Google Cloud Professional Cloud Architect practice questions

Question 1

An organization is being designed around a new global SaaS product and the architect must decide how to scope the initial design review against the Well-Architected Framework. Which approach best reflects the framework's intent for the design review?

Accepted Answer

Treat the six pillars (security, reliability, performance, cost, operations, sustainability) as a single set of principles and recommendations to review in a coordinated way.

Answer

Schedule one isolated review per pillar so that the security and reliability teams never share findings, ensuring strict separation of duties across the review process.

Answer

Defer the design review until after general availability so that production telemetry can be used as the sole input into the framework checklist.

Answer

Use only the cost pillar during the design review because the other pillars are not enforceable in Google Cloud organizations without a paid support contract attached.

Question 2

An enterprise is being designed around a regulated Google Cloud landing zone and the architect wants a Google-authored reference for the baseline resources. Per the enterprise foundations blueprint, which option matches the documented purpose?

Accepted Answer

The enterprise foundations blueprint describes the best practices that let you deploy a foundational set of resources in Google Cloud and explains that a cloud foundation is the baseline of resources, configurations, and capabilities that enable companies to adopt Google Cloud for their business needs.

Answer

The enterprise foundations blueprint is a one-time Cloud Build template that compiles container images and is unrelated to the IAM, networking, or governance baseline in Google Cloud.

Answer

The enterprise foundations blueprint is a Cloud SQL schema migration tool and is unrelated to the cloud foundation, organization hierarchy, or security controls in Google Cloud.

Answer

The enterprise foundations blueprint is a marketing brochure that contains no technical guidance and is unrelated to the deployment of Google Cloud baseline resources. This phrasing conflates the underlying architectural concept and is not what the Google Cloud documentation defines for this scenario.

Question 3

A platform team is being onboarded onto Terraform on Google Cloud and is establishing the team's IaC code conventions. Per Google Cloud's Terraform best practices, which option matches the documented standard module structure?

Accepted Answer

Terraform modules must follow the standard module structure: start every module with a main.tf file, include a README.md file in Markdown format, and place examples in an examples/ folder with a separate subdirectory for each example.

Answer

Terraform modules must use a strict layered structure where main.tf is forbidden and all resources are declared inside a templates/ subdirectory, with no examples or README required.

Answer

Terraform modules must be vendored into the workload's source repository as binary HCL artifacts produced by terraform plan, with no main.tf or README at the module root.

Answer

Terraform modules must be packaged as Helm charts so they can be deployed through Cloud Build instead of through Terraform itself, with main.tf replaced by a Chart.yaml file.

Question 4

A company is rolling out cost-optimization reviews and the architect must explain what the cost-optimization pillar of the Well-Architected Framework actually covers. Per Google Cloud's documentation, which option matches?

Accepted Answer

The cost optimization pillar in the Google Cloud Well-Architected Framework describes principles and recommendations to optimize the cost of your workloads in Google Cloud.

Answer

The cost optimization pillar is a per-region SLA credit policy that Google Cloud refunds to customers when a Compute Engine region exceeds a billing threshold for the workload.

Answer

The cost optimization pillar applies only to on-premises workloads being migrated to Google Cloud and is not relevant after the migration is complete in any deployment region.

Answer

The cost optimization pillar is a one-time spreadsheet of Compute Engine list prices that the architect downloads once a year and is not part of the Well-Architected Framework.

Question 5

An architect is being asked to summarize how Cloud Monitoring alerts are structured. Per Google Cloud's documentation, which option matches?

Accepted Answer

The Cloud Monitoring alerting process contains three parts: an alerting policy, which describes the circumstances under which you want to be alerted and how you want to be notified about an incident; each incident is a record of the type of data that was monitored and when the conditions were met; and a notification channel that defines how you receive notifications when Monitoring creates an incident.

Answer

Cloud Monitoring alerts are a single static dashboard and have no concept of policies, incidents, or notification channels at any level. This option mixes adjacent concepts but does not match what Google Cloud actually documents for this control. This option restates a related but distinct cloud concept and does not satisfy the design requirement in the scenario.

Answer

Cloud Monitoring alerts are exclusively delivered via Cloud KMS HSM-signed messages and have no concept of email, SMS, or other notification channels in the documented design. This wording shifts the meaning to a different Google Cloud service or property and is therefore incorrect here.

Answer

Cloud Monitoring alerts are a per-region SLA credit policy and have no concept of monitoring or notification, regardless of how the customer configures the workload. The architectural reasoning in this option does not align with the published Google Cloud guidance for this case.

Question 6

A team is being asked to centralize API management for their microservices on Google Cloud. Per Google Cloud's Cloud Endpoints documentation, which option matches?

Accepted Answer

Endpoints is a distributed API management system, and it provides an API console, hosting, logging, monitoring, and other features to help you create, share, maintain, and secure your APIs.

Answer

Endpoints is a managed Compute Engine machine type that hosts a single API on a single VM and is unrelated to API management features such as logging or monitoring across multiple services.

Answer

Endpoints is a Cloud KMS HSM cluster that signs every API call from a Google Cloud workload and is unrelated to API hosting, logging, or monitoring.

Answer

Endpoints is a one-time CSV export of API call counts that the architect downloads quarterly and is not a managed API management product in Google Cloud.

Question 7

An architect is being asked to enumerate reliability best practices that the Well-Architected Framework calls out. Select the two best practices the framework explicitly lists under reliability.

Accepted Answer

Redundancy and fault-tolerant design as part of the architecture, and monitoring and automated recovery processes during operation.

Accepted Answer

Establishing fault-tolerant design as a baseline, with monitoring and automated recovery processes complementing it for the operational steady state.

Answer

Routing all production traffic through a single regional load balancer in the cheapest region to keep the design simple and predictable for operators.

Answer

Disabling autoscaling so that machine counts never fluctuate during a release window or a regional event, ensuring constant capacity. This wording shifts the meaning to a different Google Cloud service or property and is therefore incorrect here.

Question 8

An architect is being asked whether CMEK replaces Google's default encryption or works alongside it. Per Google Cloud's CMEK documentation, which option matches the documented model?

Accepted Answer

CMEK integration is a server-side encryption technology that you can use in place of Google Cloud's default encryption. This phrasing conflates two related Google Cloud features and is not what the documentation prescribes for this design.

Answer

CMEK integration is a TLS-tunneling proxy that handles in-transit encryption only, and does not affect at-rest encryption for the resource in any way.

Answer

CMEK integration is a client-side encryption SDK that runs on the customer's laptop and is unrelated to server-side encryption inside Google Cloud services.

Answer

CMEK integration disables all encryption at rest for the resource and forces the customer to implement their own encryption protocol outside the Google Cloud product.

Question 9

A company is designing a horizontally scalable web frontend on Compute Engine and the architect must choose between managed and unmanaged instance groups. Per Google Cloud's documentation, which statement about managed instance groups matches?

Accepted Answer

Managed instance groups (MIGs) let you operate apps on multiple identical VMs and make your workloads scalable and highly available by taking advantage of automated MIG services, including autoscaling, autohealing, regional (multiple zone) deployment, and automatic updating.

Answer

Managed instance groups always require the operator to manually replace failed VMs because Compute Engine does not auto-heal MIG members in any topology, including regional MIGs.

Answer

Managed instance groups are limited to a single zone and cannot deploy VMs across multiple zones, so regional MIG deployments are not supported on Compute Engine. This wording shifts the meaning to a different Google Cloud service or property and is therefore incorrect here.

Answer

Managed instance groups do not support autoscaling and require operators to set a fixed VM count for every deployment of the workload, with no scaling signal involved.

Question 10

An architect is being asked to defend why a deep workload-resource analysis precedes any cost decisions. Per Google Cloud's optimize-resource-usage guidance, which option matches?

Accepted Answer

To optimize the cost of your cloud resources, you need to thoroughly understand your workloads resource requirements and load patterns, and this understanding is the basis for a well defined cost model that lets you forecast the total cost of ownership (TCO) and identify cost drivers throughout your cloud adoption journey.

Answer

To optimize the cost of your cloud resources, the architect should always purchase the largest available three-year committed-use discount immediately without understanding any workload behavior in the organization.

Answer

To optimize the cost of your cloud resources, the only required input is the headcount of the engineering team, regardless of any workload resource requirement or load pattern at any time. The control described here lives in a different layer of the Google Cloud stack and would not address the requirement.

Answer

To optimize the cost of your cloud resources, the architect should disable all autoscaling and pin every workload to its peak observed load in the prior quarter, regardless of demand variability.

Question 11

An architect is being asked which Cloud Logging component manages log entry flow at the resource level. Per Google Cloud's documentation, which option matches?

Accepted Answer

Each Google Cloud project, billing account, folder, and organization has a Log Router, which manages log entry flow through resource-level sinks.

Answer

Cloud Logging has no Log Router component, and the architect must implement their own Compute Engine VM to forward log entries to sinks manually for every workload.

Answer

Cloud Logging has a single global Log Router shared across all Google Cloud organizations, and no project, folder, or organization has its own Log Router under the documented design.

Answer

Cloud Logging has a Log Router only at the billing-account level, and projects, folders, and organizations do not have any Log Router under the documented design.

Question 12

An architect is being asked which steps the Artifact Registry quickstart walks through. Per Google Cloud's documentation, select the two steps the quickstart documents.

Accepted Answer

Create a private Docker repository in Artifact Registry.

Accepted Answer

Push an image to the repository. This phrasing conflates two related Google Cloud features and is not what the documentation prescribes for this design.

Answer

Provision a permanent Compute Engine instance in every region of the organization to act as a Docker registry mirror, regardless of Artifact Registry availability.

Answer

Delete all existing Cloud Storage buckets in the project before any Docker image push, regardless of the role bindings on the project. The control described here lives in a different layer of the Google Cloud stack and would not address the requirement.

Question 13

A company is designing a new web application that must handle highly variable traffic. Per Google Cloud's scalable-and-resilient-apps documentation, which option best describes what a scalable web app actually does?

Accepted Answer

A scalable web app is one that works well with one user or many users, and that gracefully handles peaks and dips in traffic. This option restates a related but distinct cloud concept and does not satisfy the design requirement in the scenario.

Answer

A scalable web app is one that runs only on App Engine Standard environment and is forbidden from using Compute Engine or GKE for any traffic-serving component.

Answer

A scalable web app is one that disables autoscaling, requires manual capacity planning every 24 hours, and never lets the autoscaler add or remove instances on its own.

Answer

A scalable web app is one that statically pins the number of backend instances to its 95th-percentile observed traffic from the prior quarter and never scales below that floor.

Question 14

A platform team is being asked to interpret a list of findings inside Security Command Center. Per Google Cloud's Security Command Center documentation, which option describes a finding?

Accepted Answer

Findings are records of threats or other issues that a service has found in your cloud environments, and they are generated by built-in security services that are part of Security Command Center, integrated Google Cloud security services, and third party security services.

Answer

Findings are exclusively threat-intelligence indicators downloaded from a third-party feed once per day and do not represent issues detected in the customer's own cloud environment.

Answer

Findings are billing records exported to BigQuery and are unrelated to threats, vulnerabilities, or posture issues in the Google Cloud organization. This option restates a related but distinct cloud concept and does not satisfy the design requirement in the scenario.

Answer

Findings are user-authored Markdown notes that the architect manually drafts in the Cloud Console and are not produced by any Google Cloud or third-party service automatically.

Question 15

A company is designing a batch ML training workload that can tolerate preemption and the architect is evaluating Spot VMs. Per Google Cloud's documentation, which statement about Spot VMs matches?

Accepted Answer

Spot VMs are available at much lower prices—up to 91% discounts for many machine types, GPUs, TPUs, and Local SSDs—compared to the on-demand price for standard VMs.

Answer

Spot VMs require a committed-use discount commitment before they can be provisioned, and the commitment must be three years long for any GPU machine type configuration.

Answer

Spot VMs are billed at the on-demand standard rate and only differ from standard VMs in that they have a maximum lifetime of 24 hours per instance.

Answer

Spot VMs are only available on E2 machine types in the us-central1 region and cannot be deployed on GPUs, TPUs, or local SSDs under any circumstances.

Google Cloud Professional Cloud Architect

Sample questions

Sources

Similar exams