View Full Google Professional Cloud Architect Exam Dumps and Practice Test Dumps.

 

Question 361

A company wants to allow an external workload running outside Google Cloud to access specific Google Cloud resources without storing a service account key. Which capability should it evaluate?

1. Cloud CDN
2. Workload Identity Federation
3. Cloud Scheduler
4. Cloud Storage lifecycle management

Correct Answer: 2

Explanation

Workload Identity Federation allows external workloads to obtain access to Google Cloud resources without requiring long-lived service account keys. Instead of distributing private credentials, the external identity can be exchanged for short-lived Google Cloud credentials according to configured trust and authorization policies. This approach can reduce credential-management risks and is useful for workloads running outside Google Cloud, such as in another cloud or an external environment. Cloud CDN, Cloud Scheduler, and Cloud Storage lifecycle management address different requirements. Therefore, Workload Identity Federation should be evaluated for this scenario.

Question 362

A company has a latency-sensitive application deployed in several regions. It wants users to reach the application through one globally accessible frontend while traffic is distributed among healthy backends. Which service should it use?

1. Filestore
2. Cloud Scheduler
3. Global external Application Load Balancer
4. Cloud KMS

Correct Answer: 3

Explanation

A global external Application Load Balancer provides a globally accessible frontend and can distribute incoming traffic across eligible backend services. It can support multi-region architectures where workloads are deployed closer to users and traffic should be directed to appropriate healthy backends. This can improve availability and user experience while centralizing traffic management. Filestore provides file storage, Cloud Scheduler handles scheduled tasks, and Cloud KMS manages encryption keys. Therefore, a global external Application Load Balancer is appropriate for a globally distributed, latency-sensitive application.

Question 363

A security team wants to determine which users accessed a sensitive Google Cloud resource and review the corresponding administrative activity. Which capability should it use?

1. Cloud Audit Logs
2. Cloud CDN
3. Cloud NAT
4. Cloud Run

Correct Answer: 1

Explanation

Cloud Audit Logs provides records of administrative and other supported activities involving Google Cloud resources. Security teams can use these records to investigate resource access, configuration changes, and administrative operations according to the applicable audit-log categories. This information can support security investigations, compliance reviews, and incident response. Cloud CDN provides content delivery, Cloud NAT provides outbound network translation, and Cloud Run executes containerized applications. Therefore, Cloud Audit Logs should be used when security personnel need an auditable record of relevant activity involving sensitive resources.

Question 364

A company wants to run a service that receives HTTP requests but does not want to manage servers, operating systems, or Kubernetes nodes. Which platform is most suitable?

1. Compute Engine
2. GKE Standard
3. Cloud Run
4. Cloud Interconnect

Correct Answer: 3

Explanation

Cloud Run provides a fully managed environment for running containerized HTTP services without requiring teams to administer VM instances or Kubernetes nodes. It can automatically adjust service capacity according to incoming traffic and is well suited to stateless web applications and APIs. Compute Engine requires VM administration, while GKE Standard requires management of Kubernetes infrastructure and node pools. Cloud Interconnect is a network connectivity service rather than an application runtime. Therefore, Cloud Run is the most suitable platform when managed HTTP container execution is required.

Question 365

A company wants to ensure that a production project cannot create resources in locations that violate its data-residency requirements. Which control should be applied at the appropriate level of the resource hierarchy?

1. Cloud Trace
2. Organization Policy location constraint
3. Cloud CDN
4. Memorystore

Correct Answer: 2

Explanation

Organization Policy supports location constraints that can restrict where supported Google Cloud resources are created. Applying such a constraint at an organization or folder level can establish a centralized requirement that projects beneath that hierarchy follow the approved location policy. This helps address data-residency and regulatory requirements consistently. Cloud Trace provides distributed tracing, Cloud CDN handles content delivery, and Memorystore provides caching. Therefore, an Organization Policy location constraint is the appropriate governance mechanism for restricting production resource locations.

Question 366

An application receives millions of events from users and several independent services need to process those events at their own pace. Which architecture is most appropriate?

1. Pub/Sub with multiple subscriptions
2. One shared database table
3. Direct synchronous API calls
4. Cloud DNS forwarding

Correct Answer: 1

Explanation

Pub/Sub supports a publish-subscribe architecture in which producers publish events to a topic and multiple subscriptions can independently receive those events. Each consuming service can process messages according to its own capacity and requirements, reducing direct dependencies between the producer and consumers. This architecture also provides buffering and asynchronous communication. A shared database table can create contention and tighter coupling, while synchronous calls increase dependency between services. Cloud DNS forwarding does not provide event-delivery functionality. Therefore, Pub/Sub with multiple subscriptions is appropriate.

Question 367

A company needs a relational database for an application that requires PostgreSQL compatibility but has modest scale and does not require global horizontal database distribution. Which service should it evaluate?

1. Cloud Spanner
2. Bigtable
3. Cloud SQL for PostgreSQL
4. Firestore

Correct Answer: 3

Explanation

Cloud SQL for PostgreSQL provides a managed PostgreSQL database environment suitable for applications that need PostgreSQL compatibility without requiring a globally distributed database architecture. It handles many infrastructure and database administration responsibilities, making it appropriate for conventional relational workloads with moderate scale. Cloud Spanner is designed for distributed relational workloads with stronger global scalability requirements, Bigtable is a wide-column database, and Firestore is document-oriented. Therefore, Cloud SQL for PostgreSQL should be evaluated for a conventional managed PostgreSQL application with modest scale.

Question 368

A company wants to route selected application logs into BigQuery so analysts can perform SQL-based investigations. Which configuration should the architect recommend?

1. Cloud CDN
2. Log sink to BigQuery
3. Cloud NAT
4. Private Service Connect

Correct Answer: 2

Explanation

Cloud Logging log sinks can route selected log entries to BigQuery. This allows organizations to create centralized analytical workflows in which logs are filtered and exported for SQL-based investigation, reporting, or security analysis. Administrators can define filters to avoid sending unnecessary log data and can structure destinations according to organizational requirements. Cloud CDN provides caching, Cloud NAT provides outbound connectivity, and Private Service Connect provides private service connectivity. Therefore, a log sink targeting BigQuery is appropriate for analyzing selected logs with SQL.

Question 369

A company wants to reduce latency for repeated database queries by caching frequently requested results in memory. Which architectural pattern should it use?

1. In-memory caching
2. Cold archival storage
3. Batch-only processing
4. DNS forwarding

Correct Answer: 1

Explanation

An in-memory caching pattern stores frequently requested information in a low-latency cache so applications do not need to repeatedly retrieve the same data from a slower backend database. Memorystore can provide a managed implementation of this pattern for supported workloads. Effective cache design requires decisions about expiration, invalidation, consistency, and behavior when cached entries are unavailable. Cold archival storage is optimized for infrequent access, batch processing is intended for scheduled or large-scale processing, and DNS forwarding addresses name resolution. Therefore, in-memory caching is the appropriate pattern.

Question 370

A company wants to establish a private hybrid connection but has moderate traffic and prefers an encrypted tunnel over the public internet rather than dedicated physical connectivity. Which solution should it evaluate?

1. HA VPN
2. Cloud Interconnect
3. Cloud CDN
4. Filestore

Correct Answer: 1

Explanation

HA VPN provides highly available IPsec connectivity between an on-premises environment and Google Cloud using the public internet. It is appropriate when encrypted tunnels are sufficient and the organization does not require dedicated private connectivity. Cloud Interconnect provides private connectivity and is more appropriate for organizations with requirements involving substantial traffic, predictable capacity, or private network paths. Cloud CDN and Filestore address content delivery and shared file storage. Therefore, HA VPN should be evaluated when encrypted internet-based hybrid connectivity is preferred.

Question 371

A company needs a managed database capable of handling very high-throughput key-value workloads with low latency and massive scale. Which service should it consider?

1. Cloud SQL
2. Bigtable
3. Firestore
4. Filestore

Correct Answer: 2

Explanation

Bigtable is designed for large-scale, low-latency workloads involving high-throughput reads and writes using a wide-column data model. It is well suited to use cases such as time-series data, operational analytics, and workloads involving very large numbers of records with predictable key-based access patterns. Cloud SQL provides relational databases, Firestore provides a document-oriented model, and Filestore provides shared file storage. Therefore, Bigtable should be considered when the primary requirement is massive scale and high-throughput low-latency access.

Question 372

A company wants to protect sensitive application credentials while allowing authorized applications to retrieve the latest secret version at runtime. Which service should it use?

1. Cloud KMS
2. Secret Manager
3. Cloud Storage
4. Cloud Monitoring

Correct Answer: 2

Explanation

Secret Manager is designed to store and manage sensitive application information such as passwords, API credentials, tokens, and certificates. Applications can retrieve authorized secret versions at runtime instead of embedding credentials directly in source code or configuration files. Secret Manager also supports secret versioning and access control through IAM. Cloud KMS focuses on cryptographic key management, Cloud Storage provides object storage, and Cloud Monitoring provides operational observability. Therefore, Secret Manager should be used for runtime management of application credentials.

Question 373

A company has a VM-based application that requires full operating-system control, custom software installation, and specialized kernel configuration. Which compute service is appropriate?

1. Cloud Run
2. App Engine
3. Compute Engine
4. BigQuery

Correct Answer: 3

Explanation

Compute Engine provides virtual machines where organizations can select machine configurations and retain significant control over the operating system, installed software, networking, and system-level settings. This makes it suitable for applications that require specialized operating-system configuration or software that cannot easily run on more managed platforms. Cloud Run abstracts server infrastructure for containers, App Engine provides a managed application platform, and BigQuery is an analytics service. Therefore, Compute Engine is appropriate when full VM and operating-system control is a key requirement.

Question 374

A company wants to automatically scale a VM-based application according to traffic while also replacing unhealthy instances. Which combination should the architect configure?

1. Cloud Storage lifecycle rules and Cloud CDN
2. MIG autoscaling and autohealing
3. Cloud DNS and Cloud KMS
4. Pub/Sub and Cloud Scheduler

Correct Answer: 2

Explanation

Managed instance group autoscaling and autohealing address two different but complementary requirements. Autoscaling adjusts the number of VM instances according to workload demand, while autohealing uses health checks to identify unhealthy instances and recreate them when necessary. Together, these capabilities can maintain both appropriate capacity and instance health for a VM-based application. The other combinations address storage, content delivery, DNS, encryption, messaging, or scheduling rather than compute scaling and recovery. Therefore, MIG autoscaling and autohealing should be configured.

Question 375

A company wants to store an application configuration file that is not highly sensitive but needs durable object storage and versioning capabilities. Which service should it consider?

1. Cloud Storage
2. Cloud Spanner
3. Cloud Router
4. Memorystore

Correct Answer: 1

Explanation

Cloud Storage provides durable object storage suitable for files such as configuration artifacts, documents, backups, and other unstructured data. Object versioning can help preserve previous versions when supported and appropriately configured, which can be useful for recovering from accidental overwrites or maintaining historical copies. Cloud Spanner is a distributed relational database, Cloud Router manages dynamic routing, and Memorystore provides in-memory caching. Therefore, Cloud Storage should be considered for durable configuration-file storage when an object-storage model is appropriate.

Question 376

A company wants to establish a service-level target for application availability and track whether the target is being achieved. Which concept represents the target?

1. SLI
2. SLO
3. RPO
4. RTO

Correct Answer: 2

Explanation

A Service Level Objective, or SLO, defines a target level of service performance or reliability, such as a specified availability percentage. An SLI is the measurement used to evaluate that characteristic, while the SLO defines the desired target for the measured indicator. RPO and RTO are disaster-recovery concepts concerned with acceptable data loss and restoration time. Therefore, an SLO represents the target the organization wants its service to achieve and provides a basis for evaluating reliability performance.

Question 377

A company wants to identify underutilized cloud resources and receive recommendations that could reduce unnecessary spending. Which Google Cloud capability should it investigate?

1. Active Assist
2. Cloud CDN
3. Pub/Sub
4. Cloud DNS

Correct Answer: 1

Explanation

Active Assist provides recommendations and insights that can help organizations optimize their Google Cloud environments. Depending on the supported recommendation, it can identify opportunities involving resource utilization, cost, security, reliability, or other operational considerations. Recommendations should be reviewed against application requirements before changes are implemented because automated suggestions may not capture every business constraint. Cloud CDN, Pub/Sub, and Cloud DNS provide content delivery, messaging, and DNS services rather than broad optimization recommendations. Therefore, Active Assist should be investigated for identifying potential resource optimization opportunities.

Question 378

A company requires a recovery strategy that restores a critical application within five minutes after a major outage. Which metric defines this requirement?

1. RPO
2. SLI
3. RTO
4. SLA

Correct Answer: 3

Explanation

Recovery Time Objective, or RTO, defines the maximum targeted time required to restore a service after a disruptive event. If a business requires a critical application to be restored within five minutes, that restoration requirement represents an RTO of five minutes. RPO instead defines the acceptable amount of data loss measured in time. SLI measures a service characteristic, while SLA represents a contractual or formal service commitment where applicable. Therefore, RTO is the correct metric for defining the required recovery time.

Question 379

A company wants to prevent application teams from creating certain types of resources across an entire folder. Which Google Cloud feature should it use?

1. Organization Policy
2. Cloud Trace
3. Cloud CDN
4. Memorystore

Correct Answer: 1

Explanation

Organization Policy can apply supported constraints at the organization, folder, or project level. Applying a policy to a folder allows common governance requirements to affect projects and resources within that hierarchy. This is useful when application teams should be prevented from creating or configuring resources in ways that violate centralized security, compliance, or operational standards. Cloud Trace provides distributed tracing, Cloud CDN handles content delivery, and Memorystore provides caching. Therefore, Organization Policy is the appropriate mechanism for folder-level resource governance.

Question 380

A company wants to continuously deploy applications while using automated build processes and controlled promotion between environments. Which combination provides a suitable CI/CD architecture?

1. Cloud Build and Cloud Deploy
2. Cloud DNS and Cloud NAT
3. Cloud Storage and Filestore
4. Cloud Trace and Cloud Monitoring

Correct Answer: 1

Explanation

Cloud Build can automate application builds, tests, and related CI activities, while Cloud Deploy can manage controlled delivery and promotion of releases through deployment environments. Together, they can form a managed CI/CD workflow that separates build automation from release management. This supports repeatable deployments and can incorporate validation or approval stages according to the delivery design. Cloud DNS and Cloud NAT address networking, Cloud Storage and Filestore provide different storage models, and Cloud Trace and Cloud Monitoring focus on observability. Therefore, Cloud Build and Cloud Deploy provide a suitable CI/CD combination.