Professional-Cloud-Architect Google Certified Professional - Cloud Architect (GCP) Questions and Answers

Verify that the database is online.

Verify that the project quota hasn't been exceeded.

Verify that the new feature code did not introduce any performance bugs.

Verify that the load-testing team is not running their tool against production.

Set up API key validation.

Integrate OAuth 2.0 authorization.

Configure Quota policies.

Activate XML threat protection.

Create a scalable environment in GCP for simulating production load.

Use the existing infrastructure to test the GCP-based backend at scale.

Build stress tests into each component of your application using resources internal to GCP to simulate load.

Create a set of static environments in GCP to test different levels of load — for example, high, medium, and low.

Use Explainable AI.

Use Vision AI.

Use Google Cloud’s operations suite.

Use Jupyter Notebooks.

Store the card data in Secret Manager after running a query to identify duplicates.

Encrypt the card data with a deterministic algorithm stored in Firestore using Datastore mode.

Encrypt the card data with a deterministic algorithm and shard it across multiple Memorystore instances.

Use column-level encryption to store the data in Cloud SQL.

Log into each Compute Engine instance and collect disk, CPU, memory, and network usage statistics for

analysis.

Use the gcloud compute instances list to list the virtual machine instances that have the idle: true label set.

Use the gcloud recommender command to list the idle virtual machine instances.

From the Google Console, identify which Compute Engine instances in the managed instance groups are

no longer responding to health check probes.

Use Firestore for its scalable and flexible document-based database. Use collections to aggregate race data

by season and event.

Use Cloud Spanner for its scalability and ability to version schemas with zero downtime. Split race data

using season as a primary key.

Use BigQuery for its scalability and ability to add columns to a schema. Partition race data based on

season.

Use Cloud SQL for its ability to automatically manage storage increases and compatibility with MySQL. Use

separate database instances for each season.

Set up Cloud Tasks and a Cloud Storage bucket that triggers a Cloud Function.

Set up a Cloud Logging sink and a Cloud Storage bucket that triggers a Cloud Function.

Configure the deployment job to notify a Pub/Sub queue that triggers a Cloud Function.

Set up Identity and Access Management (IAM) and Confidential Computing to trigger a Cloud Function.

Apply a Cloud Armor security policy to external load balancers using a named IP list for Fastly.

Apply a Cloud Armor security policy to external load balancers using the IP addresses that Fastly has published. C. Apply a VPC firewall rule on port 443 for Fastly IP address ranges.

Apply a VPC firewall rule on port 443 for network resources tagged with scurceiplisr-fasrly.

Configure two Partner Interconnect connections in one metro (City), and make sure the Interconnect connections are placed in different metro zones.

Configure two VPN connections from on-premises to Google Cloud, and make sure the VPN devices on-premises are in separate racks.

Configure Direct Peering between EHR Healthcare and Google Cloud, and make sure you are peering at least two Google locations.

Configure two Dedicated Interconnect connections in one metro (City) and two connections in another metro, and make sure the Interconnect connections are placed in different metro zones.

Error rates for requests from Asia

Latency difference between US and Asia

Total visits, error rates, and latency from Asia

Total visits and average latency for users in Asia

The number of character sets present in the database

Verify EHR's product usage against the list of compliant products on the Google Cloud compliance page.

Advise EHR to execute a Business Associate Agreement (BAA) with Google Cloud.

Use Firebase Authentication for EHR's user facing applications.

Implement Prometheus to detect and prevent security breaches on EHR's web-based applications.

Use GKE private clusters for all Kubernetes workloads.

Enable Binary Authorization on GKE, and sign containers as part of a CI/CD pipeline.

Configure Jenkins to utilize Kritis to cryptographically sign a container as part of a CI/CD pipeline.

Configure Container Registry to only allow trusted service accounts to create and deploy containers from the registry.

Configure Container Registry to use vulnerability scanning to confirm that there are no vulnerabilities before deploying the workload.

Add a new Dedicated Interconnect connection.

Upgrade the bandwidth on the Dedicated Interconnect connection to 100 G.

Add three new Cloud VPN connections.

Add a new Carrier Peering connection.

Increase the Pub/Sub Total Timeout retry value.

Move from a Pub/Sub subscriber pull model to a push model.

Turn off Pub/Sub message batching.

Create a backup Pub/Sub message queue.

Create an Organizational Policy with a constraint to allow external IP addresses only on the frontend Compute Engine instances.

Revoke the compute.networkAdmin role from all users in the project with front end instances.

Create an Identity and Access Management (IAM) policy that maps the IT staff to the compute.networkAdmin role for the organization.

Create a custom Identity and Access Management (IAM) role named GCE_FRONTEND with the compute.addresses.create permission.

Add a new Dedicated Interconnect connection

Upgrade the bandwidth on the Dedicated Interconnect connection to 100 G

Add three new Cloud VPN connections

Add a new Carrier Peering connection

Request Transfer Appliances from Google Cloud, export the data to appliances, and return the appliances to Google Cloud.

Configure the Storage Transfer service from Google Cloud to send the data from your data center to Cloud Storage

Make sure there are no other users consuming the 1 Gbps link, and use multi-thread transfer to upload the data to Cloud Storage.

Export files to an encrypted USB device, send the device to Google Cloud, and request an import of the data to Cloud Storage

Use a private cluster with a private endpoint with master authorized networks configured.

Use a public cluster with firewall rules and Virtual Private Cloud (VPC) routes.

Use a private cluster with a public endpoint with master authorized networks configured.

Use a public cluster with master authorized networks enabled and firewall rules.

Use BigQuery as the data warehouse. Connect all vehicles to the network and stream data into BigQuery using Cloud Pub/Sub and Cloud Dataflow. Use Google Data Studio for analysis and reporting.

Use BigQuery as the data warehouse. Connect all vehicles to the network and upload gzip files to a Multi-Regional Cloud Storage bucket using gcloud. Use Google Data Studio for analysis and reporting.

Use Cloud Dataproc Hive as the data warehouse. Upload gzip files to a MultiRegional Cloud Storage

bucket. Upload this data into BigQuery using gcloud. Use Google data Studio for analysis and reporting.

Use Cloud Dataproc Hive as the data warehouse. Directly stream data into prtitioned Hive tables. Use Pig scripts to analyze data.

Replace the existing data warehouse with BigQuery. Use table partitioning.

Replace the existing data warehouse with a Compute Engine instance with 96 CPUs.

Replace the existing data warehouse with BigQuery. Use federated data sources.

Replace the existing data warehouse with a Compute Engine instance with 96 CPUs. Add an additional Compute Engine pre-emptible instance with 32 CPUs.

Deploy Cloud Run services to multiple availability zones. Create Cloud Endpoints that point to the services. Create a global HTIP(S) Load Balancing instance and attach the Cloud Endpoints to its backend.

Deploy Cloud Run services to multiple regions Create serverless network endpoint groups pointing to the services. Add the serverless NE Gs to a backend service that is used by a global HTIP(S) Load Balancing instance.

Cloud Run services to multiple regions. In Cloud DNS, create a latency-based DNS name that points to the services.

Deploy Cloud Run services to multiple availability zones. Create a TCP/IP global load balancer. Add the Cloud Run Endpoints to its backend service.

Create a Cloud Storage lifecycle rule with Age: “30”, Storage Class: “Standard”, and Action: “Set to Coldline”, and create a second GCS life-cycle rule with Age: “365”, Storage Class: “Coldline”, and Action: “Delete”.

Create a Cloud Storage lifecycle rule with Age: “30”, Storage Class: “Coldline”, and Action: “Set to Nearline”, and create a second GCS life-cycle rule with Age: “91”, Storage Class: “Coldline”, and Action: “Set to Nearline”.

Create a Cloud Storage lifecycle rule with Age: “90”, Storage Class: “Standard”, and Action: “Set to Nearline”, and create a second GCS life-cycle rule with Age: “91”, Storage Class: “Nearline”, and Action: “Set to Coldline”.

Create a Cloud Storage lifecycle rule with Age: “30”, Storage Class: “Standard”, and Action: “Set to Coldline”, and create a second GCS life-cycle rule with Age: “365”, Storage Class: “Nearline”, and Action: “Delete”.

Create a BigQuery table for the European data, and set the table retention period to 36 months. For Cloud Storage, use gsutil to enable lifecycle management using a DELETE action with an Age condition of 36 months.

Create a BigQuery table for the European data, and set the table retention period to 36 months. For Cloud Storage, use gsutil to create a SetStorageClass to NONE action when with an Age condition of 36 months.

Create a BigQuery time-partitioned table for the European data, and set the partition expiration period to 36 months. For Cloud Storage, use gsutil to enable lifecycle management using a DELETE action with an Age condition of 36 months.

Create a BigQuery time-partitioned table for the European data, and set the partition period to 36 months. For Cloud Storage, use gsutil to create a SetStorageClass to NONE action with an Age condition of 36 months.

Google Kubernetes Engine with an SSL Ingress

Cloud IoT Core with public/private key pairs

Compute Engine with project-wide SSH keys

Compute Engine with specific SSH keys

Create a scheduled job in Cloud Run to invoke a container every minute. The container will check the application URL If the application is down, switch the URL to the "Site is unavailable" page, and notify the Ops team.

Create a cron job on a Compute Engine VM that runs every minute. The cron job invokes a Python program to check the application URL If the application is down, switch the URL to the "Site is unavailable" page, and notify the Ops team.

Create a Cloud Monitoring uptime check to validate the application URL If it fails, put a message in a Pub/Sub queue that triggers a Cloud Function to switch the URL to the "Site is unavailable" page, and notify the Ops team.

Use Cloud Error Reporting to check the application URL If the application is down, switch the URL to the "Site is unavailable" page, and notify the Ops team.

Configure a Kubernetes autoscaling based on the subscription/push_request metric.

Use the –enable- autoscaling flag when you create the Kubernetes cluster

Configure a Kubernetes autoscaling based on the subscription/num_undelivered message metric.

Use kubectl autoscale deployment APP_NAME –max 6 –min 2 –cpu- percent 50 to configure Kubernetes autoscaling deployment

Configure private services access

Configure private Google access for on-premises hosts only

Configure serverless VPC access

Configure private Google access

1. Install the Cloud Ops agent on all instances.

2. Create a sink to export logs into a partitioned BigQuery table.

3. Set a time_partitioning_expiration of 30 days.

1. Install the Cloud Ops agent on all instances.

2. Create a sink to export logs into a regional Cloud Storage bucket.

3. Create an Object Lifecycle rule to move files into a Coldline Cloud Storage bucket after one month.

4. Configure a retention policy at the bucket level to create a lock.

1. Create a daily cron job, running on all instances, that uploads logs into a partitioned BigQuery

table. 2. Set a time_partitioning_expiration of 30 days.

1. Write a daily cron job, running on all instances, that uploads logs into a Cloud Storage bucket.

2. Create a sink to export logs into a regional Cloud Storage bucket.

3. Create an Object Lifecycle rule to move files into a Coldline Cloud Storage bucket after one month.

A single VPN tunnel, which limits throughput

A tier of Google Cloud Storage that is not suited for this task

A copy command that is not suited to operate over long distances

Fewer virtual machines (VMs) in GCP than on-premises machines

A separate storage layer outside the VMs, which is not suited for this task

Complicated internet connectivity between the on-premises infrastructure and GCP

Delete the virtual machine (VM) and disks and create a new one.

Delete the instance, attach the disk to a new VM, and investigate.

Take a snapshot of the disk and connect to a new machine to investigate.

Check inbound firewall rules for the network the machine is connected to.

Connect the machine to another network with very simple firewall rules and investigate.

Print the Serial Console output for the instance for troubleshooting, activate the interactive console, and investigate.

Cloud Spanner

Google BigQuery

Google Cloud SQL

Google Cloud Datastore

Configure VPC Service Controls and configure Private Google Access for on-premises hosts.

Create a service account, grant the BigQuery JobUser role and Storage Object Viewer role to the service account, and remove all other Identity and Access Management (1AM) access from the project.

Configure Private Google Access.

Configure Private Service Connect.

Use G Suite Password Sync to replicate passwords into Google.

Federate authentication via SAML 2.0 to the existing Identity Provider.

Provision users in Google using the Google Cloud Directory Sync tool.

Ask users to set their Google password to match their corporate password.

Save the files in a Multi-Regional Cloud Storage bucket.

Save the files in a Regional Cloud Storage bucket, one bucket per zone of the region.

Save the files in multiple Regional Cloud Storage buckets, one bucket per zone per region.

Save the files in multiple Multi-Regional Cloud Storage buckets, one bucket per multi-region.

Create a Cloud VPN connection from the new VPC to the data center, create a Cloud Router, and apply new IP addresses so there is no overlapping IP space.

Create a Cloud VPN connection from the new VPC to the data center, and create a Cloud NAT instance to perform NAT on the overlapping IP space.

Create a Cloud VPN connection from the new VPC to the data center, create a Cloud Router, and apply a custom route advertisement to block the overlapping IP space.

Create a Cloud VPN connection from the new VPC to the data center, and apply a firewall rule that blocks the overlapping IP space.

Add all users to a group. Grant the group the role of BigQuery user on the billing project and BigQuery

dataViewer on the projects that contain the data.

Add all users to a group. Grant the group the roles of BigQuery dataViewer on the billing project and

BigQuery user on the projects that contain the data.

Add all users to a group. Grant the group the roles of BigQuery jobUser on the billing project and BigQuery dataViewer on the projects that contain the data.

Add all users to a group. Grant the group the roles of BigQuery dataViewer on the billing project and

BigQuery jobUser on the projects that contain the data.

Provision service account keys for the on-premises infrastructure and for the GCE virtual machines (VMs).

Authenticate the on-premises infrastructure with a user account and provision service account keys for the VMs.

Provision service account keys for the on-premises infrastructure and use Google Cloud Platform (GCP) managed keys for the VMs

Deploy a custom authentication service on GCE/Google Container Engine (GKE) for the on-premises infrastructure and use GCP managed keys for the VMs.

Use a Cloud Storage bucket in the same region as your virtual machines Configure lifecycle policies to delete files after processing

Use Filestore to store temporary files

Use performance persistent disks.

Use Local SSDs attached to the VMs running the generative Al models

Deploy failure injection software to the game analytics platform that can inject additional latency to mobile client analytics traffic.

Build a test client that can be run from a mobile phone emulator on a Compute Engine virtual machine, and run multiple copies in Google Cloud Platform regions all over the world to generate realistic traffic.

Add the ability to introduce a random amount of delay before beginning to process analytics files uploaded from mobile devices.

Create an opt-in beta of the game that runs on players' mobile devices and collects response times from analytics endpoints running in Google Cloud Platform regions all over the world.

Store as much analytics and game activity data as financially feasible today so it can be used to train machine learning models to predict user behavior in the future.

Begin packaging their game backend artifacts in container images and running them on Kubernetes Engine to improve the availability to scale up or down based on game activity.

Set up a CI/CD pipeline using Jenkins and Spinnaker to automate canary deployments and improve development velocity.

Adopt a schema versioning tool to reduce downtime when adding new game features that require storing additional player data in the database.

Implement a weekly rolling maintenance process for the Linux virtual machines so they can apply critical kernel patches and package updates and reduce the risk of 0-day vulnerabilities.

Create network load balancers. Use preemptible Compute Engine instances.

Create network load balancers. Use non-preemptible Compute Engine instances.

Create a global load balancer with managed instance groups and autoscaling policies. Use preemptible Compute Engine instances.

Create a global load balancer with managed instance groups and autoscaling policies. Use non-preemptible Compute Engine instances.

Cloud Bigtable

Cloud Spanner

BigQuery

Cloud Datastore

Use Cloud SQL for time series data, and use Cloud Bigtable for historical data queries.

Use Cloud SQL to replace MySQL, and use Cloud Spanner for historical data queries.

Use Cloud Bigtable to replace MySQL, and use BigQuery for historical data queries.

Use Cloud Bigtable for time series data, use Cloud Spanner for transactional data, and use BigQuery for historical data queries.

Evaluate the impact of migrating their current batch ETL code to Cloud Dataflow.

Write a schema migration plan to denormalize data for better performance in BigQuery.

Draw an architecture diagram that shows how to move from a single MySQL database to a MySQL cluster.

Load 10 TB of analytics data from a previous game into a Cloud SQL instance, and run test queries against the full dataset to confirm that they complete successfully.

Integrate Cloud Armor to defend against possible SQL injection attacks in analytics files uploaded to Cloud Storage.

Create an instance template for the backend. For every region, deploy it on a multi-zone managed instance group. Use an L4 load balancer.

Create an instance template for the backend. For every region, deploy it on a single-zone managed instance group. Use an L4 load balancer.

Create an instance template for the backend. For every region, deploy it on a multi-zone managed instance group. Use an L7 load balancer.

Create an instance template for the backend. For every region, deploy it on a single-zone managed instance group. Use an L7 load balancer.

Set up VPC Service Controls to restrict access to sensitive resources and prevent data exfiltration.

Configure Cloud Next Generation Firewall (NGFW) with custom rules to filter malicious traffic at the network level.

Deploy Google Cloud Armor with pre-configured and custom rules for L3/L4 and L7 protection.

Activate Security Command Center to monitor security posture and detect potential threats.

Run unit testing.

Use load testing.

Perform end-to-end testing.

Execute integration testing.

Configure Cloud Storage to use server-side encryption with Google-managed encryption keys. Create a bucket policy to restrict access to only authorized Google groups and required service accounts.

Use Cloud Storage default encryption at rest. Implement fine-grained access control using IAM roles and groups to restrict access to sensitive buckets.

Implement client-side encryption before uploading it to Cloud Storage. Store the encryption keys in a HashiCorp Vault instance deployed on Google Kubernetes Engine (GKE). Implement fine-grained access control to sensitive Cloud Storage buckets using IAM roles.

Use customer-managed encryption keys (CMEK) for all Cloud Storage buckets storing sensitive media content. Implement fine-grained access control using IAM roles and groups to restrict access to sensitive buckets.

Query logs in Cloud Logging.

Analyze the data via Cloud Profiler.

Instrument the code to use Cloud Trace.

Inspect data from Snapshot Debugger.

Configure reserved VM instances

Deploy spot VM instances.

Set up standard VM instances.

Use Cloud Run functions.

Use gsutil to batch move files in sequence.

Use gsutil to batch copy the files in parallel.

Use gsutil to extract the files as the first part of ETL.

Use gsutil to load the files as the last part of ETL.

Create CPU Utilization and Request Latency as service level indicators.

Create GKE CPU Utilization and Memory Utilization as service level indicators.

Create Request Latency and Error Rate as service level indicators.

Create Server Uptime and Error Rate as service level indicators.

Use Stackdriver Trace to create a trace list analysis.

Use Stackdriver Monitoring to create a dashboard on the project’s activity.

Enable Cloud Identity-Aware Proxy in all projects, and add the group of Administrators as a member.

Use the Activity page in the GCP Console and Stackdriver Logging to provide the required insight.

Replace RabbitMQ with Google Pub/Sub.

Downgrade MySQL to v5.7, which is supported by Cloud SQL for MySQL.

Resize compute resources to match predefined Compute Engine machine types.

Containerize the micro services and host them in Google Kubernetes Engine.

Web applications deployed using App Engine standard environment

RabbitMQ deployed using an unmanaged instance group

Hadoop/Spark deployed using Cloud Dataproc Regional in High Availability mode

Jenkins, monitoring, bastion hosts, security scanners services deployed on custom machine types

Assign custom IAM roles to the Google Groups you created in order to enforce security requirements.

Encrypt data with a customer-supplied encryption key when storing files in Cloud Storage.

Assign custom IAM roles to the Google Groups you created in order to enforce security requirements.

Enable default storage encryption before storing files in Cloud Storage.

Assign predefined IAM roles to the Google Groups you created in order to enforce security requirements.

Utilize Google’s default encryption at rest when storing files in Cloud Storage.

Assign predefined IAM roles to the Google Groups you created in order to enforce security requirements. Ensure that the default Cloud KMS key is set before storing files in Cloud Storage.

Migrate the web application layer to App Engine, and MySQL to Cloud Datastore, and NAS to Cloud Storage. Deploy RabbitMQ, and deploy Hadoop servers using Deployment Manager.

Migrate RabbitMQ to Cloud Pub/Sub, Hadoop to BigQuery, and NAS to Compute Engine with Persistent Disk storage. Deploy Tomcat, and deploy Nginx using Deployment Manager.

Implement managed instance groups for Tomcat and Nginx. Migrate MySQL to Cloud SQL, RabbitMQ to Cloud Pub/Sub, Hadoop to Cloud Dataproc, and NAS to Compute Engine with Persistent Disk storage.

Implement managed instance groups for the Tomcat and Nginx. Migrate MySQL to Cloud SQL, RabbitMQ to Cloud Pub/Sub, Hadoop to Cloud Dataproc, and NAS to Cloud Storage.

Deploy Nginx and Tomcat using Cloud Deployment Manager to Compute Engine. Deploy a Cloud SQL server to replace MySQL. Deploy Jenkins using Cloud Deployment Manager.

Deploy Nginx and Tomcat using Cloud Launcher. Deploy a MySQL server using Cloud Launcher. Deploy Jenkins to Compute Engine using Cloud Deployment Manager scripts.

Migrate Nginx and Tomcat to App Engine. Deploy a Cloud Datastore server to replace the MySQL server in a high-availability configuration. Deploy Jenkins to Compute Engine using Cloud Launcher.

Migrate Nginx and Tomcat to App Engine. Deploy a MySQL server using Cloud Launcher. Deploy Jenkins to Compute Engine using Cloud Launcher.

Google Cloud Storage Coldline to store the data, and gsutil to access the data.

Google Cloud Storage Nearline to store the data, and gsutil to access the data.

Google Bigtabte with US or EU as location to store the data, and gcloud to access the data.

BigQuery to store the data, and a web server cluster in a managed instance group to access the data. Google Cloud SQL mirrored across two distinct regions to store the data, and a Redis cluster in a managed instance group to access the data.

Install the Stackdriver agent on all of the legacy web servers.

In the Cloud Platform Console download the list of the uptime servers' IP addresses and create an inbound firewall rule

Configure their load balancer to pass through the User-Agent HTTP header when the value matches GoogleStackdriverMonitoring-UptimeChecks (https://cloud.google.com/monitoring)

Configure their legacy web servers to allow requests that contain user-Agent HTTP header when the value matches GoogleStackdriverMonitoring— UptimeChecks (https://cloud.google.com/monitoring)