I85PREP
⌘ K
GCP Cloud Architect study materials
GCP Cloud Architect study resources

GCP Cloud Architect practice questions

One question at a time. Build your GCP Cloud Architect understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Design and plan a cloud solution architecture

In the Google Cloud resource hierarchy, which node sits above folders and projects and acts as the root for organization-wide policy inheritance?

  1. The project node
  2. The organization node Correct answer.
  3. The folder node
  4. The billing account

Explanation

The resource hierarchy is organization > folders > projects > resources. The organization node is the root, and IAM policies and Organization Policy constraints applied there are inherited by every folder and project beneath it. Folders and projects only exist below it.

Question 2Design and plan a cloud solution architecture

Which Google Cloud database offers relational semantics, strong consistency, and horizontal scale-out with a 99.999% availability SLA when deployed in a multi-region configuration?

  1. Cloud Spanner Correct answer.
  2. Cloud SQL
  3. Firestore
  4. Cloud Bigtable

Explanation

Cloud Spanner is a globally distributed relational database that scales horizontally through splits and offers a multi-region configuration with a 99.999% SLA. Cloud SQL is relational but scales primarily vertically and has a lower SLA ceiling.

Question 3Design and plan a cloud solution architecture

An architecture document states a recovery time objective (RTO) of 30 minutes. What does that figure constrain?

  1. The interval between automated backup snapshots
  2. The maximum acceptable time to restore service after a failure Correct answer.
  3. The length of time a standby region must run in active-active mode
  4. The maximum tolerable amount of data loss measured in time

Explanation

RTO is the maximum acceptable elapsed time to bring a service back after disruption, which drives the choice of standby capacity and failover automation. It is distinct from RPO, which bounds data loss.

Question 4Design and plan a cloud solution architecture

Which option provides a private, dedicated physical link between an on-premises data center and Google Cloud?

  1. Dedicated Interconnect Correct answer.
  2. Cloud NAT
  3. Private Service Connect
  4. Cloud VPN

Explanation

Dedicated Interconnect provisions a direct physical circuit between a customer's colocation facility and a Google edge location, bypassing the public internet. Cloud VPN also offers private connectivity but tunnels over the internet.

Question 5Design and plan a cloud solution architecture

What does Shared VPC enable in Google Cloud?

  1. A project can be billed to several billing accounts at once
  2. Subnets in a host project can be used by resources in attached service projects Correct answer.
  3. VPC networks belonging to different organizations can be peered automatically
  4. A single service account can be reused by every project in an organization

Explanation

Shared VPC centralizes network administration in a host project while service projects deploy resources into its subnets. IAM on the host project controls which service project identities may use which subnets.

Question 6Design and plan a cloud solution architecture

Which compute option runs a containerized HTTP service that scales to zero when idle, with no cluster or node pool to administer?

  1. Cloud Run Correct answer.
  2. GKE Standard
  3. A managed instance group of Compute Engine VMs
  4. Cloud Batch

Explanation

Cloud Run deploys a container image as a managed serverless service that scales request-driven instances, including down to zero. It removes cluster and node management entirely.

Question 7Design and plan a cloud solution architecture

Which mechanism enforces that every project in an organization may create resources only in European regions?

  1. A VPC Service Controls perimeter
  2. IAM conditional role bindings
  3. A Cloud Armor security policy
  4. An Organization Policy constraint for resource locations Correct answer.

Explanation

Organization Policy constraints are guardrails inherited from the organization or folder down to projects, and the location constraint restricts where resources may be created. They apply regardless of a user's IAM permissions.

Question 8Design and plan a cloud solution architecture

How does a regional persistent disk differ from a zonal persistent disk?

  1. It is asynchronously replicated to a different region for disaster recovery
  2. It is object storage accessed over HTTPS instead of a block device
  3. It can be mounted read-write by VMs in different zones simultaneously
  4. It replicates synchronously across two zones within the same region Correct answer.

Explanation

A regional persistent disk keeps two synchronous replicas in different zones of one region, so a zone failure does not lose the data. Replication never leaves the region.

Question 9Design and plan a cloud solution architecture

A web application serves customers on three continents and requires a single global anycast IP address, TLS termination, CDN caching, and automatic failover between regional backends. Which design meets these requirements?

  1. One regional external Application Load Balancer per region fronted by Cloud DNS round-robin records
  2. A global external Application Load Balancer with Cloud CDN and managed instance group backends in several regions Correct answer.
  3. An external proxy Network Load Balancer with a global backend service
  4. Cloud DNS routing policies alone, pointing clients at regional IP addresses

Explanation

The global external Application Load Balancer advertises one anycast IP, terminates TLS at the edge, integrates Cloud CDN, and routes to the nearest healthy regional backend. This gives both low latency and automated cross-region failover.

Question 10Design and plan a cloud solution architecture

A telemetry platform ingests hundreds of thousands of sensor writes per second, keeps petabytes of time-series rows, and reads them by row key with no multi-row transactions. Which database fits best?

  1. Firestore
  2. Cloud Spanner
  3. Cloud SQL for PostgreSQL
  4. Cloud Bigtable Correct answer.

Explanation

Bigtable is a wide-column store designed for very high write throughput and petabyte-scale sparse data accessed by row key, which matches time-series ingestion. It deliberately omits multi-row transactions and SQL joins.

Question 11Design and plan a cloud solution architecture

An insider with legitimate BigQuery permissions must be prevented from copying datasets to a project outside the company's approved environment. Which control addresses this directly?

  1. An IAM deny policy on the export action for all users
  2. A VPC Service Controls service perimeter around the data projects Correct answer.
  3. A Cloud DLP de-identification template applied to the tables
  4. A Cloud Armor security policy on the BigQuery endpoint

Explanation

VPC Service Controls create a service perimeter that blocks data from crossing the perimeter boundary even when the caller holds valid IAM permissions. This defends against exfiltration by authorized identities.

Question 12Design and plan a cloud solution architecture

A pool of workers on GKE consumes messages from a Pub/Sub subscription, and lag varies sharply with upstream bursts. Which autoscaling configuration follows demand most directly?

  1. Cluster Autoscaler with a high maximum node count and a fixed replica count
  2. Horizontal Pod Autoscaler targeting 60% average CPU utilization
  3. Horizontal Pod Autoscaler driven by an external metric for the subscription's undelivered message count Correct answer.
  4. A scheduled scaling policy that raises replica counts during business hours

Explanation

Scaling on the backlog metric ties replica count to actual queue depth, which reflects demand even when each message is cheap in CPU terms. CPU-based targets lag behind queue growth for I/O-bound consumers.

Question 13Design and plan a cloud solution architecture

A team must move 200 on-premises VMware virtual machines to Compute Engine within a month with minimal changes to the guest operating systems. Which service is intended for this?

  1. Migrate to Containers
  2. Migrate to Virtual Machines Correct answer.
  3. Database Migration Service
  4. Storage Transfer Service

Explanation

Migrate to Virtual Machines performs lift-and-shift migration of source VMs, including VMware workloads, into Compute Engine with minimal guest changes. It handles replication and cutover of the machine images.

Question 14Design and plan a cloud solution architecture

A compliance rule requires the company to control, rotate, and revoke the keys protecting data at rest in BigQuery. Which configuration satisfies this?

  1. Create Cloud KMS keys in the required region and configure customer-managed encryption keys on the datasets Correct answer.
  2. Wrap the project in a VPC Service Controls perimeter
  3. Use Cloud External Key Manager to supply customer-supplied encryption keys for BigQuery tables
  4. Rely on Google's default encryption at rest for the datasets

Explanation

Customer-managed encryption keys (CMEK) let the organization own the Cloud KMS key, control its rotation schedule, and disable it to revoke access to the protected data. BigQuery datasets support CMEK.

Question 15Design and plan a cloud solution architecture

An organization needs about 1 Gbps of private connectivity to Google Cloud but has no presence in any colocation facility where Google peers. Which option fits?

  1. Partner Interconnect through a supported service provider Correct answer.
  2. A Network Connectivity Center hub with a site-to-site VPN spoke
  3. Cloud VPN with two tunnels for redundancy
  4. Dedicated Interconnect ordered in two metros

Explanation

Partner Interconnect delivers private connectivity through a third-party provider, so the organization does not need its own colocation presence. It supports sub-10 Gbps capacities such as 1 Gbps.

Question 16Design and plan a cloud solution architecture

A Compute Engine workload will run continuously with stable utilization for the next three years. Which purchasing approach yields the largest discount?

  1. Running the workload on Spot VMs
  2. Relying on sustained use discounts
  3. Per-second billing combined with aggressive autoscaling
  4. A three-year committed use contract for the resources Correct answer.

Explanation

Committed use contracts trade a long-term commitment for a substantially deeper discount than on-demand pricing, and longer terms discount further. For steady 24/7 workloads the commitment is fully consumed.

Question 17Design and plan a cloud solution architecture

Log data is written once, read roughly once a month for investigations, requires millisecond access, and is retained for one year. Which Cloud Storage class is the most cost-effective fit?

  1. Standard
  2. Nearline Correct answer.
  3. Coldline
  4. Archive

Explanation

Nearline is designed for data accessed less than once a month with millisecond retrieval and a 30-day minimum storage duration. Its lower storage price beats Standard for this access pattern while satisfying the one-month read cadence.

Question 18Design and plan a cloud solution architecture

Pods on GKE must call the Cloud Storage API using IAM permissions, and security policy forbids exporting service account key files. What should be configured?

  1. Run the pods as the Compute Engine default service account
  2. Federate the cluster's Kubernetes service account with a Google service account using Workload Identity Federation for GKE Correct answer.
  3. Export a service account JSON key and mount it into the pods as a Secret
  4. Store a service account key in Secret Manager and download it at container startup

Explanation

Workload Identity Federation for GKE maps a Kubernetes service account to a Google service account so pods obtain short-lived credentials from the metadata server. No long-lived key material is created or stored.

Question 19Design and plan a cloud solution architecture

VMs without external IP addresses must reach Cloud Storage APIs without their traffic leaving Google's network and without deploying a NAT gateway. What should be enabled?

  1. Private Google Access on the VM's subnet Correct answer.
  2. A Cloud NAT gateway with a reserved external address range
  3. Ephemeral external IP addresses on the VMs
  4. A custom route whose next hop is the default internet gateway

Explanation

Private Google Access lets instances with only internal IP addresses reach Google APIs and services through Google's internal network. It requires no external address and no NAT device.

Question 20Design and plan a cloud solution architecture

A middle tier must reach a set of database VMs in the same region over TCP. The design requires layer-4 balancing, preservation of the client source IP, and no internet exposure. Which load balancer fits?

  1. An external proxy Network Load Balancer with a regional backend
  2. A global external Application Load Balancer with a serverless NEG
  3. A regional internal passthrough Network Load Balancer Correct answer.
  4. An internal Application Load Balancer with a URL map

Explanation

A regional internal passthrough Network Load Balancer balances layer-4 flows, preserves the client source address because packets are not proxied, and is reachable only from inside the VPC.

Question 21Design and plan a cloud solution architecture

A SaaS provider will host hundreds of business tenants, each needing its own IAM boundary, quota pool, and billing attribution. Which design scales best?

  1. One Compute Engine VM per tenant inside a shared project
  2. All tenants in one project, isolated by separate VPC networks
  3. One project per tenant, organized under folders, with IAM and Organization Policy applied at folder and project level Correct answer.
  4. One project per region, with tenants separated only by resource labels

Explanation

Projects are the unit of IAM boundary, API quota, and billing attribution, so a project per tenant gives clean isolation that scales with automation. Folders apply shared guardrails and policy without repeating configuration per tenant.

Question 22Design and plan a cloud solution architecture

Object data must remain readable with an RPO close to zero if an entire region becomes unavailable, while staying within a single country for data residency. Which design satisfies both?

  1. A dual-region bucket in the country's two regions with turbo replication enabled Correct answer.
  2. A multi-region bucket with lifecycle rules moving objects to Nearline after 30 days
  3. Two regional buckets synchronized hourly by Storage Transfer Service
  4. Two regional buckets in different regions synchronized by a nightly transfer job

Explanation

A dual-region bucket with turbo replication targets a recovery point objective of about 15 minutes by replicating new objects to the paired region almost immediately. Choosing the two regions inside the country satisfies residency.

Question 23Design and plan a cloud solution architecture

Forty product teams share one Google Cloud project and constantly collide on API rate limits and IAM changes. Which structural change addresses the root cause?

  1. Keep one project and file quota increase requests for every API used
  2. Give each team its own project under a shared folder, with IAM and quotas managed per project Correct answer.
  3. Consolidate into a single project and grant everyone the Editor role
  4. Move all workloads into one VPC network and use firewall rules for isolation

Explanation

API quotas and IAM policy are enforced per project, so splitting teams into separate projects removes the shared contention point and lets each team be governed independently. A folder applies common guardrails without merging boundaries.

Question 24Design and plan a cloud solution architecture

A public-facing web application must remain usable by anonymous users while blocking SQL injection attempts and denying traffic from a list of sanctioned countries. Which control implements this?

  1. VPC firewall rules with prioritized egress deny rules
  2. Cloud NAT with a restricted external address range
  3. Identity-Aware Proxy with context-aware access levels
  4. A Cloud Armor security policy attached to the backend service, using geo-based rules and preconfigured WAF rules Correct answer.

Explanation

Cloud Armor evaluates requests at the load balancer and can combine preconfigured WAF rule sets with geo-based conditions in one policy. Because it filters at the edge, anonymous visitors are still served unless a rule matches.

Question 25Design and plan a cloud solution architecture

A web tier stores session state on the local disk of a single Compute Engine VM and must now scale horizontally behind a load balancer while surviving a zone failure. Which design change is required first?

  1. Move session state into Memorystore for Redis and run stateless instances in a regional managed instance group Correct answer.
  2. Enable autoscaling on the managed instance group with a CPU target and keep sessions on local SSD
  3. Configure session affinity on the load balancer and add more VMs
  4. Replace the VM with a larger machine type backed by a regional persistent disk

Explanation

Horizontal scaling and zone fault tolerance both require that no request depend on state held on one machine, so session data moves to a shared, replicated store. The instances then become interchangeable and can be spread across zones.

Question 26Design and plan a cloud solution architecture

A company wants many teams to deploy resources into a single centrally managed VPC network while each team keeps its own IAM and billing boundary. In a Shared VPC design, which project owns the VPC networks and subnets?

  1. The folder that contains the team projects
  2. A separate peering project managed by the network team
  3. Each team project, using subnets it creates itself
  4. The host project designated by an administrator Correct answer.

Explanation

Shared VPC separates network administration from resource administration: a host project owns the VPC networks, subnets, and shared firewall rules, and service projects attach to it and deploy resources into the shared subnets. The host project must be designated by an administrator who has the required organization-level permissions.

Question 27Design and plan a cloud solution architecture

An administrator grants a role to a group at the folder level. Which resources does that grant apply to?

  1. All resources in projects beneath that folder Correct answer.
  2. Only projects that existed when the grant was made
  3. Only resources in the project where the group was created
  4. Only the folder's own metadata and billing settings

Explanation

IAM policies are inherited down the resource hierarchy from organization to folders, then projects, then individual resources. A grant at a folder therefore applies to every current and future descendant resource, unless a deny policy overrides it.

Question 28Design and plan a cloud solution architecture

A team needs internal DNS names such as db.internal for Compute Engine instances, resolvable only from inside their VPC networks and not visible on the public internet. What should they configure?

  1. A private managed zone authorized for the VPC Correct answer.
  2. An A record added in the domain registrar's panel
  3. A public Cloud DNS zone with DNSSEC disabled
  4. A Cloud DNS zone with a 24-hour TTL

Explanation

A private managed zone serves records only to the VPC networks it is authorized for, so names resolve internally and are never published to the public internet. Public zones, by contrast, are visible to any resolver on the internet.

Question 29Design and plan a cloud solution architecture

A relational OLTP application must run in three regions, serve reads and writes locally in each, and remain strongly consistent with automatic synchronous replication. Which database should be used?

  1. Cloud SQL for PostgreSQL with cross-region read replicas
  2. Spanner with a multi-region instance configuration Correct answer.
  3. Bigtable with a multi-cluster routing policy
  4. Firestore in Datastore mode in a multi-region location

Explanation

Spanner is a globally distributed relational database that synchronously replicates data across regions in a multi-region configuration while offering strong consistency and regional read-write endpoints. That matches a requirement for multi-region relational transactions with no manual failover.

Question 30Design and plan a cloud solution architecture

A genomics batch pipeline runs thousands of independent, checkpointed tasks that each take 20 to 90 minutes, can resume from the last checkpoint, and tolerate occasional interruption. Cost is the primary constraint. Which purchasing option fits best?

  1. Spot VMs, since tasks resume from checkpoints Correct answer.
  2. Three-year committed use discounts for the pipeline
  3. Sole-tenant nodes reserved for the pipeline
  4. Standard on-demand VMs spread over three zones

Explanation

Spot VMs are heavily discounted but can be reclaimed with short notice, which is acceptable for fault-tolerant work that checkpoints its progress and restarts. Committed discounts only pay off for steady, predictable, long-running usage.

Question 31Design and plan a cloud solution architecture

An enterprise needs a hybrid connection from its data center to Google Cloud with a 99.99% availability SLA that survives the loss of any single Interconnect connection. What should the design include?

  1. Two Interconnect connections in different metros Correct answer.
  2. A single Dedicated Interconnect connection with two VLAN attachments
  3. One Partner Interconnect connection from a single provider
  4. Two Cloud VPN tunnels on the same VPN gateway

Explanation

The 99.99% Interconnect SLA requires a redundant topology of two connections in separate metropolitan areas, each with its own VLAN attachment, so that a failure in one metro or link does not drop connectivity. Anything with a shared component remains a single point of failure.

Question 32Design and plan a cloud solution architecture

Fifty Linux render nodes must mount the same shared file system, which requires POSIX semantics, file locking, and multi-terabyte capacity. Which service meets the requirement?

  1. A Cloud Storage bucket mounted with gcsfuse on each node
  2. A Filestore NFS instance mounted by all render nodes Correct answer.
  3. Local SSD on each node, synchronized by a cron job
  4. One zonal persistent disk attached read-write to all nodes

Explanation

Filestore provides managed NFS shares that many clients can mount concurrently with POSIX semantics and file locking, which is what shared-render workloads depend on. Object storage and node-local disks do not provide a shared, lock-aware file system.

Question 33Design and plan a cloud solution architecture

A producer whose traffic spikes tenfold during promotions must be decoupled from a consumer that must not lose events, must not be blocked by a malformed event, and must apply each event only once. Which design meets these requirements?

  1. A Pub/Sub topic with a dead-letter topic and idempotent consumers Correct answer.
  2. Synchronous REST calls with client retries and long timeouts
  3. A Pub/Sub topic with automatic redelivery and no dead-letter topic
  4. A Cloud Tasks queue configured with unlimited retry attempts

Explanation

Pub/Sub buffers bursts so the producer and consumer scale independently, and a dead-letter topic removes messages that repeatedly fail so they cannot block the subscription. Delivery is at-least-once, so the consumer must key its writes on a message attribute to make processing idempotent.

Question 34Design and plan a cloud solution architecture

A VM-based inventory system running in one region must survive a regional outage with an RTO of 30 minutes and an RPO of 15 minutes at the lowest cost that satisfies those targets. Which design should be recommended?

  1. Active-active in two regions with synchronous replication
  2. Warm standby in a second region with continuously replicated data Correct answer.
  3. Cold standby, where the 4 TB database is restored from snapshots and the environment is rebuilt with IaC, which takes several hours
  4. Restore from multi-region backups after the outage is detected

Explanation

A warm standby keeps a scaled-down but running copy of the environment in a second region with continuously replicated data, so failover fits a 30-minute RTO and 15-minute RPO while costing much less than running full capacity in both regions. Active-active is technically sufficient but exceeds both targets at a higher price.

Question 35Manage and provision the cloud solution infrastructure

Which node sits at the top of the Google Cloud resource hierarchy for an organization that has a Google Workspace domain?

  1. Project
  2. Billing account
  3. Folder
  4. Organization Correct answer.

Explanation

The resource hierarchy is Organization > Folder > Project > resources. Creating an organization node requires a Google Workspace or Cloud Identity domain, and it becomes the root of every folder and project created under it. Billing accounts are linked to projects but are not part of the hierarchy tree.

Question 36Manage and provision the cloud solution infrastructure

Which IAM role type is maintained by Google with a fixed set of permissions that customers cannot modify?

  1. Deny policy
  2. Custom role
  3. Predefined role Correct answer.
  4. Access boundary

Explanation

Predefined roles are curated by Google for a specific service or task, such as roles/storage.objectViewer, and their permission sets are read-only to customers. Custom roles are ones you build yourself from a permission list, while deny policies and access boundaries are guardrails rather than roles.

Question 37Manage and provision the cloud solution infrastructure

In a VPC network created in custom mode, how are subnets provisioned?

  1. One subnet is created automatically in each region
  2. Subnets are created only in the regions you specify Correct answer.
  3. Subnets are created automatically when a VM is deployed
  4. One subnet is created in each zone of us-central1

Explanation

In custom mode, no subnets exist until you create them, and each subnet belongs to exactly one region with a primary IPv4 range. Auto mode instead creates one subnet per region with preset ranges. Subnets are regional, not zonal, and are never created implicitly by deploying a VM.

Question 38Manage and provision the cloud solution infrastructure

Which Cloud Storage class is designed for data accessed less than once a year and carries a 365-day minimum storage duration?

  1. Nearline
  2. Coldline
  3. Archive Correct answer.
  4. Standard

Explanation

Archive is the lowest-cost class, intended for long-term retention with access expected less than once per year, and it enforces a 365-day minimum storage duration. Nearline targets roughly monthly access with a 30-day minimum, and Coldline targets quarterly access with a 90-day minimum.

Question 39Manage and provision the cloud solution infrastructure

An organization wants to block the creation of external IP addresses on Compute Engine instances in every project under a folder. What should be configured?

  1. Removal of the compute.instanceAdmin role from every user
  2. A Cloud Armor security policy attached to a global load balancer
  3. A VPC firewall egress rule that denies traffic to the 0.0.0.0/0 destination range
  4. An organization policy constraint compute.vmExternalIpAccess set to deny Correct answer.

Explanation

Organization policies are guardrails evaluated independently of IAM and can be enforced at the organization, folder, or project level; the compute.vmExternalIpAccess constraint specifically controls whether instances may have external IPs. Firewall rules and Cloud Armor filter traffic but do not prevent the address from being assigned. Removing roles is easily reversed and does not target the IP assignment itself.

Question 40Manage and provision the cloud solution infrastructure

In a Shared VPC setup, which grant lets a developer in a service project create instances that use a subnet in the host project?

  1. roles/owner on the host project
  2. roles/compute.networkAdmin on the service project
  3. roles/compute.networkUser on the host project subnet Correct answer.
  4. roles/compute.instanceAdmin.v1 granted on the host project

Explanation

Service project users need roles/compute.networkUser on the host project or on the specific subnet they will use, which authorizes them to use that network. Instance admin rights on the service project are also needed to create VMs, but network use is granted separately on the host side.

Question 41Manage and provision the cloud solution infrastructure

Which Google Cloud load balancer provides a single global anycast IP address and terminates TLS for HTTP(S) traffic?

  1. Regional passthrough network load balancer
  2. Regional external proxy network load balancer
  3. Global external Application Load Balancer Correct answer.
  4. Internal TCP/UDP load balancer

Explanation

The global external Application Load Balancer is an L7 proxy that exposes one global anycast VIP and terminates HTTP(S)/TLS at the edge before forwarding to backends. Proxy network load balancers handle TCP/SSL but are regional in scope, and passthrough and internal load balancers do not terminate TLS at a global edge.

Question 42Manage and provision the cloud solution infrastructure

Which statement describes node management in a GKE Autopilot cluster?

  1. Google provisions and scales nodes based on pod requests Correct answer.
  2. You define node pools and machine types manually
  3. You are billed per node-hour for each node pool
  4. You must enable cluster autoscaling for pods to run

Explanation

Autopilot shifts node lifecycle management to Google: nodes are created, sized, and removed automatically to fit the resource requests of the pods you deploy. You are billed for the resources your pods request rather than for individual nodes, and manual node pool configuration is not part of the model.

Question 43Manage and provision the cloud solution infrastructure

Which behavior is a standard feature of a Cloud Run service?

  1. It runs only in a single zone that you select
  2. It requires at least one instance to run at all times
  3. It scales to zero instances when it receives no traffic Correct answer.
  4. It requires a GKE cluster in the same project

Explanation

Cloud Run is a serverless container platform that scales instances down to zero when there is no traffic, so you pay only for resources consumed while serving requests. Setting a minimum instance count is optional and is used to reduce cold starts. Cloud Run does not expose zone selection, and it can run on fully managed infrastructure without a GKE cluster.

Question 44Manage and provision the cloud solution infrastructure

A team of engineers uses Terraform against multiple projects and needs shared state that prevents simultaneous conflicting applies. What should they do?

  1. Store state in a versioned Cloud Storage bucket as the backend Correct answer.
  2. Keep state on each engineer's laptop and reconcile manually
  3. Commit terraform.tfstate to the application's Git repository
  4. Disable state entirely and rely on the Google provider to detect drift

Explanation

A remote backend such as a Cloud Storage bucket with object versioning gives the team a single shared copy of state and supports locking so concurrent applies do not corrupt it. Versioning also provides rollback when state is damaged. Local or repository-committed state cannot coordinate multiple operators safely.

Question 45Manage and provision the cloud solution infrastructure

How does Cloud SQL provide high availability for a production instance?

  1. It relies on read replicas that the application promotes when the primary fails
  2. It maintains a standby in another zone and fails over automatically Correct answer.
  3. It spreads the primary instance across three zones
  4. It keeps nightly exports in multiple regions

Explanation

Regional high availability keeps a synchronous standby in a different zone of the same region and promotes it automatically when the primary fails. Read replicas are for scaling reads and are not the failover mechanism, and Cloud SQL instances run in a single zone or a two-zone HA configuration rather than spread across three.

Question 46Manage and provision the cloud solution infrastructure

Which table design most reduces the bytes scanned by queries that always filter on a date column?

  1. A table partitioned on the date column Correct answer.
  2. A table with a wildcard suffix for each month
  3. A table clustered on a randomly generated key
  4. A table with all dates stored as a STRING column and no filter support

Explanation

Partitioning on the date column lets BigQuery prune partitions that cannot match the filter, so only relevant data is scanned and billed. Clustering helps on high-cardinality filter columns but is not a substitute for partition pruning on a date predicate, and storing dates as strings prevents partition pruning.

Question 47Manage and provision the cloud solution infrastructure

A security team needs to stop data in a set of projects from being copied to a project outside the group, even by principals who hold valid IAM permissions. Which control fits this requirement?

  1. Private Google Access on each subnet
  2. CMEK keys restricted to the same region
  3. A hierarchical firewall policy with a deny rule
  4. A VPC Service Controls service perimeter Correct answer.

Explanation

VPC Service Controls defines a perimeter around projects and their Google Cloud services, blocking data movement across the boundary even when the caller has the required IAM permissions. Firewall policies govern network traffic rather than API-level data access, and CMEK affects encryption keys, not the destination of data.

Question 48Manage and provision the cloud solution infrastructure

An organization defines a hierarchical firewall policy with a deny rule at the organization node, and a project defines a VPC firewall rule that allows the same traffic. What is the result?

  1. Both rules apply and traffic is logged but allowed
  2. The deny wins; hierarchical rules are evaluated first Correct answer.
  3. Traffic is allowed only after the policy is deleted
  4. The VPC firewall rule wins because it is more specific

Explanation

Hierarchical firewall policies attached at the organization or folder level are evaluated before VPC firewall rules, and a deny match stops evaluation of lower-level rules. This lets central teams enforce non-negotiable restrictions that project owners cannot override with local allow rules.

Question 49Manage and provision the cloud solution infrastructure

Which practice reduces risk for a Compute Engine workload that calls Cloud Storage APIs?

  1. Enabling the Cloud Platform scope on the instance
  2. Attaching a dedicated service account with only the needed storage role Correct answer.
  3. Using the default Compute Engine service account with the Editor role on the project
  4. Embedding a downloaded service account key in the VM image

Explanation

A dedicated service account with a narrowly scoped predefined or custom role follows least privilege and gives each workload an auditable, revocable identity. The default compute service account with Editor grants broad access, and long-lived keys embedded in images are a well-known credential exposure risk.

Question 50Manage and provision the cloud solution infrastructure

Which resource metadata feature is intended for cost breakdown and filtering by team or environment?

  1. Instance metadata keys
  2. Network tags
  3. Resource names with prefixes
  4. Labels Correct answer.

Explanation

Labels are key-value pairs that can be attached to most resources and used to filter queries and to break down billing exports by dimensions such as team or environment. Network tags affect firewall targeting, and naming conventions are only a convention with no billing-report effect.