View Full Google Professional Cloud Architect Exam Dumps and Practice Test Dumps.

 

Question 201

A company wants to give an application access to Google Cloud resources without embedding service account keys in the application. Which approach is preferred?

1. Workload identity-based access
2. Hard-coded JSON keys
3. Shared administrator credentials
4. Anonymous access

Correct Answer: 1

Explanation

Workload identity-based access allows applications to obtain appropriate Google Cloud credentials without storing long-lived service account keys inside source code or deployment artifacts. Depending on where the workload runs, this can use mechanisms such as attached service accounts or Workload Identity Federation. This approach reduces credential exposure and simplifies credential lifecycle management. Hard-coded keys and shared administrator credentials increase security risks and operational complexity, while anonymous access is inappropriate for protected resources. Therefore, workload identity-based access is preferred for secure application authentication.

Question 202

Which Google Cloud service provides a managed relational database compatible with SQL Server workloads?

1. Bigtable
2. Cloud SQL
3. Firestore
4. Cloud Storage

Correct Answer: 2

Explanation

Cloud SQL is a managed relational database service that supports database engines including MySQL, PostgreSQL, and SQL Server. It handles many infrastructure and database administration tasks, allowing teams to focus more on application development and database usage. Bigtable is a wide-column NoSQL database, Firestore uses a document model, and Cloud Storage provides object storage. Therefore, Cloud SQL is the appropriate service when a workload requires a managed relational database compatible with SQL Server.

Question 203

A global application requires a single external endpoint while application backends are deployed in multiple regions. Which architecture is most appropriate?

1. Separate public IPs with manual client configuration
2. Regional DNS servers only
3. Global external Application Load Balancer
4. One VM serving all users

Correct Answer: 3

Explanation

A global external Application Load Balancer can provide a unified external endpoint while distributing traffic among appropriate backends deployed across multiple regions. This architecture supports global application delivery and can route traffic according to backend health and configured load-balancing behavior. Multiple regional public IPs would require clients to handle endpoint selection, while a single VM creates a significant availability and scalability limitation. Regional DNS alone does not provide the same application traffic-management capabilities. Therefore, a global external Application Load Balancer is appropriate for a multi-region application with one public endpoint.

Question 204

A company wants to keep a production database available during a zonal infrastructure failure. Which Cloud SQL capability should it configure?

1. Read replica only
2. High availability
3. Cloud CDN
4. Cloud NAT

Correct Answer: 2

Explanation

Cloud SQL high availability provides a primary instance and standby configuration designed to support failover when certain infrastructure failures occur. The standby is placed in a different zone within the selected region, reducing dependence on a single zone. A read replica can support read scaling or other use cases but is not equivalent to a high-availability failover configuration. Cloud CDN and Cloud NAT provide content delivery and network address translation rather than database redundancy. Therefore, Cloud SQL high availability should be configured when protection against zonal database failures is required.

Question 205

Which Google Cloud service is designed to capture changes from supported databases and continuously replicate them to downstream systems?

1. Cloud Scheduler
2. Datastream
3. Cloud CDN
4. Cloud DNS

Correct Answer: 2

Explanation

Datastream provides change data capture and continuous replication from supported database sources. It can capture database changes and make them available to downstream destinations for analytics, processing, migration, or other workflows. This allows organizations to build near-real-time data pipelines without repeatedly performing full database exports. Cloud Scheduler manages scheduled tasks, Cloud CDN provides content delivery, and Cloud DNS handles name resolution. Therefore, Datastream is the appropriate service when continuous database-change replication is required.

Question 206

A security team needs centralized visibility into vulnerabilities, misconfigurations, and other security findings across multiple Google Cloud projects. Which service should it use?

1. Security Command Center
2. Cloud Composer
3. Cloud Build
4. Cloud Scheduler

Correct Answer: 1

Explanation

Security Command Center provides centralized security visibility across Google Cloud environments. It can aggregate supported security findings, identify vulnerabilities and misconfigurations, and help security teams understand the security posture of resources across projects. This centralized view can simplify investigation and prioritization of security issues. Cloud Composer is a workflow orchestration service, Cloud Build supports software builds, and Cloud Scheduler runs scheduled jobs. Therefore, Security Command Center is appropriate when security teams need centralized visibility across multiple projects.

Question 207

A company wants to deploy a containerized application but has a requirement for Kubernetes-native networking and workload management. Which platform should it select?

1. Cloud Run
2. Google Kubernetes Engine
3. Cloud Storage
4. Cloud Functions

Correct Answer: 2

Explanation

Google Kubernetes Engine provides a managed Kubernetes platform for deploying containerized workloads using Kubernetes-native concepts such as pods, deployments, services, and other resources. It is appropriate when an application specifically requires Kubernetes capabilities, ecosystem compatibility, or Kubernetes-based workload management. Cloud Run provides managed container execution without exposing the same Kubernetes management model, while Cloud Storage and Cloud Functions address storage and event-driven execution. Therefore, Google Kubernetes Engine should be selected when Kubernetes-native workload management is a requirement.

Question 208

A company wants to expose an internal application to another organization using a private service endpoint without requiring the consumer to access the provider’s VPC directly. Which technology should it evaluate?

1. Private Service Connect
2. Cloud NAT
3. Cloud CDN
4. Local SSD

Correct Answer: 1

Explanation

Private Service Connect can provide private access to supported services through internal IP addresses while helping maintain separation between the service producer and consumer networks. This can be useful when an organization wants to publish a service privately without requiring consumers to establish direct network-level access to the provider’s entire VPC. Cloud NAT provides outbound internet connectivity, Cloud CDN handles content delivery, and Local SSD provides temporary storage. Therefore, Private Service Connect should be evaluated for private service publishing and consumption.

Question 209

A company needs to execute a containerized task once per hour, with no requirement for the task to remain available between executions. Which service is well suited to this workload?

1. Cloud Run jobs
2. Cloud SQL
3. Cloud Storage
4. Cloud DNS

Correct Answer: 1

Explanation

Cloud Run jobs are designed for containerized workloads that execute tasks and terminate rather than continuously serving requests. They can be triggered or scheduled according to application requirements, making them suitable for periodic batch processing, maintenance tasks, and data transformations. The infrastructure is managed by Google Cloud, reducing the need to maintain dedicated servers for intermittent jobs. Cloud SQL provides relational databases, Cloud Storage provides object storage, and Cloud DNS manages DNS. Therefore, Cloud Run jobs are well suited to a containerized task that executes periodically and then terminates.

Question 210

A company has a data center with large amounts of data and wants private connectivity to Google Cloud without using the public internet. Which solution should it evaluate?

1. Cloud Interconnect
2. Cloud NAT
3. Cloud CDN
4. Cloud Scheduler

Correct Answer: 1

Explanation

Cloud Interconnect provides private connectivity between an organization’s network and Google Cloud. It can support high-bandwidth workloads and large-scale data transfers while avoiding dependence on public internet paths. Organizations can use Dedicated Interconnect or Partner Interconnect depending on their connectivity architecture and requirements. Cloud NAT provides outbound internet connectivity for private resources, Cloud CDN accelerates content delivery, and Cloud Scheduler runs scheduled jobs. Therefore, Cloud Interconnect should be evaluated when private data-center connectivity to Google Cloud is required.

Question 211

Which storage option should be selected when an application requires durable block storage that can be detached from one VM and attached to another supported VM?

1. Local SSD
2. Persistent Disk
3. Cloud CDN
4. Memorystore

Correct Answer: 2

Explanation

Persistent Disk provides durable block storage that exists independently from the lifecycle of a particular VM instance. Depending on the configuration and access requirements, a persistent disk can be detached from one VM and attached to another supported VM. This makes it useful for applications requiring durable block-level storage. Local SSD is temporary high-performance local storage, Cloud CDN is a content-delivery service, and Memorystore provides in-memory caching. Therefore, Persistent Disk is the appropriate option for durable block storage that needs to move between supported VMs.

Question 212

A company wants to make application deployment repeatable and automatically build container images whenever developers merge code into a repository. Which service should perform the build automation?

1. Cloud Build
2. Cloud DNS
3. Cloud Router
4. Cloud Storage lifecycle management

Correct Answer: 1

Explanation

Cloud Build provides managed build automation that can compile source code, run tests, create container images, and perform other build steps based on configured triggers and build definitions. It can integrate with source repositories so that a code change can automatically initiate a build pipeline. Cloud DNS handles name resolution, Cloud Router manages dynamic routing, and Cloud Storage lifecycle management controls object actions. Therefore, Cloud Build is the appropriate service for automating container-image builds following source-code changes.

Question 213

A company needs to allow private VMs to download software updates from the internet without assigning external IP addresses. Which design should it use?

1. External load balancer
2. Cloud NAT
3. Cloud CDN
4. Private Cloud DNS zone

Correct Answer: 2

Explanation

Cloud NAT allows resources without external IP addresses to establish outbound connections to internet destinations. Private VMs can therefore access software repositories, update servers, or external APIs without becoming directly reachable from the public internet. The NAT gateway translates the private source addresses for outbound traffic. An external load balancer is intended for inbound traffic, Cloud CDN provides caching and acceleration, and a private DNS zone handles internal name resolution. Therefore, Cloud NAT is the appropriate design for private VMs requiring outbound internet access.

Question 214

An organization wants to use separate Google Cloud projects for each application team while applying common governance policies from a central location. Which resource hierarchy feature supports this design?

1. Folders
2. Local SSD
3. Cloud CDN
4. Pub/Sub subscriptions

Correct Answer: 1

Explanation

Folders allow organizations to group projects within the Google Cloud resource hierarchy according to departments, environments, or business units. Policies and IAM configurations can be applied at higher levels of the hierarchy and inherited by applicable child resources. This enables central governance while maintaining separate projects for individual application teams. Local SSD provides temporary storage, Cloud CDN provides content delivery, and Pub/Sub subscriptions handle message consumption. Therefore, folders are useful for organizing projects and applying centralized governance.

Question 215

A company wants to restrict which external domains or network destinations a workload can reach as part of a security architecture. Which component should be evaluated?

1. Firewall and egress-control policies
2. Cloud Storage lifecycle rules
3. Cloud Trace
4. BigQuery partitioning

Correct Answer: 1

Explanation

Network firewall and egress-control policies can help restrict outbound traffic according to the organization’s security requirements. By controlling permitted destinations and protocols where supported, administrators can reduce the risk of workloads communicating with unauthorized external systems. The exact design may also involve proxy services, DNS controls, or other security mechanisms depending on the required level of domain-based filtering. Cloud Storage lifecycle rules, Cloud Trace, and BigQuery partitioning address different concerns. Therefore, firewall and egress-control policies should be evaluated for controlling outbound network communication.

Question 216

A company wants to analyze historical data stored in Cloud Storage using BigQuery without first copying every object into native BigQuery storage. Which capability should it consider?

1. External tables
2. Cloud NAT
3. Cloud Armor
4. Cloud Scheduler

Correct Answer: 1

Explanation

BigQuery external tables can allow BigQuery to query supported data stored outside native BigQuery storage, including appropriate data in Cloud Storage. This can be useful when organizations want to analyze existing datasets without immediately loading all data into managed BigQuery tables. Performance and supported formats should be considered when choosing external tables versus loading data into native storage. Cloud NAT provides network translation, Cloud Armor provides security controls, and Cloud Scheduler manages scheduled jobs. Therefore, external tables should be considered for querying supported Cloud Storage data directly.

Question 217

A company wants to make a database available for read-heavy workloads while keeping the primary database focused on writes. Which capability can help?

1. Read replicas
2. Cloud CDN
3. Cloud DNS
4. Cloud Scheduler

Correct Answer: 1

Explanation

Read replicas can provide additional database instances that serve read operations while the primary database continues handling writes. This can reduce read pressure on the primary instance and improve scalability for workloads with substantial read traffic. The exact replication behavior and supported features depend on the database service and engine. Cloud CDN is designed for content delivery, Cloud DNS manages name resolution, and Cloud Scheduler handles scheduled tasks. Therefore, read replicas can be useful when separating read workloads from primary database write operations.

Question 218

A company wants to deploy resources only in regions that satisfy its data-residency requirements. Which governance mechanism is most appropriate?

1. Cloud Trace
2. Organization Policy location constraints
3. Cloud Build
4. Memorystore

Correct Answer: 2

Explanation

Organization Policy can apply location constraints that restrict where supported Google Cloud resources may be created. This can help organizations enforce data-residency and geographic governance requirements across projects or folders. Centralized constraints are useful because application teams do not need to independently interpret and implement location restrictions. Cloud Trace provides observability, Cloud Build handles build automation, and Memorystore provides caching. Therefore, Organization Policy location constraints are appropriate when resource placement must comply with geographic or residency requirements.

Question 219

A company needs to protect confidential data stored in Cloud Storage and wants control over the encryption keys used to encrypt that data. Which approach should it consider?

1. Customer-managed encryption keys with Cloud KMS
2. Public bucket access
3. Cloud CDN caching
4. Anonymous authentication

Correct Answer: 1

Explanation

Customer-managed encryption keys can be created and controlled through Cloud KMS and used with supported Google Cloud services, including applicable Cloud Storage configurations. This provides organizations with greater control over key lifecycle, access permissions, and rotation than relying exclusively on Google-managed encryption. Public access and anonymous authentication would weaken data protection rather than improve it, while Cloud CDN is unrelated to key management. Therefore, customer-managed encryption keys with Cloud KMS should be considered when an organization requires greater control over encryption for confidential Cloud Storage data.

Question 220

A company wants to automatically test and deploy application changes after source code is committed, using separate build and release stages. Which combination is most appropriate?

1. Cloud Storage and Cloud DNS
2. Cloud Build and Cloud Deploy
3. Cloud KMS and Cloud Router
4. BigQuery and Cloud CDN

Correct Answer: 2

Explanation

Cloud Build can automate source-code compilation, testing, artifact creation, and other build activities, while Cloud Deploy can manage controlled application releases through defined delivery pipelines. Using the services together separates the build process from application promotion across environments such as testing and production. This creates a more structured CI/CD workflow and can reduce manual deployment steps. The other combinations do not provide equivalent build-and-release functionality. Therefore, Cloud Build and Cloud Deploy are the appropriate combination for automated application testing and controlled deployment.