View Full Google Professional Cloud Architect Exam Dumps and Practice Test Dumps.

 

Question 261

Which Google Cloud feature helps prevent an identity from performing specific actions even when another IAM policy grants access?

1. IAM Recommender
2. IAM Deny Policies
3. Cloud Audit Logs
4. Organization folders

Correct Answer: 2

Explanation

IAM deny policies provide an explicit mechanism for preventing specified permissions from being used by selected principals. They can be useful when an organization needs a centralized restriction that should remain effective even if an identity receives an allow permission through another applicable IAM policy. This helps strengthen governance for sensitive operations and reduces the risk of accidental privilege expansion. IAM Recommender helps identify permissions that may be excessive, Audit Logs record activity, and folders organize resources. Therefore, IAM deny policies are the appropriate choice.

Question 262

An enterprise wants employees to access Google Cloud using identities from its existing corporate identity provider instead of creating separate Google Cloud user accounts. Which capability should it use?

1. Workforce Identity Federation
2. Cloud Storage Transfer
3. Cloud NAT
4. Cloud CDN

Correct Answer: 1

Explanation

Workforce Identity Federation allows external workforce identities from a supported identity provider to access Google Cloud resources without requiring users to maintain separate Google Cloud credentials. This can simplify identity management and allow organizations to continue using their existing workforce identity infrastructure. It can also reduce the need for long-lived credentials and improve centralized authentication governance. Cloud Storage Transfer handles data movement, Cloud NAT provides outbound connectivity, and Cloud CDN distributes cached content. Therefore, Workforce Identity Federation is appropriate for external workforce identity integration.

Question 263

A development team needs to let one service account perform actions as another service account without distributing the second account’s private key. What should the architect recommend?

1. Service account impersonation
2. Public bucket access
3. Shared user passwords
4. Static API keys

Correct Answer: 1

Explanation

Service account impersonation allows an authorized principal or workload to obtain temporary credentials that act as another service account. This avoids distributing long-lived private keys and provides a more controlled authentication model. Permissions can be granted specifically to identities that are allowed to impersonate the target service account. Public bucket access and shared passwords introduce unnecessary security exposure, while static API keys can remain valid for long periods. Therefore, service account impersonation is the preferred approach when one identity needs controlled temporary authority as another service account.

Question 264

A VPC needs private subnets for application servers while allowing them to reach Google APIs without using external IP addresses. Which feature is appropriate?

1. Cloud Armor
2. Private Google Access
3. Cloud CDN
4. Cloud Trace

Correct Answer: 2

Explanation

Private Google Access allows instances that do not have external IP addresses to reach supported Google APIs and services using private connectivity. This is useful for workloads placed in private subnets where direct internet exposure should be avoided. The feature helps maintain a more restricted network architecture while still allowing applications to interact with required Google services. Cloud Armor protects applications from network and application-layer threats, Cloud CDN caches content, and Cloud Trace provides distributed tracing. Therefore, Private Google Access is the appropriate feature for this requirement.

Question 265

A company has multiple VPC networks that need private communication, but it wants each network to remain independently administered. Which connectivity option should the architect evaluate?

1. VPC Network Peering
2. Cloud CDN
3. Cloud Storage
4. Cloud Scheduler

Correct Answer: 1

Explanation

VPC Network Peering provides private connectivity between separate VPC networks while allowing each network to remain independently administered. It can be useful when workloads in different projects or organizations need private IP communication without requiring all networks to be combined into a single VPC. Peering does not automatically provide transitive routing through another peered network, so the overall topology must be designed carefully. Cloud CDN, Cloud Storage, and Cloud Scheduler solve different problems. Therefore, VPC Network Peering should be evaluated for independently managed VPCs requiring private connectivity.

Question 266

A company wants applications in a VPC to use a custom domain name for internal services while keeping those DNS records inaccessible from the public internet. What should it configure?

1. Public DNS zone
2. Private Cloud DNS zone
3. Cloud CDN
4. External HTTP load balancer

Correct Answer: 2

Explanation

A private Cloud DNS zone provides DNS records that are available only to the VPC networks associated with the zone. This is useful for internal service names, private application endpoints, and other resources that should not be resolvable through public DNS. A public DNS zone is intended for internet-facing names, while Cloud CDN and external load balancing address traffic delivery rather than private DNS resolution. Therefore, a private Cloud DNS zone is appropriate when internal domain names must remain inaccessible from the public internet.

Question 267

An organization wants a single VPC to serve workloads in several regions. What should the architect understand about Google Cloud VPC networks?

1. A VPC can contain subnets in multiple regions
2. Every VPC is restricted to one region
3. Each VM must have a separate VPC
4. VPC subnets are global resources

Correct Answer: 1

Explanation

Google Cloud VPC networks are global resources, while their subnets are regional resources. A single VPC can therefore contain multiple subnets located in different regions, allowing organizations to build regional workloads within a shared global network architecture. This design supports centralized network connectivity and policies while allowing resources to be deployed geographically. However, each subnet itself belongs to one region. Therefore, the correct statement is that a VPC can contain subnets across multiple regions.

Question 268

A company needs private connectivity to Google Cloud with predictable high bandwidth and lower dependence on the public internet. Which service should it evaluate?

1. Cloud Interconnect
2. Cloud DNS
3. Cloud Functions
4. Cloud Scheduler

Correct Answer: 1

Explanation

Cloud Interconnect provides private connectivity between an external network and Google Cloud. Depending on the selected Interconnect architecture, organizations can establish dedicated or partner-based connectivity with predictable network characteristics and high capacity. This can be preferable for enterprise workloads with substantial traffic, strict network requirements, or a need to reduce dependence on internet-based connectivity. Cloud DNS handles name resolution, Cloud Functions provides event-driven execution, and Cloud Scheduler handles scheduled jobs. Therefore, Cloud Interconnect should be evaluated for private, high-capacity connectivity to Google Cloud.

Question 269

A company wants to automatically increase the number of VM instances when CPU utilization rises above a defined threshold. Which configuration should it use?

1. Cloud Storage lifecycle rule
2. MIG autoscaler
3. Cloud DNS policy
4. Pub/Sub subscription

Correct Answer: 2

Explanation

A managed instance group autoscaler can adjust the number of VM instances based on configured signals such as CPU utilization. When demand increases and utilization exceeds the configured target, the autoscaler can add instances, while lower demand can cause the group to scale down within configured limits. This provides elastic capacity without requiring administrators to manually create or remove instances. Cloud Storage lifecycle rules manage objects, Cloud DNS policies manage DNS behavior, and Pub/Sub subscriptions consume messages. Therefore, a MIG autoscaler is appropriate for CPU-based VM scaling.

Question 270

A financial application requires a relational database and supports PostgreSQL features, but the team does not want to manage database servers or operating systems. Which service is appropriate?

1. Bigtable
2. Cloud Storage
3. Cloud SQL for PostgreSQL
4. Firestore

Correct Answer: 3

Explanation

Cloud SQL for PostgreSQL provides a managed PostgreSQL database service while Google Cloud handles many underlying administrative responsibilities such as infrastructure maintenance, backups, and supported database operations. This makes it suitable for applications that require PostgreSQL compatibility without requiring the team to manage database servers or operating systems directly. Bigtable is a wide-column database, Cloud Storage is object storage, and Firestore is a document database. Therefore, Cloud SQL for PostgreSQL is appropriate for a managed relational PostgreSQL workload.

Question 271

A company wants to deploy containerized HTTP applications without managing Kubernetes clusters or VM instances. Which platform should it consider?

1. Cloud Run
2. Compute Engine
3. Filestore
4. Cloud Interconnect

Correct Answer: 1

Explanation

Cloud Run provides a managed platform for running containerized applications without requiring the organization to manage Kubernetes clusters or individual VM instances. It is well suited to stateless HTTP services and can automatically scale according to incoming demand. This reduces infrastructure management overhead and allows development teams to focus on application behavior. Compute Engine requires VM management, Filestore provides managed file storage, and Cloud Interconnect provides network connectivity. Therefore, Cloud Run should be considered when containerized HTTP applications need a highly managed execution platform.

Question 272

A company wants to enforce that newly created resources comply with organizational rules, such as restrictions on certain resource configurations. Which Google Cloud capability should it evaluate?

1. Cloud Trace
2. Organization Policy Service
3. Cloud CDN
4. Memorystore

Correct Answer: 2

Explanation

Organization Policy Service provides centralized governance controls that can constrain how Google Cloud resources are configured or created. Administrators can apply supported constraints at different levels of the resource hierarchy, allowing policies to be inherited by projects and resources beneath them. This helps organizations enforce security, compliance, and operational requirements consistently. Cloud Trace focuses on distributed tracing, Cloud CDN handles content delivery, and Memorystore provides in-memory caching. Therefore, Organization Policy Service should be evaluated when resource configurations need centralized organizational restrictions.

Question 273

A company has a critical VM workload that must remain available if a single availability zone fails. Which architecture provides the appropriate compute redundancy?

1. A single VM with more CPU
2. Multiple VMs distributed across zones
3. One VM with a larger boot disk
4. A single unmanaged instance

Correct Answer: 2

Explanation

Distributing application instances across multiple availability zones reduces dependence on a single zone. If one zone experiences an outage, instances in another zone can continue serving the workload, provided the application and supporting architecture are designed for failover. Simply increasing the size of one VM does not protect against a zonal failure because the workload remains concentrated in one location. A larger disk also does not provide compute redundancy. Therefore, deploying multiple VMs across zones is the appropriate architecture for improving resilience against a single-zone failure.

Question 274

An organization wants to analyze who changed IAM policies and when those changes occurred. Which capability should security administrators use?

1. Cloud Audit Logs
2. Cloud CDN
3. Cloud Run
4. Cloud NAT

Correct Answer: 1

Explanation

Cloud Audit Logs records administrative and other relevant activities involving Google Cloud resources. Security and compliance teams can use audit information to investigate changes, including actions involving IAM configuration, resource administration, and access-related operations where supported. This provides an important source of evidence for incident investigation and governance reviews. Cloud CDN provides content caching, Cloud Run executes containers, and Cloud NAT provides outbound network translation. Therefore, Cloud Audit Logs should be used when administrators need to determine who performed configuration changes and when those activities occurred.

Question 275

A company wants to protect a public web application from common application-layer attacks and malicious traffic before requests reach the backend. Which service should it configure?

1. Cloud Storage
2. Cloud Armor
3. BigQuery
4. Cloud Scheduler

Correct Answer: 2

Explanation

Cloud Armor provides security controls for applications exposed through supported Google Cloud load balancing architectures. It can help protect internet-facing applications against malicious traffic and common web attacks by applying configurable security policies before traffic reaches application backends. This allows organizations to centralize application protection at the edge of the network. Cloud Storage provides object storage, BigQuery supports analytics, and Cloud Scheduler runs scheduled jobs. Therefore, Cloud Armor should be configured when an internet-facing web application requires protection from malicious application-layer traffic.

Question 276

A company wants to deploy a Kubernetes application with Google managing much of the underlying cluster infrastructure and node operations. Which option should it consider?

1. GKE Autopilot
2. Compute Engine
3. Cloud SQL
4. Cloud Storage

Correct Answer: 1

Explanation

GKE Autopilot provides a managed Kubernetes experience in which Google Cloud handles many infrastructure and node-management responsibilities. This can reduce operational overhead for teams that want Kubernetes capabilities without managing as much of the underlying cluster infrastructure themselves. Compute Engine provides virtual machines, Cloud SQL provides managed relational databases, and Cloud Storage provides object storage. Therefore, GKE Autopilot should be considered when an organization needs Kubernetes while minimizing the operational responsibilities associated with node management.

Question 277

A company is migrating an existing application to Google Cloud with minimal code changes and wants to move it quickly rather than redesign it. Which migration strategy best describes this approach?

1. Refactor
2. Replatform
3. Rehost
4. Retire

Correct Answer: 3

Explanation

Rehosting, commonly described as a lift-and-shift approach, moves an existing application to the target environment with minimal changes to its architecture or code. It can reduce migration time and complexity when the immediate objective is relocation rather than modernization. Replatforming introduces selected platform changes, while refactoring involves more substantial application redesign to take advantage of cloud-native capabilities. Retiring means removing an application that is no longer needed. Therefore, rehost is the appropriate migration strategy when speed and minimal modification are primary objectives.

Question 278

A company needs to copy large volumes of data from an existing storage environment into Google Cloud and wants a managed transfer service rather than writing custom scripts. Which service should it evaluate?

1. Storage Transfer Service
2. Cloud Trace
3. Cloud Armor
4. Cloud DNS

Correct Answer: 1

Explanation

Storage Transfer Service provides managed mechanisms for moving large amounts of data into Google Cloud from supported sources. It can automate transfer operations and reduce the need for organizations to build and maintain custom data-migration scripts. This is useful during cloud migrations and recurring data-transfer workflows where reliability and operational simplicity are important. Cloud Trace is an observability service, Cloud Armor provides application protection, and Cloud DNS manages name resolution. Therefore, Storage Transfer Service should be evaluated for managed large-scale data transfers into Google Cloud.

Question 279

An application needs a globally distributed relational database with strong transactional consistency and automatic scaling across regions. Which characteristic most strongly points to Cloud Spanner?

1. Object-based storage
2. Wide-column key-value access
3. Global relational transactions
4. In-memory caching

Correct Answer: 3

Explanation

Global relational transactions are a key architectural characteristic that points toward Cloud Spanner. Spanner provides relational database capabilities while supporting distributed deployments and strong consistency across regions. This makes it suitable for applications that need transactional integrity together with geographic distribution and significant scalability. Object-based storage points toward Cloud Storage, wide-column access is associated with Bigtable, and in-memory caching is associated with Memorystore. Therefore, global relational transactions are the strongest indicator among these choices for selecting Cloud Spanner.

Question 280

A company needs to continuously process streaming events, transform them in real time, and write the results into an analytics warehouse. Which architecture is appropriate?

1. Cloud Storage → Cloud SQL → Cloud CDN
2. Pub/Sub → Dataflow → BigQuery
3. Cloud DNS → Cloud NAT → Compute Engine
4. Filestore → Cloud Scheduler → Bigtable

Correct Answer: 2

Explanation

Pub/Sub, Dataflow, and BigQuery form a suitable architecture for real-time event analytics. Pub/Sub can ingest and distribute streaming events, Dataflow can transform and process those events continuously, and BigQuery can store and analyze the resulting datasets at scale. This architecture separates ingestion, processing, and analytical storage while allowing each component to scale according to its workload. The other combinations do not provide an equivalent managed streaming analytics pipeline. Therefore, Pub/Sub → Dataflow → BigQuery is appropriate for continuous event processing and analytics.