View Full Google Professional Cloud Architect Exam Dumps and Practice Test Dumps.

 

Question 161

A company wants application teams to deploy workloads into centrally managed subnets while keeping each team’s resources in separate projects. Which architecture should it use?

1. Cloud CDN
2. Shared VPC
3. Cloud NAT
4. VPC Network Peering

Correct Answer: 2

Explanation

Shared VPC allows a host project to centrally manage VPC networks and subnets while workloads are deployed from attached service projects. This architecture separates networking administration from application ownership and can provide consistent governance across multiple teams. Application teams can maintain their own projects while using centrally controlled network resources. Cloud CDN manages content delivery, Cloud NAT provides outbound internet connectivity, and VPC Network Peering connects separate VPC networks. Therefore, Shared VPC is the appropriate architecture for centralized networking across multiple projects.

Question 162

Which Google Cloud service is designed to migrate databases into Google Cloud with minimal application downtime?

1. Cloud CDN
2. Database Migration Service
3. Cloud Scheduler
4. Cloud Trace

Correct Answer: 2

Explanation

Database Migration Service helps organizations migrate supported databases to Google Cloud while reducing migration complexity and downtime. It can support continuous data replication during migration, allowing the destination database to remain synchronized before the final cutover. This approach can make migration less disruptive for production workloads compared with taking the source database offline for a long period. Cloud CDN, Cloud Scheduler, and Cloud Trace address content delivery, scheduling, and observability respectively. Therefore, Database Migration Service is appropriate for managed database migration with reduced downtime.

Question 163

A company needs a private connection from a VPC to a supported Google service without sending traffic through the public internet. Which technology should it evaluate?

1. Private Service Connect
2. Cloud CDN
3. Cloud Storage lifecycle management
4. Cloud Scheduler

Correct Answer: 1

Explanation

Private Service Connect provides private connectivity to supported services using internal IP addresses within a VPC environment. It can help organizations consume services without requiring applications to expose traffic through public internet paths. This architecture can improve network isolation and simplify private service access in environments with strong security requirements. Cloud CDN focuses on content delivery, lifecycle management controls object-storage behavior, and Cloud Scheduler runs scheduled jobs. Therefore, Private Service Connect should be evaluated when an organization needs private connectivity to supported services.

Question 164

A company wants to use infrastructure configurations that can be reviewed, versioned, and reproduced consistently across environments. Which practice should it adopt?

1. Manual console configuration
2. Infrastructure as Code
3. Shared administrator accounts
4. Ad hoc configuration changes

Correct Answer: 2

Explanation

Infrastructure as Code represents infrastructure configuration in machine-readable files that can be stored in version-control systems and reviewed before deployment. This improves consistency between environments and makes infrastructure changes repeatable and auditable. Teams can use the same configuration patterns for development, testing, and production while controlling changes through standard development workflows. Manual console changes and ad hoc configuration are harder to reproduce and track, while shared administrator accounts reduce accountability. Therefore, Infrastructure as Code is the appropriate practice for consistent, versioned infrastructure management.

Question 165

A company wants to reduce application latency by placing users close to regional application backends while maintaining a unified public endpoint. Which architecture should be considered?

1. Global load balancing with regional backends
2. One VM in a single region
3. A single public IP on each client
4. Manual DNS changes during every traffic spike

Correct Answer: 1

Explanation

Global load balancing with regional backends can provide a unified public entry point while distributing user traffic across appropriate healthy application backends. This architecture can improve user experience by directing traffic according to the load-balancing configuration, backend health, and supported routing behavior. A single VM creates a single point of failure and may introduce unnecessary latency for distant users. Manual DNS changes are slow and operationally difficult during traffic changes. Therefore, global load balancing with regional backends is an appropriate architecture for globally distributed applications.

Question 166

Which service provides a managed environment for running Apache Spark jobs without requiring teams to maintain traditional cluster infrastructure?

1. Dataproc Serverless
2. Cloud DNS
3. Cloud Armor
4. Memorystore

Correct Answer: 1

Explanation

Dataproc Serverless allows teams to submit supported Spark and batch workloads without managing persistent Dataproc clusters. The service handles the underlying infrastructure needed to execute jobs, which can reduce operational overhead for intermittent or variable data-processing workloads. Traditional cluster-based approaches require more infrastructure administration and capacity planning. Cloud DNS manages DNS, Cloud Armor provides application security controls, and Memorystore offers in-memory caching. Therefore, Dataproc Serverless is appropriate when teams need Spark processing without maintaining long-lived cluster infrastructure.

Question 167

A security team wants applications to access Google Cloud APIs privately from resources that do not have external IP addresses. Which feature should be considered?

1. Cloud NAT
2. Private Google Access
3. Cloud CDN
4. External Application Load Balancer

Correct Answer: 2

Explanation

Private Google Access allows eligible resources that do not have external IP addresses to access supported Google APIs and services through private connectivity. This can reduce public exposure while allowing private workloads to interact with services such as Cloud Storage and other supported APIs. Cloud NAT provides outbound internet connectivity but is not the same mechanism as private access to Google APIs. Cloud CDN and external load balancing serve different application-delivery purposes. Therefore, Private Google Access is the appropriate feature for private access to supported Google APIs.

Question 168

A company has a stateful application running on a managed instance group and needs instance-specific persistent disks to remain associated with replacement instances. Which capability should be investigated?

1. Stateful managed instance group configuration
2. Cloud CDN
3. Pub/Sub
4. Cloud DNS

Correct Answer: 1

Explanation

Stateful managed instance groups can preserve stateful configuration such as persistent disks, metadata, or specific instance identities when instances are recreated. This capability is useful for workloads that cannot be treated as completely stateless and require certain resources to remain associated with individual instances. A standard stateless managed instance group is generally designed for interchangeable instances. Cloud CDN provides caching, Pub/Sub provides messaging, and Cloud DNS provides name resolution. Therefore, stateful managed instance group configuration should be investigated for stateful VM workloads.

Question 169

Which service is designed to stream database changes into Google Cloud data-processing or analytics systems?

1. Datastream
2. Cloud CDN
3. Cloud Scheduler
4. Filestore

Correct Answer: 1

Explanation

Datastream is a serverless change-data-capture and replication service that can continuously stream changes from supported database sources. It can help organizations move operational database changes into destinations used for analytics, processing, or migration workflows. This approach can reduce the need for periodic full exports when near-real-time replication is required. Cloud CDN handles content delivery, Cloud Scheduler manages scheduled jobs, and Filestore provides shared file storage. Therefore, Datastream is appropriate when continuously capturing database changes is a core requirement.

Question 170

A company wants to store data that is rarely accessed but must be retained for long periods at lower storage cost. Which Cloud Storage class should it consider?

1. Standard
2. Nearline
3. Coldline
4. Archive

Correct Answer: 4

Explanation

Archive storage is designed for data that is expected to be accessed very rarely and retained for long periods. It can provide lower storage costs than frequently accessed storage classes, although access and retrieval characteristics must be considered when selecting the appropriate class. Standard is intended for frequent access, while Nearline and Coldline are generally suitable for progressively less frequent access patterns. The final choice should also consider minimum storage duration and retrieval requirements. Therefore, Archive should be considered for long-term data that is rarely accessed.

Question 171

A company wants to reduce database load by caching frequently requested application data in memory. Which architecture should it implement?

1. Memorystore caching layer
2. Cloud DNS forwarding
3. Cloud Storage lifecycle policy
4. Cloud Router

Correct Answer: 1

Explanation

A Memorystore caching layer can store frequently requested data in memory, allowing applications to retrieve that information without repeatedly querying the primary database. This can reduce database workload and improve response latency for suitable access patterns. Cached information should be treated as derived or temporary data unless the architecture specifically provides persistence guarantees. Cloud DNS handles name resolution, Cloud Storage lifecycle policies manage object retention, and Cloud Router manages dynamic network routing. Therefore, a Memorystore caching layer is appropriate for reducing repeated database reads.

Question 172

An organization wants to ensure that users can access only the resources necessary for their assigned job functions. Which IAM principle should guide the design?

1. Broad administrative access
2. Least privilege
3. Shared credentials
4. Anonymous access

Correct Answer: 2

Explanation

Least privilege means granting identities only the permissions required to perform their assigned responsibilities. This limits the potential impact of compromised credentials, accidental changes, and unauthorized activity. IAM roles should be selected carefully and scoped to appropriate resources rather than granting broad organization-wide permissions when they are unnecessary. Shared credentials reduce accountability and make access management difficult, while anonymous access removes meaningful identity controls. Therefore, least privilege should guide IAM design when organizations want users to access only the resources necessary for their job functions.

Question 173

A company wants to run a containerized application with automatic scaling but requires direct control over Kubernetes node pools and machine configurations. Which option should it select?

1. Cloud Run
2. GKE Autopilot
3. GKE Standard
4. Cloud Functions

Correct Answer: 3

Explanation

GKE Standard provides detailed control over Kubernetes infrastructure, including node pools, machine types, and other cluster-level configurations. This makes it suitable for organizations whose workloads require specific infrastructure configurations or operational control. GKE Autopilot provides more managed infrastructure with reduced node-management responsibilities, while Cloud Run and Cloud Functions are managed application platforms outside the traditional Kubernetes node-management model. Therefore, GKE Standard is the appropriate choice when Kubernetes is required and the organization needs direct control over node infrastructure.

Question 174

A company needs to process a continuous stream of events and calculate real-time aggregates before storing the results in BigQuery. Which architecture is appropriate?

1. Cloud Storage → Cloud CDN → BigQuery
2. Pub/Sub → Dataflow → BigQuery
3. Cloud DNS → Cloud Router → BigQuery
4. Filestore → Cloud NAT → BigQuery

Correct Answer: 2

Explanation

Pub/Sub can ingest a continuous stream of events, Dataflow can process and transform those events in real time, and BigQuery can store the resulting analytical data for querying. This architecture separates event ingestion, stream processing, and analytics while allowing each service to scale according to its workload. The other combinations do not provide an appropriate streaming analytics pipeline. Cloud Storage is object storage, Cloud DNS provides name resolution, and Filestore provides shared file storage. Therefore, Pub/Sub → Dataflow → BigQuery is an appropriate architecture for real-time event analytics.

Question 175

A company needs to encrypt data using keys that can be revoked or disabled independently of the application storing the data. Which capability supports this requirement?

1. Cloud KMS
2. Cloud CDN
3. Cloud Scheduler
4. Cloud DNS

Correct Answer: 1

Explanation

Cloud KMS allows organizations to manage cryptographic keys separately from the applications and data services that use them. Administrators can control key permissions and perform lifecycle operations such as rotation or disabling keys according to organizational requirements. This separation can provide additional governance over encryption. Cloud CDN handles content delivery, Cloud Scheduler handles scheduled jobs, and Cloud DNS provides DNS services. Therefore, Cloud KMS supports the requirement for centrally managed encryption keys that can be controlled independently of the application.

Question 176

A company wants to detect unusual security findings across its Google Cloud environment and centralize security posture information. Which service should it evaluate?

1. Cloud Build
2. Security Command Center
3. Cloud Scheduler
4. Cloud Composer

Correct Answer: 2

Explanation

Security Command Center provides centralized security and risk-management capabilities across Google Cloud environments. It can aggregate security findings and provide visibility into security posture, vulnerabilities, misconfigurations, and other supported security signals. This helps security teams identify issues across projects and prioritize investigation. Cloud Build supports software builds, Cloud Scheduler manages scheduled tasks, and Cloud Composer orchestrates workflows. Therefore, Security Command Center should be evaluated when an organization needs centralized visibility into security findings and cloud security posture.

Question 177

A company wants to keep an application’s database credentials out of source code and rotate them periodically. Which design is most appropriate?

1. Store credentials in source files
2. Put credentials in public configuration
3. Use Secret Manager with controlled rotation
4. Embed credentials in container images

Correct Answer: 3

Explanation

Secret Manager provides a centralized and access-controlled location for sensitive credentials and supports secret versioning that can be incorporated into rotation workflows. Keeping credentials outside application source code and container images reduces the risk of accidentally exposing them through repositories, artifacts, or deployment packages. Access can also be controlled through IAM so that only authorized workloads can retrieve the required secret. Public configuration and embedded credentials create unnecessary exposure. Therefore, Secret Manager with an appropriate rotation process is the recommended design.

Question 178

A company wants to use a private connection to Google Cloud that provides high bandwidth and avoids relying on an encrypted tunnel over the public internet. Which solution should it evaluate?

1. Cloud VPN
2. Cloud Interconnect
3. Cloud NAT
4. Cloud CDN

Correct Answer: 2

Explanation

Cloud Interconnect provides private connectivity between an organization’s network and Google Cloud and is designed for scenarios requiring high bandwidth or predictable network performance. Unlike VPN connectivity over the public internet, Interconnect uses dedicated or partner connectivity paths. This can be important for large hybrid workloads, data transfer, and applications with demanding network requirements. Cloud VPN provides encrypted tunnels over the public internet, Cloud NAT handles outbound translation, and Cloud CDN provides content delivery. Therefore, Cloud Interconnect should be evaluated for high-bandwidth private connectivity.

Question 179

A production application has a defined target of 99.9% successful requests. What type of reliability target is this?

1. SLO
2. SLI
3. RPO
4. RTO

Correct Answer: 1

Explanation

A Service Level Objective (SLO) defines a target level of service performance or reliability. A target such as 99.9% successful requests represents an SLO when it is established as the desired reliability objective for the application. The SLI would be the actual measured percentage of successful requests used to evaluate performance against that target. RPO concerns acceptable data loss, while RTO concerns recovery time after an outage. Therefore, the stated 99.9% reliability target is an SLO.

Question 180

A company wants to separate infrastructure administration from application development by allowing a central team to manage networks while application teams manage workloads. Which design is most appropriate?

1. Give application developers organization-wide Owner access
2. Use Shared VPC with centralized network administration
3. Put all workloads in one project
4. Give every team its own unmanaged physical network

Correct Answer: 2

Explanation

Shared VPC supports separation of responsibilities by allowing a central networking team to manage network resources in a host project while application teams deploy workloads in service projects. This model can provide centralized network governance without requiring developers to receive broad organization-level permissions. It also supports project-level separation for application teams and can simplify consistent network administration. Giving developers Owner access is overly broad, while putting everything in one project reduces isolation. Therefore, Shared VPC with centralized network administration is appropriate for this organizational model.