Google Professional Cloud Architect practice questions

1. Question 1 of 25

   You write a Python script to connect to Google BigQuery from a Google Compute Engine virtual machine. The script is printing errors that it cannot connect to BigQuery. What should you do to fix the script?

   • AInstall the latest BigQuery API client library for Python
   • BRun your script on a new virtual machine with the BigQuery access scope enabled
   • CCreate a new service account with BigQuery access and execute your script with that user
   • DInstall the bq component for gcloud with the command gcloud components install bq.

   Show answer

   Correct answer: C

   How others answered

   • C80%
   • B19%

   Explanation

   A - If client library was not installed, the python scripts won't run - since the question states the script reports "cannot connect" - the client library must have been installed. so it's B or C. B - https://cloud.google.com/bigquery/docs/authorization an access scope is how your client application retrieve access_token with access permission in OAuth when you want to access services via API call - in this case, it is possible that the python script use an API call instead of library, if this is true, then access scope is required. client library requires no access scope (as it does not go through OAuth) C - service account is Google Cloud's best practice So prefer C.

   Adapted from community discussion by kalschi · 2024-09-20 · 99 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

   1. K

      kalschi

      2024-09-20

      99 upvotes

      A - If client library was not installed, the python scripts won't run - since the question states the script reports "cannot connect" - the client library must have been installed. so it's B or C. B - https://cloud.google.com/bigquery/docs/authorization an access scope is how your client application retrieve access_token with access permission in OAuth when you want to access services via API call - in this case, it is possible that the python script use an API call instead of library, if this is true, then access scope is required. client library requires no access scope (as it does not go through OAuth) C - service account is Google Cloud's best practice So prefer C.

   2. C

      cloudguy1

      2020-08-14

      36 upvotes

      Stop confusing people, B) doesn't make any sense. Why would you use or create a whole new VM just because of a permission issue? If anything, just stop the instance and edit the scope of the default Compute Service Account and grant it the role through IAM. C) is the most appropriate answer since you can only set scopes of the default Compute Service Account, if you're using any other, there's no scope option - its access is dictated strictly by IAM in such scenario. So C) is the answer: Stop the VM, change the Service Account with the appropriate permissions and done. B) would still need to have permission the set through IAM & Admin, the scope isn't enough with the default Compute Service Account.

   3. T

      tartar

      2020-08-14

      15 upvotes

      Sorry, B is ok. You can create service account, add user to service account, and grant the user role as Service Account User. You still need to enable BigQuery scope to make the Python script running the instance to access BigQuery.

   4. R

      rishab86

      2021-10-09

      11 upvotes

      Access scopes are the legacy method of specifying permissions for your instance. read from > https://cloud.google.com/compute/docs/access/service-accounts . So , I would go with C

2. Question 2 of 25

   You need to ensure reliability for your application and operations by supporting reliable task scheduling for compute on GCP. Leveraging Google best practices, what should you do?

   • AUsing the Cron service provided by App Engine, publish messages directly to a message-processing utility service running on Compute Engine instances.
   • BUsing the Cron service provided by App Engine, publish messages to a Cloud Pub/Sub topic. Subscribe to that topic using a message-processing utility service running on Compute Engine instances.
   • CUsing the Cron service provided by Google Kubernetes Engine (GKE), publish messages directly to a message-processing utility service running on Compute Engine instances.
   • DUsing the Cron service provided by GKE, publish messages to a Cloud Pub/Sub topic. Subscribe to that topic using a message-processing utility service running on Compute Engine instances.

   Show answer

   Correct answer: B

   How others answered

   • B97%

   Explanation

   Answer is B, but this question is outdated, Today the best practices for cron is Cloud Scheduler: fully managed enterprise-grade cron job scheduler https://cloud.google.com/scheduler/?gad_source=1&gclsrc=ds&gclsrc=ds

   Adapted from community discussion by odacir · 2024-05-18 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

   1. S

      Smart

      2020-08-25

      30 upvotes

      B is correct. More appropriately: https://cloud.google.com/solutions/reliable-task-scheduling-compute-engine

   2. O

      odacir

      2024-05-18

      Selected B20 upvotes

      Answer is B, but this question is outdated, Today the best practices for cron is Cloud Scheduler: fully managed enterprise-grade cron job scheduler https://cloud.google.com/scheduler/?gad_source=1&gclsrc=ds&gclsrc=ds

   3. B

      beehive

      2023-06-30

      8 upvotes

      Answer is B. Cloud Scheduler provides a fully managed, enterprise-grade service that lets you schedule events. After you have scheduled a job, Cloud Scheduler will call the configured event handlers, which can be App Engine services, HTTP endpoints, or Pub/Sub subscriptions. To run tasks on your Compute Engine instance in response to Cloud Scheduler events, you need to relay the events to those instances. One way to do this is by calling an HTTP endpoint that runs on your Compute Engine instances. Another option is to pass messages from Cloud Scheduler to your Compute Engine instances using Pub/Sub.

   4. J

      JPA210

      2024-04-11

      9 upvotes

      This seems to be an old question, despite B could be the more correct answer, it is not exactly a good one. 'Using the Cron service provided by App Engine', the cron service is provided by Cloud Scheduler, not App Engine. App Engine HTTP endpoint can be a target for the cron task.

3. Question 3 of 25

   Your company is building a new architecture to support its data-centric business focus. You are responsible for setting up the network. Your company's mobile and web-facing applications will be deployed on-premises, and all data analysis will be conducted in GCP. The plan is to process and load 7 years of archived .csv files totaling 900 TB of data and then continue loading 10 TB of data daily. You currently have an existing 100-MB internet connection. What actions will meet your company's needs?

   • ACompress and upload both archived files and files uploaded daily using the gsutil ג€"m option.
   • BLease a Transfer Appliance, upload archived files to it, and send it to Google to transfer archived data to Cloud Storage. Establish a connection with Google using a Dedicated Interconnect or Direct Peering connection and use it to upload files daily.
   • CLease a Transfer Appliance, upload archived files to it, and send it to Google to transfer archived data to Cloud Storage. Establish one Cloud VPN Tunnel to VPC networks over the public internet, and compress and upload files daily using the gsutil ג€"m option.
   • DLease a Transfer Appliance, upload archived files to it, and send it to Google to transfer archived data to Cloud Storage. Establish a Cloud VPN Tunnel to VPC networks over the public internet, and compress and upload files daily.

   Show answer

   Correct answer: B

   How others answered

   • B90%

   Explanation

   Hmm. Not easy. Everybody tends to B. But I think that can't be correct for the simple reason... A is obviously not an option because of the initial amount of data. It could be that through compression the amount can be extremely reduced (I saw examples down to 5% of the original size). But the assumption at that point is, that the entropy is high => that means the compression is not necessarily the most important factor. B: The answer doesn't say anything about the reach-ability of the interconnect / peering (meaning IXP's). So one has to assume that they CAN'T be reached. That means that only C/D can be correct. I would tend to C because Google obviously would always recommend their own tools (gsutil). Then the hope would be that the compression and the bandwidth of the VPN is enough to get accomplish the job successfully.

   Adapted from community discussion by cpi_web · 2022-05-14 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

   1. K

      KouShikyou

      2019-10-09

      53 upvotes

      With option A, daily data would take 27 hours. My answer is B. How do you think?

   2. W

      wk

      2019-10-20

      21 upvotes

      Agree B. 100Mbps connections for 10TB data transfer is takes too long https://cloud.google.com/solutions/transferring-big-data-sets-to-gcp#close

   3. C

      chiar

      2019-10-15

      7 upvotes

      It's depends on the compression. You are compressing before, you don't know how much it will occupy. But I'would choose B answer too. But I'm not sure

   4. 9

      9xnine

      2022-06-03

      6 upvotes

      Dedicated Interconnect will be a new connection and will not run over the existing internet connection. With dedicated interconnect the existing ISP becomes irrelevant. If you were trying to use VPN the existing internet connection would be relevant. Answer is B.

4. Question 4 of 25

   You are developing a globally scaled frontend for a legacy streaming backend data API. This API expects events in strict chronological order with no repeat data for proper processing. Which products should you deploy to ensure guaranteed-once FIFO (first-in, first-out) delivery of data?

   • ACloud Pub/Sub alone
   • BCloud Pub/Sub to Cloud Dataflow
   • CCloud Pub/Sub to Stackdriver
   • DCloud Pub/Sub to Cloud SQL

   Show answer

   Correct answer: B

   How others answered

   • B59%
   • A41%

   Only 59% agreed on this answer — treat it as contested rather than settled.

   Explanation

   I believe the answer is B. "Pub/Sub doesn't provide guarantees about the order of message delivery. Strict message ordering can be achieved with buffering, often using Dataflow." https://cloud.google.com/solutions/data-lifecycle-cloud-platform

   Adapted from community discussion by exampanic · 2020-01-02 · 69 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

   1. E

      exampanic

      2020-01-02

      69 upvotes

      I believe the answer is B. "Pub/Sub doesn't provide guarantees about the order of message delivery. Strict message ordering can be achieved with buffering, often using Dataflow." https://cloud.google.com/solutions/data-lifecycle-cloud-platform

   2. X

      xhova

      2020-05-04

      28 upvotes

      B is the answer. CloudSQL is only for storage, to get the messages in order you need timestamp processed in dataflow to arrange them before putting it in any storage volume. The system described is not querying a db it is expecting a stream of messages only dataflow can correct the order. ACID has no value here because the db is not being queried. You'll not find any documentation on pub/sub order being corrected with a db. See notes below on pub/sub and dataflow using timestamps and windows to ensure order https://cloud.google.com/pubsub/docs/pubsub-dataflow

   3. J

      jask

      2021-09-30

      14 upvotes

      Answer is B. The question is talking about guaranteed-once FIFO delivery of data. Although Pub/sub provides data in order (FIFO) but it does 'at-least' once delivery of data. So, we need Dataflow for deduplication of data.

   4. O

      omermahgoub

      2022-12-22

      8 upvotes

      To ensure guaranteed-once FIFO (first-in, first-out) delivery of data from a globally scaled frontend to a legacy streaming backend data API, you can use Cloud Pub/Sub in combination with Cloud Dataflow. Cloud Pub/Sub is a fully-managed messaging service that enables you to send and receive messages between independent systems. It provides a range of features to ensure the delivery of messages, including at-least-once delivery, ordering guarantees, and message deduplication. Cloud Dataflow is a fully-managed, cloud-native data processing service that allows you to build and deploy data processing pipelines that can process unbounded streams of data. It can be used to process data from Cloud Pub/Sub in a streaming fashion, ensuring that messages are processed in strict chronological order with no repeat data. Together, Cloud Pub/Sub and Cloud Dataflow can provide a reliable, scalable solution for delivering data from a globally scaled frontend to a legacy streaming backend data API, ensuring guaranteed-once FIFO delivery of the data.

5. Question 5 of 25

   Your company is planning to perform a lift and shift migration of their Linux RHEL 6.5+ virtual machines. The virtual machines are running in an on-premises VMware environment. You want to migrate them to Compute Engine following Google-recommended practices. What should you do?

   • A1. Define a migration plan based on the list of the applications and their dependencies. 2. Migrate all virtual machines into Compute Engine individually with Migrate for Compute Engine.
   • B1. Perform an assessment of virtual machines running in the current VMware environment. 2. Create images of all disks. Import disks on Compute Engine. 3. Create standard virtual machines where the boot disks are the ones you have imported.
   • C1. Perform an assessment of virtual machines running in the current VMware environment. 2. Define a migration plan, prepare a Migrate for Compute Engine migration RunBook, and execute the migration.
   • D1. Perform an assessment of virtual machines running in the current VMware environment. 2. Install a third-party agent on all selected virtual machines. 3. Migrate all virtual machines into Compute Engine.

   Show answer

   Correct answer: C

   How others answered

   • C93%

   Explanation

   Ans ) C , Migrate for Compute Engine organizes groups of VMs into Waves. After understanding the dependencies of your applications, create runbooks that contain groups of VMs and begin your migration! https://cloud.google.com/migrate/compute-engine/docs/4.5/how-to/migrate-on-premises-to-gcp/overview

   Adapted from community discussion by kopper2019 · 2021-07-01 · 36 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

   1. K

      kopper2019

      2021-07-01

      36 upvotes

      Ans ) C , Migrate for Compute Engine organizes groups of VMs into Waves. After understanding the dependencies of your applications, create runbooks that contain groups of VMs and begin your migration! https://cloud.google.com/migrate/compute-engine/docs/4.5/how-to/migrate-on-premises-to-gcp/overview

   2. E

      examch

      2023-01-01

      Selected C2 upvotes

      C is the correct answer, Runbooks are created from the Migrate for Compute Engine Manager. The system queries VMware or AWS for VMs and generates a CSV for you to edit. By editing the CSV, you define: The VMs in a wave. The order in which those VMs are migrated. The type and disk space of VMs that are launched on Google Cloud. Other characteristics that are defined in the Runbook reference. https://cloud.google.com/migrate/compute-engine/docs/4.8/how-to/organizing-migrations/creating-and-modifying-runbooks#generating_runbook_templates

   3. A

      atlasga

      2021-12-24

      3 upvotes

      When you are doing cloud migrations, you do migrations in "waves" which are groupings of one or more applications/workloads. Moving machines individually would break things, such as dependencies. This is standard industry practice.

   4. P

      plumbig11

      2024-12-31

      Selected C1 upvote

      1. Perform an assessment of virtual machines running in the current VMware environment. (You should as best pratice perform an assessment of virtual machines and define a migration plan) 2. Define a migration plan, prepare a Migrate for Compute Engine migration RunBook, and execute the migration. (compute Engine migration Runbook is the best pratice)

6. Question 6 of 25

   You need to deploy an application to Google Cloud. The application receives traffic via TCP and reads and writes data to the filesystem. The application does not support horizontal scaling. The application process requires full control over the data on the file system because concurrent access causes corruption. The business is willing to accept a downtime when an incident occurs, but the application must be available 24/7 to support their business operations. You need to design the architecture of this application on Google Cloud. What should you do?

   • AUse a managed instance group with instances in multiple zones, use Cloud Filestore, and use an HTTP load balancer in front of the instances.
   • BUse a managed instance group with instances in multiple zones, use Cloud Filestore, and use a network load balancer in front of the instances.
   • CUse an unmanaged instance group with an active and standby instance in different zones, use a regional persistent disk, and use an HTTP load balancer in front of the instances.
   • DUse an unmanaged instance group with an active and standby instance in different zones, use a regional persistent disk, and use a network load balancer in front of the instances.

   Show answer

   Correct answer: D

   How others answered

   • D82%
   • B18%

   Explanation

   Correct Ans : D Since the Traffic is TCP, Ans A & C gets eliminated as HTTPS load balance is not supported. B - File storage system is Cloud Firestore which do not give full control, hence eliminated. D - Unmanaged instance group with network load balance with regional persistent disk for storage gives full control which is required for the migration.

   Adapted from community discussion by VishalB · 2022-01-06 · 63 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

   1. V

      VishalB

      2022-01-06

      63 upvotes

      Correct Ans : D Since the Traffic is TCP, Ans A & C gets eliminated as HTTPS load balance is not supported. B - File storage system is Cloud Firestore which do not give full control, hence eliminated. D - Unmanaged instance group with network load balance with regional persistent disk for storage gives full control which is required for the migration.

   2. K

      kopper2019

      2022-01-01

      29 upvotes

      Ans ) D , unmanaged instance group as application does not support horizontal scaling and network load balancer as no mention of http traffic .

   3. O

      omermahgoub

      2023-06-22

      21 upvotes

      An unmanaged instance group allows you to create and manage a group of Compute Engine instances manually, rather than using an autoscaling solution like a managed instance group. This is appropriate for an application that does not support horizontal scaling, as you can manually create and manage the number of instances needed to meet the traffic demands. To ensure high availability and minimize downtime, you should deploy the instances in different zones and use a regional persistent disk to store the application's data. This will ensure that the application is still available even if one of the instances or a zone experiences an outage. A network load balancer should be used in front of the instances to distribute traffic to the instances. A network load balancer is a highly available and scalable load balancing solution that operates at the network layer and can handle high volumes of traffic. It can also balance traffic across multiple zones to ensure that the application is always available to users.

   4. J

      JC0926

      2023-09-19

      Selected D17 upvotes

      Since the application does not support horizontal scaling, a managed instance group is not required. Instead, an unmanaged instance group can be used to ensure that the application runs on multiple instances in different zones for high availability. The network load balancer is designed to handle TCP and UDP traffic The HTTP(S) load balancer is designed specifically for HTTP and HTTPS traffic.

7. Question 7 of 25

   You are managing an application deployed on Cloud Run for Anthos, and you need to define a strategy for deploying new versions of the application. You want to evaluate the new code with a subset of production traffic to decide whether to proceed with the rollout. What should you do?

   • ADeploy a new revision to Cloud Run with the new version. Configure traffic percentage between revisions.
   • BDeploy a new service to Cloud Run with the new version. Add a Cloud Load Balancing instance in front of both services.
   • CIn the Google Cloud Console page for Cloud Run, set up continuous deployment using Cloud Build for the development branch. As part of the Cloud Build trigger, configure the substitution variable TRAFFIC_PERCENTAGE with the percentage of traffic you want directed to a new version.
   • DIn the Google Cloud Console, configure Traffic Director with a new Service that points to the new version of the application on Cloud Run. Configure Traffic Director to send a small percentage of traffic to the new version of the application.

   Show answer

   Correct answer: A

   How others answered

   • A76%
   • C24%

   Explanation

    Correct Answer: A o Each deployment to a service creates a revision. A revision consists of a specific container image, along with environment settings such as environment variables, memory limits, or concurrency value. o Once the new revision is deployed to a Service you can manage the traffic using MANAGE TRAFFIC option inside the revision tab  https://cloud.google.com/run/docs/resource-model

   Adapted from community discussion by VishalB · 2022-01-07 · 54 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

   1. V

      VishalB

      2022-01-07

      54 upvotes

       Correct Answer: A o Each deployment to a service creates a revision. A revision consists of a specific container image, along with environment settings such as environment variables, memory limits, or concurrency value. o Once the new revision is deployed to a Service you can manage the traffic using MANAGE TRAFFIC option inside the revision tab  https://cloud.google.com/run/docs/resource-model

   2. O

      omermahgoub

      2023-06-22

      19 upvotes

      The correct answer is A. Deploy a new revision to Cloud Run with the new version. Configure traffic percentage between revisions. Cloud Run for Anthos allows you to deploy new revisions of your application with a specific percentage of traffic, which allows you to perform a gradual rollout of the new version. To do this, you can follow these steps: Deploy a new revision of your application to Cloud Run with the new version. In the Cloud Run for Anthos console, navigate to the service that you want to roll out the new version for. In the "Revisions" tab, you should see the new revision listed alongside the current revision. Use the traffic percentage slider to specify the percentage of traffic that you want to send to the new revision. You can set the percentage to a small value initially, such as 5%, and gradually increase it over time as you evaluate the new version. Once you have set the traffic percentage, Cloud Run for Anthos will start directing a portion of the traffic to the new revision, allowing you to evaluate the new version with a subset of production traffic.

   3. O

      omermahgoub

      2023-06-22

      11 upvotes

      Option B, deploying a new service and adding a Cloud Load Balancer instance in front of both services, is not recommended because it would require you to create and manage a separate service for the new version, which would be more complex and less efficient than deploying a new revision. Option C, using continuous deployment with Cloud Build and substitution variables, is not relevant to this scenario because it involves deploying new versions automatically based on changes to a development branch, rather than manually deploying new revisions with a specific percentage of traffic. Option D, using Traffic Director, is also not relevant because Traffic Director is used for managing traffic between different services or clusters, rather than between revisions of the same service.

   4. K

      kopper2019

      2022-01-01

      13 upvotes

      Ans A, A. Deploy a new revision to Cloud Run with the new version. Configure traffic percentage between revisions.

8. Question 8 of 25

   You are monitoring Google Kubernetes Engine (GKE) clusters in a Cloud Monitoring workspace. As a Site Reliability Engineer (SRE), you need to triage incidents quickly. What should you do?

   • ANavigate the predefined dashboards in the Cloud Monitoring workspace, and then add metrics and create alert policies.
   • BNavigate the predefined dashboards in the Cloud Monitoring workspace, create custom metrics, and install alerting software on a Compute Engine instance.
   • CWrite a shell script that gathers metrics from GKE nodes, publish these metrics to a Pub/Sub topic, export the data to BigQuery, and make a Data Studio dashboard.
   • DCreate a custom dashboard in the Cloud Monitoring workspace for each incident, and then add metrics and create alert policies.

   Show answer

   Correct answer: A

   How others answered

   • A61%
   • D39%

   Only 61% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Answer is A: A. Navigate the predefined dashboards in the Cloud Monitoring workspace, and then add metrics and create alert policies. Cloud Monitoring provides predefined dashboards that display key metrics and resource groupings for various GCP services, including GKE. You can use these dashboards to quickly understand the health of your GKE clusters and identify potential incidents. You can also add additional metrics to the dashboards and create alert policies to be notified when specific conditions are met, allowing you to proactively triage incidents. Option D, creating a custom dashboard in the Cloud Monitoring workspace for each incident, and then adding metrics and creating alert policies, is not a recommended approach. Creating a separate dashboard for each incident may not be necessary or practical, and may add complexity to your monitoring setup. Additionally, you can add metrics and create alert policies on the predefined dashboards to proactively triage incidents.

   Adapted from community discussion by omermahgoub · 2023-06-22 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

   1. D

      DiegoMDZ

      2022-01-07

      31 upvotes

      It's A for me... Create a dashboard for each incident?? I think D isn't a good choice...

   2. O

      omermahgoub

      2023-06-22

      12 upvotes

      Answer is A: A. Navigate the predefined dashboards in the Cloud Monitoring workspace, and then add metrics and create alert policies. Cloud Monitoring provides predefined dashboards that display key metrics and resource groupings for various GCP services, including GKE. You can use these dashboards to quickly understand the health of your GKE clusters and identify potential incidents. You can also add additional metrics to the dashboards and create alert policies to be notified when specific conditions are met, allowing you to proactively triage incidents. Option D, creating a custom dashboard in the Cloud Monitoring workspace for each incident, and then adding metrics and creating alert policies, is not a recommended approach. Creating a separate dashboard for each incident may not be necessary or practical, and may add complexity to your monitoring setup. Additionally, you can add metrics and create alert policies on the predefined dashboards to proactively triage incidents.

   3. E

      ET42

      2022-03-28

      9 upvotes

      D is wrong because you wouldn't create a dashboard for something that has already happened when you need to be addressing it. You'd want a notification of something actively happening, hence you'd set metrics on parameters in the predefined dashboards. You cannot triage as quickly when you are busy setting up a dashboard for a momentary incident that may never happen again. B is wrong because its GKE, not compute engine A is a clear, strait forward answer. Triage off alerts on the environmental variables in play.

   4. H

      hzaoui

      2024-07-22

      Selected A5 upvotes

      Explanation: Cloud Monitoring provides predefined dashboards for monitoring GKE clusters, which facilitate an immediate and comprehensive view of cluster performance and health. As an SRE, utilizing these dashboards helps triage incidents quickly. You can also add additional metrics that are pertinent to the incident and create alert policies that will notify you when specific conditions indicative of an incident are met. This strategy allows for the proactive monitoring of incidents and rapid response when necessary.

9. Question 9 of 25

   Select 2

   You are implementing a single Cloud SQL MySQL second-generation database that contains business-critical transaction data. You want to ensure that the minimum amount of data is lost in case of catastrophic failure. Which two features should you implement? (Choose two.)

   • ASharding
   • BRead replicas
   • CBinary logging
   • DAutomated backups
   • ESemisynchronous replication

   Show answer

   Correct answer: C, D

   How others answered

   • CD76%
   • BD24%

   Explanation

   Ans) C and D Cloud SQL. If you use Cloud SQL, the fully managed Google Cloud MySQL database, you should enable automated backups and binary logging for your Cloud SQL instances. This allows you to perform a point-in-time recovery, which restores your database from a backup and recovers it to a fresh Cloud SQL instance

   Adapted from community discussion by kopper2019 · 2022-01-01 · 38 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

   1. K

      kopper2019

      2022-01-01

      38 upvotes

      Ans) C and D Cloud SQL. If you use Cloud SQL, the fully managed Google Cloud MySQL database, you should enable automated backups and binary logging for your Cloud SQL instances. This allows you to perform a point-in-time recovery, which restores your database from a backup and recovers it to a fresh Cloud SQL instance

   2. N

      Nirca

      2022-12-20

      Selected C, D6 upvotes

      Data lose is being managed via datafiles/database backups. Once a day or once every time interval. Between backups the logs(redo/bin logs/archive logs) must be copied on a continuous manner. Only that way point in time recovery or full recovery without data loss might be successful. Else you will be able to backup-restore. AND not backup-restore-recovery.

   3. O

      odacir

      2024-05-18

      Selected C, D5 upvotes

      Prerequisites for creating a read replica Before you can create a read replica of a primary Cloud SQL instance, the instance must meet the following requirements: Automated backups must be enabled. Binary logging must be enabled which requires point-in-time recovery to be enabled. Learn more about the impact of these logs. At least one backup must have been created after binary logging was enabled. https://cloud.google.com/sql/docs/mysql/replication#requirements

   4. [

      [Removed]

      2024-06-28

      4 upvotes

      CD Binary Logging: Binary logging in MySQL records changes to the database. It can be used for backup and replication, and it's essential for point-in-time recovery. With binary logging, you can roll your database forward to any point in time, minimizing data loss. Automated Backups: Automated backups periodically take a snapshot of your database. In the event of a catastrophic failure, you can restore your database to the state it was in at the time of the last backup. This can also help minimize data loss. While read replicas and semisynchronous replication can enhance availability and performance, they do not directly minimize data loss. Also, you cannot create a read replica without enabling Automated backups and Enable binary logging Sharding can improve performance but it's not directly aimed at data loss prevention. https://cloud.google.com/sql/docs/mysql/backup-recovery/backups

10. Question 10 of 25

    You are working at a sports association whose members range in age from 8 to 30. The association collects a large amount of health data, such as sustained injuries. You are storing this data in BigQuery. Current legislation requires you to delete such information upon request of the subject. You want to design a solution that can accommodate such a request. What should you do?

    • AUse a unique identifier for each individual. Upon a deletion request, delete all rows from BigQuery with this identifier.
    • BWhen ingesting new data in BigQuery, run the data through the Data Loss Prevention (DLP) API to identify any personal information. As part of the DLP scan, save the result to Data Catalog. Upon a deletion request, query Data Catalog to find the column with personal information.
    • CCreate a BigQuery view over the table that contains all data. Upon a deletion request, exclude the rows that affect the subject's data from this view. Use this view instead of the source table for all analysis tasks.
    • DUse a unique identifier for each individual. Upon a deletion request, overwrite the column with the unique identifier with a salted SHA256 of its value.

    Show answer

    Correct answer: A

    How others answered

    • A62%
    • B38%

    Only 62% agreed on this answer — treat it as contested rather than settled.

    Explanation

    According to me, the question states "The association collects a large amount of health data, such as sustained injuries." and the nuance on the word such => " Current legislation requires you to delete "SUCH" information upon request of the subject. " So from that point of view the question is not to delete the entire user records but specific data related to personal health data. With DLP you can use InfoTypes and InfoType detectors to specifically scan for those entries and how to act upon them (link https://cloud.google.com/dlp/docs/concepts-infotypes) I would say B.

    Adapted from community discussion by milan74 · 2021-07-09 · 85 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. M

       milan74

       2021-07-09

       85 upvotes

       According to me, the question states "The association collects a large amount of health data, such as sustained injuries." and the nuance on the word such => " Current legislation requires you to delete "SUCH" information upon request of the subject. " So from that point of view the question is not to delete the entire user records but specific data related to personal health data. With DLP you can use InfoTypes and InfoType detectors to specifically scan for those entries and how to act upon them (link https://cloud.google.com/dlp/docs/concepts-infotypes) I would say B.

    2. X

       XDevX

       2021-06-30

       36 upvotes

       IMHO a) is the correct answer because it is easier to operate. The question is not how to mask data and so on but just to delete data on request, so I don't think that we have to use for just the deletion of specific data DLP.

    3. A

       Arad

       2021-11-26

       12 upvotes

       as PhilipKoku mentioned below: A) is the correct answer. B) is only masking the data and then when a request is received, it identified the record but it doesn’t delete it. D) Is masking the ID.

    4. I

       Ishu_awsguy

       2022-08-18

       12 upvotes

       There is no need of DLP. All the data is sensitive but only upon user request it needs deletion. So A should be the correct answer.

11. Question 11 of 25

    Your customer is moving an existing corporate application to Google Cloud Platform from an on-premises data center. The business owners require minimal user disruption. There are strict security team requirements for storing passwords. What authentication strategy should they use?

    • AUse G Suite Password Sync to replicate passwords into Google
    • BFederate authentication via SAML 2.0 to the existing Identity Provider
    • CProvision users in Google using the Google Cloud Directory Sync tool
    • DAsk users to set their Google password to match their corporate password

    Show answer

    Correct answer: B

    How others answered

    • B79%
    • C21%

    Explanation

    The correct answer is B. GCDS tool only copies the usernames, not the passwords. And more over strict security requirements for the passwords. Not allowed to copy them onto Google, I think. Federation technique help resolve this issue. Please correct me if I am wrong.

    Adapted from community discussion by gcp_aws · 2020-05-04 · 80 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • support.google.com documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. G

       gcp_aws

       2020-05-04

       80 upvotes

       The correct answer is B. GCDS tool only copies the usernames, not the passwords. And more over strict security requirements for the passwords. Not allowed to copy them onto Google, I think. Federation technique help resolve this issue. Please correct me if I am wrong.

    2. E

       Eroc

       2019-10-24

       22 upvotes

       "A" will syncronise passwords between on pre-mise and the GCP, this duplicates the existing strategy plus Google's "built-in" encryption of all the data. "B" does not support the moving to GCP. "C" The directory sync tool copies the filesystem settings between servers, UNIX filesystems have permission settings built in and passwords to log into the permission groups, syncing these would set GCP up the same way their on-premises is, plus Google's "built-in" encryption. "D" disrupts the users, so this is not correct. The debate should be between "A" and "C", "C" includes "A" according to (https://cloud.google.com/solutions/migrating-consumer-accounts-to-cloud-identity-or-g-suite-best-practices-federation) so choose "C"

    3. B

       brss39

       2023-10-31

       18 upvotes

       B is the answer. Why ? GCDS syncs passwords - Ok but which passwords? Clients need to provide a new password for accessing Google Cloud after GCDS sync. Google recognizes the user because GCDS populated the user list. The user is redirected to a standard Google sign-in screen where they enter their standard username and Google Cloud-specific password. The issue here is the two sets of passwords. Even if a user manually sets them both to the same value, they aren’t managed in a single place. If you need to update your password, you’d have to do that in AD and then again in Google Cloud Identity. In some cases, this approach can allow for better separation between your on-premises environment and Google Cloud, but it’s also one more password to manage for your users.

    4. C

       cetanx

       2020-06-26

       16 upvotes

       GCDS syncs user accounts and some other LDAP attributes but not the passwords, with hybrid connectivity to GCP, SAML (or federation) is the preferred method. Answer should be "B" https://cloud.google.com/solutions/patterns-for-authenticating-corporate-users-in-a-hybrid-environment https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-synchronizing-user-accounts#deciding_what_to_provision

12. Question 12 of 25

    Your company is running its application workloads on Compute Engine. The applications have been deployed in production, acceptance, and development environments. The production environment is business-critical and is used 24/7, while the acceptance and development environments are only critical during office hours. Your CFO has asked you to optimize these environments to achieve cost savings during idle times. What should you do?

    • ACreate a shell script that uses the gcloud command to change the machine type of the development and acceptance instances to a smaller machine type outside of office hours. Schedule the shell script on one of the production instances to automate the task.
    • BUse Cloud Scheduler to trigger a Cloud Function that will stop the development and acceptance environments after office hours and start them just before office hours.
    • CDeploy the development and acceptance applications on a managed instance group and enable autoscaling.
    • DUse regular Compute Engine instances for the production environment, and use preemptible VMs for the acceptance and development environments.

    Show answer

    Correct answer: B

    How others answered

    • B73%
    • C25%

    Only 73% agreed on this answer — treat it as contested rather than settled.

    Explanation

    B is the answer. https://cloud.google.com/blog/products/it-ops/best-practices-for-optimizing-your-cloud-costs Schedule VMs to auto start and stop: The benefit of a platform like Compute Engine is that you only pay for the compute resources that you use. Production systems tend to run 24/7; however, VMs in development, test or personal environments tend to only be used during business hours, and turning them off can save you a lot of money! https://cloud.google.com/blog/products/storage-data-transfer/save-money-by-stopping-and-starting-compute-engine-instances-on-schedule Cloud Scheduler, GCP’s fully managed cron job scheduler, provides a straightforward solution for automatically stopping and starting VMs. By employing Cloud Scheduler with Cloud Pub/Sub to trigger Cloud Functions on schedule, you can stop and start groups of VMs identified with labels of your choice (created in Compute Engine). Here you can see an example schedule that stops all VMs labeled "dev" at 5pm and restarts them at 9am, while leaving VMs labeled "prod" untouched

    Adapted from community discussion by pamepadero · 2021-07-07 · 38 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. P

       pamepadero

       2021-07-07

       38 upvotes

       B is the answer. https://cloud.google.com/blog/products/it-ops/best-practices-for-optimizing-your-cloud-costs Schedule VMs to auto start and stop: The benefit of a platform like Compute Engine is that you only pay for the compute resources that you use. Production systems tend to run 24/7; however, VMs in development, test or personal environments tend to only be used during business hours, and turning them off can save you a lot of money! https://cloud.google.com/blog/products/storage-data-transfer/save-money-by-stopping-and-starting-compute-engine-instances-on-schedule Cloud Scheduler, GCP’s fully managed cron job scheduler, provides a straightforward solution for automatically stopping and starting VMs. By employing Cloud Scheduler with Cloud Pub/Sub to trigger Cloud Functions on schedule, you can stop and start groups of VMs identified with labels of your choice (created in Compute Engine). Here you can see an example schedule that stops all VMs labeled "dev" at 5pm and restarts them at 9am, while leaving VMs labeled "prod" untouched

    2. K

       kopper2019

       2021-07-01

       26 upvotes

       Ans ) B , assuming VM doesn't need to be up after office hours .

    3. R

       rzygor

       2022-07-30

       19 upvotes

       Question says that dev/test are "not critical", it doesn't mean that they are not needed at all ...

    4. S

       sgofficial

       2022-08-01

       16 upvotes

       Excellent ......even the good CFO is telling leave the office after 5.oo and come next day to work :)

13. Question 13 of 25

    Your company has just acquired another company, and you have been asked to integrate their existing Google Cloud environment into your company's data center. Upon investigation, you discover that some of the RFC 1918 IP ranges being used in the new company's Virtual Private Cloud (VPC) overlap with your data center IP space. What should you do to enable connectivity and make sure that there are no routing conflicts when connectivity is established?

    • ACreate a Cloud VPN connection from the new VPC to the data center, create a Cloud Router, and apply new IP addresses so there is no overlapping IP space.
    • BCreate a Cloud VPN connection from the new VPC to the data center, and create a Cloud NAT instance to perform NAT on the overlapping IP space.
    • CCreate a Cloud VPN connection from the new VPC to the data center, create a Cloud Router, and apply a custom route advertisement to block the overlapping IP space.
    • DCreate a Cloud VPN connection from the new VPC to the data center, and apply a firewall rule that blocks the overlapping IP space.

    Show answer

    Correct answer: B

    How others answered

    • B43%
    • A42%
    • C15%

    Only 43% agreed on this answer — treat it as contested rather than settled.

    Explanation

    You can't use Cloud NAT according to this documentation: https://cloud.google.com/nat/docs/troubleshooting#overlapping-ip-addresses "Can I use Cloud NAT to connect a VPC network to another network to work around overlapping IP addresses? No, Cloud NAT cannot apply to any custom route whose next hop is not the default internet gateway. For example, Cloud NAT cannot apply to traffic sent to a next hop Cloud VPN tunnel, even if the destination is a publicly routable IP address."

    Adapted from community discussion by elenamatay · 2022-01-06 · 16 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. V

       VishalB

       2021-07-30

       42 upvotes

       Correct Answer: A - IP Should not overlap so applying new IP address is the solution

    2. T

       TotoroChina

       2021-07-01

       36 upvotes

       Answer is C. https://cloud.google.com/network-connectivity/docs/router/how-to/advertising-custom-ip

    3. E

       elenamatay

       2022-01-06

       16 upvotes

       You can't use Cloud NAT according to this documentation: https://cloud.google.com/nat/docs/troubleshooting#overlapping-ip-addresses "Can I use Cloud NAT to connect a VPC network to another network to work around overlapping IP addresses? No, Cloud NAT cannot apply to any custom route whose next hop is not the default internet gateway. For example, Cloud NAT cannot apply to traffic sent to a next hop Cloud VPN tunnel, even if the destination is a publicly routable IP address."

    4. I

       imgcp

       2021-07-28

       13 upvotes

       B is NOT correct. Cloud NAT is specifically used for translating the IP address of the outbound packets destined to the Internet. But this question is about using VPN communication between two private IP address spaces (RFC1918). Cloud NAT cannot achieve the purpose here, you can't use Cloud NAT to translate from one private IP to another private ip. I would vote for C.

14. Question 14 of 25

    You have an application that runs in Google Kubernetes Engine (GKE). Over the last 2 weeks, customers have reported that a specific part of the application returns errors very frequently. You currently have no logging or monitoring solution enabled on your GKE cluster. You want to diagnose the problem, but you have not been able to replicate the issue. You want to cause minimal disruption to the application. What should you do?

    • A1. Update your GKE cluster to use Cloud Operations for GKE. 2. Use the GKE Monitoring dashboard to investigate logs from affected Pods.
    • B1. Create a new GKE cluster with Cloud Operations for GKE enabled. 2. Migrate the affected Pods to the new cluster, and redirect traffic for those Pods to the new cluster. 3. Use the GKE Monitoring dashboard to investigate logs from affected Pods.
    • C1. Update your GKE cluster to use Cloud Operations for GKE, and deploy Prometheus. 2. Set an alert to trigger whenever the application returns an error.
    • D1. Create a new GKE cluster with Cloud Operations for GKE enabled, and deploy Prometheus. 2. Migrate the affected Pods to the new cluster, and redirect traffic for those Pods to the new cluster. 3. Set an alert to trigger whenever the application returns an error.

    Show answer

    Correct answer: A

    How others answered

    • A65%
    • C33%

    Only 65% agreed on this answer — treat it as contested rather than settled.

    Explanation

    IMHO a) is the correct answer, not c) The point is, that we have a scenario in that often errors in GKE happen - within 2 week a lot of people complained about a lot of errors. For the past we have no data at all as we have not monitored anything. That means we will collect data from now on to find out what the problem is. The additional value of an alert is not clear - and it for me not clear why we need additionally to install Prometheus considering that until now we had no GKE monitoring at all. Please correct me if I am wrong.

    Adapted from community discussion by XDevX · 2021-06-30 · 18 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. T

       TotoroChina

       2021-07-01

       49 upvotes

       According to the reference, answer should be A. https://cloud.google.com/blog/products/management-tools/using-logging-your-apps-running-kubernetes-engine

    2. P

       poseidon24

       2021-07-28

       19 upvotes

       correct, from GCP best practices for GKE we should rely on native logging capabilities. No need for additional solutions like Prometheus. Also it is about reviewing logs, monitoring the service, not receiving alerts each time its happens, that will not provide any insight on the issue.

    3. X

       XDevX

       2021-06-30

       18 upvotes

       IMHO a) is the correct answer, not c) The point is, that we have a scenario in that often errors in GKE happen - within 2 week a lot of people complained about a lot of errors. For the past we have no data at all as we have not monitored anything. That means we will collect data from now on to find out what the problem is. The additional value of an alert is not clear - and it for me not clear why we need additionally to install Prometheus considering that until now we had no GKE monitoring at all. Please correct me if I am wrong.

    4. V

       victorlie

       2021-08-30

       6 upvotes

       Also, as long you know there is a problem, i think you should investigate immediately the issue, not wait for new errors

15. Question 15 of 25

    You need to deploy a stateful workload on Google Cloud. The workload can scale horizontally, but each instance needs to read and write to the same POSIX filesystem. At high load, the stateful workload needs to support up to 100 MB/s of writes. What should you do?

    • AUse a persistent disk for each instance.
    • BUse a regional persistent disk for each instance.
    • CCreate a Cloud Filestore instance and mount it in each instance.
    • DCreate a Cloud Storage bucket and mount it in each instance using gcsfuse.

    Show answer

    Correct answer: C

    How others answered

    • C94%

    Explanation

    Cloud Filestore: Cloud Filestore is a scalable and highly available shared file service fully managed by Google. Cloud Filestore provides persistent storage ideal for shared workloads. It is best suited for enterprise applications requiring persistent, durable, shared storage which is accessed by NFS or requires a POSIX compliant file system. https://cloud.google.com/terms/services-20180724

    Adapted from community discussion by deenee · 2022-07-18 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. T

       TotoroChina

       2021-07-01

       36 upvotes

       Answer should be C, https://cloud.google.com/storage/docs/gcs-fuse#notes

    2. X

       XDevX

       2021-06-30

       16 upvotes

       IMHO d) is wrong, the correct answer is c). The requirement is explicitly POSIX filesystem - using gcsfuse Cloud Storage still remains an object storage - IMHO gcsfuse brings a lot of downsizes compared with Filestore and in the question there are no indications that a non-POSIX filesystem shall be used.

    3. D

       deenee

       2022-07-18

       13 upvotes

       Cloud Filestore: Cloud Filestore is a scalable and highly available shared file service fully managed by Google. Cloud Filestore provides persistent storage ideal for shared workloads. It is best suited for enterprise applications requiring persistent, durable, shared storage which is accessed by NFS or requires a POSIX compliant file system. https://cloud.google.com/terms/services-20180724

    4. C

       CloudWars

       2023-08-04

       8 upvotes

       directly from the documentation of gcs fuse > While Cloud Storage FUSE has a file system interface, it is not like an NFS or CIFS file system on the backend. Additionally, Cloud Storage FUSE is not POSIX compliant. For a POSIX file system product in Google Cloud, see Filestore.

16. Question 16 of 25

    You are implementing the infrastructure for a web service on Google Cloud. The web service needs to receive and store the data from 500,000 requests per second. The data will be queried later in real time, based on exact matches of a known set of attributes. There will be periods where the web service will not receive any requests. The business wants to keep costs low. Which web service platform and database should you use for the application?

    • ACloud Run and BigQuery
    • BCloud Run and Cloud Bigtable
    • CA Compute Engine autoscaling managed instance group and BigQuery
    • DA Compute Engine autoscaling managed instance group and Cloud Bigtable

    Show answer

    Correct answer: B

    How others answered

    • B62%
    • D36%

    Only 62% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Any correct answer must involve Cloud Bigtable over BigQuery since Bigtable is optimized for heavy write loads. That leaves B and D. I would suggest B b/c it is lower cost ("The business wants to keep costs low")

    Adapted from community discussion by Enzian · 2021-07-01 · 80 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. E

       Enzian

       2021-07-01

       80 upvotes

       Any correct answer must involve Cloud Bigtable over BigQuery since Bigtable is optimized for heavy write loads. That leaves B and D. I would suggest B b/c it is lower cost ("The business wants to keep costs low")

    2. P

       pakilodi

       2021-12-15

       21 upvotes

       Not only: occasionally there will be no requests. so Cloud Run will scale to zero

    3. X

       XDevX

       2021-07-01

       7 upvotes

       IMHO b) is the correct answer, not d). The requirement is to keep cost low - the quizzer says explicitly that there will be periods where the web service will not receive any requests - my impression is that the quizzer wants by using that statement to point on a solution that can scale to zero...

    4. T

       TotoroChina

       2021-07-01

       7 upvotes

       Answer should be A, Cloud Run and BigQuery There will be periods where the web service will not receive any requests => Cloud Run The data will be queried later in real time, based on exact matches of a known set of attributes => BigQuery

17. Question 17 of 25

    Your company has a networking team and a development team. The development team runs applications on Compute Engine instances that contain sensitive data. The development team requires administrative permissions for Compute Engine. Your company requires all network resources to be managed by the networking team. The development team does not want the networking team to have access to the sensitive data on the instances. What should you do?

    • A1. Create a project with a standalone VPC and assign the Network Admin role to the networking team. 2. Create a second project with a standalone VPC and assign the Compute Admin role to the development team. 3. Use Cloud VPN to join the two VPCs.
    • B1. Create a project with a standalone Virtual Private Cloud (VPC), assign the Network Admin role to the networking team, and assign the Compute Admin role to the development team.
    • C1. Create a project with a Shared VPC and assign the Network Admin role to the networking team. 2. Create a second project without a VPC, configure it as a Shared VPC service project, and assign the Compute Admin role to the development team.
    • D1. Create a project with a standalone VPC and assign the Network Admin role to the networking team. 2. Create a second project with a standalone VPC and assign the Compute Admin role to the development team. 3. Use VPC Peering to join the two VPCs.

    Show answer

    Correct answer: C

    How others answered

    • C57%
    • B43%

    Only 57% agreed on this answer — treat it as contested rather than settled.

    Explanation

    C. 1. Create a project with a Shared VPC and assign the Network Admin role to the networking team. 2. Create a second project without a VPC, configure it as a Shared VPC service project, and assign the Compute Admin role to the development team.

    Adapted from community discussion by victory108 · 2021-07-11 · 31 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. V

       victory108

       2021-07-11

       31 upvotes

       C. 1. Create a project with a Shared VPC and assign the Network Admin role to the networking team. 2. Create a second project without a VPC, configure it as a Shared VPC service project, and assign the Compute Admin role to the development team.

    2. N

       Nick89GR

       2022-04-18

       18 upvotes

       I do not understand why do we need to have a shared VPC. With B the dev team will not be able to make any network change and the Network team will not be able to do any change on the CE. I would say B is the correct answer although C does not seem wrong

    3. O

       omermahgoub

       2022-12-25

       11 upvotes

       C: Create a project with a Shared VPC and assign the Network Admin role to the networking team. Create a second project without a VPC, configure it as a Shared VPC service project, and assign the Compute Admin role to the development team. A Shared VPC allows you to share a single VPC network across multiple projects within your organization. By creating a Shared VPC network and assigning the Network Admin role to the networking team, you can ensure that the networking team has full control over the network resources, while keeping the development team's Compute Engine instances separate in a different project. By creating a second project without a VPC and configuring it as a Shared VPC service project, you can allow the development team to create Compute Engine instances within the Shared VPC network, while keeping the development team's resources separate from the networking team's resources. This allows the development team to have administrative permissions for Compute Engine, while preventing the networking team from having access to the sensitive data on the instances.

    4. T

       TonyKGH

       2023-06-25

       13 upvotes

       For full separation of the teams you will need to use a shared VPC in this case. If you compare the two roles you will see that Compute Admin includes the permissions of the Network Admin so with option B you don't separate the teams as Compute Admin includes compute.network.* permissions (and others). https://cloud.google.com/iam/docs/understanding-roles

18. Question 18 of 25

    Your company wants you to build a highly reliable web application with a few public APIs as the backend. You don't expect a lot of user traffic, but traffic could spike occasionally. You want to leverage Cloud Load Balancing, and the solution must be cost-effective for users. What should you do?

    • AStore static content such as HTML and images in Cloud CDN. Host the APIs on App Engine and store the user data in Cloud SQL.
    • BStore static content such as HTML and images in a Cloud Storage bucket. Host the APIs on a zonal Google Kubernetes Engine cluster with worker nodes in multiple zones, and save the user data in Cloud Spanner.
    • CStore static content such as HTML and images in Cloud CDN. Use Cloud Run to host the APIs and save the user data in Cloud SQL.
    • DStore static content such as HTML and images in a Cloud Storage bucket. Use Cloud Functions to host the APIs and save the user data in Firestore.

    Show answer

    Correct answer: D

    How others answered

    • D63%
    • C18%

    Only 63% agreed on this answer — treat it as contested rather than settled.

    Explanation

    IMHO it is d), not b). Reason is that you don't need Cloud Spanner just to store user data - FireStore is the better solution. Additionally, I see no indications concerning the requirement to use GKE... Please correct me when I am wrong.

    Adapted from community discussion by XDevX · 2021-07-01 · 17 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. T

       TotoroChina

       2021-07-01

       54 upvotes

       Answer should be D, https://cloud.google.com/load-balancing/docs/https/setting-up-https-serverless#gcloud:-cloud-functions https://cloud.google.com/blog/products/networking/better-load-balancing-for-app-engine-cloud-run-and-functions

    2. X

       XDevX

       2021-07-01

       17 upvotes

       IMHO it is d), not b). Reason is that you don't need Cloud Spanner just to store user data - FireStore is the better solution. Additionally, I see no indications concerning the requirement to use GKE... Please correct me when I am wrong.

    3. M

       MaxNRG

       2021-10-21

       6 upvotes

       B is not cost-effective - GKE + Spanner is very expensive So, A or C - Cloud CDN + App Engine or Cloud CDN + Cloud Run Since Cloud Run is serverless it is more cost-effective as compared to App Engine, so C. https://cloud.google.com/hosting-options https://dev.to/pcraig3/cloud-run-vs-app-engine-a-head-to-head-comparison-using-facts-and-science-1225 Cloud CDN uses HTTP(S) Load Balancing as the origin for cacheable content. An external HTTP(S) load balancer can deliver a mix of static and dynamically-created content to users through one global IP address from the following types of backends: • Instance groups • Zonal network endpoint groups (NEGs) • Serverless NEGs: One or more App Engine, Cloud Run, or Cloud Functions services • Internet NEGs for external backends • Buckets in Cloud Storage https://cloud.google.com/cdn/docs/best-practices

    4. M

       mikesp

       2021-10-24

       8 upvotes

       IMHO, i agree with you. Furthermore: Cloud Storage buckets are a good choice for static web content. Cloud storage buckets behave like a CDN Network: https://cloud.google.com/storage/docs/caching So it is lower cost than CDN.

19. Question 19 of 25

    You have deployed several instances on Compute Engine. As a security requirement, instances cannot have a public IP address. There is no VPN connection between Google Cloud and your office, and you need to connect via SSH into a specific machine without violating the security requirements. What should you do?

    • AConfigure Cloud NAT on the subnet where the instance is hosted. Create an SSH connection to the Cloud NAT IP address to reach the instance.
    • BAdd all instances to an unmanaged instance group. Configure TCP Proxy Load Balancing with the instance group as a backend. Connect to the instance using the TCP Proxy IP.
    • CConfigure Identity-Aware Proxy (IAP) for the instance and ensure that you have the role of IAP-secured Tunnel User. Use the gcloud command line tool to ssh into the instance.
    • DCreate a bastion host in the network to SSH into the bastion host from your office location. From the bastion host, SSH into the desired instance.

    Show answer

    Correct answer: C

    How others answered

    • C74%
    • D26%

    Only 74% agreed on this answer — treat it as contested rather than settled.

    Explanation

    And D seems correct, bastion host is specifically used for this purpose, using option C user can connect through cloud only. By using a bastion host, you can connect to an VM that does not have an external IP address. This approach allows you to connect to a development environment or manage the database instance for your external application, for example, without configuring additional firewall rules. https://cloud.google.com/solutions/connecting-securely

    Adapted from community discussion by ank82 · 2021-07-10 · 16 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. T

       TotoroChina

       2021-07-01

       60 upvotes

       Answer is C. https://cloud.google.com/iap/docs/using-tcp-forwarding#tunneling_with_ssh

    2. A

       ank82

       2021-07-10

       16 upvotes

       And D seems correct, bastion host is specifically used for this purpose, using option C user can connect through cloud only. By using a bastion host, you can connect to an VM that does not have an external IP address. This approach allows you to connect to a development environment or manage the database instance for your external application, for example, without configuring additional firewall rules. https://cloud.google.com/solutions/connecting-securely

    3. M

       mikesp

       2021-10-24

       12 upvotes

       Agee too. Bastion host violates security requirements due to it has public IP :)

    4. M

       meh009

       2021-10-13

       11 upvotes

       100% Agree. I use IAP all the time which allows me to reduce exposure to VM from public internet. Ans is C

20. Question 20 of 25

    Your company provides a recommendation engine for retail customers. You are providing retail customers with an API where they can submit a user ID and the API returns a list of recommendations for that user. You are responsible for the API lifecycle and want to ensure stability for your customers in case the API makes backward-incompatible changes. You want to follow Google-recommended practices. What should you do?

    • ACreate a distribution list of all customers to inform them of an upcoming backward-incompatible change at least one month before replacing the old API with the new API.
    • BCreate an automated process to generate API documentation, and update the public API documentation as part of the CI/CD process when deploying an update to the API.
    • CUse a versioning strategy for the APIs that increases the version number on every backward-incompatible change.
    • DUse a versioning strategy for the APIs that adds the suffix ג€DEPRECATEDג€ to the current API version number on every backward-incompatible change. Use the current version number for the new API.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Answer C All Google API interfaces must provide a major version number, which is encoded at the end of the protobuf package, and included as the first part of the URI path for REST APIs. If an API introduces a breaking change, such as removing or renaming a field, it must increment its API version number to ensure that existing user code does not suddenly break.

    Adapted from community discussion by VishalB · 2022-01-13 · 23 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. V

       VishalB

       2022-01-13

       23 upvotes

       Answer C All Google API interfaces must provide a major version number, which is encoded at the end of the protobuf package, and included as the first part of the URI path for REST APIs. If an API introduces a breaking change, such as removing or renaming a field, it must increment its API version number to ensure that existing user code does not suddenly break.

    2. K

       kopper2019

       2022-01-15

       7 upvotes

       21 NEw Qs - July 12, 2021 7. For this question, refer to the TerramEarth case study.The application from your private data center to Google Cloud. The TerramEarth Security team sent you several recent Linux vulnerabilities published by common vulnerabilities and exposures (CVE). You need assistance in understanding how these vulnerabilities could impact your migration. What should you do?Choose two answers a. Read the CVE’s from the Google Cloud status dashboard to understand the impact b. Read the CVE’s from the Google Cloud platform security bulletins to understand the impact c. Open a support case regarding the CVE and chat with the support engineer d. Post a question regarding the CVE in stack overflow to get an explanation e. Post a question regarding the CVE in a Google Cloud discussion group to get an answer Answer B, C, please share you answers

    3. S

       syvoon

       2022-01-18

       9 upvotes

       D - Cloud monitoring uptime checks can be used to check availability of a URL and set alert policy : https://cloud.google.com/monitoring/uptime-checks What do you think?

    4. E

       exo_k

       2022-02-24

       7 upvotes

       https://cloud.google.com/blog/products/management-tools/how-to-use-pubsub-as-a-cloud-monitoring-notification-channel vote for D

21. Question 21 of 25

    Your company has a Kubernetes application that pulls messages from Pub/Sub and stores them in Filestore. Because the application is simple, it was deployed as a single pod. The infrastructure team has analyzed Pub/Sub metrics and discovered that the application cannot process the messages in real time. Most of them wait for minutes before being processed. You need to scale the elaboration process that is I/O-intensive. What should you do?

    • AUse kubectl autoscale deployment APP_NAME --max 6 --min 2 --cpu-percent 50 to configure Kubernetes autoscaling deployment.
    • BConfigure a Kubernetes autoscaling deployment based on the subscription/push_request_latencies metric.
    • CUse the --enable-autoscaling flag when you create the Kubernetes cluster.
    • DConfigure a Kubernetes autoscaling deployment based on the subscription/num_undelivered_messages metric.

    Show answer

    Correct answer: D

    How others answered

    • D87%

    Explanation

    Direct answer - D https://cloud.google.com/kubernetes-engine/docs/samples/container-pubsub-horizontal-pod-autoscaler apiVersion: autoscaling/v2beta2 kind: HorizontalPodAutoscaler metadata: name: pubsub spec: minReplicas: 1 maxReplicas: 5 metrics: - external: metric: name: pubsub.googleapis.com|subscription|num_undelivered_messages selector: matchLabels: resource.labels.subscription_id: echo-read target: type: AverageValue averageValue: 2 type: External scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: pubsub

    Adapted from community discussion by aut0pil0t · 2022-09-03 · 23 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. R

       Rzla

       2021-09-04

       40 upvotes

       Answer is D. num_undelivered_messages metric can indicate if subscribers are keeping up with message submissions. https://cloud.google.com/pubsub/docs/monitoring#monitoring_the_backlog

    2. A

       aut0pil0t

       2022-09-03

       Selected D23 upvotes

       Direct answer - D https://cloud.google.com/kubernetes-engine/docs/samples/container-pubsub-horizontal-pod-autoscaler apiVersion: autoscaling/v2beta2 kind: HorizontalPodAutoscaler metadata: name: pubsub spec: minReplicas: 1 maxReplicas: 5 metrics: - external: metric: name: pubsub.googleapis.com|subscription|num_undelivered_messages selector: matchLabels: resource.labels.subscription_id: echo-read target: type: AverageValue averageValue: 2 type: External scaleTargetRef: apiVersion: apps/v1 kind: Deployment name: pubsub

    3. V

       VishalB

       2021-08-30

       6 upvotes

       in above case their is latency, messaging are getting processed 1 min later so metrics name: pubsub.googleapis.com|subscription|num_undelivered_messages would not be usefull

    4. P

       pddddd

       2022-01-10

       5 upvotes

       https://cloud.google.com/kubernetes-engine/docs/samples/container-pubsub-horizontal-pod-autoscaler

22. Question 22 of 25

    You are designing a Data Warehouse on Google Cloud and want to store sensitive data in BigQuery. Your company requires you to generate the encryption keys outside of Google Cloud. You need to implement a solution. What should you do?

    • AGenerate a new key in Cloud Key Management Service (Cloud KMS). Store all data in Cloud Storage using the customer-managed key option and select the created key. Set up a Dataflow pipeline to decrypt the data and to store it in a new BigQuery dataset.
    • BGenerate a new key in Cloud KMS. Create a dataset in BigQuery using the customer-managed key option and select the created key.
    • CImport a key in Cloud KMS. Store all data in Cloud Storage using the customer-managed key option and select the created key. Set up a Dataflow pipeline to decrypt the data and to store it in a new BigQuery dataset.
    • DImport a key in Cloud KMS. Create a dataset in BigQuery using the customer-supplied key option and select the created key.

    Show answer

    Correct answer: D

    How others answered

    • D74%
    • C20%

    Only 74% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The answer is easy. It says keys must be left outside of Google Cloud. This automatically eliminates A / B. Now the C option says decrypts before storing it in BigQuery which the point is to encrypt the data while been in BigQuery, D is the only possible answer.

    Adapted from community discussion by alexandercamachop · 2022-09-11 · 18 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. A

       alexandercamachop

       2022-09-11

       Selected D18 upvotes

       The answer is easy. It says keys must be left outside of Google Cloud. This automatically eliminates A / B. Now the C option says decrypts before storing it in BigQuery which the point is to encrypt the data while been in BigQuery, D is the only possible answer.

    2. N

       NodummyIQ

       2023-01-01

       4 upvotes

       Answer D is incorrect because BigQuery does not support the use of customer-supplied keys to encrypt data at rest. Instead, you can use customer-managed encryption keys in Cloud KMS to encrypt the data in BigQuery. To do this, you can either generate a new key in Cloud KMS (answer A) or import an existing key (answer C). Once you have a key in Cloud KMS, you can create a BigQuery dataset and select the key as the customer-managed key for the dataset. This will enable BigQuery to use the key to encrypt the data in the dataset.

    3. B

       bossdellacert

       2022-08-24

       Selected D2 upvotes

       That's my idea: Scenario 1. there are Google generated and managed encryption key, which are the default with BigQuery and used to encrypt the data at rest (no action/management needed by the customer) Scenario 2. Then there are CMEK (customer-managed encryption keys): customer generate encryption keys and then manage them within GCP with Cloud Key Management Service (Cloud KMS), here keys are provided by the customer, managed with Cloud KMS and then provided to BigQuery to encrypt their data at rest Scenario 3. At the end there are CSEK: customer generate and manage keys outside GCP and have to provide those keys every time is needed through API call to the service. BigQuery seems do not support this. I think here the correct answer could be D, because we can be in scenario 2 which is supported by BigQuery.

    4. D

       devnul

       2023-08-23

       4 upvotes

       GCP docu says "BigQuery and BigLake tables don't support Customer-Supplied Encryption Keys (CSEK)." However, I just tested it and it worked: 1. Create Key openssl rand 32 > ./key2 2. Import into KMS gcloud kms keys versions import --import-job csek1 --location us-west1 --keyring csek --key csek --algorithm google-symmetric-encryption --target-key-file ./key2 3. In Cloud Console: select the key when creating a new data set and table in BigQuery

23. Question 23 of 25

    Your organization has stored sensitive data in a Cloud Storage bucket. For regulatory reasons, your company must be able to rotate the encryption key used to encrypt the data in the bucket. The data will be processed in Dataproc. You want to follow Google-recommended practices for security. What should you do?

    • ACreate a key with Cloud Key Management Service (KMS). Encrypt the data using the encrypt method of Cloud KMS.
    • BCreate a key with Cloud Key Management Service (KMS). Set the encryption key on the bucket to the Cloud KMS key.
    • CGenerate a GPG key pair. Encrypt the data using the GPG key. Upload the encrypted data to the bucket.
    • DGenerate an AES-256 encryption key. Encrypt the data in the bucket using the customer-supplied encryption keys feature.

    Show answer

    Correct answer: B

    How others answered

    • B88%

    Explanation

    B. Create a key with Cloud Key Management Service (KMS). Set the encryption key on the bucket to the Cloud KMS key. To rotate the encryption key used to encrypt data in a Cloud Storage bucket, it is recommended to use Cloud KMS. You can create a new key version, set it as the primary version, and update the bucket's default KMS key to the new key version. This allows you to rotate the encryption key while still allowing access to the data. You can then process the data in Dataproc while the encryption key is being rotated. This approach provides security and compliance with regulations, as well as easy key rotation without disrupting access to data.

    Adapted from community discussion by JC0926 · 2023-09-23 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. V

       victory108

       2022-03-05

       32 upvotes

       B. Create a key with Cloud Key Management Service (KMS). Set the encryption key on the bucket to the Cloud KMS key.

    2. S

       SweetieS

       2022-02-24

       9 upvotes

       B is OK https://cloud.google.com/storage/docs/encryption/using-customer-managed-keys#add-object-key

    3. [

       [Removed]

       2022-04-12

       8 upvotes

       Correction: B is correct. No customer supplied keys. Why so many questions have wrong answer? Can admin explain this? Its too confusing. The answer should be explained otherwise this is not adding any value to learning...

    4. J

       JC0926

       2023-09-23

       Selected B4 upvotes

       B. Create a key with Cloud Key Management Service (KMS). Set the encryption key on the bucket to the Cloud KMS key. To rotate the encryption key used to encrypt data in a Cloud Storage bucket, it is recommended to use Cloud KMS. You can create a new key version, set it as the primary version, and update the bucket's default KMS key to the new key version. This allows you to rotate the encryption key while still allowing access to the data. You can then process the data in Dataproc while the encryption key is being rotated. This approach provides security and compliance with regulations, as well as easy key rotation without disrupting access to data.

24. Question 24 of 25

    Your application needs to process credit card transactions. You want the smallest scope of Payment Card Industry (PCI) compliance without compromising the ability to analyze transactional data and trends relating to which payment methods are used. How should you design your architecture?

    • ACreate a tokenizer service and store only tokenized data
    • BCreate separate projects that only process credit card data
    • CCreate separate subnetworks and isolate the components that process credit card data
    • DStreamline the audit discovery phase by labeling all of the virtual machines (VMs) that process PCI data
    • EEnable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    Final Decision to go with Option A. I have done PCI DSS Audit for my project and thats the best suited case. 100% sure to use tokenised data instead of actual card number

    Adapted from community discussion by AD2AD4 · 2020-05-28 · 47 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. A

       AD2AD4

       2020-05-28

       47 upvotes

       Final Decision to go with Option A. I have done PCI DSS Audit for my project and thats the best suited case. 100% sure to use tokenised data instead of actual card number

    2. O

       omermahgoub

       2022-12-20

       36 upvotes

       To minimize the scope of Payment Card Industry (PCI) compliance while still allowing for the analysis of transactional data and trends related to payment methods, you should consider using a tokenizer service and storing only tokenized data, as described in option A. Tokenization is a process of replacing sensitive data, such as credit card numbers, with unique, randomly-generated tokens that cannot be used for fraudulent purposes. By using a tokenizer service and storing only tokenized data, you can reduce the scope of PCI compliance to only the tokenization service, rather than the entire application. This can help minimize the amount of sensitive data that needs to be protected and reduce the overall compliance burden.

    3. N

       natpilot

       2020-01-26

       11 upvotes

       E is correct. the proper model to exporting the credit card processing data to forward from a squis proxy to stackdriver logging, and export from stackdriver loggind to bigquery. view https://cloud.google.com/solutions/pci-dss-compliance-in-gcp#monitoring_and_logging_flow

    4. C

       clouddude

       2020-05-10

       7 upvotes

       I'm going to go with A. A seems very reasonable because tokenization replaces the PII with anonymous tokens. B may be a good architecture practice but it doesn't necessarily have the most impact in terms of protecting the data. C may be a good architecture practice but it doesn't necessarily have the most impact in terms of protecting the data. D does not seem feasible because labeling does nothing in terms of adjusting the scope of the environment. E does not seem reasonable because it does nothing in terms of reducing the scope of the environment.

25. Question 25 of 25

    Your team needs to create a Google Kubernetes Engine (GKE) cluster to host a newly built application that requires access to third-party services on the internet. Your company does not allow any Compute Engine instance to have a public IP address on Google Cloud. You need to create a deployment strategy that adheres to these guidelines. What should you do?

    • AConfigure the GKE cluster as a private cluster, and configure Cloud NAT Gateway for the cluster subnet.
    • BConfigure the GKE cluster as a private cluster. Configure Private Google Access on the Virtual Private Cloud (VPC).
    • CConfigure the GKE cluster as a route-based cluster. Configure Private Google Access on the Virtual Private Cloud (VPC).
    • DCreate a Compute Engine instance, and install a NAT Proxy on the instance. Configure all workloads on GKE to pass through this proxy to access third-party services on the Internet.

    Show answer

    Correct answer: A

    How others answered

    • A98%

    Explanation

    ** Admins: More than 60% of the answers you have selected are wrong. Please correct them ASAP. I must appreciate community here for taking out time to share their perspective and help fellow learners. "B" can never be an answer here as the Private Google Access enables internal access to Google APIs only whereas in question the ask is "access to third-party services on the internet"

    Adapted from community discussion by RitwickKumar · 2022-08-20 · 26 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by PCA or CertExamHQ.

    1. R

       RitwickKumar

       2022-08-20

       Selected A26 upvotes

       ** Admins: More than 60% of the answers you have selected are wrong. Please correct them ASAP. I must appreciate community here for taking out time to share their perspective and help fellow learners. "B" can never be an answer here as the Private Google Access enables internal access to Google APIs only whereas in question the ask is "access to third-party services on the internet"

    2. J

       jlambdan

       2023-04-03

       13 upvotes

       This is most likely on purpose. Otherwise google will do something in order for the exam dump to be shutdown.

    3. [

       [Removed]

       2021-10-12

       9 upvotes

       A is correct. NAT does not expose GKE private IP. B is connection to on.prem option which is not ask here.

    4. E

       examch

       2023-01-07

       Selected A4 upvotes

       A is the correct answer, Granting private nodes outbound internet access To provide outbound internet access for your private nodes, such as to pull images from an external registry, use Cloud NAT to create and configure a Cloud Router. Cloud NAT lets private clusters establish outbound connections over the internet to send and receive packets. The Cloud Router allows all your nodes in the region to use Cloud NAT for all primary and alias IP ranges. It also automatically allocates the external IP addresses for the NAT gateway. For instructions to create and configure a Cloud Router, refer to Create a Cloud NAT configuration using Cloud Router in the Cloud NAT documentation. https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters#private-nodes-outbound

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCA practice, question 1 of 25