Free Google Cloud Professional Cloud Architect practice test

Dedicated Interconnect with two 10 Gbps circuits is the correct answer. It provides 10+ Gbps of dedicated bandwidth, does not traverse the public internet, and Google offers a 99.9% (single circuit) or 99.99% (redundant circuits) uptime SLA — all three requirements are met. Cloud VPN (A) traverses the public internet and is capped at ~3 Gbps per tunnel; it cannot meet the 5 Gbps non-internet requirement. Direct Peering (C) is used to exchange traffic between a company's network and Google's edge for access to Google Workspace and APIs — it does not connect to a VPC, provides no SLA, and is not a managed hybrid connectivity product. Partner Interconnect (D) does not traverse the public internet and can provide an SLA, but the availability of a 5 Gbps VLAN depends on a third-party provider's topology; Dedicated Interconnect is the more architecturally definitive choice when the bandwidth requirement is at least 10 Gbps and direct physical co-location is available.

Compact placement policies (C) instruct GCP to place instances on physical hosts that are close together in the same zone, minimizing the physical network distance and reducing latency — this is specifically designed for HPC and latency-sensitive workloads. gVNIC (D) is Google's high-performance virtual network interface that supports higher throughput and enables features like higher packet rates and Tier_1 networking, directly improving inter-instance network performance for bandwidth-intensive workloads. Jumbo frames/high MTU (F) reduce per-packet overhead for large transfers but do not meaningfully reduce latency for a message-passing pattern that likely uses smaller messages; also, GCP's default MTU is already 1460 and jumbo frames require specific configuration. External IP addresses (B) would actually route traffic externally and then back in, introducing higher latency — internal IP traffic stays within Google's network fabric and is preferred. Multi-zone placement (E) directly contradicts the co-location requirement and increases latency. Dedicated Interconnect (A) is for connecting on-premises infrastructure to GCP, not for inter-instance communication within GCP.

Cloud Run Jobs are purpose-built for batch workloads: they run a container to completion, then terminate, and you pay only for the execution time. Combined with Cloud Scheduler for triggering, this is the most cost-effective and operationally simple approach for a nightly job. A continuously running Compute Engine instance (A) wastes money for the ~23.5 hours per day when no work is being done. Cloud Composer (B) is a powerful orchestration tool but introduces significant infrastructure overhead and cost for a single simple daily job. Cloud Functions (D) have a maximum execution timeout of 60 minutes (9 minutes for 1st gen), which could be insufficient for a 20–40 minute ETL job, and functions are better suited for event-driven lightweight tasks rather than heavy data transformations.

Cloud Spanner's multi-region configurations (like nam-eur-asia1) automatically place read-only replicas in multiple regions. Strong reads can be served from the nearest replica without incurring cross-region roundtrips for the read itself (though the commit operation still requires quorum). This provides globally low read latency with strong consistency, which is the stated requirement. A regional instance with Memorystore caching (A) introduces cache invalidation complexity, potential stale data, and additional operational overhead; it also doesn't guarantee strong consistency. Stale reads (B) sacrifices strong consistency, which contradicts the requirement. Multiple separate Spanner instances (D) would require custom application-level replication and conflict resolution logic — this is complex, error-prone, and defeats the purpose of using a managed globally distributed database.

The core problem is that by the time the cluster autoscaler adds nodes (which takes 2–4 minutes), the flash sale spike has already caused scheduling failures. Option A (cluster autoscaler) is necessary to eventually scale out the cluster, but alone it is too slow. Option F (overprovisioning with placeholder pods) directly solves the latency problem: low-priority pause pods pre-warm spare nodes; when real workload pods arrive, the placeholders are evicted instantly, and the cluster autoscaler adds replacement nodes in the background—providing immediate capacity. Together A and F address both the scale-out latency and the long-term scaling need. Option B (VPA Auto) is not appropriate here because VPA restarts pods to resize them, which would cause disruption during a spike, and it does not add new nodes. Option C (NAP with Spot VMs) could help but Spot VMs carry preemption risk during high-demand periods, which is risky for flash sales; also NAP alone does not solve the provisioning latency. Option D (permanent oversized cluster) solves availability but wastes significant cost the rest of the time, violating the minimal cost impact requirement. Option E (HPA) scales pods but cannot schedule them if there are no nodes available; HPA without overprovisioning does not solve node provisioning latency.

Option A is correct. The terraform_remote_state data source is the canonical Terraform mechanism for sharing outputs between independent root modules. The networking module publishes its VPC name as an output, and the application module reads it from the networking module's remote state (e.g., stored in a Cloud Storage bucket configured as a GCS backend). This keeps modules decoupled while enabling safe, automated cross-module data sharing. Option B is wrong because hardcoding the value creates maintenance toil and introduces human error; if the network is renamed or recreated, the application module becomes stale and a manual synchronization step is required. Option C is wrong because merging modules into a single root module eliminates separation of concerns, makes state files large and risky (a mistake in one area can affect the other), and removes the ability to independently manage networking and application infrastructure lifecycles. Option D is wrong because injecting values through CI/CD environment variables is fragile, ties the infrastructure to a specific pipeline tool, and makes local development (running terraform plan without the pipeline) difficult or broken.

Option B is correct because GCP folders support nested hierarchies, and IAM policies are inherited downward — policies set at the business-unit folder cascade to all team sub-folders and their projects, while additional project-level or sub-folder-level bindings allow team-level customization. Option D is wrong because projects are the boundary for billing and access, not a structural hierarchy — labels do not enforce IAM inheritance. Option A groups by environment, not business unit, breaking the requirement that business-unit-level policies cascade to all teams in that unit. Option C places everything in a single project, making fine-grained isolation impossible and conflating all teams' resources.

Option B is correct because Google Cloud's resource hierarchy allows IAM policies to be set at the folder level and inherited by all projects (environments) within that folder. A folder per business unit with child projects per environment precisely matches the requirement of business-unit-level policy inheritance with environment-level customization. Option A is wrong because a single project per business unit cannot cleanly separate environment IAM policies; labels do not enforce IAM boundaries. Option C is wrong because a single shared folder loses the ability to apply distinct IAM policies per business unit at the folder level—IAM conditions on individual projects are harder to manage and do not scale. Option D is wrong because creating separate organizations is an anti-pattern for a single company; it breaks shared billing, organization policies, and centralized governance, and is far more operationally complex.

Options B and C are correct and address the two distinct requirements using appropriate tools. Option C (IAM Deny Policies) is the correct mechanism for creating hard, unconditional prohibitions on specific permissions. IAM deny policies are evaluated before allow policies, meaning that even a principal explicitly granted a permission via an allow policy will be denied if a deny policy covers them. Denying permissions like logging.logs.delete at the organization level ensures no principal — regardless of their role — can disable audit logs. Option B (Organization Policy custom constraints) is the correct mechanism to prevent operational actions like granting roles/owner — org policies enforce constraints on resource configurations and GCP API behaviors at scale across all projects under the organization node, applying to current and future projects automatically. Together, these two preventive controls form a robust, layered approach. Option F is incorrect because IAM Conditions restrict when a binding is active (e.g., time-based, resource-based) but cannot prevent a project owner from granting new bindings to others or from taking actions within their role; conditions on existing bindings don't constrain future bindings or prevent all paths to an action. Option D is partially correct in concept (deny policies are the right tool) but the specific permission iam.roles.actAs governs service account impersonation, not the granting of roles/owner; this option describes a related but different control, and the explanation conflates separate permissions. Option A is incorrect because VPC Service Controls perimeters protect data services (like BigQuery, Cloud Storage) from exfiltration across a network boundary; they do not and cannot restrict IAM API calls or prevent privilege escalation by authenticated principals who are already inside the perimeter or who access the global IAM control plane. Option E is incorrect because the requirement explicitly calls for preventive controls. Detective controls (SCC alerts, Access Transparency) are valuable complements but do not prevent the prohibited actions from occurring — they only notify after the fact.

Options B and C are correct and work together: an access level can identify the Dataflow service account (or its originating network/project), and an ingress rule on the perimeter must explicitly permit that identity to access the Cloud Storage service. VPC Service Controls evaluates both IAM and perimeter policies, so both must allow the request. Options B and C together constitute the correct mechanism — defining an access level for the identity and creating an ingress rule that references it and scopes it to Cloud Storage. Option E is incorrect because adding the Dataflow project to the perimeter would include all of that project's resources inside the perimeter, which is a much broader change and may not be permissible under the organization's security requirements. Option D is incorrect because disabling a perimeter to run a job is operationally dangerous, defeats the purpose of the control, and is not an accepted pattern for granting scoped access. Option A is incorrect because IAM permissions alone are not sufficient — VPC Service Controls enforces an additional perimeter check that is independent of and additive to IAM; a service account with IAM access will still be blocked by the perimeter without an appropriate ingress policy. Option F is incorrect because a perimeter bridge connects two existing perimeters to allow communication between their member projects; it is not the right tool when the Dataflow job's project is not itself inside a separate perimeter.

Cloud HSM (Hardware Security Module) provides FIPS 140-2 Level 3 validated hardware for key storage. When you create a Cloud KMS key ring in Cloud HSM and use it as a CMEK for Cloud SQL, encryption keys are managed by your organization and protected by dedicated HSM hardware, satisfying PCI DSS requirements for strong key management.

A (Google-managed encryption) is wrong — Google manages those keys, so the organization has no control over them, violating the PCI DSS requirement for organizational key ownership.

B (Software key ring) is wrong — A software-backed Cloud KMS key ring is FIPS 140-2 Level 1, not Level 3, and keys are stored in software, not hardware.

D (CSEK in Secret Manager) is wrong — Customer-Supplied Encryption Keys require you to manage and supply raw key material with every API call and are not stored in Secret Manager; this is operationally fragile and does not use validated HSM hardware.

A (secretAccessor on the specific secret) is correct — Scoping the secretAccessor role to the individual secret resource (not the project) follows least privilege; the service account can only access that one secret.

C (Mount the secret via Cloud Run configuration) is correct — Cloud Run natively supports mounting Secret Manager secrets as environment variables or volumes, which avoids hardcoding credentials and integrates securely with the service account binding.

B (secretmanager.admin at project level) is wrong — This is overly permissive; admin access allows creating, deleting, and modifying all secrets in the project.

D (Plaintext env variable) is wrong — This exposes credentials in the service definition, which is visible in logs and deployment history, defeating the purpose of Secret Manager.

E (Default Compute Engine SA at org level) is wrong — Using the default service account violates workload identity isolation, and granting it at the org level is far too broad, violating least privilege.

Option D (correct): Switching from hourly TIMESTAMP partitioning to DATE partitioning dramatically reduces the number of partitions the query engine must evaluate for queries spanning 90-day ranges. With hourly partitioning, a 90-day query touches up to 2,160 partitions; with DATE partitioning it touches only 90, improving partition pruning and lowering costs. Option E (correct): Creating a pre-aggregated materialized summary table (or materialized view) partitioned by DATE and clustered by region and content_id directly targets the majority of queries that span large time ranges. Queries read far less data from a smaller, pre-aggregated table, which is the most impactful cost-reduction technique for this pattern. Option A (incorrect): BI Engine is a fast in-memory analysis service primarily suited to accelerating BI dashboard tools (Looker Studio, Connected Sheets) for a fixed hot dataset. It does not reduce bytes billed for on-demand ad-hoc SQL queries that scan large historical ranges, so it does not address the root cause. Option F (incorrect): The clustering order content_id, region is already described as the existing schema. Asserting no change is needed ignores that the queries still perform full table scans due to poor partition pruning on wide time ranges — the real problem is the partitioning granularity, not the cluster column order. Option C (incorrect): Purchasing more slots (flex commitments) does not reduce the amount of data scanned; on-demand pricing is billed per byte scanned regardless of slot count. More slots improve concurrency and speed but not cost for on-demand queries. Option B (incorrect): BigQuery supports partitioning by INTEGER RANGE, DATE/TIMESTAMP/DATETIME, and ingestion time — but partitioning by a string column like region using integer-range partitioning is not directly applicable without a mapping. More importantly, region cardinality is typically low (e.g., 5–20 values), making it a good clustering column but a poor partition key, as it would create very few partitions with uneven data distribution.

Total error budget = 10,000,000 × (1 - 0.9995) = 5,000 allowed failures. With 3,500 already consumed, the remaining budget is 5,000 - 3,500 = 1,500 requests. Option C (5,000) is the total budget ignoring already-consumed failures. Option A (500) would apply if 4,500 failures had already occurred, not 3,500. Option D (6,500) incorrectly adds the already-failed requests to the total budget instead of subtracting them.

Hourly backups satisfy the 4-hour RPO (worst case: data is up to 1 hour old — well within 4 hours). A Dual-Region bucket with turbo replication ensures data is replicated to the secondary region within 15 minutes, so the backup is available even during a regional outage. A pre-configured instance template in the secondary region means restoration can begin immediately, meeting the 2-hour RTO. This is lower cost than Multi-Region storage. — (A) is wrong because Multi-Region storage is more expensive than Dual-Region for the same cross-region resilience requirement; Dual-Region with turbo replication is the cost-optimal choice for resilience to a single regional outage. — (C) is wrong because a Regional bucket in only the primary region is lost during a regional GCP outage, violating the requirement; also, a scheduled Cloud Function replication is not as reliable or fast as native dual-region storage replication. — (D) is wrong because pre-warming a standby instance adds significant cost; the question asks for the LEAST cost solution, and an instance template (used only at disaster time) is cheaper than a running warm standby. Also, Nearline storage has retrieval costs and latency not ideal for frequent restore operations.

CPU utilization at 15% of requests indicates significant over-provisioning of CPU. Reducing CPU requests frees capacity on existing nodes, enabling the cluster autoscaler to scale down nodes and reduce cost. Using VPA in 'Recommend' mode first is a safe approach — it observes workload patterns and provides rightsizing recommendations without automatically modifying running pods, reducing the risk of disrupting production workloads. Option E is risky: memory is already at 80% utilization, which is near the limit; reducing memory requests/limits risks OOM kills, especially during traffic spikes. Option C (VPA 'Auto' mode immediately) can cause pod evictions and restarts across all Deployments simultaneously in production, which is operationally risky without prior validation. Option F (adding nodes) increases costs rather than reducing them and does not address the root cause. Option A (increasing CPU limit to match requests) does not help with bin packing or cost reduction and is the wrong direction.

Re-platforming means moving to a managed cloud service with minimal code changes to reduce operational overhead. App Engine Standard with the Java runtime is a PaaS that runs WAR/JAR applications without managing servers, representing a re-platform of Tomcat. Cloud SQL for MySQL is a fully managed relational database that is a direct drop-in for MySQL, reducing DBA operational burden while requiring no schema changes. Together these re-platform both tiers. — Keeping Tomcat on Compute Engine VMs (D) is a lift-and-shift, not re-platforming, and does not reduce operational overhead. — Migrating MySQL to Bigtable (B) is a re-architecture requiring significant data model changes; Bigtable is a NoSQL wide-column store and is not a drop-in MySQL replacement. — GKE Autopilot with custom Tomcat images (C) is closer to re-platforming via containerization but introduces Kubernetes management complexity and requires containerizing the application, making it a more significant change than App Engine.

Apigee is GCP's full-featured API management platform designed for enterprise use cases. It natively provides rate limiting (quota policies), OAuth 2.0 / OpenID Connect authentication, rich analytics and reporting dashboards, and a self-service developer portal for partner onboarding — all of which are required here. (A) Cloud Endpoints supports rate limiting and authentication but lacks a built-in developer portal and enterprise-grade analytics dashboards; it is more suited to lightweight API management within GCP projects. (B) Cloud Armor is a web application firewall and DDoS protection service, not an API management platform — it has no rate limiting at the API key level, OAuth support, or developer portal. (D) IAP provides identity-based access control to GCP-hosted applications but does not offer API rate limiting, analytics, or a developer portal for external partner onboarding.

Option A is correct: while there is no single 'magic' Cloud Monitoring feature that auto-detects percentage deviations from dynamic baselines across all services without any configuration, the practical recommended approach at scale is to use IaC (Terraform with the Cloud Monitoring provider) to programmatically generate and deploy one alerting policy per service. This is the GCP-recommended operational pattern for managing monitoring at scale and keeps policies maintainable. Option C is partially appealing but misleading: Cloud Trace does support SLO-based alerting, but SLOs require explicit threshold definition, not dynamic 20%-above-baseline detection, and do not automatically establish baselines. Option B is wrong: Metric Absence conditions fire when no data is received for a metric, not when a metric deviates from a historical baseline. Option D is close but fundamentally flawed: a single policy with groupByFields can evaluate all services in one policy, but a 'static threshold' does not satisfy the requirement of detecting deviation from each service's individual historical baseline — a single static threshold would not be appropriate across services with very different baseline latencies.

Option E is correct because blameless postmortems with clear timelines, root cause analysis, and actionable items with owners are a cornerstone of SRE incident management—they drive systemic improvement without creating a culture of fear. Option F is correct because updating the runbook with newly discovered diagnostic steps reduces the mean time to resolution (MTTR) for future similar incidents and is a direct output of incident review. Option A is correct because automating manual remediation steps is a core SRE principle of toil reduction; if a human had to run commands manually during an incident, automating those steps prevents the same toil in future incidents. Option C is wrong because SRE explicitly advocates blameless culture—assigning individual blame inhibits honest reporting and does not address systemic causes. Option D is wrong because arbitrarily raising the SLO target shrinks the error budget and does not address the root cause; it is also counterproductive when the team is already struggling with reliability. Option B is wrong because postmortems are valuable for all significant incidents regardless of severity classification, and archiving without review wastes an opportunity for learning.