View Full Google Professional Cloud Architect Exam Dumps and Practice Test Dumps.

 

Question 321

A company wants to give an application temporary access to a Google Cloud resource without creating a long-lived service account key. Which approach should the architect recommend?

1. Service account impersonation
2. Public IAM access
3. Shared administrator credentials
4. Permanent API keys

Correct Answer: 1

Explanation

Service account impersonation allows an authorized identity to obtain temporary credentials that act as another service account. This avoids distributing long-lived private keys and provides better control over how and when elevated permissions are used. Administrators can grant impersonation permissions only to trusted principals and can monitor the resulting activity through available audit mechanisms. Public access and shared administrator credentials unnecessarily increase exposure, while permanent API keys can remain valid until manually revoked. Therefore, service account impersonation is appropriate when temporary access is needed without distributing persistent credentials.

Question 322

An organization has separate development, testing, and production environments and wants strong administrative isolation between them. Which design should it consider?

1. Separate Google Cloud projects
2. One project with unrestricted access
3. One shared service account for all teams
4. One public VPC

Correct Answer: 1

Explanation

Separate Google Cloud projects provide a useful boundary for organizing environments and controlling access. IAM permissions, quotas, billing configuration, and many resource settings can be managed independently at the project level. This reduces the chance that a development change or permission assignment directly affects production resources. A shared project can still be appropriate in some environments, but it requires more careful separation. Shared credentials and public networking do not provide equivalent administrative isolation. Therefore, separate projects are appropriate when development, testing, and production require clear boundaries.

Question 323

A company needs to route traffic between an on-premises network and Google Cloud dynamically as network prefixes change. Which technology is central to this design?

1. BGP
2. HTTP caching
3. Object lifecycle rules
4. DNS TTL only

Correct Answer: 1

Explanation

Border Gateway Protocol, or BGP, enables dynamic exchange of routing information between connected networks. In Google Cloud, Cloud Router uses BGP with supported connectivity solutions such as Cloud VPN and Cloud Interconnect. Dynamic routing allows network prefixes to be learned and advertised automatically rather than requiring every route change to be configured manually. HTTP caching improves content delivery, object lifecycle rules manage storage objects, and DNS TTL controls name-resolution caching. Therefore, BGP is central to a dynamic hybrid network routing design.

Question 324

A company wants to reduce application latency for users located around the world by caching frequently requested static content close to them. Which service should it use?

1. Cloud CDN
2. Cloud KMS
3. Cloud SQL
4. Cloud Scheduler

Correct Answer: 1

Explanation

Cloud CDN caches eligible content at Google edge locations so users can receive frequently requested content from locations closer to them. This can reduce latency and decrease repeated requests to the origin application. It is particularly useful for static assets and other cacheable content accessed by geographically distributed users. Cloud KMS manages cryptographic keys, Cloud SQL provides managed relational databases, and Cloud Scheduler handles scheduled jobs. Therefore, Cloud CDN is the appropriate service for improving global delivery of cacheable content.

Question 325

A company needs a storage service for unstructured files such as images, videos, backups, and documents. Which service is the natural choice?

1. Cloud Storage
2. Cloud Spanner
3. Cloud SQL
4. Bigtable

Correct Answer: 1

Explanation

Cloud Storage is an object storage service designed for unstructured data such as images, videos, documents, backups, and large files. Objects are stored in buckets and can be accessed through supported APIs and interfaces. Cloud Storage also offers different storage classes and lifecycle capabilities for managing cost and retention. Cloud Spanner and Cloud SQL are relational database services, while Bigtable is a wide-column NoSQL database. Therefore, Cloud Storage is the natural choice when the primary requirement is durable object storage for unstructured files.

Question 326

A company wants to decouple an order-processing application from several downstream services so that temporary failures in one service do not immediately block the producer. Which architecture should it use?

1. Pub/Sub messaging
2. Direct synchronous calls only
3. Shared local files
4. Public DNS records

Correct Answer: 1

Explanation

Pub/Sub provides asynchronous messaging that can decouple producers from consumers. An order-processing application can publish events to a topic while downstream services consume those messages independently. This reduces tight coupling and allows consumers to process messages according to their own availability and capacity. It can also provide buffering during temporary processing slowdowns. Direct synchronous calls create stronger dependencies between services, while shared files and public DNS records do not provide a suitable event-messaging architecture. Therefore, Pub/Sub is appropriate for decoupling order-processing components.

Question 327

A company requires a globally distributed relational database but needs strong transactional consistency between geographically separated application deployments. Which service should it evaluate?

1. Firestore
2. Cloud Spanner
3. Cloud Storage
4. Memorystore

Correct Answer: 2

Explanation

Cloud Spanner is designed for relational workloads that require horizontal scalability and distributed deployment while maintaining strong transactional consistency. It can support applications that operate across geographic regions and need consistent transactional behavior rather than eventually consistent replicas alone. Firestore uses a document-oriented model, Cloud Storage provides object storage, and Memorystore provides low-latency in-memory data services. Therefore, Cloud Spanner should be evaluated when global distribution, relational semantics, and strong transactional consistency are all important architectural requirements.

Question 328

A company wants to allow a private application to access a third-party service through a private endpoint rather than exposing the application’s traffic directly to the public internet. Which technology should it investigate?

1. Private Service Connect
2. Cloud CDN
3. Cloud Storage lifecycle management
4. Cloud Scheduler

Correct Answer: 1

Explanation

Private Service Connect enables private connectivity between consumers and supported service producers through private endpoints. Depending on the supported service architecture, this can allow applications to consume services without requiring direct public network exposure. It provides an abstraction that helps separate consumer and producer network environments while maintaining private connectivity. Cloud CDN is intended for content delivery, Cloud Storage lifecycle management automates object actions, and Cloud Scheduler handles scheduled execution. Therefore, Private Service Connect should be investigated for a private service-consumption architecture.

Question 329

A company wants to prevent a service account from being used outside a defined context, such as a particular request or resource condition. Which IAM capability can provide conditional authorization?

1. IAM Conditions
2. Cloud CDN
3. BigQuery reservations
4. Cloud Storage classes

Correct Answer: 1

Explanation

IAM Conditions allow organizations to apply additional conditions to access decisions instead of granting permissions unconditionally. Conditions can use supported attributes and expressions to restrict when or where an IAM binding applies. This provides more granular authorization and can support context-aware access requirements. Cloud CDN manages content delivery, BigQuery reservations concern analytical compute capacity, and Cloud Storage classes determine storage characteristics and pricing. Therefore, IAM Conditions are the appropriate IAM capability when authorization must depend on defined contextual conditions.

Question 330

A company has an internet-facing application and wants protection against distributed denial-of-service attacks as well as configurable application-layer security rules. Which service should it consider?

1. Cloud Armor
2. Cloud Composer
3. Bigtable
4. Cloud Storage

Correct Answer: 1

Explanation

Cloud Armor provides security capabilities for supported Google Cloud load-balancing architectures and can help protect internet-facing applications from distributed denial-of-service attacks and application-layer threats. Security policies can be configured to control unwanted traffic based on supported conditions and rules. Cloud Composer is a workflow orchestration service, Bigtable is a wide-column database, and Cloud Storage provides object storage. Therefore, Cloud Armor should be considered when a public application requires edge-based traffic protection and configurable application security controls.

Question 331

A company needs to perform SQL analytics on billions of records without managing database servers. Which service should it select?

1. BigQuery
2. Filestore
3. Cloud Router
4. Cloud Functions

Correct Answer: 1

Explanation

BigQuery is a fully managed analytical data warehouse designed for large-scale SQL analytics. It separates analytical processing from traditional server management and can process very large datasets using Google’s distributed infrastructure. This makes it appropriate for workloads involving billions of records, reporting, business intelligence, and analytical queries. Filestore provides managed file storage, Cloud Router manages dynamic routing, and Cloud Functions provides event-driven application execution. Therefore, BigQuery should be selected when large-scale SQL analytics are required without managing database servers.

Question 332

A company wants to run a stateless API in containers and expose it through HTTPS while allowing the platform to handle infrastructure scaling. Which service is appropriate?

1. Cloud Run
2. Cloud Storage
3. Cloud KMS
4. Cloud Interconnect

Correct Answer: 1

Explanation

Cloud Run provides a managed execution environment for containerized applications and is well suited to stateless HTTP APIs. The platform handles much of the underlying infrastructure management and can automatically adjust service capacity based on incoming traffic. This allows teams to deploy containers without maintaining VM fleets or Kubernetes nodes. Cloud Storage provides object storage, Cloud KMS manages encryption keys, and Cloud Interconnect provides private network connectivity. Therefore, Cloud Run is appropriate for a stateless containerized API requiring managed scaling.

Question 333

A company wants to automatically recover failed VM instances by recreating unhealthy instances according to a defined health signal. Which capability should it configure?

1. Managed instance group autohealing
2. Cloud CDN
3. Cloud DNS
4. Secret Manager

Correct Answer: 1

Explanation

Managed instance group autohealing uses health checks to detect unhealthy VM instances and can recreate instances when they fail the configured health criteria. This improves application resilience by automatically replacing failed instances rather than relying entirely on manual intervention. Autohealing is distinct from autoscaling: autoscaling changes capacity according to demand, while autohealing focuses on maintaining healthy instances. Cloud CDN provides content delivery, Cloud DNS handles name resolution, and Secret Manager stores sensitive values. Therefore, MIG autohealing is the appropriate capability for automatic instance recovery.

Question 334

A company needs to keep a high-performance copy of frequently accessed application data in memory to reduce database load. Which service should it consider?

1. Memorystore
2. Cloud Storage
3. BigQuery
4. Cloud Interconnect

Correct Answer: 1

Explanation

Memorystore provides managed in-memory data stores that can be used for caching frequently accessed information. By serving repeated requests from memory rather than querying a backend database for every request, an application can reduce database load and improve response times. The cache strategy should account for expiration, invalidation, consistency, and failure behavior. Cloud Storage is object storage, BigQuery is designed for analytics, and Cloud Interconnect provides network connectivity. Therefore, Memorystore should be considered when a fast in-memory cache is needed.

Question 335

A company wants to make a private Google Cloud service available to another project without requiring broad network access to the service provider’s VPC. Which architecture is most appropriate?

1. Private Service Connect
2. VPC Network Peering
3. Public IP exposure
4. Cloud CDN

Correct Answer: 1

Explanation

Private Service Connect allows a service producer to publish supported services privately while consumers connect through private endpoints. This avoids giving consumers broad network-level access to the producer’s VPC and creates a more controlled service-consumption model. VPC Network Peering connects entire VPC networks and may provide broader network connectivity than required for a service-specific architecture. Public IP exposure increases external exposure, while Cloud CDN is intended for content delivery. Therefore, Private Service Connect is the appropriate choice for privately publishing a service across projects.

Question 336

A company wants to control which Google Cloud APIs can be used by projects under a specific organizational unit. Which governance approach should the architect investigate?

1. Organization Policy and centralized project governance
2. Cloud CDN
3. Local SSD
4. Memorystore

Correct Answer: 1

Explanation

Centralized organizational governance can be used to establish restrictions and standards across projects. Organization Policy provides supported constraints that can be inherited through the resource hierarchy, while project-level administration and API controls can be managed according to the organization’s governance model. This allows administrators to establish consistent controls for groups of projects rather than configuring every workload independently. Cloud CDN, Local SSD, and Memorystore address application delivery, local storage, and caching rather than organizational governance. Therefore, centralized organization and project governance should be investigated for this requirement.

Question 337

A company has a latency-sensitive workload that requires fast local temporary storage attached directly to the VM. Which storage option should it consider?

1. Local SSD
2. Cloud Storage Archive
3. Filestore
4. Cloud DNS

Correct Answer: 1

Explanation

Local SSD provides high-performance local block storage attached to a Compute Engine VM. It is suitable for workloads that require very low-latency temporary storage, such as caches, scratch space, and intermediate processing data. Local SSD data is not intended to provide the same persistence guarantees as durable storage services, so applications should not use it as the sole location for critical persistent data. Cloud Storage Archive is object storage for long-term data, Filestore provides shared file storage, and Cloud DNS provides name resolution. Therefore, Local SSD is appropriate for temporary high-performance storage.

Question 338

A company wants to maintain a copy of database data that can be promoted or used during a regional disaster while keeping the primary workload in another region. Which architectural consideration is most important?

1. Recovery objectives and replication behavior
2. DNS record formatting only
3. CDN cache duration only
4. VM hostname length

Correct Answer: 1

Explanation

A regional disaster-recovery architecture must be designed around recovery objectives such as RPO and RTO, along with the replication characteristics of the chosen database technology. Architects should determine how much data loss is acceptable, how quickly the application must be restored, whether replication is synchronous or asynchronous, and how the secondary environment will be activated. DNS configuration may be part of the final failover process but is not the primary architectural consideration. Therefore, recovery objectives and replication behavior should drive the design of the secondary database environment.

Question 339

A company wants to move an existing application to Google Cloud while changing its underlying platform to a managed database and managed application runtime, but without completely redesigning the application. Which migration strategy best fits?

1. Rehost
2. Replatform
3. Retire
4. Archive

Correct Answer: 2

Explanation

Replatforming involves moving an application to a new environment while making selected modifications that take advantage of managed services or cloud capabilities. For example, an organization might move from a self-managed database to a managed database service while keeping most application functionality intact. Rehosting generally involves fewer changes and resembles lift-and-shift migration. Retiring removes an application rather than migrating it, while archiving refers to preserving information rather than changing application platforms. Therefore, replatforming best fits a migration involving targeted modernization without a complete redesign.

Question 340

A company wants to automatically scale compute resources according to workload demand while maintaining minimum and maximum capacity limits. Which capability should it configure?

1. Autoscaling
2. Cloud Audit Logs
3. Cloud KMS
4. Private Cloud DNS

Correct Answer: 1

Explanation

Autoscaling allows supported Google Cloud resources to adjust capacity according to workload demand. Architects can define limits such as minimum and maximum capacity to ensure that the workload maintains a baseline while preventing uncontrolled resource growth. The specific autoscaling implementation depends on the service, but the underlying goal is to match available capacity with changing demand. Cloud Audit Logs records activity, Cloud KMS manages cryptographic keys, and private Cloud DNS provides internal name resolution. Therefore, autoscaling should be configured when compute capacity must dynamically follow workload demand.