View Full Google Professional Cloud Architect Exam Dumps and Practice Test Dumps.

 

Question 301

A company wants to allow a VM without an external IP address to access Google APIs while keeping its network path private. Which configuration should the architect recommend?

1. Cloud CDN
2. Private Google Access
3. Cloud NAT
4. Public IP assignment

Correct Answer: 2

Explanation

Private Google Access allows eligible resources without external IP addresses to access supported Google APIs and services through private connectivity. This is useful for workloads deployed in private subnets where direct internet exposure should be avoided. Cloud NAT can provide outbound internet access, but it serves a different purpose and is not specifically the mechanism for private access to Google APIs. Cloud CDN handles content delivery, while assigning a public IP increases exposure. Therefore, Private Google Access is the appropriate configuration for this requirement.

Question 302

A company operates an application in multiple regions and wants users to be directed to the closest healthy deployment. Which capability should it use?

1. Regional Persistent Disk
2. Global load balancing
3. Cloud Scheduler
4. Filestore

Correct Answer: 2

Explanation

Global load balancing can distribute traffic across eligible backends in multiple regions while considering factors such as availability and proximity. This allows users to be served by an appropriate healthy deployment and can improve application responsiveness and resilience. Regional Persistent Disk provides storage replication within supported regional configurations, Cloud Scheduler executes scheduled tasks, and Filestore provides managed file storage. Therefore, global load balancing is the appropriate capability when a multi-region application needs intelligent traffic distribution across healthy deployments.

Question 303

A security team needs to ensure that a workload can access only the specific Google Cloud APIs and resources required for its function. Which principle should guide the IAM design?

1. Least privilege
2. Public access
3. Shared credentials
4. Administrator access

Correct Answer: 1

Explanation

The principle of least privilege means granting identities only the permissions necessary to perform their required tasks. Applying this principle reduces the potential impact if credentials are compromised or a workload behaves unexpectedly. Instead of granting broad administrative roles, architects should identify the required operations and assign the narrowest appropriate permissions. Public access and shared credentials increase exposure, while administrator access provides substantially more authority than most workloads need. Therefore, least privilege should guide IAM design for workloads that require tightly controlled access.

Question 304

A company needs to inspect traffic entering a public application and block requests based on IP addresses, geographic conditions, or other supported rules. Which service should it evaluate?

1. Cloud Storage
2. Cloud KMS
3. Cloud Armor
4. Cloud Composer

Correct Answer: 3

Explanation

Cloud Armor provides security policies that can be applied to supported Google Cloud load-balancing architectures. These policies can use configurable rules to allow, deny, or otherwise control incoming traffic based on supported request characteristics. This makes Cloud Armor useful for protecting public applications from unwanted or malicious traffic before requests reach application backends. Cloud Storage provides object storage, Cloud KMS manages cryptographic keys, and Cloud Composer supports workflow orchestration. Therefore, Cloud Armor should be evaluated when centralized edge traffic filtering is required.

Question 305

A company wants to run a containerized batch process that starts on demand, performs a finite task, and then stops. Which service is well suited for this workload?

1. Cloud Run jobs
2. Cloud DNS
3. Cloud CDN
4. Cloud Interconnect

Correct Answer: 1

Explanation

Cloud Run jobs are designed for containerized workloads that perform finite tasks and terminate after completion. They are useful for batch processing, data transformations, administrative operations, and other workloads that do not require a continuously running HTTP service. Cloud DNS provides domain-name resolution, Cloud CDN distributes cached content, and Cloud Interconnect provides private network connectivity. Therefore, Cloud Run jobs are well suited to an on-demand container that performs a task and exits when the task is complete.

Question 306

A company has a highly available database requirement and wants the managed database service to automatically maintain a standby instance in another zone. Which Cloud SQL capability should it use?

1. Read replica only
2. High availability configuration
3. Cloud CDN
4. Cloud Storage lifecycle rules

Correct Answer: 2

Explanation

Cloud SQL high availability configurations can provide a standby instance in another zone within the applicable regional architecture. If the primary instance becomes unavailable, the service can perform a failover to the standby according to the configured high-availability design. A read replica is primarily intended for read scaling or other supported replication scenarios and should not be treated as an equivalent replacement for a high-availability configuration. Cloud CDN and Cloud Storage lifecycle rules address unrelated requirements. Therefore, Cloud SQL high availability is appropriate for zonal database resilience.

Question 307

An organization wants to ensure that only container images approved by its security process can be deployed to production. What should it integrate into the deployment architecture?

1. Binary Authorization
2. Cloud DNS
3. Cloud Trace
4. Memorystore

Correct Answer: 1

Explanation

Binary Authorization provides policy-based controls for container deployments by allowing organizations to require images to satisfy defined authorization conditions before deployment. This can support software supply-chain governance by ensuring that production workloads use images that have passed specified approval or attestation requirements. Cloud DNS provides name resolution, Cloud Trace supports distributed tracing, and Memorystore provides in-memory caching. Therefore, Binary Authorization should be integrated when production deployments must be restricted to approved container images.

Question 308

A company needs to connect an on-premises environment to Google Cloud and exchange dynamic routes using BGP. Which Google Cloud component should it configure?

1. Cloud Router
2. Cloud CDN
3. Secret Manager
4. BigQuery

Correct Answer: 1

Explanation

Cloud Router uses Border Gateway Protocol, or BGP, to dynamically exchange routes between Google Cloud and supported external networks. It is commonly used with connectivity solutions such as Cloud VPN and Cloud Interconnect to provide dynamic route advertisement and learning. This can simplify network management as routes change and can support redundant connectivity architectures. Cloud CDN handles content delivery, Secret Manager stores sensitive values, and BigQuery supports analytics. Therefore, Cloud Router is the appropriate component when dynamic BGP-based route exchange is required.

Question 309

A company wants to process a large batch of data using Apache Spark without managing a persistent cluster. Which Google Cloud option should it consider?

1. Dataproc Serverless
2. Cloud DNS
3. Cloud Armor
4. Cloud KMS

Correct Answer: 1

Explanation

Dataproc Serverless allows organizations to run supported Spark and related data-processing workloads without maintaining a long-lived Dataproc cluster. Google Cloud manages the underlying infrastructure required for the submitted workload, reducing operational overhead and allowing resources to be used according to processing needs. Cloud DNS provides name resolution, Cloud Armor protects applications, and Cloud KMS manages encryption keys. Therefore, Dataproc Serverless is appropriate when a company wants managed Spark processing without maintaining a persistent cluster.

Question 310

A company wants to store encryption keys in a highly controlled environment with stronger hardware-backed protection for sensitive workloads. Which Cloud KMS option should it evaluate?

1. Software-only keys
2. Cloud HSM
3. Cloud CDN
4. Cloud Scheduler

Correct Answer: 2

Explanation

Cloud HSM provides hardware-backed protection for cryptographic keys through dedicated hardware security modules. It can be appropriate for workloads with stringent security or compliance requirements where stronger protection of key material is needed. Software-protected keys can still provide strong security, but some organizations require hardware-backed key protection because of policy or regulatory requirements. Cloud CDN distributes content, while Cloud Scheduler manages scheduled operations. Therefore, Cloud HSM should be evaluated when sensitive encryption keys require hardware-backed protection.

Question 311

A development team wants to deploy applications to Google Kubernetes Engine but needs direct control over node pools, machine types, and node-level configuration. Which GKE mode should it choose?

1. GKE Autopilot
2. GKE Standard
3. Cloud Run
4. App Engine

Correct Answer: 2

Explanation

GKE Standard provides greater control over cluster infrastructure and node configuration than Autopilot. Teams can manage node pools, machine types, scaling configurations, and other node-level settings according to their workload requirements. GKE Autopilot abstracts more infrastructure management and is intended for teams that prefer a more managed Kubernetes experience. Cloud Run is a managed container platform outside Kubernetes, while App Engine is a managed application platform. Therefore, GKE Standard is appropriate when detailed control over nodes and node pools is required.

Question 312

A company wants a platform that automatically scales a web application and requires minimal infrastructure management, but the application is not packaged as a container. Which service should it evaluate?

1. App Engine
2. Cloud Interconnect
3. Bigtable
4. Cloud KMS

Correct Answer: 1

Explanation

App Engine provides a managed application platform designed to simplify deployment and scaling of supported applications without requiring teams to manage underlying servers directly. It can automatically adjust application capacity according to demand and supports application environments appropriate for different runtime requirements. Cloud Interconnect provides network connectivity, Bigtable is a NoSQL database, and Cloud KMS manages cryptographic keys. Therefore, App Engine should be evaluated when a web application needs managed scaling and does not require a container-first deployment model.

Question 313

A company wants to keep a second copy of data in another region so that an application can recover from a regional outage. Which architectural concept does this primarily address?

1. Regional disaster recovery
2. DNS caching
3. Application logging
4. Identity federation

Correct Answer: 1

Explanation

Maintaining a copy of data in another region can improve resilience against a regional outage and forms part of a disaster-recovery architecture. The exact implementation depends on the database or storage technology, recovery objectives, replication capabilities, and application design. A secondary region may be configured as a standby or active environment depending on the required recovery strategy. DNS caching, application logging, and identity federation address different concerns. Therefore, cross-region data replication primarily addresses regional disaster recovery and business continuity.

Question 314

A company has a database workload that requires read scaling but can tolerate some replication delay between the primary and secondary databases. Which option should the architect consider?

1. Read replicas
2. Cloud CDN
3. Cloud NAT
4. Cloud Scheduler

Correct Answer: 1

Explanation

Read replicas can provide additional database instances that replicate data from a primary database and serve supported read workloads. This can reduce read pressure on the primary database and improve the capacity available for applications with substantial read traffic. Replication can involve some delay, so read replicas should not automatically be treated as strongly consistent copies for every use case. Cloud CDN, Cloud NAT, and Cloud Scheduler address content delivery, network translation, and scheduled execution. Therefore, read replicas should be considered for workloads requiring additional read capacity.

Question 315

A company wants to allow users to access an application through a single global IP address while traffic is distributed to appropriate backend services. Which component should the architect evaluate?

1. Global external Application Load Balancer
2. Filestore
3. Cloud KMS
4. Cloud Scheduler

Correct Answer: 1

Explanation

The global external Application Load Balancer provides a globally reachable frontend and can distribute traffic to appropriate backend services according to the configured architecture. It is suitable for internet-facing applications that need global traffic distribution, centralized load-balancing policies, and integration with other edge capabilities. Filestore provides shared file storage, Cloud KMS manages cryptographic keys, and Cloud Scheduler executes scheduled tasks. Therefore, a global external Application Load Balancer should be evaluated when users need a globally accessible application endpoint with distributed backend traffic management.

Question 316

A company wants to monitor whether a production service is meeting a target response-time objective. Which observability concept should the architect define first?

1. SLI
2. Cloud Storage class
3. IAM role
4. VPC subnet

Correct Answer: 1

Explanation

A Service Level Indicator, or SLI, is a quantitative measurement of a service characteristic such as latency, availability, or error rate. For a response-time objective, the organization should first define how latency will be measured and represented as an SLI. That measurement can then support an SLO defining the desired target. Storage classes, IAM roles, and VPC subnets address different infrastructure concerns. Therefore, an SLI should be defined first when the organization needs a measurable indicator for production response-time performance.

Question 317

A company needs to store objects that are rarely accessed and wants to reduce storage costs while accepting slower retrieval and potential retrieval charges. Which Cloud Storage class should it consider?

1. Standard
2. Archive
3. Premium Persistent Disk
4. Local SSD

Correct Answer: 2

Explanation

The Cloud Storage Archive storage class is intended for data that is accessed infrequently and needs long-term retention at a lower storage cost. It is suitable for use cases such as archival records, backups, and historical datasets where immediate frequent access is not expected. Retrieval considerations and applicable charges should be included when evaluating the total cost. Standard storage is designed for more frequently accessed data, while Persistent Disk and Local SSD are block-storage options rather than Cloud Storage classes. Therefore, Archive should be considered for rarely accessed long-term objects.

Question 318

A company wants to run a service that automatically scales down to zero when there are no requests and scales up when traffic arrives. Which platform is a strong candidate?

1. Cloud Run
2. Compute Engine managed instance group only
3. Filestore
4. Cloud Interconnect

Correct Answer: 1

Explanation

Cloud Run can automatically scale containerized services according to incoming request traffic, including scaling down when there is no active demand under supported configurations. This makes it attractive for variable workloads where maintaining continuously running infrastructure would be inefficient. Compute Engine managed instance groups can scale based on configured signals, but they involve VM-based infrastructure. Filestore provides shared file storage, while Cloud Interconnect provides private connectivity. Therefore, Cloud Run is a strong candidate for request-driven services that benefit from scale-to-zero behavior.

Question 319

A company needs a highly available connection between Google Cloud and its on-premises data center and has substantial, predictable network traffic. Which solution should it evaluate?

1. Cloud Interconnect
2. Cloud Scheduler
3. Cloud CDN
4. Secret Manager

Correct Answer: 1

Explanation

Cloud Interconnect is designed for private connectivity between external networks and Google Cloud and can support high-capacity enterprise network traffic. It is appropriate when an organization has substantial predictable traffic and requires a private connection rather than relying solely on internet-based VPN connectivity. The exact Interconnect architecture should be selected according to capacity, location, provider availability, redundancy, and operational requirements. Cloud Scheduler, Cloud CDN, and Secret Manager address scheduled execution, content delivery, and secret management. Therefore, Cloud Interconnect should be evaluated for this connectivity requirement.

Question 320

A company wants to improve database availability and also needs an additional copy of data for read-heavy workloads. Which architecture should the architect distinguish carefully?

1. High availability and read replicas serve identical purposes
2. High availability supports failover, while read replicas primarily support read scaling
3. Read replicas always provide synchronous failover
4. High availability is only useful for analytics

Correct Answer: 2

Explanation

High availability and read replicas address different architectural requirements. A high-availability configuration is designed primarily to improve service continuity and support failover when the primary database becomes unavailable. Read replicas primarily provide additional capacity for supported read workloads and may involve replication lag. A read replica should therefore not automatically be considered an equivalent replacement for a high-availability configuration. Understanding the distinction helps architects select database features according to availability, performance, consistency, and recovery requirements rather than treating replication mechanisms as interchangeable.