View Full Google Professional Cloud Architect Exam Dumps and Practice Test Dumps.

 

Question 241

A company wants to prevent developers from accidentally creating resources in regions that are not approved for regulatory reasons. Which control should the architecture team recommend?

1. Cloud Trace
2. Organization Policy
3. Cloud CDN
4. Memorystore

Correct Answer: 2

Explanation

Organization Policy provides centralized governance across Google Cloud resources and can enforce supported constraints at the organization, folder, or project level. Location constraints can be used to restrict resource deployment to approved geographic locations, helping organizations address regulatory, residency, or internal governance requirements. Cloud Trace provides distributed tracing, Cloud CDN handles content delivery, and Memorystore provides caching. Therefore, Organization Policy is the appropriate control when resource creation must be restricted to approved regions.

Question 242

An application needs a relational database with automatic horizontal scaling and strong consistency across multiple regions. Which service should the architect evaluate?

1. Cloud SQL
2. Firestore
3. Cloud Spanner
4. Bigtable

Correct Answer: 3

Explanation

Cloud Spanner is a distributed relational database designed for workloads requiring horizontal scalability, strong consistency, and high availability across distributed deployments. It combines relational SQL capabilities with a globally distributed architecture. Cloud SQL provides managed relational databases but is not designed for the same global horizontal scaling model. Firestore is a document-oriented NoSQL database, while Bigtable is a wide-column NoSQL database. Therefore, Cloud Spanner should be evaluated when a workload requires relational transactions together with large-scale distributed deployment and strong consistency.

Question 243

A company needs to give a third-party application temporary access to specific Google Cloud resources without creating permanent user credentials. Which approach should it investigate?

1. Short-lived credentials
2. Shared administrator password
3. Permanent service account key
4. Anonymous access

Correct Answer: 1

Explanation

Short-lived credentials can provide temporary access without requiring long-lived secrets to remain valid indefinitely. Google Cloud supports mechanisms such as service account impersonation and token-based authentication that can issue temporary credentials for authorized workloads or identities. This reduces the exposure associated with permanent credentials and improves control over access duration. Shared passwords and permanent service account keys create longer-lived security risks, while anonymous access removes meaningful authorization. Therefore, short-lived credentials should be investigated when temporary, narrowly controlled third-party access is required.

Question 244

A company wants to automatically remove temporary objects from a Cloud Storage bucket after a specified number of days. Which feature should it configure?

1. Cloud Storage Object Lifecycle Management
2. Cloud Trace
3. Cloud Router
4. Cloud Armor

Correct Answer: 1

Explanation

Cloud Storage Object Lifecycle Management allows organizations to automatically perform actions on objects when specified conditions are met. Conditions can include object age, creation date, storage class, or other supported properties. A lifecycle rule can therefore delete temporary objects after they reach a defined age, reducing storage accumulation and administrative overhead. Cloud Trace provides tracing, Cloud Router manages dynamic routing, and Cloud Armor provides application security controls. Therefore, Object Lifecycle Management is the appropriate feature for automatically deleting temporary Cloud Storage objects.

Question 245

A company operates workloads across several Google Cloud projects and wants centralized network administration with application teams retaining ownership of their projects. Which architecture should it choose?

1. Shared VPC
2. Cloud CDN
3. Cloud Storage
4. Cloud DNS forwarding only

Correct Answer: 1

Explanation

Shared VPC enables a central host project to manage shared network resources while service projects contain workloads owned by individual application teams. This provides separation between network administration and application ownership while allowing teams to use centrally managed subnets. It can also simplify network governance and standardization across many projects. Cloud CDN, Cloud Storage, and DNS forwarding do not provide the same project-level network administration model. Therefore, Shared VPC is appropriate when central networking and independent application projects are both required.

Question 246

A company needs to encrypt sensitive data using keys that its security team can manage and rotate independently. Which service should it use?

1. Cloud Scheduler
2. Cloud KMS
3. Cloud DNS
4. Cloud Trace

Correct Answer: 2

Explanation

Cloud KMS provides centralized management of cryptographic keys and supports key lifecycle operations such as creation, rotation, disabling, and access control. This allows a security team to manage encryption keys independently from the applications and data services that use them. Appropriate IAM permissions can restrict which identities are allowed to administer or use the keys. Cloud Scheduler manages scheduled tasks, Cloud DNS handles name resolution, and Cloud Trace provides observability. Therefore, Cloud KMS is the appropriate service for centrally managed encryption keys.

Question 247

A web application experiences unpredictable traffic bursts. The architecture team wants capacity to increase automatically without keeping a large number of idle VMs running. Which design is appropriate?

1. Fixed VM capacity
2. Managed instance group autoscaling
3. Manual VM provisioning
4. One oversized VM

Correct Answer: 2

Explanation

Managed instance group autoscaling adjusts the number of VM instances according to configured signals and capacity requirements. During traffic increases, additional instances can be created, while capacity can be reduced when demand falls. This allows organizations to respond to variable workloads without permanently maintaining excess compute capacity. Fixed capacity and manual provisioning require more operational intervention and may either underprovision or waste resources. A single oversized VM also creates a significant failure and scalability limitation. Therefore, managed instance group autoscaling is appropriate for unpredictable traffic bursts.

Question 248

A company wants to expose a service privately to consumers while preventing those consumers from gaining direct access to the provider’s entire VPC network. Which technology should it evaluate?

1. Private Service Connect
2. Cloud NAT
3. Cloud VPN
4. Cloud CDN

Correct Answer: 1

Explanation

Private Service Connect allows service producers to publish supported services privately while consumers connect through private endpoints. This approach helps preserve network isolation because consumers do not need broad network-level access to the provider’s VPC. It is useful for service-provider and service-consumer architectures where private connectivity is required without exposing the entire underlying network. Cloud NAT provides outbound internet connectivity, Cloud VPN creates encrypted network tunnels, and Cloud CDN provides content caching. Therefore, Private Service Connect should be evaluated for privately exposing services while maintaining VPC isolation.

Question 249

A company needs to store application session information in memory for very fast retrieval across multiple application instances. Which service should it consider?

1. BigQuery
2. Cloud Storage
3. Memorystore
4. Cloud SQL

Correct Answer: 3

Explanation

Memorystore provides managed in-memory data stores that can be used for low-latency application data such as session information, caching, and frequently accessed values. Multiple application instances can use the managed cache instead of maintaining separate local copies of session state. BigQuery is designed for analytics, Cloud Storage provides object storage, and Cloud SQL provides relational database services. Therefore, Memorystore should be considered when an application needs fast shared access to session information stored in memory.

Question 250

A company wants to reduce deployment risk by gradually releasing a new application version to a small percentage of users before expanding the rollout. Which deployment strategy should it use?

1. Big-bang deployment
2. Canary deployment
3. Manual rollback only
4. Permanent blue environment

Correct Answer: 2

Explanation

A canary deployment releases a new application version to a limited portion of traffic or users before expanding the rollout. The team can monitor metrics, errors, and user behavior during the initial release and stop or roll back the deployment if problems are detected. This reduces the potential impact of defects compared with immediately replacing the entire production version. A big-bang deployment exposes all users at once, while manual rollback is a recovery action rather than a gradual release strategy. Therefore, a canary deployment is appropriate for reducing deployment risk.

Question 251

A company needs to continuously stream events from an application into a processing pipeline. Which service should act as the managed message-ingestion layer?

1. Pub/Sub
2. Cloud DNS
3. Cloud KMS
4. Filestore

Correct Answer: 1

Explanation

Pub/Sub provides managed asynchronous messaging and can ingest large volumes of events from application producers. Producers publish messages to topics, while subscribers consume them independently for processing or downstream workflows. This architecture helps decouple event producers from processing services and allows components to scale independently. Cloud DNS handles name resolution, Cloud KMS manages cryptographic keys, and Filestore provides shared file storage. Therefore, Pub/Sub should act as the message-ingestion layer for a continuously generated application event stream.

Question 252

A company wants to query large datasets using SQL while separating analytical workloads from its transactional application database. Which service should it use?

1. BigQuery
2. Cloud DNS
3. Cloud NAT
4. Memorystore

Correct Answer: 1

Explanation

BigQuery is designed for large-scale analytical workloads and can process SQL queries without requiring organizations to manage traditional database infrastructure. Separating analytics from a transactional database can reduce the impact of complex analytical queries on production application workloads. Data can be loaded or otherwise made available to BigQuery through supported integration patterns. Cloud DNS manages naming, Cloud NAT provides outbound network translation, and Memorystore is an in-memory caching service. Therefore, BigQuery is appropriate for separating large-scale analytical processing from transactional application workloads.

Question 253

A company wants to collect logs from multiple projects in a central location for security investigations. Which capability should it configure?

1. Centralized log routing
2. Cloud CDN
3. Cloud NAT
4. Local SSD

Correct Answer: 1

Explanation

Centralized log routing allows organizations to route logs from multiple projects to a designated destination for centralized storage, analysis, and security operations. This can help security teams investigate events consistently without manually reviewing separate project environments. Appropriate routing configurations can support centralized governance and long-term retention requirements. Cloud CDN handles content delivery, Cloud NAT provides outbound connectivity, and Local SSD supplies temporary local storage. Therefore, centralized log routing should be configured when logs from multiple projects need to be collected for security investigations.

Question 254

A company wants to connect its on-premises network to Google Cloud using encrypted tunnels over the public internet and requires high availability. Which solution is appropriate?

1. HA VPN
2. Cloud Interconnect
3. Cloud CDN
4. Cloud Storage

Correct Answer: 1

Explanation

HA VPN provides highly available IPsec VPN connectivity between an on-premises environment and Google Cloud over the public internet. It is appropriate when encrypted network tunnels are required without deploying private physical connectivity. Cloud Interconnect provides private connectivity rather than VPN tunnels over the public internet. Cloud CDN provides content delivery, while Cloud Storage provides object storage. Therefore, HA VPN is appropriate when an organization requires highly available encrypted connectivity over the public internet.

Question 255

A company has an application that requires a traditional shared NFS file system accessible by multiple VM instances. Which Google Cloud service should it select?

1. Bigtable
2. Filestore
3. Cloud Run
4. BigQuery

Correct Answer: 2

Explanation

Filestore provides managed file storage that supports file-system access patterns appropriate for applications requiring shared NFS-compatible storage. Multiple VM instances can access shared files according to the configured Filestore service and network architecture. This makes it useful for workloads such as shared application files, content repositories, and applications designed around traditional file-system semantics. Bigtable is a wide-column database, Cloud Run provides managed container execution, and BigQuery is an analytical warehouse. Therefore, Filestore is appropriate for a shared NFS file-system requirement.

Question 256

A company wants to make its CI/CD process more secure by preventing unauthorized container images from being deployed to production. Which capability should it investigate?

1. Binary Authorization
2. Cloud DNS
3. Cloud Scheduler
4. Cloud CDN

Correct Answer: 1

Explanation

Binary Authorization can help enforce deployment policies for supported container workloads by requiring images to satisfy defined authorization criteria before deployment. This can strengthen software supply-chain controls by ensuring that only approved or appropriately attested container images are deployed. Cloud DNS manages name resolution, Cloud Scheduler manages scheduled tasks, and Cloud CDN provides content delivery. Therefore, Binary Authorization should be investigated when an organization wants policy-based controls that prevent unauthorized container images from reaching production environments.

Question 257

A company needs to store a very large number of small records with predictable low-latency reads and writes rather than perform complex relational joins. Which database is a strong candidate?

1. Bigtable
2. Cloud SQL
3. Cloud Spanner
4. Cloud Storage

Correct Answer: 1

Explanation

Bigtable is designed for large-scale, low-latency workloads using a wide-column data model. It can handle very large numbers of records and high-throughput read and write operations when the access patterns fit its key-based design. Cloud SQL is a relational database, Cloud Spanner provides distributed relational capabilities, and Cloud Storage is object storage rather than a database. Bigtable is not intended for arbitrary relational joins or traditional relational schemas. Therefore, Bigtable is a strong candidate for massive low-latency key-oriented workloads.

Question 258

A company wants a service to automatically execute a function whenever a supported cloud event occurs. Which service should it consider?

1. Cloud Functions
2. Cloud Storage
3. Cloud Router
4. Cloud DNS

Correct Answer: 1

Explanation

Cloud Functions provides managed event-driven execution for supported triggers. A function can respond to events and execute application logic without requiring the organization to provision or manage dedicated servers. This makes it useful for lightweight automation, event processing, integrations, and other reactive workloads. Cloud Storage provides object storage, Cloud Router manages dynamic routing, and Cloud DNS provides name resolution. Therefore, Cloud Functions should be considered when application logic needs to execute automatically in response to supported cloud events.

Question 259

A company wants to monitor an application for errors and identify exceptions that occur in production. Which observability service should it evaluate?

1. Cloud Error Reporting
2. Cloud CDN
3. Cloud Scheduler
4. Cloud Router

Correct Answer: 1

Explanation

Cloud Error Reporting helps identify and group application errors and exceptions so development and operations teams can investigate recurring production problems. It can provide visibility into application failures without requiring teams to manually search through every log entry. Cloud CDN handles content delivery, Cloud Scheduler manages scheduled tasks, and Cloud Router provides dynamic network routing. Therefore, Cloud Error Reporting should be evaluated when the primary requirement is identifying and investigating application exceptions occurring in production.

Question 260

A company wants to reduce the amount of data transferred between its application and users by serving frequently requested content from locations closer to users. Which service should it use?

1. Cloud CDN
2. Cloud KMS
3. Cloud SQL
4. Cloud Composer

Correct Answer: 1

Explanation

Cloud CDN caches eligible content at edge locations so frequently requested data can be served closer to users. This can reduce latency and decrease repeated requests to the origin application, potentially lowering bandwidth consumption between users and the origin. Cloud KMS manages encryption keys, Cloud SQL provides relational databases, and Cloud Composer orchestrates workflows. Therefore, Cloud CDN is the appropriate service when the goal is to serve frequently requested content closer to users and reduce repeated origin traffic.