I85PREP
⌘ K
PCCP study materials
PCCP study resources

PCCP - Professional Cloud Certified Professional practice questions

One question at a time. Build your PCCP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Designing and planning a cloud solution architecture

A team is designing a new workload on Google Cloud and needs to choose between a zonal and a regional managed instance group (MIG). Which requirement most strongly favors a regional MIG?

  1. The workload needs to run on preemptible VMs to reduce compute cost.
  2. The workload must be pinned to a single zone for data residency reasons.
  3. The workload must survive the loss of a single zone without manual intervention. Correct answer.
  4. The workload requires autoscaling based on HTTP load-balancing metrics.

Explanation

A regional MIG spreads instances across multiple zones in a region, so losing one zone does not take down the whole group; the group reschedules capacity in surviving zones. Zonal MIGs concentrate instances in one zone and therefore inherit that zone's failure domain. Autoscaling and preemptible VMs are available in both zonal and regional MIGs, so they do not decide the choice.

Question 2Designing and planning a cloud solution architecture

An architect is placing a two-tier application in a single VPC network. The web tier must accept traffic from the internet, while the database tier must accept connections only from the web tier. What is the most appropriate network design?

  1. Put both tiers behind a single external load balancer and let the load balancer route to the database.
  2. Put the database tier in a subnet with an external IP address so the web tier can reach it directly.
  3. Put both tiers in one subnet and rely on the database's own authentication.
  4. Put the web tier in a subnet with a route to the internet gateway and the database tier in a subnet whose firewall rules allow only the web tier's source tags. Correct answer.

Explanation

Separating tiers into subnets lets you apply VPC firewall rules scoped by source service account or network tag, so only the web tier can reach the database ports. The database subnet needs no inbound internet path, which reduces exposure. Using tags or service accounts rather than IP ranges keeps the rule stable as instances scale.

Question 3Designing and planning a cloud solution architecture

Which Google Cloud storage service is the natural choice for a design that needs a POSIX-compliant shared file system mounted concurrently by many Compute Engine instances?

  1. Persistent Disk in read-write mode attached to each instance
  2. Filestore Correct answer.
  3. Cloud Storage with a standard bucket
  4. Bigtable

Explanation

Filestore provides a managed NFS file system that many clients can mount at the same time, which matches a POSIX shared-file requirement. Cloud Storage is object storage accessed through APIs rather than a mounted POSIX file system. Persistent Disk is block storage, and a standard disk cannot be attached read-write to multiple instances simultaneously.

Question 4Designing and planning a cloud solution architecture

A design must ingest millions of small event records per second and make them queryable by row key with single-digit-millisecond latency at very large scale. Which data service best fits this requirement?

  1. Bigtable Correct answer.
  2. Cloud Spanner
  3. BigQuery
  4. Cloud SQL for PostgreSQL

Explanation

Bigtable is a wide-column, horizontally scalable database designed for high-throughput writes and low-latency reads by row key. Cloud SQL is a relational service with vertical scaling limits and is not intended for millions of writes per second. BigQuery is an analytics warehouse optimized for large scans, not single-row low-latency lookups, and Spanner targets strongly consistent relational workloads rather than this key-access pattern.

Question 5Designing and planning a cloud solution architecture

What is the primary purpose of a Google Cloud folder in the resource hierarchy?

  1. To define the physical region where child resources are created
  2. To act as a VPC network shared across projects
  3. To group projects for policy inheritance and delegated administration Correct answer.
  4. To provide a billing account that pays for all projects beneath it

Explanation

Folders sit between the organization and projects so that IAM policies and organization policies applied at a folder are inherited by everything beneath it. They also let you delegate administration to teams without granting rights at the organization level. Folders carry no billing, location, or networking function of their own.

Question 6Designing and planning a cloud solution architecture

An application running on Compute Engine needs to read objects from a Cloud Storage bucket without any long-lived credentials stored on the instances. What is the recommended design?

  1. Grant the allUsers principal object viewer on the bucket.
  2. Store a user's OAuth refresh token in instance metadata.
  3. Attach a user-managed service account to the instances and grant it the appropriate bucket role. Correct answer.
  4. Create a service account key and bake it into the instance image.

Explanation

Attaching a service account to the instance lets workloads obtain short-lived credentials automatically from the metadata server, so no key material is stored on disk. IAM roles on that service account then scope access to the bucket. This avoids the rotation and leakage risks of exported keys.

Question 7Designing and planning a cloud solution architecture

Which Google Cloud load balancer is the appropriate choice for a design that must distribute global HTTP(S) traffic across backends in multiple regions with a single anycast IP address?

  1. Global external Application Load Balancer Correct answer.
  2. Regional external passthrough Network Load Balancer
  3. Proxy Network Load Balancer
  4. Internal regional Application Load Balancer

Explanation

The global external Application Load Balancer provides a single anycast IP and routes HTTP(S) requests to backends across regions, which is the requirement described. Passthrough network load balancers operate at layer 4 and are regional. Internal Application Load Balancers serve private clients within a region.

Question 8Designing and planning a cloud solution architecture

A team wants to run a containerized application on Google Cloud with minimal operational overhead and automatic scaling, and the application is stateless. Which compute option should the architect recommend?

  1. Compute Engine instances in a zonal MIG
  2. Bare Metal Solution
  3. Google Kubernetes Engine with a self-managed node pool
  4. Cloud Run Correct answer.

Explanation

Cloud Run is a fully managed serverless container runtime that scales automatically, including to zero, and requires no cluster or node management. It fits stateless request-driven services well. GKE and MIGs give more control but require more operational effort, and Bare Metal Solution is for specialized hardware needs.

Question 9Designing and planning a cloud solution architecture

An architect is designing a multi-region architecture for a relational OLTP database that requires strong consistency and 99.999% availability. Which service should be the primary candidate?

  1. Cloud Spanner with a multi-region instance configuration Correct answer.
  2. BigQuery with a multi-region dataset
  3. Cloud SQL with a cross-region read replica
  4. Firestore in Datastore mode

Explanation

Spanner is a globally distributed relational database offering strong consistency and multi-region configurations with a 99.999% SLA. Cloud SQL read replicas are asynchronous and do not provide a multi-region strongly consistent write endpoint. BigQuery is analytical, and Firestore in Datastore mode is a NoSQL document store without relational semantics.

Question 10Designing and planning a cloud solution architecture

A company has separate projects for each team and wants a single shared VPC so that central networking controls apply while teams keep managing their own resources. Which configuration achieves this?

  1. Create VPC peering between every pair of team projects.
  2. Create one VPC per team and connect them with Cloud VPN.
  3. Create a Shared VPC host project, attach each team project as a service project, and grant subnet-level IAM to the teams. Correct answer.
  4. Grant each team the network admin role at the organization level.

Explanation

Shared VPC centralizes network administration in a host project while service projects consume subnets from it. Granting subnet-level IAM lets each team deploy into its own subnets without controlling the whole network. This preserves separation of duties between network and application teams.

Question 11Designing and planning a cloud solution architecture

A design requires that data at rest for a regulated workload be encrypted with keys that the customer controls, rotated on a schedule, and usable across multiple services. Which approach should the architect choose?

  1. Customer-managed encryption keys in Cloud KMS Correct answer.
  2. Customer-supplied encryption keys supplied on every API call
  3. Google-managed encryption keys with default settings
  4. Client-side encryption with a key stored in application source code

Explanation

Customer-managed encryption keys in Cloud KMS give the customer control over key lifecycle, rotation, and IAM access while integrating with many Google Cloud services. Rotation can be scheduled and old versions retained for decryption. Storing keys in source code or re-supplying them per call is operationally fragile and less secure.

Question 12Designing and planning a cloud solution architecture

A batch analytics job reads a large Cloud Storage dataset once per day and must complete within a fixed cost budget. The data is in a bucket that is accessed daily for two weeks and then rarely. Which storage class strategy best balances cost and access?

  1. Store in Standard and add an Object Lifecycle rule to transition to Nearline after 30 days. Correct answer.
  2. Store everything in Standard storage permanently.
  3. Store in Coldline and rely on retrieval within minutes.
  4. Store in Archive storage from the start.

Explanation

Standard suits frequent access, and a lifecycle rule moving objects to a colder class after the active period lowers long-term cost without manual work. Nearline is intended for data accessed less than once a month, which fits the post-active phase. Archive and Coldline carry minimum storage durations and retrieval costs that penalize the initial daily access.

Question 13Designing and planning a cloud solution architecture

An architect needs to connect an on-premises data center to a VPC with a dedicated private connection that offers a defined SLA and higher throughput than internet-based options. Which service should be selected?

  1. Cloud VPN with HA VPN tunnels
  2. VPC peering
  3. Cloud Interconnect (Dedicated Interconnect) Correct answer.
  4. Cloud NAT

Explanation

Dedicated Interconnect provides a private, SLA-backed connection between on-premises networks and Google Cloud at high bandwidth. HA VPN runs over the public internet and is appropriate when a dedicated circuit is not justified. VPC peering and Cloud NAT are internal networking features, not on-premises connectivity services.

Question 14Designing and planning a cloud solution architecture

A design must ensure that a Cloud Storage bucket containing sensitive reports is never made public, even by a project editor who later misconfigures IAM. Which control best enforces this at the organization level?

  1. A Cloud Audit Logs sink that records bucket IAM changes
  2. An organization policy constraint that disables public access on Cloud Storage buckets Correct answer.
  3. A budget alert that notifies the security team when storage costs rise
  4. A VPC Service Controls perimeter around the project

Explanation

An organization policy constraint on public access prevention is enforced by the platform and blocks the configuration regardless of a user's IAM permissions. Audit logs and budget alerts detect or record events but do not prevent the change. VPC Service Controls restrict data exfiltration paths but do not by themselves stop a bucket from being made public.

Question 15Designing and planning a cloud solution architecture

An application's traffic is spiky and unpredictable, with long idle periods overnight. The architect wants to minimize cost while keeping response latency low during bursts. Which compute design is most appropriate?

  1. A zonal MIG with a minimum size equal to peak load
  2. Reserved sole-tenant nodes sized for peak load
  3. A Cloud Run service with a maximum instance limit and concurrency configured Correct answer.
  4. A fixed-size regional MIG sized for peak load

Explanation

Cloud Run scales out on demand and back to zero when idle, so you pay mainly for requests and instance time actually consumed. Setting a maximum instance limit and concurrency controls cost and protects downstream systems during bursts. Fixed or reserved capacity sized for peak pays for idle capacity overnight.

Question 16Designing and planning a cloud solution architecture

A team is designing a messaging architecture where multiple independent consumers must each receive every event, and producers must not be blocked by slow consumers. Which design is most appropriate?

  1. A Cloud Tasks queue with one task per consumer
  2. A single Pub/Sub subscription shared by all consumers
  3. Separate Pub/Sub subscriptions per consumer on the same topic Correct answer.
  4. A single Cloud Storage bucket polled by every consumer

Explanation

Pub/Sub delivers a copy of each message to every subscription on a topic, so separate subscriptions give each consumer its own stream and independent acknowledgement. Producers publish asynchronously and are decoupled from consumer speed. A shared subscription would load-balance messages across consumers instead of fanning out.

Question 17Designing and planning a cloud solution architecture

An architect is designing for disaster recovery and needs a recovery point objective of near zero for a transactional database, with a recovery time objective measured in minutes. Which approach best meets the RPO?

  1. Asynchronous log shipping every hour
  2. Weekly snapshots retained for a year
  3. Synchronous replication to a standby in another region Correct answer.
  4. Nightly database exports to Cloud Storage

Explanation

Near-zero RPO requires that committed transactions already exist at the recovery site, which synchronous replication provides. Nightly exports, weekly snapshots, and hourly log shipping all lose the transactions committed since the last transfer, giving RPOs of hours or a day. The choice of technology must match the stated RPO before RTO is considered.

Question 18Designing and planning a cloud solution architecture

A company wants to expose an internal API to partner projects in the same organization without sending traffic over the public internet. Which design should the architect use?

  1. A Cloud Storage signed URL per partner
  2. An internal Application Load Balancer with Private Service Connect or private access configured for the partner projects Correct answer.
  3. A public Cloud Run service with IAP disabled
  4. A global external Application Load Balancer with an allowlist of partner IP addresses

Explanation

An internal Application Load Balancer keeps traffic on private Google Cloud networking, and Private Service Connect lets specified consumer projects reach the service without public exposure. An external load balancer, even with IP allowlisting, still exposes the endpoint to the internet. Signed URLs serve objects, not an API.

Question 19Designing and planning a cloud solution architecture

A migration design must move a large on-premises data warehouse to BigQuery with minimal downtime and a repeatable, incremental transfer. Which approach is most appropriate?

  1. Export tables to CSV and upload them manually each time.
  2. Run a one-time full export and switch over immediately.
  3. Query the source warehouse directly from BigQuery federated queries permanently.
  4. Use the BigQuery Data Transfer Service or a change-data-capture pipeline to load incrementally. Correct answer.

Explanation

A managed transfer service or CDC pipeline supports scheduled and incremental loads, which reduces downtime and makes the transfer repeatable. A one-time full export creates a long cutover window and no mechanism for catching up on changes. Permanent federated queries keep the legacy system as a runtime dependency rather than completing the migration.

Question 20Designing and planning a cloud solution architecture

An application must authenticate users from an existing corporate identity provider and enforce fine-grained, per-resource access in Google Cloud APIs. Which combination should the architect design?

  1. Identity Platform for user sign-in and IAM policies on the resources Correct answer.
  2. A shared service account key distributed to all users
  3. A single allUsers IAM binding on the resources
  4. Cloud KMS keys per user with no IAM

Explanation

Identity Platform federates with the corporate identity provider so users sign in with existing credentials, and IAM policies on each resource enforce least-privilege access. Distributing a shared key removes individual accountability and cannot be revoked per user. Granting allUsers removes access control entirely.

Question 21Designing and planning a cloud solution architecture

A design requires a VPC network in which workloads in one subnet can reach a managed Google API such as Cloud Storage without traversing the public internet, and the traffic must be attributable to specific instances. Which configuration is most appropriate?

  1. Private Google Access enabled on the subnet Correct answer.
  2. A Cloud NAT gateway on the subnet
  3. A Cloud VPN tunnel to a partner network
  4. An external IP address on each instance

Explanation

Private Google Access lets instances without external IP addresses reach Google APIs and services using internal routes, keeping traffic off the public internet. Cloud NAT provides outbound internet access for general destinations, not the private API path. External IPs and VPN tunnels do not provide the required private API routing.

Question 22Designing and planning a cloud solution architecture

An architect is designing a multi-tenant SaaS platform on GKE where each tenant's data must be isolated and noisy-neighbor effects minimized. Which design best addresses both concerns?

  1. Per-tenant namespaces with ResourceQuota and LimitRange, plus network policies between namespaces Correct answer.
  2. A single deployment for all tenants with tenant ID passed in the request body only
  3. One large node pool shared by all tenants with default scheduling
  4. A single namespace shared by all tenants with no resource quotas

Explanation

Namespaces provide a logical boundary for tenant resources, and ResourceQuota and LimitRange cap the CPU and memory each tenant can consume, limiting noisy-neighbor impact. Network policies restrict cross-namespace traffic so tenants cannot reach each other's services. A single shared namespace or deployment removes both the resource and network boundaries.

Question 23Designing and planning a cloud solution architecture

A financial system requires that no data leave a defined set of projects except through approved services, and that access to Cloud Storage and BigQuery APIs from outside the perimeter be blocked. Which control should the architect design as the primary enforcement mechanism?

  1. Cloud Armor security policies on the load balancer
  2. Cloud Audit Logs with log-based alerts
  3. VPC Service Controls with a service perimeter around the projects Correct answer.
  4. Firewall rules that block egress to the internet

Explanation

VPC Service Controls defines a service perimeter that blocks access to protected APIs such as Cloud Storage and BigQuery from outside the perimeter, which directly addresses data exfiltration. Cloud Armor protects web endpoints, and firewall rules operate at the network layer rather than the API layer. Audit logs and alerts detect activity but do not enforce the boundary.

Question 24Designing and planning a cloud solution architecture

A design must provide a strongly consistent, globally available configuration store for a control plane that experiences frequent small writes and reads from many regions, with automatic failover and no downtime during regional outages. Which service best fits?

  1. Bigtable with a single-cluster instance
  2. Cloud Spanner with a multi-region configuration Correct answer.
  3. Cloud SQL with a single primary and cross-region replicas
  4. Memorystore for Redis with a single zone

Explanation

Spanner multi-region configurations provide strong consistency, automatic regional failover, and a 99.999% availability SLA, which matches the control-plane requirements. Cloud SQL with cross-region replicas requires a manual or scripted failover and replicas are asynchronous. A single-zone Redis instance and a single-cluster Bigtable instance are both single points of failure.

Question 25Designing and planning a cloud solution architecture

An architect is designing a data pipeline where late-arriving events must be handled correctly and exactly-once processing is required for financial aggregations. Which design element is most important?

  1. Using a subscription with at-most-once delivery to avoid duplicates
  2. Processing events in arrival order with no windowing or deduplication
  3. Using a subscription with at-least-once delivery and idempotent, windowed processing keyed by event ID with allowed lateness Correct answer.
  4. Relying on message ordering alone to guarantee exactly-once results

Explanation

Exactly-once results are achieved by combining at-least-once delivery with idempotent processing keyed on a stable event identifier, so duplicates are collapsed. Windowed processing with allowed lateness lets late events update the correct aggregation window. At-most-once delivery drops messages and cannot guarantee complete results, and ordering alone does not prevent duplicates.

Question 26Designing and planning a cloud solution architecture

An architect is choosing a compute platform for a new application whose traffic pattern is flat and predictable, and whose team wants the lowest per-hour cost for long-running, fault-tolerant batch workers that can tolerate interruptions. Which Google Cloud compute option best fits this requirement?

  1. Compute Engine preemptible/Spot VMs Correct answer.
  2. App Engine standard environment
  3. Cloud Run services with minimum instances set to zero
  4. GKE Autopilot with cluster autoscaling enabled

Explanation

Spot (preemptible) VMs offer large discounts in exchange for the possibility that the instance is stopped, which is acceptable for fault-tolerant batch work with predictable duration. Because the workload is steady and interruption-tolerant, the discount is realized without architectural risk.

Question 27Designing and planning a cloud solution architecture

A solution architect is defining the resource hierarchy for a new organization. Teams must be prevented from disabling a required audit logging setting, while individual projects still need freedom to grant developers broad roles. Where should the architect apply the policy constraint?

  1. At the folder level only, with exceptions granted per project
  2. In each project, using a custom role without the logging permission
  3. In each project, using IAM deny policies on the developers group
  4. At the organization node, using an organization policy constraint that is inherited by all projects Correct answer.

Explanation

Organization policy constraints are inherited down the resource hierarchy and can restrict what descendant projects are allowed to do, including enforcing audit log settings. Applying the constraint at the organization node prevents teams from overriding it in their own projects while leaving IAM role grants flexible.

Question 28Designing and planning a cloud solution architecture

A design must let an on-premises application reach a private IP address of a Compute Engine instance without exposing that instance to the public internet, and the connection must traverse a dedicated interconnect. Which combination should the architect specify?

  1. Cloud VPN over the internet with the instance given an external IP
  2. Dedicated Interconnect with Cloud Router and a VPC route to the on-premises range Correct answer.
  3. Private Service Connect endpoint for the instance
  4. Cloud NAT with the instance in a private subnet

Explanation

Dedicated Interconnect provides a private dedicated circuit, and Cloud Router advertises routes dynamically so on-premises hosts can reach private instance addresses over the VPC. No external IP is required on the instance for this path.

Question 29Designing and planning a cloud solution architecture

An application stores user-uploaded files in Cloud Storage. The architect must ensure that access is granted to a large set of external partners without managing each partner individually, and that permissions are limited to reading only one bucket. Which approach should be used?

  1. Grant roles/editor on the project to a service account shared with partners
  2. Grant roles/storage.objectViewer on the bucket to a Google Group containing the partners Correct answer.
  3. Make the bucket public and rely on unguessable object names
  4. Grant roles/storage.admin on the project to each partner's user account

Explanation

Bucket-level IAM bindings scope permissions to the specific bucket, and binding to a Google Group lets membership changes be managed centrally rather than per partner. objectViewer grants read access without write or administrative rights.

Question 30Designing and planning a cloud solution architecture

A team needs a managed relational database for a new application and expects modest, steady traffic with no requirement for cross-region writes. The architect wants automated backups, patching, and replication to a standby in a second zone with minimal design effort. Which choice meets this requirement?

  1. Bigtable with a single cluster
  2. Spanner with a multi-region instance configuration
  3. Cloud SQL with a regional high-availability configuration Correct answer.
  4. Firestore in Datastore mode

Explanation

Cloud SQL regional configuration maintains a standby in a second zone and handles failover, backups, and patching as managed operations. It matches a moderate relational workload without requiring multi-region write scaling.

Question 31Designing and planning a cloud solution architecture

An architect is designing storage for analytics queries over parquet files that will be read by multiple engines. The design should minimize cost for data accessed a few times per month and allow SQL querying without loading the data into a separate warehouse table. Which combination should the architect choose?

  1. Persistent Disk attached to a Compute Engine cluster
  2. Cloud Storage Standard bucket loaded nightly into BigQuery
  3. Filestore shared across analytics VMs
  4. Cloud Storage Nearline bucket queried through BigQuery external tables Correct answer.

Explanation

Nearline storage lowers cost for data accessed less than once a month, and BigQuery external tables allow SQL over files in Cloud Storage without ingestion. Together they meet the infrequent-access and query-without-loading requirements.

Question 32Designing and planning a cloud solution architecture

An architect must design a solution so that a regulated workload's network traffic never uses the public internet, and all egress to Google APIs stays within the VPC. Which feature should be enabled on the subnets?

  1. Private Google Access Correct answer.
  2. Cloud CDN
  3. Serverless VPC Access connector
  4. Cloud Armor

Explanation

Private Google Access allows instances with only internal IP addresses to reach Google APIs and services using internal routing rather than the public internet. It is enabled per subnet and is the direct control for this requirement.

Question 33Designing and planning a cloud solution architecture

A company is planning a migration of 200 on-premises virtual machines to Google Cloud and wants a repeatable, low-risk process with the ability to test workloads before cutover. Which design element should the architect include first?

  1. Rewrite every application as containers before any migration
  2. Move all workloads to a single large bare-metal instance
  3. Replatform all applications directly onto Cloud Functions
  4. Migrate to Compute Engine using Migrate to Virtual Machines with a staged test-and-cutover plan Correct answer.

Explanation

Migrate to Virtual Machines supports replicating and testing on-premises VMs in Google Cloud before final cutover, which reduces risk and makes the process repeatable. A staged plan lets teams validate each wave before committing.

Question 34Designing and planning a cloud solution architecture

A solution must process messages from a topic where ordering per customer ID is required and consumers must acknowledge messages individually. Which Google Cloud service should the architect select?

  1. Pub/Sub with ordering keys enabled and subscriptions using individual acknowledgements Correct answer.
  2. Cloud Tasks with a single queue
  3. Cloud Scheduler with a cron job
  4. Eventarc with a single trigger

Explanation

Pub/Sub ordering keys preserve publish order per key for a subscription, and subscribers acknowledge messages individually. This matches the per-customer ordering and per-message acknowledgement requirements.

Question 35Designing and planning a cloud solution architecture

An architect is designing a solution that must serve a global audience with low latency for static assets and dynamic API responses, while protecting the backend from sudden traffic spikes. Which combination should be used?

  1. Global external Application Load Balancer with Cloud CDN and Cloud Armor Correct answer.
  2. TCP proxy load balancer with a single-zone managed instance group
  3. External passthrough Network Load Balancer with autoscaling
  4. Regional internal passthrough Network Load Balancer with Cloud NAT

Explanation

A global external Application Load Balancer provides anycast frontends and global balancing for HTTP(S), Cloud CDN caches static content near users, and Cloud Armor absorbs or blocks abusive spikes. Together they meet latency and resilience goals.

Question 36Designing and planning a cloud solution architecture

A workload must run on GKE and needs node-level access to a licensed kernel module that cannot run in a sandboxed runtime. The architect also wants automatic node repair and upgrade management. Which design should be chosen?

  1. GKE Autopilot with the default sandboxed runtime
  2. Cloud Run with a custom container image
  3. Cloud Functions with a second-generation runtime
  4. GKE Standard with a node pool of Compute Engine nodes and node auto-repair and auto-upgrade enabled Correct answer.

Explanation

GKE Standard gives control over node configuration, including the container-optimized OS and privileged access needed for kernel modules, while node auto-repair and auto-upgrade retain managed lifecycle benefits. Autopilot restricts privileged node customization.

Question 37Designing and planning a cloud solution architecture

An architect must ensure that application secrets used by a Compute Engine workload are never stored in the instance image and are rotated regularly. Which design meets this requirement?

  1. Pass secrets as startup script metadata in plain text
  2. Store secrets in a Cloud Storage bucket with uniform access
  3. Bake the secrets into a custom image built by the team
  4. Store secrets in Secret Manager and have the instance fetch them at runtime using its attached service account Correct answer.

Explanation

Secret Manager centralizes secret storage and supports versioning and rotation, and the attached service account provides short-lived credentials for retrieval at runtime. This keeps secrets out of images and metadata.

Question 38Designing and planning a cloud solution architecture

A design requires that an application running in project A can call a Cloud Run service in project B over a private path that is not exposed to the internet, and that only approved consumer projects can connect. Which approach should the architect use?

  1. Use a VPC peering connection between the two projects and call the public URL
  2. Assign the Cloud Run service a public URL and rely on an API key
  3. Publish the Cloud Run service through Private Service Connect and allow only the approved consumer projects Correct answer.
  4. Route traffic through a shared Cloud NAT gateway in project B

Explanation

Private Service Connect lets a producer publish a service endpoint that consumers reach privately, and access can be restricted to specific consumer projects. This satisfies both the private path and the allowlist requirement.

Question 39Designing and planning a cloud solution architecture

An architect is designing a data warehouse solution where analysts must query only rows for their own business unit, and the underlying table must remain a single shared table. Which BigQuery feature should be used?

  1. Authorized views that copy the table for each analyst
  2. Column-level access control on the business unit column
  3. Row-level security with a policy filter on the business unit column Correct answer.
  4. Separate datasets per business unit with duplicated data

Explanation

BigQuery row-level security applies a filter so each principal sees only permitted rows while the table remains shared. Column-level controls restrict columns, not rows, and duplicating data defeats the single-table requirement.

Question 40Designing and planning a cloud solution architecture

A system must remain available during the loss of an entire region and must serve reads locally in each region. Writes must be accepted in any region with strong consistency. Which database design should the architect choose?

  1. Cloud SQL with a cross-region read replica
  2. Bigtable with a single cluster
  3. Firestore in Native mode with a single-region location
  4. Spanner with a multi-region instance configuration Correct answer.

Explanation

Spanner multi-region configurations provide synchronous replication and strong consistency for reads and writes across regions, with regional failover built in. This satisfies both local reads and globally consistent writes.

Question 41Designing and planning a cloud solution architecture

An architect is planning a landing zone for many teams. Requirements include centralized network administration, per-team billing visibility, and the ability to apply different guardrails to production versus development. Which hierarchy design best meets these needs?

  1. A single project containing all teams separated by labels
  2. One organization per team with no shared services
  3. A flat set of projects directly under the organization with no folders
  4. An organization with environment folders containing team projects, plus a shared VPC host project Correct answer.

Explanation

Folders let the architect apply environment-specific guardrails that inherit to contained projects, and a shared VPC host project centralizes network administration. Billing export by project and folder gives per-team cost visibility.

Question 42Designing and planning a cloud solution architecture

A workload must run batch jobs that read from and write to a Cloud Storage bucket. The architect wants to avoid long-lived service account keys while still allowing the jobs to run unattended. Which design should be used?

  1. Create a service account key and mount it as a file in each job
  2. Store an OAuth refresh token in the job configuration
  3. Use the Compute Engine default service account with the Editor role
  4. Attach a user-managed service account to the compute resources and grant it least-privilege bucket access Correct answer.

Explanation

Attaching a service account to compute resources provides short-lived credentials through the metadata server, so no key files are needed. Granting only the required bucket permissions follows least privilege.

Question 43Designing and planning a cloud solution architecture

An architect must design disaster recovery for an application whose recovery time objective is 15 minutes and recovery point objective is 5 minutes. The primary region runs a managed instance group behind a load balancer. Which design best meets both targets at reasonable cost?

  1. An active-active design in three regions with synchronous writes everywhere
  2. A single region with zonal redundancy only
  3. A cold standby region with backups restored only after a disaster is declared
  4. A warm standby region with a scaled-down managed instance group and asynchronous database replication Correct answer.

Explanation

A warm standby with a running scaled-down deployment can be scaled up within minutes, meeting a 15-minute RTO, while asynchronous replication with a short lag meets a 5-minute RPO. It costs less than full active-active while satisfying the targets.

Question 44Designing and planning a cloud solution architecture

A company needs to give a third-party analytics vendor access to a specific BigQuery dataset for 90 days, after which access must end automatically. Which design should the architect choose?

  1. Share a service account key with the vendor and rotate it quarterly
  2. Grant the vendor project-level BigQuery Admin and remove it manually later
  3. Export the dataset to a public bucket for the vendor to download
  4. Grant the vendor a dataset-level IAM role with an IAM condition that expires at a set timestamp Correct answer.

Explanation

IAM conditions support time-based expiry on role bindings, so access ends automatically without manual follow-up. Dataset-level scope limits the vendor to only the intended data.

Question 45Designing and planning a cloud solution architecture

An architect is designing a multi-tenant SaaS platform where each tenant's data must be encrypted with a tenant-specific key, and some tenants require the ability to revoke access to their key immediately. Which design should be used?

  1. A single customer-managed key shared by all tenants
  2. Application-level encryption with a key stored in the same database as the data
  3. Cloud KMS with a separate customer-managed key per tenant and IAM-scoped key access Correct answer.
  4. Google-managed encryption keys for all tenant data

Explanation

Per-tenant customer-managed keys let each tenant's data be isolated cryptographically, and disabling or revoking access to a tenant's key immediately blocks decryption. This meets both isolation and revocation requirements.

Question 46Designing and planning a cloud solution architecture

A design must guarantee that only images from a trusted build pipeline can run in a GKE cluster, and that any non-compliant deployment is rejected at admission time. Which combination should the architect specify?

  1. Network policies restricting egress from pods
  2. Pod Security Admission with the restricted profile
  3. Image vulnerability scanning in Artifact Registry only
  4. Binary Authorization with an attestor in the build pipeline and enforcement enabled on the cluster Correct answer.

Explanation

Binary Authorization verifies attestations at admission time and rejects images that were not produced by the trusted pipeline. An attestor created during the build signs images that pass the pipeline.

Question 47Designing and planning a cloud solution architecture

An architect must design a cost-governed analytics platform where queries should fail rather than exceed a per-team monthly budget, and where spend must be attributable to each team. Which design should be used?

  1. Separate BigQuery projects or reservations per team with custom quotas and billing export by project Correct answer.
  2. A single shared project with no quotas and monthly manual review
  3. Flat-rate commitments shared by all teams with no labels
  4. On-demand pricing with query results cached indefinitely

Explanation

Project-level separation enables per-team billing attribution, and custom quotas can cap query usage so spend cannot exceed the budget. Billing export provides the reporting needed to track consumption.

Question 48Designing and planning a cloud solution architecture

An architect is designing a solution where on-premises applications must access a Cloud Storage bucket over a private connection with predictable latency, and the design must survive the failure of a single interconnect circuit. Which design should be used?

  1. Two Dedicated Interconnect connections in different metro locations with Cloud Router and global dynamic routing Correct answer.
  2. Cloud CDN in front of the bucket with public access
  3. A single Dedicated Interconnect connection with a backup Cloud VPN over the internet
  4. A single Partner Interconnect connection in one metro

Explanation

Two Dedicated Interconnect circuits in separate metros provide physical path diversity, and Cloud Router with global dynamic routing reconverges traffic if one circuit fails. This delivers private, predictable connectivity with resilience.

Question 49Managing and provisioning a cloud solution infrastructure

A team needs to run a containerized batch job on Google Cloud with minimal operational overhead and no cluster management. Which compute option best fits this requirement?

  1. Cloud Run jobs Correct answer.
  2. Google Kubernetes Engine Standard with a node pool per job
  3. Compute Engine managed instance groups with autoscaling
  4. Bare metal solution instances

Explanation

Cloud Run jobs execute containerized workloads to completion without requiring you to provision or manage any cluster or underlying nodes, which directly matches the low-overhead requirement. GKE Standard and Compute Engine both require capacity and lifecycle management, and bare metal is the opposite of low operational overhead.

Question 50Managing and provisioning a cloud solution infrastructure

Which Cloud Storage option is designed for long-term archival data that is accessed at most once per year and can tolerate retrieval times of several hours?

  1. Nearline storage
  2. Standard storage
  3. Coldline storage
  4. Archive storage Correct answer.

Explanation

Archive storage has the lowest storage price and is intended for data accessed less than once a year, with retrieval typically taking hours. Nearline targets monthly access, Coldline targets quarterly access, and Standard is for frequent access.