Professional Cloud Architect · 11% of the exam

Manage implementation: free practice questions

5 sample questions from our 28-question bank for this domain — answers and explanations included. These are the same scenario-based style as the real Google Cloud exam.

1. A data engineering team needs to regularly migrate 500 TB of historical log files from an on-premises NFS server (connected via a 1 Gbps Dedicated Interconnect) to Cloud Storage. The transfer must complete within a 5-day window. Which service should they use, and what is the PRIMARY reason to prefer it over the alternatives?

A. Transfer Appliance, because shipping physical hardware is faster than any network transfer at this data volume.
B. Storage Transfer Service, because it can schedule and parallelize the transfer over the existing Interconnect connection, and 500 TB over 1 Gbps is feasible within the 5-day window.✓ Correct
C. gsutil -m cp, because parallel composite uploads in gsutil provide the highest throughput for on-premises to Cloud Storage transfers.
D. BigQuery Data Transfer Service, because it is optimized for large-scale data migrations from on-premises systems.

Explanation

Storage Transfer Service supports on-premises sources via an agent installed on the NFS server, can parallelize transfers across multiple agents, and is optimized for large-scale scheduled transfers. Theoretical maximum throughput of 1 Gbps over 5 days is approximately 540 TB (1 Gbps × 86400 s × 5 days / 8 bits ≈ 540 TB), making 500 TB feasible. (A) Transfer Appliance is recommended when network bandwidth is insufficient — typically petabyte-scale transfers or very slow connections. With a 1 Gbps Interconnect and a 5-day window, the network is sufficient, making the physical appliance unnecessary overhead. (C) gsutil -m cp can work but is not designed for scheduled, agent-based NFS transfers at this scale; Storage Transfer Service provides better reliability, monitoring, and scheduling. (D) BigQuery Data Transfer Service is for loading data into BigQuery from specific SaaS sources (e.g., Google Ads, S3) and is not applicable for general file migrations to Cloud Storage.

2. A global retail company is re-architecting its monolithic order management system into a set of microservices on GKE. The architecture team needs to expose the new microservices to both internal consumers (other GKE services) and external consumers (mobile apps, third-party partners). Internal consumers require low-latency gRPC communication. External consumers require RESTful JSON over HTTPS with API key authentication and rate limiting. The team wants to minimize the number of separate infrastructure components to manage. Which combination of GCP services should the architect recommend? (Select TWO)

A. Deploy Cloud Endpoints with gRPC transcoding on Cloud Run to serve both internal gRPC and external REST traffic from a single service proxy.✓ Correct
B. Use an internal GKE Ingress (backed by an Internal HTTP(S) Load Balancer) for internal gRPC consumers.
C. Use Apigee for all external partner and mobile app traffic, enforcing API keys, OAuth, and rate limiting as Apigee policies.✓ Correct
D. Use Cloud Armor attached to the internal GKE service to enforce rate limiting for internal gRPC consumers.
E. Deploy a separate nginx sidecar in each microservice pod to handle gRPC-to-REST transcoding for external consumers.
F. Use Cloud Endpoints configured on the GKE ingress gateway for internal gRPC with a separate API Gateway for external REST consumers.

Explanation

Cloud Endpoints with gRPC transcoding (A) deployed on Cloud Run (or as an Extensible Service Proxy) can handle both native gRPC from internal consumers and automatically transcode those same endpoints to RESTful JSON for HTTP/1.1 clients — from a single proxy. This minimizes infrastructure components. Apigee (C) is purpose-built for external API management with full lifecycle management including API keys, OAuth 2.0, developer portals, rate limiting, and analytics for partner and mobile consumers. Together, Endpoints handles the dual-protocol internal/external serving layer while Apigee provides the enterprise API management gateway for external traffic. — An internal GKE Ingress (B) handles internal load balancing but does not provide API management features like API keys or rate limiting, nor does it handle both internal and external traffic in a unified way. — Cloud Armor (D) is a WAF/DDoS protection service applied to external HTTP(S) load balancers; it does not perform rate limiting at the API key or per-consumer level and is not applicable to internal gRPC services directly. — nginx sidecars per pod (E) would work for transcoding but defeats the 'minimize infrastructure components' requirement and creates a maintenance burden across all pods. — Option F adds complexity by using two separate products where Cloud Endpoints alone (with transcoding) can serve both internal and external protocols from a unified proxy.

3. An organization needs to migrate 800 TB of archival video files from an on-premises tape library (connected to a Linux server via NFS) to Cloud Storage. The on-premises internet connection is 100 Mbps and is shared with production traffic. The migration must complete within 3 weeks. Which migration approach is most suitable?

A. Use Storage Transfer Service with a Transfer Agent installed on the on-premises Linux server to transfer data over the existing internet connection.
B. Use the gsutil -m cp command from the on-premises Linux server to stream all files in parallel directly to Cloud Storage.
C. Request a Transfer Appliance from Google, copy the data from the NFS server to the appliance on-premises, and ship the appliance to Google for ingest into Cloud Storage.✓ Correct
D. Use BigQuery Data Transfer Service to load the video files from the NFS server into Cloud Storage as a preliminary step.

Explanation

Transfer Appliance is Google's offline data transfer solution designed exactly for this scenario: very large datasets (hundreds of TB to petabytes), limited or shared network bandwidth, and tight deadlines. At 100 Mbps shared bandwidth, even uncontested, 800 TB would take approximately 740 days to transfer — far exceeding the 3-week window. The appliance is shipped, data is loaded offline, and Google ingests it into Cloud Storage. — Storage Transfer Service (A) can use on-premises agents but still relies on the internet connection; 100 Mbps shared is completely insufficient for 800 TB in 3 weeks. — gsutil -m cp (B) also uses the internet connection and suffers the same bandwidth constraint; it would also not complete in time. — BigQuery Data Transfer Service (D) is designed for structured data transfers into BigQuery from specific data sources like SaaS applications; it has no capability to ingest raw files from NFS servers.

4. A company exposes several internal services to third-party partners via a managed API platform. The security team requires that each partner be identified individually for analytics, rate limiting per partner, and the ability to revoke access for a single partner without affecting others. The platform team also needs to transform request/response payloads and enforce OAuth 2.0. Which API management solution and capability combination best meets these requirements?

A. Cloud Endpoints with API keys per partner, combined with a Cloud Armor policy for rate limiting.
B. Apigee, using developer apps and API products to issue per-partner API keys or OAuth tokens, with quota policies and mediation policies for payload transformation.✓ Correct
C. Cloud Endpoints with gRPC transcoding to enforce OAuth 2.0 and a custom Envoy filter for payload transformation.
D. API Gateway with a per-method authentication configuration and Cloud Functions for payload transformation logic.

Explanation

Apigee is Google Cloud's enterprise-grade API management platform. It natively supports the full lifecycle of partner management: developer apps issue per-partner credentials, API Products define access scopes, quota policies enforce per-partner rate limits, and mediation policies (AssignMessage, JavaScript, etc.) handle payload transformation. OAuth 2.0 token validation is a built-in policy. — Cloud Endpoints with API keys (A) can identify callers and provides basic rate limiting via quotas, but lacks built-in payload transformation capabilities and the partner/developer app management model required for enterprise partner programs. — Cloud Endpoints with Envoy filters (C) can handle OAuth and gRPC transcoding but requires custom filter development for payload transformation; it lacks the partner lifecycle management features of Apigee. — API Gateway (D) is a lighter-weight solution without native payload transformation or comprehensive partner management; it requires offloading transformation to Cloud Functions, increasing complexity.

5. A solutions architect is advising a team migrating a traditional three-tier web application to Google Cloud using a re-platform strategy. The application currently runs on Apache Tomcat servers with a MySQL database. The team wants to reduce operational overhead for the middleware tier without a full re-architecture. Which combination of GCP services represents the most appropriate re-platforming target? (Select TWO)

A. Migrate the Tomcat application layer to App Engine Standard Environment with the Java 11/17 runtime.✓ Correct
B. Migrate the Tomcat application layer to Compute Engine VMs running the same Tomcat configuration (lift-and-shift).
C. Migrate the MySQL database to Cloud SQL for MySQL with automated backups and high availability enabled.✓ Correct
D. Migrate the MySQL database to Bigtable, re-mapping relational tables to wide-column format.
E. Migrate the Tomcat application layer to a GKE Autopilot cluster using custom Tomcat container images.

Explanation

Re-platforming means moving to a managed cloud service with minimal code changes to reduce operational overhead. App Engine Standard with the Java runtime is a PaaS that runs WAR/JAR applications without managing servers, representing a re-platform of Tomcat. Cloud SQL for MySQL is a fully managed relational database that is a direct drop-in for MySQL, reducing DBA operational burden while requiring no schema changes. Together these re-platform both tiers. — Keeping Tomcat on Compute Engine VMs (B) is a lift-and-shift, not re-platforming, and does not reduce operational overhead. — Migrating MySQL to Bigtable (D) is a re-architecture requiring significant data model changes; Bigtable is a NoSQL wide-column store and is not a drop-in MySQL replacement. — GKE Autopilot with custom Tomcat images (E) is closer to re-platforming via containerization but introduces Kubernetes management complexity and requires containerizing the application, making it a more significant change than App Engine.

23 more questions in this domain

Practice the full bank with instant grading, flashcards, and a timed mock exam.

Start practicing free