View Full Google Professional Cloud Architect Exam Dumps and Practice Test Dumps.

 

Question 141

A company needs to expose an application running on GKE to users on the internet and distribute traffic across healthy application instances. Which component should be considered?

1. Cloud Storage
2. External Application Load Balancer
3. Cloud Scheduler
4. Cloud KMS

Correct Answer: 2

Explanation

An external Application Load Balancer can provide an internet-facing entry point for applications and distribute incoming HTTP or HTTPS traffic across appropriate backends. When used with GKE, it can integrate with Kubernetes services and workloads to provide scalable traffic distribution and health-aware routing. Cloud Storage provides object storage, Cloud Scheduler manages scheduled tasks, and Cloud KMS manages cryptographic keys. Therefore, an external Application Load Balancer should be considered when a GKE-hosted application needs a public entry point and traffic distribution across healthy backends.

Question 142

Which Google Cloud service is designed to provide managed orchestration for data-processing workflows?

1. Cloud Composer
2. Cloud CDN
3. Cloud Armor
4. Cloud NAT

Correct Answer: 1

Explanation

Cloud Composer provides managed workflow orchestration based on Apache Airflow. It can coordinate complex sequences of data-processing tasks, define dependencies, schedule executions, and monitor workflow progress. This makes it useful when an organization needs to orchestrate pipelines involving services such as BigQuery, Dataflow, Cloud Storage, or other processing systems. Cloud CDN accelerates content delivery, Cloud Armor provides application protection, and Cloud NAT provides outbound connectivity for private resources. Therefore, Cloud Composer is the appropriate service for managed data-workflow orchestration.

Question 143

A company wants to store sensitive configuration values separately from application source code and retrieve them securely at runtime. Which service should it use?

1. Cloud DNS
2. Cloud Scheduler
3. Secret Manager
4. Cloud CDN

Correct Answer: 3

Explanation

Secret Manager provides centralized storage and controlled access for sensitive information such as API keys, passwords, tokens, and other application secrets. Applications can retrieve secrets at runtime rather than embedding them directly in source code or configuration files. Secret versions also support controlled updates and rotation workflows. Cloud DNS manages name resolution, Cloud Scheduler runs scheduled tasks, and Cloud CDN provides content delivery. Therefore, Secret Manager is the appropriate service for securely separating sensitive configuration from application source code.

Question 144

A company is migrating a legacy application to Google Cloud and wants to make only the infrastructure change necessary to move it, without redesigning the application. Which migration strategy is being used?

1. Refactor
2. Rehost
3. Retire
4. Rebuild

Correct Answer: 2

Explanation

Rehosting involves moving an existing application to a new infrastructure environment with minimal modification to the application itself. This approach is commonly called lift and shift and can reduce the initial migration effort when the primary goal is to move workloads quickly. Refactoring involves changing application architecture to take advantage of cloud-native capabilities, while rebuilding generally involves creating a substantially new implementation. Retiring means removing an application that is no longer required. Therefore, rehost is the migration strategy described in this scenario.

Question 145

A production database must remain available even if the VM hosting one database component fails. Which design principle is most important?

1. Eliminate all backups
2. Introduce redundancy
3. Use only local storage
4. Deploy everything on one VM

Correct Answer: 2

Explanation

Redundancy is a fundamental reliability principle for critical workloads. By maintaining additional instances or standby components, an application can continue operating when an individual component fails. Depending on the database technology, redundancy may involve synchronous replication, standby instances, regional configurations, or managed high-availability features. Relying on one VM creates a single point of failure, while local storage alone does not provide sufficient redundancy. Backups remain important for recovery but do not necessarily provide immediate failover. Therefore, introducing appropriate redundancy is essential for improving production database availability.

Question 146

Which Google Cloud service is intended for asynchronous communication between producers and consumers?

1. Cloud SQL
2. Cloud Run
3. Pub/Sub
4. Cloud DNS

Correct Answer: 3

Explanation

Pub/Sub is a managed messaging service designed to decouple producers from consumers through asynchronous communication. A publisher sends messages to a topic, while one or more subscribers receive and process those messages independently. This architecture allows components to operate at different speeds and reduces direct dependencies between services. Cloud SQL provides relational databases, Cloud Run executes containerized applications, and Cloud DNS manages name resolution. Therefore, Pub/Sub is the appropriate service when applications need scalable asynchronous messaging and loose coupling.

Question 147

An organization wants to give a development team access to resources in a project but prevent access to unrelated production projects. Which IAM design is most appropriate?

1. Grant access at the entire organization level
2. Use project-level IAM permissions
3. Give every developer Owner access
4. Share one administrator account

Correct Answer: 2

Explanation

Project-level IAM permissions allow an organization to scope access to the resources required by a particular team without automatically granting access to unrelated projects. This supports the principle of least privilege and improves administrative separation between development and production environments. Granting organization-wide permissions may provide excessive access, while Owner access is broader than most application-development tasks require. Shared administrator accounts also reduce accountability. Therefore, project-level IAM permissions are appropriate when a development team needs access to one project while remaining isolated from unrelated production environments.

Question 148

A company wants to run a Kubernetes workload while retaining detailed control over node pools, machine types, and cluster infrastructure. Which GKE mode is more appropriate?

1. GKE Standard
2. Cloud Run
3. Cloud Functions
4. App Engine

Correct Answer: 1

Explanation

GKE Standard provides greater control over cluster infrastructure, including node pools, machine configurations, and other Kubernetes infrastructure settings. This flexibility is useful when application requirements or operational policies require detailed control over how Kubernetes resources are deployed. GKE Autopilot provides a more managed experience with less node-level responsibility. Cloud Run, Cloud Functions, and App Engine are managed application platforms but do not provide the same Kubernetes infrastructure control. Therefore, GKE Standard is more appropriate when detailed control over cluster infrastructure is required.

Question 149

A data engineering team needs to run Apache Spark and Hadoop workloads without managing a long-lived cluster. Which option should it evaluate?

1. Cloud DNS
2. Dataproc Serverless
3. Cloud Armor
4. Memorystore

Correct Answer: 2

Explanation

Dataproc Serverless allows organizations to run supported Spark and batch processing workloads without maintaining a persistent Dataproc cluster. Google Cloud manages the underlying infrastructure, allowing data teams to focus on submitting jobs and processing data. This can reduce operational overhead and avoid maintaining clusters when processing requirements are intermittent. Cloud DNS manages DNS, Cloud Armor protects applications, and Memorystore provides caching. Therefore, Dataproc Serverless should be evaluated when Spark or related data-processing workloads are needed without long-lived cluster management.

Question 150

Which approach is most appropriate for an application that must continue serving users even when one entire region becomes unavailable?

1. Deploy all resources in a single region
2. Use only zonal local storage
3. Deploy application capacity across multiple regions
4. Disable automated health checks

Correct Answer: 3

Explanation

Regional redundancy requires distributing application capacity across more than one region so that a failure affecting an entire region does not eliminate all application instances. A global load-balancing architecture can direct traffic toward healthy regional backends when properly configured. Keeping all resources in one region does not protect against a regional outage. Local SSD provides temporary local storage and does not create regional redundancy, while disabling health checks reduces the ability to detect failed backends. Therefore, deploying application capacity across multiple regions is appropriate for regional disaster resilience.

Question 151

A company wants to prevent unauthorized changes to sensitive resources while still allowing teams to manage the resources they own. Which principle should guide IAM design?

1. Least privilege
2. Maximum privilege
3. Shared credentials
4. Anonymous access

Correct Answer: 1

Explanation

The principle of least privilege means granting users and workloads only the permissions required to perform their responsibilities. Applying this principle reduces the potential impact of compromised accounts and accidental administrative actions. Organizations can implement it through appropriate predefined or custom IAM roles, carefully scoped resource permissions, and separate administrative responsibilities. Shared credentials and anonymous access reduce accountability and can expose resources unnecessarily, while maximum privilege directly conflicts with secure access design. Therefore, least privilege should guide IAM design when sensitive resources need stronger access control.

Question 152

A company needs to query a large analytical dataset using SQL and does not want to manage database servers. Which service should it use?

1. BigQuery
2. Filestore
3. Cloud DNS
4. Local SSD

Correct Answer: 1

Explanation

BigQuery is a fully managed, serverless analytical data warehouse designed for large-scale SQL queries and data analysis. It removes the need for organizations to provision and maintain traditional database servers for analytical workloads. BigQuery can process large datasets and integrate with various Google Cloud data sources. Filestore provides shared file storage, Cloud DNS manages name resolution, and Local SSD provides temporary high-performance block storage. Therefore, BigQuery is the appropriate service when teams need serverless SQL analytics over large datasets.

Question 153

An application receives unpredictable traffic spikes and should automatically add compute capacity when demand increases. Which capability should be used?

1. Static resource allocation
2. Managed instance group autoscaling
3. Manual VM creation
4. Fixed-size database storage

Correct Answer: 2

Explanation

Managed instance group autoscaling automatically adjusts the number of VM instances in a managed instance group according to configured signals such as CPU utilization or other supported metrics. This allows applications to respond to changing demand without requiring administrators to manually create or remove instances. Static resource allocation and manual VM creation cannot respond as efficiently to unpredictable traffic changes. Database storage sizing addresses a different resource requirement. Therefore, managed instance group autoscaling is appropriate when VM-based application capacity must automatically increase and decrease with demand.

Question 154

A company needs to encrypt sensitive data using keys that it controls and manages through Google Cloud. Which service should be used to manage those cryptographic keys?

1. Cloud Monitoring
2. Cloud KMS
3. Cloud Scheduler
4. Cloud DNS

Correct Answer: 2

Explanation

Cloud Key Management Service (Cloud KMS) allows organizations to create, manage, rotate, and control access to cryptographic keys used for encryption and other security operations. It can support customer-managed encryption key architectures when organizations need greater control over key management than Google-managed encryption alone provides. Cloud Monitoring handles observability, Cloud Scheduler manages scheduled tasks, and Cloud DNS handles DNS services. Therefore, Cloud KMS is the appropriate service for centralized management of customer-controlled cryptographic keys.

Question 155

A company wants to identify which users or service accounts performed administrative actions on Google Cloud resources. Which capability should it examine?

1. Cloud Audit Logs
2. Cloud CDN
3. Cloud Storage lifecycle rules
4. Cloud Run jobs

Correct Answer: 1

Explanation

Cloud Audit Logs provides records of activities performed on Google Cloud resources, including administrative actions and applicable access events depending on the audit-log category. These records can help security and operations teams determine which identity performed an action and when it occurred. Audit logs are useful for investigations, compliance monitoring, and operational accountability. Cloud CDN provides content delivery, Cloud Storage lifecycle rules manage objects, and Cloud Run jobs execute containerized tasks. Therefore, Cloud Audit Logs should be examined when tracking administrative activity.

Question 156

A company wants to deploy a small event-driven function without managing servers or container infrastructure. Which service is appropriate?

1. Compute Engine
2. Cloud Functions
3. Filestore
4. Bigtable

Correct Answer: 2

Explanation

Cloud Functions provides a managed execution environment for event-driven functions without requiring the team to manage servers or container infrastructure directly. Functions can respond to supported triggers and execute application logic when events occur. This makes the service useful for lightweight event-driven processing, automation, and integration tasks. Compute Engine requires VM management, Filestore provides shared file storage, and Bigtable is a database service. Therefore, Cloud Functions is appropriate when a small event-driven workload needs serverless execution with minimal infrastructure management.

Question 157

A company needs a highly available private connection between its on-premises network and Google Cloud over the public internet. Which solution should it consider?

1. Standard public DNS
2. HA VPN
3. Cloud CDN
4. Cloud Storage

Correct Answer: 2

Explanation

HA VPN provides highly available IPsec VPN connectivity between networks using Google Cloud’s VPN infrastructure. It is designed for scenarios where encrypted connectivity over the public internet is required while improving availability compared with a single basic VPN tunnel. Depending on the architecture, HA VPN can be combined with Cloud Router and BGP for dynamic route exchange. Public DNS handles name resolution, Cloud CDN accelerates content delivery, and Cloud Storage provides object storage. Therefore, HA VPN should be considered for highly available encrypted hybrid connectivity over the internet.

Question 158

A company wants to reduce application latency by keeping frequently accessed data in memory rather than repeatedly querying a database. Which service should it evaluate?

1. Cloud Storage
2. Memorystore
3. Cloud Router
4. BigQuery

Correct Answer: 2

Explanation

Memorystore provides managed in-memory data stores that can be used for caching frequently accessed application data. Keeping suitable data in memory can reduce the number of repeated database queries and improve application response times. This is particularly useful for workloads with frequently requested, relatively short-lived data. Cloud Storage is object storage, Cloud Router manages dynamic network routing, and BigQuery is designed for analytical workloads. Therefore, Memorystore should be evaluated when an application needs a managed in-memory caching layer to reduce latency and database load.

Question 159

A company has a workload with strict recovery requirements and wants to define how much data it can afford to lose after a disaster. Which metric should it establish?

1. RPO
2. RTO
3. SLI
4. SLA

Correct Answer: 1

Explanation

Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss measured in time. For example, an RPO of 15 minutes means the organization aims to recover data to a point no more than approximately 15 minutes before the disruption. RTO instead defines how quickly the service should be restored. SLI is a service-performance measurement, while SLA represents a formal service commitment. Therefore, RPO is the appropriate metric when an organization needs to determine how much data it can afford to lose during disaster recovery.

Question 160

A team wants to monitor CPU utilization and receive an alert when a production VM exceeds a defined threshold. Which Google Cloud service should it use?

1. Cloud Storage
2. Cloud Monitoring
3. Cloud DNS
4. Cloud Build

Correct Answer: 2

Explanation

Cloud Monitoring collects metrics from Google Cloud resources and applications and provides dashboards, alerting policies, and other observability capabilities. A team can create an alerting policy that evaluates VM CPU utilization against a defined threshold and notifies the appropriate recipients when the condition is met. Cloud Storage provides object storage, Cloud DNS manages DNS, and Cloud Build supports software build automation. Therefore, Cloud Monitoring is the appropriate service for tracking CPU utilization and generating alerts when a production VM exceeds a specified threshold.