the health check interval on the load balancer to 1 second to detect and remove overwhelmed nodes faster.
    • E.Replace the autoscaling MIG with a single, statically provisioned Compute-optimized (C2) virtual machine.
    Show answer & explanationHide answer

    Correct answer: A, C

    Deploy Cloud Tasks to decouple and buffer asynchronous requests, smoothing out traffic spikes before they reach the backend. / Utilize Cloud Service Mesh to implement a Circuit Breaker pattern that fast-fails requests when the backend is overwhelmed.

    Explanation

    To prevent cascading failures during extreme load, buffering asynchronous workloads via a message queue (Cloud Tasks or Pub/Sub) absorbs the shock of sudden spikes. Additionally, implementing the Circuit Breaker pattern (via Cloud Service Mesh) detects when the backend is struggling and deliberately fast-fails incoming requests, preventing the exhaustion of threads and resources across the entire system.

23. Question 23.You are tasked with provisioning a new Google Kubernetes Engine (GKE) environment for a data science team. The team runs thousands of ad-hoc batch jobs daily, each with vastly different CPU and memory requirements. You need to eliminate cluster management overhead, strictly pay only for the resources the pods use, and avoid manual node pool configuration entirely. Which compute provisioning strategy should you choose?

    • A.Provision a GKE Standard cluster and enable the Kubernetes Cluster Autoscaler with a wide range of node sizes.
    • B.Provision a GKE Autopilot cluster, allowing Google to manage node provisioning and scaling based dynamically on pod specifications.(correct answer)
    • C.Deploy a fleet of Compute Engine Spot VMs managed by a Managed Instance Group (MIG) running custom Docker containers.
    • D.Utilize Cloud Run functions configured with maximum memory allocation to execute the batch jobs asynchronously.
    Show answer & explanationHide answer

    Correct answer: B

    Provision a GKE Autopilot cluster, allowing Google to manage node provisioning and scaling based dynamically on pod specifications.

    Explanation

    GKE Autopilot is a fully managed operational mode that eliminates node management. Google automatically provisions, scales, and secures the underlying infrastructure based on the pod manifests. Crucially, billing in Autopilot is based purely on the vCPU, memory, and storage requested by the scheduled pods, preventing paying for unallocated overhead in the cluster.

24. Question 24.A financial enterprise requires that developers must be able to query sensitive financial data in BigQuery from their designated Compute Engine workstations to build ML models. However, strict data exfiltration policies dictate that developers must be entirely blocked from downloading or copying this data to their local laptops or external internet services. What is the most effective security configuration?

    • A.Remove the BigQuery Data Viewer role from the developers' IAM accounts, granting them only BigQuery Job User.
    • B.Create a VPC Service Controls perimeter encompassing the BigQuery API and the VPC hosting the developer workstations, disabling internet egress.(correct answer)
    • C.Enable Cloud Sensitive Data Protection (DLP) to automatically mask all numeric data within the BigQuery tables.
    • D.Configure Identity-Aware Proxy (IAP) to enforce multi-factor authentication before developers can access the Google Cloud Console.
    Show answer & explanationHide answer

    Correct answer: B

    Create a VPC Service Controls perimeter encompassing the BigQuery API and the VPC hosting the developer workstations, disabling internet egress.

    Explanation

    VPC Service Controls mitigates data exfiltration risks by creating a logical security perimeter around Google Cloud resources. By placing the developer VMs and the BigQuery API inside the same perimeter and blocking external egress, developers can seamlessly query the data for model training within the boundary, but are structurally prevented from exporting the data to outside networks or local machines.

25. Question 25.Case Study: Altostrat Media. Altostrat Media is trying to optimize their massive Cloud Storage costs. They currently store 50 PB of raw video footage in the Standard storage class. Analysis shows that videos are actively accessed daily during the first 30 days of editing, occasionally accessed between 30 and 90 days, and virtually never accessed after 90 days, though they must be retained indefinitely for compliance. Which two configurations optimize this technical process? (Select 2)

    • A.Configure an Object Lifecycle Management rule to transition objects to Nearline storage after 30 days.(correct answer)
    • B.Configure an Object Lifecycle Management rule to transition objects to Archive storage after 90 days.(correct answer)
    • C.Export all data older than 90 days to a local SAN using Storage Transfer Service to avoid cloud costs.
    • D.Enable Cloud Storage Autoclass on the bucket to automatically compress the video files.
    • E.Set an Object Lifecycle Management rule to delete the objects after 90 days and rely on local backups.
    Show answer & explanationHide answer

    Correct answer: A, B

    Configure an Object Lifecycle Management rule to transition objects to Nearline storage after 30 days. / Configure an Object Lifecycle Management rule to transition objects to Archive storage after 90 days.

    Explanation

    Based on the access patterns, transitioning to Nearline after 30 days accommodates the "occasional access" phase cost-effectively. Transitioning to Archive after 90 days perfectly aligns with the "virtually never accessed but must be retained" compliance requirement, slashing storage costs significantly. Autoclass transitions classes but does not compress data. Deletion violates the indefinite retention requirement.

26. Question 26.Following the 'Implement shift-left security' principle from the Google Cloud Well-Architected Framework, your organization mandates that no container image containing critical OS vulnerabilities can be deployed to your production GKE clusters. You use Cloud Build and Artifact Registry. What is the most robust, automated architecture to enforce this?

    • A.Use Artifact Analysis to scan images, and configure Binary Authorization with an attestor that requires a 'no critical vulnerabilities' cryptographic signature before scheduling.(correct answer)
    • B.Run a cron job that checks Artifact Registry every hour using a Python script, automatically deleting images flagged with critical CVEs.
    • C.Write a Cloud Run function that intercepts Kubernetes deployment manifests and checks the image tag against a hardcoded whitelist in Cloud Storage.
    • D.Rely on GKE's default ValidatingAdmissionWebhook to automatically block the deployment of images that are larger than 500 MB.
    Show answer & explanationHide answer

    Correct answer: A

    Use Artifact Analysis to scan images, and configure Binary Authorization with an attestor that requires a 'no critical vulnerabilities' cryptographic signature before scheduling.

    Explanation

    Binary Authorization is a deploy-time security control that ensures only trusted images run on GKE. By integrating with vulnerability scanning (Artifact Analysis) and requiring a specific attestation (cryptographic signature) verifying the scan passed without critical vulnerabilities, you enforce a strict, automated shift-left security gate directly at the cluster API level.

27. Question 27.You are managing the implementation of a new inventory application deployed on Compute Engine. The application must interact securely with Cloud Storage and Pub/Sub APIs. Historically, developers have generated long-lived JSON service account keys and committed them to the application's source code repository. How should you secure this implementation to meet Google Cloud best practices?

    • A.Encrypt the JSON keys in the Git repository using Cloud Key Management Service (KMS) symmetric keys.
    • B.Delete the JSON keys entirely and assign a dedicated Service Account directly to the Compute Engine instances.(correct answer)
    • C.Move the JSON keys into Secret Manager and hardcode the Secret Manager resource paths in the application's configuration files.
    • D.Restrict the Git repository's IAM access to only Senior Developers and Security Administrators.
    Show answer & explanationHide answer

    Correct answer: B

    Delete the JSON keys entirely and assign a dedicated Service Account directly to the Compute Engine instances.

    Explanation

    The primary security best practice for managing credentials on Google Cloud compute resources (like VMs, GKE, Cloud Run) is to attach a Service Account directly to the resource. The Google Cloud Client Libraries automatically fetch short-lived credentials via the metadata server, entirely eliminating the catastrophic risk of managing, rotating, or leaking long-lived JSON keys.

28. Question 28.Case Study: Cymbal Retail. Cymbal Retail is provisioning a new multi-region architecture to handle its expanding global catalog. They require a fully managed database providing strong global consistency, ACID transactions, and a relational SQL interface. Furthermore, they need to stream all catalog modifications in real-time to an external analytics pipeline without placing heavy read locks on the primary database. Which two Google Cloud services must they provision? (Select 2)

    • A.Cloud Spanner.(correct answer)
    • B.Cloud SQL for PostgreSQL.
    • C.Cloud Spanner Change Streams processed via Cloud Dataflow.(correct answer)
    • D.BigQuery Data Transfer Service configured for hourly batched loads.
    • E.A Cloud SQL Read Replica deployed in the secondary region.
    Show answer & explanationHide answer

    Correct answer: A, C

    Cloud Spanner. / Cloud Spanner Change Streams processed via Cloud Dataflow.

    Explanation

    Cloud Spanner is the only fully managed relational database on Google Cloud that offers strong global consistency and ACID transactions across multiple continents. To stream real-time catalog modifications (CDC) without impacting primary database performance, Cloud Spanner Change Streams natively captures these events, which are typically processed and routed using Cloud Dataflow.

29. Question 29.Following the Cost Optimization pillar of the Google Cloud Well-Architected Framework, you are auditing a legacy project. You discover hundreds of orphaned Persistent Disks (PDs) that were left behind when developers deleted their test VMs. You want to automate the identification and deletion of these unattached disks to halt ongoing storage charges. What is the recommended technical process?

    • A.Use the Active Assist Idle Resource Recommender API to identify unattached disks, and trigger a Cloud Run function to apply the deletion recommendation.(correct answer)
    • B.Set a Cloud Storage lifecycle policy on the Persistent Disks to auto-delete after 7 days of remaining unattached.
    • C.Export Cloud Asset Inventory data to BigQuery daily, and write a SQL query to drop the rows representing the orphaned disks.
    • D.Create an Organization Policy that prevents developers from deleting a VM if it still has a Persistent Disk attached.
    Show answer & explanationHide answer

    Correct answer: A

    Use the Active Assist Idle Resource Recommender API to identify unattached disks, and trigger a Cloud Run function to apply the deletion recommendation.

    Explanation

    Active Assist (specifically the Idle Resource Recommender) uses machine learning to automatically identify unattached/idle persistent disks. You can programmatically interact with the Recommender API (e.g., using Cloud Scheduler and Cloud Run functions) to automatically apply these recommendations (deleting or snapshotting the disks), ensuring continuous, hands-off cost optimization. PDs do not natively support lifecycle rules like GCS.

30. Question 30.A financial institution is designing a data lakehouse. They possess petabytes of historical trading data residing in Cloud Storage in Parquet format. Business analysts need to query this data via BigQuery using standard SQL. However, a strict organizational policy forbids duplicating or moving the data into BigQuery's native storage layer, while concurrently mandating strict row-level and column-level security. How should you design the data access layer?

    • A.Create BigLake external tables over the Cloud Storage data, enabling BigQuery querying combined with fine-grained access control.(correct answer)
    • B.Create standard BigQuery external tables over the Cloud Storage data and use IAM conditions on the bucket.
    • C.Provision a Dataproc cluster to read the data on-demand and write temporary tables into BigQuery.
    • D.Load the data into a highly available Cloud SQL instance and utilize BigQuery federated queries.
    Show answer & explanationHide answer

    Correct answer: A

    Create BigLake external tables over the Cloud Storage data, enabling BigQuery querying combined with fine-grained access control.

    Explanation

    BigLake tables unify data lakes and warehouses. They allow you to query structured data (like Parquet) directly in Cloud Storage using BigQuery without data duplication. Crucially, unlike standard external tables, BigLake tables enforce BigQuery's fine-grained security policies (row-level and column-level access controls) at the data lake storage level.

Frequently Asked Questions

Keep studying

Full exam

GCP GCP Professional Cloud Architect (GCP-PCA) details

Free practice

GCP Associate Cloud Engineer

Free practice

AWS SAA-C03

Free practice

Microsoft AZ-305