View Full Google Professional Cloud Architect Exam Dumps and Practice Test Dumps.

 

Question 101

A company wants to connect multiple VPC networks privately without exposing traffic to the public internet. Which option should it consider?

1. Cloud NAT
2. Cloud CDN
3. VPC Network Peering
4. Public DNS

Correct Answer: 3

Explanation

VPC Network Peering allows VPC networks to communicate using internal IP addresses without requiring traffic to traverse the public internet. It can be useful when workloads in separate VPC networks need private connectivity while remaining independently administered. Peering does not automatically provide transitive connectivity between multiple networks, so the overall topology must be designed carefully. Cloud NAT provides outbound internet access, Cloud CDN accelerates content delivery, and public DNS provides name resolution. Therefore, VPC Network Peering is appropriate for direct private connectivity between supported VPC networks.

Question 102

Which Google Cloud capability allows a workload running outside Google Cloud to obtain Google Cloud credentials without storing a long-lived service account key?

1. Workload Identity Federation
2. Cloud Storage lifecycle management
3. Cloud CDN
4. Cloud Armor

Correct Answer: 1

Explanation

Workload Identity Federation allows external workloads to access Google Cloud resources using federated identities rather than requiring long-lived service account keys. This can reduce credential-management risks because applications do not need to store permanent JSON key files. The external identity provider can be trusted through configured federation relationships, and access can then be controlled using Google Cloud IAM. Cloud Storage lifecycle management handles objects, Cloud CDN handles content delivery, and Cloud Armor provides application protection. Therefore, Workload Identity Federation is appropriate for securely connecting external workloads to Google Cloud resources.

Question 103

A company has a web application with users around the world. Static content is frequently requested and should be served from locations closer to users. What should the architect use?

1. Cloud SQL
2. Cloud CDN
3. Cloud Router
4. Cloud KMS

Correct Answer: 2

Explanation

Cloud CDN caches eligible content at Google’s distributed edge locations so that frequently requested content can be served closer to end users. This can reduce latency and decrease the amount of traffic reaching the application’s origin infrastructure. It is particularly useful for static assets and other cacheable content in globally distributed applications. Cloud SQL provides relational database capabilities, Cloud Router manages dynamic routing, and Cloud KMS manages cryptographic keys. Therefore, Cloud CDN is the appropriate service for improving delivery of frequently requested content to users around the world.

Question 104

An organization wants all application teams to use centrally managed networking while keeping application resources in separate projects. Which design is most appropriate?

1. Separate unrelated VPCs with no central administration
2. Shared VPC with host and service projects
3. One public subnet for every application
4. A single VM acting as a router

Correct Answer: 2

Explanation

A Shared VPC architecture allows a host project to centrally manage network resources while service projects contain application workloads. This model provides centralized control over subnets, routes, and network policies while allowing teams to maintain separate project boundaries for their applications. It is commonly useful for organizations with dedicated networking and security teams. Independent VPCs do not provide the same centralized network model, while a single VM router creates unnecessary operational complexity. Therefore, Shared VPC with host and service projects is the appropriate architecture.

Question 105

Which service is best suited for storing objects such as images, backups, and large unstructured files?

1. Cloud SQL
2. Bigtable
3. Cloud Storage
4. Firestore

Correct Answer: 3

Explanation

Cloud Storage is a managed object-storage service designed for unstructured data such as images, videos, backups, documents, and large files. Objects are stored in buckets and can use different storage classes depending on access frequency and retention requirements. Cloud SQL is designed for relational databases, Bigtable is a scalable wide-column database, and Firestore is a document-oriented database. Therefore, Cloud Storage is the most appropriate service when an application needs durable storage for large quantities of unstructured objects.

Question 106

A company needs to route traffic between an on-premises network and Google Cloud using dynamically exchanged routes. Which service provides this capability?

1. Cloud Router
2. Cloud Storage
3. Cloud Run
4. Secret Manager

Correct Answer: 1

Explanation

Cloud Router enables dynamic exchange of routes between Google Cloud VPC networks and connected external networks using Border Gateway Protocol (BGP). It can work with supported hybrid connectivity solutions such as Cloud VPN and Cloud Interconnect. Dynamic routing allows network paths to adapt as routes change rather than requiring administrators to maintain all routes manually. Cloud Storage provides object storage, Cloud Run executes containers, and Secret Manager manages sensitive values. Therefore, Cloud Router is the appropriate service when dynamically exchanged network routes are required.

Question 107

A development team needs Kubernetes but wants Google Cloud to manage the cluster infrastructure and reduce node-management responsibilities. Which GKE mode should it consider?

1. GKE Standard
2. Compute Engine unmanaged instance group
3. GKE Autopilot
4. Bare Metal Solution

Correct Answer: 3

Explanation

GKE Autopilot provides a more managed Kubernetes experience in which Google Cloud handles much of the underlying infrastructure and node management. This allows teams to focus more on Kubernetes workloads while reducing operational responsibilities associated with managing worker nodes. GKE Standard provides greater control over cluster infrastructure but requires more management. Compute Engine unmanaged instance groups and Bare Metal Solution do not provide the same managed Kubernetes experience. Therefore, GKE Autopilot should be considered when reducing node-management responsibilities is a major requirement.

Question 108

A company wants to prevent a compromised workload from accessing sensitive services outside an approved security perimeter. Which technology can help enforce this boundary?

1. Cloud Scheduler
2. VPC Service Controls
3. Cloud Trace
4. Cloud DNS

Correct Answer: 2

Explanation

VPC Service Controls can establish security perimeters around supported Google Cloud services and help restrict access to protected resources. They are designed to reduce risks such as data exfiltration by adding controls around service-to-service access that complement IAM. This can be valuable when sensitive datasets need stronger boundaries than identity-based permissions alone provide. Cloud Scheduler handles scheduled jobs, Cloud Trace provides distributed tracing, and Cloud DNS manages name resolution. Therefore, VPC Service Controls can help enforce a security boundary around sensitive cloud resources.

Question 109

An application needs a managed relational database compatible with PostgreSQL but requires higher performance and advanced database capabilities for demanding workloads. Which service should be evaluated?

1. Firestore
2. Bigtable
3. AlloyDB for PostgreSQL
4. Cloud Storage

Correct Answer: 3

Explanation

AlloyDB for PostgreSQL is a managed relational database service designed for demanding PostgreSQL-compatible workloads. It provides capabilities intended for high-performance transactional and analytical applications while maintaining compatibility with the PostgreSQL ecosystem. Firestore is a document database, Bigtable is a wide-column NoSQL database, and Cloud Storage is object storage. The appropriate database choice depends on workload requirements, compatibility, performance, and operational needs. Therefore, AlloyDB for PostgreSQL should be evaluated when an application requires a high-performance managed PostgreSQL-compatible relational database.

Question 110

Which approach helps ensure that a cloud application remains available when an entire zone becomes unavailable?

1. Deploy all instances in one zone
2. Use zonal local storage as the only copy
3. Distribute workloads across multiple zones
4. Disable health checks

Correct Answer: 3

Explanation

Distributing application workloads across multiple zones reduces dependence on any single zone. If one zone experiences an outage, healthy instances in other zones can continue serving traffic when the architecture includes appropriate load balancing, health checks, and application redundancy. Keeping all instances in one zone leaves the application exposed to a zonal failure. Local storage alone also does not provide cross-zone resilience, while disabling health checks can make traffic management less reliable. Therefore, distributing workloads across multiple zones is an important high-availability strategy.

Question 111

A company wants to deploy a new application while gradually shifting production traffic from an existing version to the new version. Which strategy fits this requirement?

1. Canary deployment
2. Full replacement without testing
3. Manual VM shutdown
4. Single-zone deployment

Correct Answer: 1

Explanation

A canary deployment introduces a new application version to a limited percentage of production traffic before expanding the rollout. This allows the team to monitor application behavior, latency, errors, and other indicators while limiting the potential impact of a defective release. Once the new version demonstrates acceptable behavior, traffic can be progressively increased. A full replacement immediately affects all users, while VM shutdown and single-zone deployment do not provide gradual traffic migration. Therefore, a canary deployment fits the stated requirement.

Question 112

Which Google Cloud service provides managed distributed tracing for requests moving through applications and services?

1. Cloud Monitoring
2. Cloud Trace
3. Cloud Storage
4. Cloud DNS

Correct Answer: 2

Explanation

Cloud Trace provides distributed tracing capabilities that help developers and operators understand request latency across application components and services. Trace information can reveal where time is being spent during a request and can help identify performance bottlenecks in distributed applications. Cloud Monitoring focuses more broadly on metrics, dashboards, and alerting, while Cloud Storage provides object storage and Cloud DNS manages DNS. Therefore, Cloud Trace is the appropriate service when the primary requirement is understanding request paths and latency across distributed application components.

Question 113

A company wants to automatically remove temporary Cloud Storage objects after a specified period. Which capability should it configure?

1. IAM Conditions
2. Cloud Storage Object Lifecycle Management
3. Cloud Router
4. Cloud Armor

Correct Answer: 2

Explanation

Cloud Storage Object Lifecycle Management allows organizations to define rules that automatically perform actions on objects when specified conditions are met. For example, temporary objects can be deleted after a defined age, while older objects can potentially be transitioned to different storage classes. This reduces manual storage administration and can help control storage costs. IAM Conditions manage access conditions, Cloud Router handles dynamic routing, and Cloud Armor provides security controls. Therefore, Object Lifecycle Management is the appropriate capability for automatically deleting temporary objects after a defined period.

Question 114

A company wants to enforce that production resources cannot be deleted accidentally by users who have otherwise broad permissions. Which approach can provide additional centralized governance?

1. Organization Policy and appropriate resource-protection controls
2. Cloud CDN
3. Cloud Trace
4. Public DNS

Correct Answer: 1

Explanation

Centralized governance mechanisms can add preventive or restrictive controls beyond ordinary operational procedures. Organization Policy can enforce supported organizational constraints, while resource-specific protection mechanisms and carefully scoped IAM permissions can further reduce the risk of accidental destructive actions. The exact control depends on the resource and deletion scenario, so architects should combine governance with least-privilege access and appropriate operational safeguards. Cloud CDN, Cloud Trace, and public DNS do not provide resource-deletion governance. Therefore, centralized policy and resource-protection controls should be considered.

Question 115

Which database is most appropriate when an application requires a flexible document model and automatic scaling for globally distributed users?

1. Cloud SQL
2. Firestore
3. Bigtable
4. Cloud Storage

Correct Answer: 2

Explanation

Firestore is a managed NoSQL document database designed for applications that need flexible document-oriented data models and scalable application development. It can support applications with distributed users and provides features such as automatic scaling and integration with Google Cloud and application platforms. Cloud SQL is a relational database, Bigtable uses a wide-column model suited to large-scale key-value workloads, and Cloud Storage is object storage. Therefore, Firestore is a suitable choice when the application needs a flexible document database with managed scaling capabilities.

Question 116

A company needs to process streaming events in near real time and transform them before storing analytical results. Which service is designed for large-scale stream processing pipelines?

1. Dataflow
2. Cloud DNS
3. Cloud KMS
4. Filestore

Correct Answer: 1

Explanation

Dataflow is a managed data-processing service designed for both batch and streaming workloads. It can process continuous event streams, transform incoming data, aggregate information, and write results to supported destinations. It is commonly used with services such as Pub/Sub for building scalable streaming pipelines. Cloud DNS handles name resolution, Cloud KMS manages encryption keys, and Filestore provides managed file storage. Therefore, Dataflow is appropriate when an organization needs managed, scalable stream processing with near-real-time data transformation.

Question 117

An organization wants to reduce the number of long-lived credentials used by applications and centralize access to secrets. What should it use?

1. Public IP addresses
2. Secret Manager
3. Cloud CDN
4. Cloud Storage Transfer Service

Correct Answer: 2

Explanation

Secret Manager provides centralized storage and controlled access for sensitive information such as passwords, API credentials, and tokens. Applications can retrieve secrets at runtime instead of embedding sensitive values directly in source code or configuration files. Secret versions also support controlled updates and rotation workflows. Public IP addresses and Cloud CDN do not provide secret management, while Storage Transfer Service is designed for moving data. Therefore, Secret Manager is appropriate when an organization wants centralized secret storage and reduced reliance on credentials embedded within applications.

Question 118

A workload requires a shared POSIX-compatible file system that can be mounted by multiple Compute Engine instances. Which service should the architect consider?

1. Cloud Storage
2. Filestore
3. Pub/Sub
4. BigQuery

Correct Answer: 2

Explanation

Filestore provides managed file storage that can be mounted by multiple compute workloads using standard file-system protocols. It is suitable for applications that require shared file-system semantics, such as applications using POSIX-compatible file access or workloads that need a common file system across multiple VM instances. Cloud Storage uses object storage semantics, Pub/Sub provides asynchronous messaging, and BigQuery is an analytical data warehouse. Therefore, Filestore should be considered when multiple Compute Engine instances require shared file-system access.

Question 119

A company wants to identify unused or oversized compute resources and receive recommendations for reducing cloud costs. Which capability should it use?

1. Cloud Profiler
2. Active Assist recommendations
3. Cloud DNS
4. Cloud Trace

Correct Answer: 2

Explanation

Active Assist provides recommendations and insights that can help organizations improve Google Cloud environments, including recommendations related to resource utilization and cost optimization. Such recommendations can help identify opportunities to rightsize resources, remove unnecessary infrastructure, or improve configuration. Cloud Profiler focuses on application performance profiling, Cloud DNS manages DNS, and Cloud Trace analyzes distributed request latency. Therefore, Active Assist recommendations are appropriate when an organization wants guidance for identifying resource optimization and cost-saving opportunities.

Question 120

A company must restore a critical application within 30 minutes after a major outage. What does this requirement define?

1. RPO
2. SLI
3. RTO
4. SLA

Correct Answer: 3

Explanation

Recovery Time Objective (RTO) defines the maximum acceptable time required to restore a service after a disruption. A requirement to restore a critical application within 30 minutes therefore represents an RTO of 30 minutes. Recovery Point Objective (RPO) instead defines the maximum acceptable amount of data loss measured in time. An SLI is a metric used to measure service behavior, while an SLA is a contractual or formal service-level commitment. Therefore, the 30-minute restoration requirement specifically defines the application’s RTO.