Google Professional Cloud Architect Practice Questions with Explanations

Correct answer: D

Using separate backend pools for each API path behind a single load balancer allows the company to serve both old and new API versions from the same SSL certificate and DNS record. The load balancer can route requests to different backend pools based on the request path, keeping the same endpoint while supporting both API versions simultaneously.

Why the other options are wrong:

• A. A new load balancer would require separate DNS/SSL records, contradicting the requirement to keep these unchanged.
• B. Reconfiguring old clients defeats the purpose of maintaining backward compatibility with the same endpoint.
• C. Having the old API forward to the new API would not allow running both versions independently and could cause compatibility issues.

Correct answer: A

Google BigQuery is a fully managed data warehouse optimized for large-scale analytical queries. It provides SQL interface for business analysts, handles multi-petabyte datasets efficiently, offers 24/7 availability, and is purpose-built for analysis and reporting scenarios like this.

Why the other options are wrong:

• B. Cloud SQL is designed for transactional databases, not analytical workloads, and has limitations for multi-petabyte datasets.
• C. Cloud Storage with flat files lacks the query capability and SQL interface needed by business analysts.
• D. Cloud Datastore is a NoSQL document database unsuitable for analytical queries and not optimized for this use case.

Correct answer: A

The code stores session data in a local Python dictionary (`sessions = {}`), which exists only in memory on a single App Engine instance. During peak load, Google App Engine automatically scales by creating multiple instances to handle requests. When users are routed to different instances (due to load balancing), their session data is not available on the new instance because each instance has its own separate in-memory dictionary. This causes previously viewed articles to reappear since the viewing history is lost when the user hits a different instance.

Why the other options are wrong:

• B. The code does not use Cloud Datastore for session storage; it only uses a local in- memory dictionary, so overwriting in Datastore is not the issue.
• C. The problem is not related to URL caching or API endpoint design; it's a session persistence issue across multiple instances.
• D. HTTP Expires headers control browser caching of responses, not the server-side session persistence problem of tracking viewed articles across instances.

Correct answer: C

The best approach is to help the team define their specific requirements and assess viable solutions. This consultative approach ensures the selected tool actually meets their needs for error capture and historical log analysis, rather than immediately prescribing a specific product or assuming the current tool can be fixed.

Why the other options are wrong:

• A. Directing them to install Stackdriver immediately skips the requirements assessment phase and may not be the right tool.
• B. Providing generic resources doesn't address their specific problem of finding the right tool for their needs.
• D. Upgrading their current tool assumes it can be fixed, but they've already determined it won't meet their needs.

Correct answer: B

NoSQL databases are ideal for this scenario because the data is high-volume time-series sensor data (1000 rooms × continuous readings), has flexible schema (sensor ID plus discrete information items), and needs to be joined with other data sources (account owners, office locations) during analysis. NoSQL handles high-velocity IoT data efficiently and scales horizontally across continents.

Why the other options are wrong:

• A. Flat files are inefficient for 1000 rooms generating continuous data and querying with related datasets.
• C. Relational databases can work but are less efficient for high-velocity sensor data and have scaling challenges.
• D. Blobstore is for unstructured binary data, not structured sensor readings that need querying and analysis.

Correct answer: C

VMs are terminating and relaunching every minute because health checks are failing. Since curl commands work from the instances themselves, the application is responding correctly. The issue is that the load balancer's health check probes cannot reach the instances because a firewall rule is blocking the health check traffic. Allowing health check source traffic (typically from Google's health check IP ranges) to the instances solves this.

Why the other options are wrong:

• A. Firewall rules for HTTP/HTTPS to the load balancer don't address the internal health check communication issue.
• B. Public IPs aren't necessary for instances behind a load balancer; this wastes resources and isn't the root cause.
• D. Creating tags with the load balancer name doesn't configure proper health check firewall rules and is incorrectly specified.

Correct answer: B

Google Compute Engine instances require the appropriate OAuth scopes to access BigQuery. A VM created without the BigQuery access scope enabled cannot authenticate to the BigQuery API, regardless of client library installation or service account configuration. Creating a new VM with the BigQuery scope enabled (or adding the scope to an existing VM) is the fundamental requirement for BigQuery access from GCE.

Why the other options are wrong:

• A. Installing the client library is necessary but insufficient without proper authentication scopes on the VM.
• C. While service accounts can be used, the VM itself must have the BigQuery scope enabled to use any credentials.
• D. The bq CLI component is optional tooling and does not resolve the underlying authentication scope problem.

Correct answer: B

SAML 2.0 federation allows users to authenticate against the existing corporate Identity Provider without requiring password replication or storage in Google systems. This approach meets the strict security requirements by keeping passwords stored only in the existing on-premises identity system, minimizes user disruption through single sign-on, and is the industry standard for enterprise cloud migrations.

Why the other options are wrong:

• A. Password Sync replicates passwords into Google systems, violating strict security requirements around password storage.
• C. Cloud Directory Sync only synchronizes user metadata, not authentication; it still requires a separate authentication mechanism.
• D. Asking users to duplicate passwords violates security best practices and creates maintenance overhead.

Correct answer: B

Google Cloud Dataflow is a unified stream and batch processing service built on Apache Beam. It handles both streaming data processing (live data as it arrives) and batch processing (hourly jobs) within a single framework, making it ideal for mixed workloads. Unlike other options, Dataflow is specifically designed for both processing paradigms without requiring separate tools.

Why the other options are wrong:

• A. Dataproc is designed for Hadoop and Spark batch processing; it is not optimized for stream processing.
• C. Container Engine with Bigtable requires custom code development and lacks the built-in processing abstractions of Dataflow.
• D. Compute Engine with BigQuery separates storage from processing and is not a stream processing solution.

Correct answer: C

The best strategy prioritizes minimizing user impact while enabling root cause analysis. Rolling back to the known good release immediately restores service for users. Then using Stackdriver Trace and Logging in a non-production environment allows safe diagnosis of the performance regression without affecting production. This approach balances operational continuity with thorough troubleshooting.

Why the other options are wrong:

• A. ISP involvement is inappropriate; the problem is clearly application-related post- update.
• B. Requesting network data before rolling back leaves users experiencing the problem longer than necessary; rolling back should be the first action.
• D. Waiting for a quieter period to re-push the problematic release unnecessarily prolongs the investigation and adds complexity when the issue can be diagnosed in staging.

Correct answer: A

GCP persistent disks can be expanded while attached to a running VM without shutdown. After increasing the disk size in the Console, the resize2fs command extends the ext4 filesystem to use the newly allocated space. This minimizes downtime to zero, as the VM and database remain operational throughout the process.

Why the other options are wrong:

• B. Requires unnecessary shutdown; disks can be resized online on GCP.
• C. The fdisk command is for partitioning and is not the appropriate tool; resize2fs is needed for ext4 filesystem expansion.
• D. Adding a new disk creates complexity in data migration and application reconfiguration; simpler to expand existing disk.
• E. Snapshot and restore introduces significant downtime and complexity when online expansion is available.

Correct answer: A

Tokenization removes actual credit card data from the system, placing only the payment processing component within PCI compliance scope. This significantly reduces audit scope and security burden while allowing analysis of payment method trends through token metadata. Non-tokenized transactional analysis can use aggregated or anonymized data that doesn't contain sensitive card information.

Why the other options are wrong:

• B. Separate projects do not reduce PCI scope; all projects handling credit card data remain in scope.
• C. Network isolation does not reduce PCI scope; compliance applies to all systems processing card data.
• D. Labeling VMs does not reduce PCI scope; it only aids in audit discovery.
• E. Logging and ACLs do not reduce the scope of systems subject to PCI; they only control access to existing data.

Correct answer: B

Google Cloud Bigtable is purpose-built for high-volume, low-latency time-series data ingestion and analysis. It handles the write rates of 6,000 clicks per minute with bursts to 8,500 clicks per second efficiently, scales automatically, and provides excellent query performance for analytical workloads. Bigtable is the standard choice for click-stream and similar analytics use cases.

Why the other options are wrong:

• A. Cloud SQL is a relational database unsuitable for high-velocity click-stream data at this scale.
• C. Cloud Storage is for object storage, not for querying structured time-series data efficiently.
• D. Cloud Datastore is a document database not optimized for high-velocity time-series analytics at this scale.

Correct answer: B

Cloud Storage lifecycle management rules, defined in JSON format and pushed via gsutil, automatically delete objects matching specified criteria (such as age over 90 days) without requiring custom scripts or manual intervention. This is the proper, scalable, and cost- effective approach to managing backup retention policies.

Why the other options are wrong:

• A. Lifecycle rules are defined in JSON, not XML, for Cloud Storage.
• C. The gsutil ls -lr syntax is incorrect and a cron script requires manual maintenance and monitoring.
• D. Custom cron scripts are inefficient, error-prone, and more expensive than built-in lifecycle rules.

Correct answer: B

Google Cloud Dataproc is a managed Apache Spark and Hadoop service designed specifically for running big data jobs with minimal operational overhead. It allows you to scale Spark and Hadoop workloads without requiring code changes, making it the ideal choice for handling forecasted increases in Apache Spark and Hadoop job demand.

Why the other options are wrong:

• A. Cloud Dataflow is for Apache Beam pipelines and stream/batch processing, not specifically optimized for existing Spark and Hadoop jobs.
• C. Compute Engine requires manual management of infrastructure, defeating the goal of minimizing operations work.
• D. Kubernetes Engine is for containerized workloads and would require significant code changes and operational complexity for Spark/Hadoop jobs.

Correct answer: C

The n1-standard-8 machine already has 30 GB of memory (sufficient for most database operations), but only 80 GB of SSD storage. For a database handling import and normalization of performance statistics with ongoing growth, increasing the persistent disk from 80 GB to 500 GB addresses I/O bottlenecks and provides capacity for data growth, which is the most likely performance constraint.

Why the other options are wrong:

• A. The n1-standard-8 already includes 30 GB of memory, which is adequate; increasing to 64 GB would be excessive and expensive for a normalization database.
• B. Switching database engines is a major migration with no guarantee of performance improvement and introduces operational risk.
• D. BigQuery is an analytical data warehouse, not appropriate for transactional database operations and real-time performance statistics ingestion.
• E. While bulk inserts help, they address only one aspect of performance; the storage constraint is more fundamental.

Correct answer: C

Google Cloud Bigtable is purpose-built for high-throughput time-series data and metrics. With 50,000 sensors sending 10 readings per second (500,000 writes/second), Bigtable's columnar storage, automatic scaling, and low-latency performance make it ideal for real- time weather-charting applications with massive sensor data ingestion.

Why the other options are wrong:

• A. BigQuery is for analytical queries on historical data, not real-time ingestion of 500,000+ events per second.
• B. Cloud SQL lacks the horizontal scalability and throughput capability needed for this volume of real-time sensor data.
• D. Cloud Storage is object storage, not suitable for structured time-series data requiring real-time queries and analytics.

Correct answer: D

Stackdriver Trace (now Cloud Trace) instruments applications to capture end-to-end request latency across microservices, breaking down where time is spent at each service hop. This direct visibility into request flow through the service mesh is exactly what's needed to identify which service causes slowness in specific API requests.

Why the other options are wrong:

• A. Setting timeouts fails requests faster but doesn't identify the problematic service causing the latency.
• B. Custom metrics to Monitoring show aggregate metrics but lack the per-request granularity needed to trace specific slow requests through services.
• C. Monitoring dashboards show when latencies are high but don't break down which service in the chain is responsible for delays.

Correct answer: D

Routinely scheduled failovers test and validate the replica promotion process before a real crisis occurs. Regular failover testing ensures the failover mechanism actually works, identifies operational gaps, and builds confidence that replicas will correctly promote when needed, preventing the scenario where a crashed master leaves the replica unpromotable.

Why the other options are wrong:

• A. Changing databases doesn't solve the fundamental issue of untested failover processes.
• B. Larger instances improve capacity but don't address failover reliability or automation issues.
• C. More frequent snapshots improve recovery point objective (RPO) but don't prevent the replica promotion failure that occurred.

Correct answer: B

Stackdriver Monitoring with export to BigQuery provides 5-year retention capability. BigQuery's cost-effective storage, full queryability, and compliance with legal hold requirements make it suitable for long-term metrics retention and analysis. Exporting to BigQuery bypasses Stackdriver's default short-term retention policies (typically 30 days to 1 year) and enables archival of metrics across all projects for legal proceedings.

Why the other options are wrong:

• A. Granting security team access to logs in each Project doesn't address retention duration or centralized storage for analysis.
• C. Default Stackdriver Monitoring retention is only 30 days to 1 year, insufficient for the required 5-year retention.
• D. While Cloud Storage can store data for 5 years economically, it lacks queryability for analysis and is less suited to structured metrics data than BigQuery.

Correct answer: A

Google Cloud Dedicated Interconnect provides a dedicated, private network connection between on-premises data centers and Google Cloud Platform. For replicating a 4TB database with frequent large updates over private address space, Dedicated Interconnect offers the highest bandwidth, lowest latency, and most reliable connection specifically designed for this use case. It provides consistent performance for continuous replication traffic without competing for bandwidth with other internet traffic.

Why the other options are wrong:

• B. VPN connections have bandwidth limitations and higher latency unsuitable for frequent large database updates and 4TB replication.
• C. A NAT and TLS gateway adds unnecessary complexity and performance overhead compared to direct private connectivity.
• D. A self-managed VPN server on a GCE instance introduces single points of failure and management overhead compared to Google's managed Dedicated Interconnect service.

Correct answer: B

Exporting Cloud IAM policy change logs to BigQuery enables efficient querying, analysis, and filtering of audit data. BigQuery's ACLs and views allow you to create custom views that scope the data shared with auditors to only relevant IAM policy changes, making the audit process streamlined and expedited while maintaining security and data governance. This approach is auditor-friendly, searchable, and supports complex queries across 12 months of data.

Why the other options are wrong:

• A. Custom Stackdriver alerts are designed for real-time monitoring notifications, not for historical audit log analysis or review.
• C. Cloud SQL is not optimized for large-scale log analysis and adds unnecessary ETL complexity compared to BigQuery's native log integration.
• D. GCS bucket exports lack the query and analysis capabilities needed for efficient audit log review; BigQuery is purpose-built for this use case.

Correct answer: C

A secret management system such as Google Secret Manager is the security best practice for storing credentials in distributed applications. It provides centralized management, encryption at rest and in transit, fine-grained access control, audit logging, and automatic rotation capabilities. For 30 microservices requiring database credentials, a dedicated secret management system ensures credentials are never exposed in code, configuration files, or environment variables where they could be leaked.

Why the other options are wrong:

• A. Storing credentials in source code is a critical security vulnerability exposing secrets to version control systems and anyone with code access.
• B. Environment variables can be exposed through process listings, logs, and container inspection, making them insecure for sensitive credentials.
• D. Config files with ACLs still require manual management and lack encryption, rotation, and audit capabilities of a proper secret management system.

Correct answer: D

Google Kubernetes Engine (GKE) meets requirements 1-4 and 6: it uses open-source Kubernetes for portability, dynamically scales compute, supports continuous delivery through container orchestration, runs multiple segregated application copies via pods/deployments, and uses Services with load balancing for URL-based routing. Jenkins (requirement 3) provides continuous software delivery pipelines. Cloud Load Balancing (requirement 6) enables URL-based routing to specific services. Helm is not necessary because requirement 5 (dynamic templates) is adequately handled by Kubernetes manifests and GKE's native capabilities.

Why the other options are wrong:

• A. While Helm provides dynamic templates, Jenkins and Helm together don't address load balancing for URL-based traffic routing (requirement 6) as directly as the chosen answer.
• B. Lacks continuous software delivery capability (requirement 3) and doesn't address dynamic template deployment (requirement 5).
• C. Cloud Deployment Manager only supports Google Cloud resources and doesn't provide continuous delivery (requirement 3) or URL-based routing (requirement 6) natively.

Correct answer: C

The shutdown-script metadata key is Google Compute Engine's native mechanism for executing scripts when a VM is preempted or shut down. By setting this metadata entry during VM creation in the Cloud Console, GCE automatically executes the shutdown script before preemption, allowing the application to gracefully shut down. This is the officially supported and simplest approach for preemptible VM lifecycle management.

Why the other options are wrong:

• A. k99.shutdown in /etc/rc.6.d/ is a Linux init system approach that may not execute reliably before preemption, which happens at the hypervisor level.
• B. xinetd service registration with Stackdriver endpoint checks doesn't integrate with GCE's preemption notification mechanism.
• D. While shutdown-script-url metadata is valid, registering as xinetd adds unnecessary complexity when a simple script via metadata is sufficient.

Correct answer: D

Firewall rules with tags provide the most granular and appropriate control for the stated requirements. By tagging each tier (web, api, database) and creating firewall rules that allow traffic from web→api and api→database while denying web→database, you enforce the required traffic flow within the same network. Firewall rules are GCP's native security mechanism for controlling traffic between resources, more flexible and maintainable than routes.

Why the other options are wrong:

• A. Different subnetworks would work but are unnecessary since all tiers need to communicate through specific paths; firewall rules are more efficient for this use case.
• B. Software-based firewalls on individual VMs create management overhead and are less reliable than GCP's infrastructure-level firewall rules.
• C. Routes control traffic forwarding based on destination IP ranges, not allow/deny policies; they don't prevent unwanted traffic between tiers.

Correct answer: B

Reverting the source code change and rerunning the deployment pipeline (B) is the correct approach because it maintains infrastructure-as-code principles, ensures reproducibility, and quickly restores the system to a known good state. This follows best practices for continuous deployment and allows investigation to happen on non-production infrastructure without business impact.

Why the other options are wrong:

• A. Manual iteration on a live server breaks the deployment pipeline principle and makes the infrastructure state untrackable and unreproducible.
• C. Manually swapping code on servers circumvents the deployment pipeline, violates infrastructure-as-code principles, and creates configuration drift.
• D. Changing the instance group template and deleting instances is cumbersome, slower than reverting code, and doesn't follow the principle of maintaining infrastructure through source control.

Correct answer: C

A single Organization with Folders for each department (C) is the Google-recommended approach. This structure enables central IAM policy management at the Organization level while allowing independent policy control per department through Folders, which can have their own IAM bindings inherited by contained projects.

Why the other options are wrong:

• A. Multiple Organizations make central policy management difficult and fragmented across separate organizational hierarchies.
• B. Multiple Organizations, one per department, completely prevents centralized control and creates administrative overhead with separate billing and policies.
• D. Multiple projects without Folders don't provide the hierarchical structure needed for independent departmental control while maintaining central oversight.

Correct answer: B

The SecurityException indicates a SHA1 digest error during manifest entry verification when the Java classloader attempts to load the CloakedServlet class. This error occurs during JAR signature verification, meaning the JAR files lack proper digital signatures or have signature mismatches. Google App Engine requires JAR files to be digitally signed to ensure integrity and security during deployment. Signing all JAR files with a valid digital signature and redeploying will resolve the manifest verification failure.

Why the other options are wrong:

• A. Missing JAR files would cause ClassNotFoundException or NoClassDefFoundError, not a SecurityException related to digest verification during signature validation.
• C. You cannot recompile a class to use MD5 instead of SHA1; hash algorithms are determined by the JVM's signature verification process, not the source code, and MD5 is deprecated for security purposes anyway.

Correct answer: C

Using PKI to encrypt with the originating user's private key (C) provides cryptographic proof of message origin through digital signatures. Only the user with the private key could have created that encrypted message, preventing spoofing and providing non-repudiation -the recipient can verify the message came from the claimed sender.

Why the other options are wrong:

• A. Client-side tagging can be spoofed; an attacker can simply tag a message with another user's identifier.
• B. Shared-key encryption doesn't prove who sent the message, only that it came from someone with the shared key.
• D. SSL connectivity secures the transport layer but doesn't authenticate the message content itself or prevent spoofing at the application level.

Correct answer: B

Configuring a Google Cloud Dedicated Interconnect (B) addresses the core issue: VPN connections have inherent latency and packet loss limitations due to their nature as encrypted tunnels over the internet. Dedicated Interconnect provides a private, high- bandwidth (up to 100 Gbps), low-latency connection between the data center and GCP, eliminating replication disruptions.

Why the other options are wrong:

• A. UDP is unreliable and would worsen replication issues; database replication requires TCP's reliability guarantees.
• C. Cloud SQL restoration is a backup strategy, not a solution to the replication latency and packet loss problems.
• D. Multiple VPN connections don't solve the fundamental latency and packet loss issues inherent to VPN technology.
• E. Cloud Pub/Sub adds complexity and latency; it's not designed for synchronous database replication.

Correct answer: C

The Cloud Data Loss Prevention API (C) is purpose-built for detecting and de-identifying PII and payment card information at scale before storage. It uses machine learning and pattern matching to identify sensitive data types and apply appropriate redaction, masking, or tokenization-the recommended approach for sanitizing sensitive data.

Why the other options are wrong:

• A. Hashing is one-way and irreversible; it doesn't sanitize data for storage and analysis where the original data needs to be recovered.
• B. Encryption secures data but doesn't de-identify or sanitize it; encrypted PII is still PII and poses compliance risks.
• D. Regular expressions are brittle, error-prone, and miss many PII patterns; they lack the sophistication of a dedicated DLP service.

Correct answer: A

The ~/bin directory (A) is in the default execution path (part of PATH environment variable) and persists across Cloud Shell sessions because it's stored in the user's home directory, which is backed by persistent storage. Custom utilities stored there will be available in future sessions.

Why the other options are wrong:

• B. Cloud Storage requires explicit gsutil commands to access and doesn't reside in the execution path.
• C. /google/scripts is not a standard location and is typically not in the PATH or persistent across sessions.
• D. /usr/local/bin requires root or sudo access in Cloud Shell and changes don't persist across session restarts due to the ephemeral nature of the Cloud Shell instance.

Correct answer: A

Creating a VPC and connecting it to the on-premises data center using Dedicated Interconnect (A) is the Google-recommended practice for requirements of 20 Gbps or higher. Dedicated Interconnect provides dedicated, private connectivity with guaranteed bandwidth and low latency, which is essential for high-bandwidth, mission-critical connections.

Why the other options are wrong:

• B. Cloud VPN has throughput limitations (typically under 3 Gbps) and cannot reliably support 20 Gbps requirements.
• C. Cloud CDN is for content delivery optimization, not for creating private connections to on-premises data centers.
• D. Cloud CDN is inappropriate for this use case, and single Cloud VPN cannot meet the 20 Gbps requirement.

Correct answer: B

For a startup in trial phase with uncertain demand, the best practice is to use the free tier to minimize immediate costs and sustained use discounts (which automatically apply to running resources) rather than committed use discounts (which require long-term commitments). Training the entire team on cost management practices is more scalable and aligns with Google best practices than provisioning a dedicated staff position, which adds overhead costs. Team-wide cost awareness ensures everyone makes cost- conscious decisions throughout development.

Why the other options are wrong:

• A. Sustained use discounts are correct, but provisioning a dedicated staff position is costly for a startup with uncertain demand and doesn't scale with team practices.
• C. Committed use discounts require upfront commitments inappropriate for unknown consumer demand, and dedicated staff adds unnecessary overhead.
• D. Committed use discounts are unsuitable when demand is unpredictable; the startup should avoid long-term commitments.

Correct answer: D

The correct approach uses Jenkins to monitor repository tags, deploy staging tags to a staging environment for thorough testing before production, then deploy to production only after verification. This implements the proper CI/CD workflow where code changes are verified in a staging environment before production deployment. This method ensures quality gates are met and allows easy rollback if issues are detected, which directly addresses the requirement to verify changes before deploying to production.

Why the other options are wrong:

• A. Red/black deployment is a production deployment strategy, not a verification strategy, and doesn't ensure changes are tested before production deployment.
• B. Running tests on production deployments is dangerous and violates best practices; testing should occur in non-production environments first.
• C. Deploying to production for 10% of users before complete rollout (canary deployment) is a rollout strategy, not a verification strategy that prevents bad code from reaching production.

Correct answer: C

Disable the health check for the instance group. Add his SSH key to the project-wide SSH Keys To allow the Linux expert colleague to SSH into the restarting VMs, the health check must be disabled to prevent instances from being terminated during investigation. Then adding his SSH key to project-wide SSH keys grants him access to all instances in the project. This allows direct investigation of why instances are restarting every 5 seconds. Disabling the health check is necessary because the continuous restart cycle would prevent meaningful troubleshooting.

Why the other options are wrong:

• A. Project Viewer role provides read-only access and does not include SSH permissions needed to access and troubleshoot the instances.
• B. A rolling restart would not help diagnose the root cause and would continue the restart cycle, providing no debugging opportunity.
• D. Autoscaling is already disabled per the question; this option addresses the wrong problem and doesn't solve the access issue.

Correct answer: C

GKE can absolutely be used in a PCI DSS-compliant environment. Google Cloud Platform provides the necessary tools, controls, and security features to build PCI DSS-compliant architectures on GKE. The responsibility is shared between Google (infrastructure security) and the customer (configuration and application security), but GKE is not prohibited under PCI DSS. Organizations can implement appropriate network isolation, encryption, access controls, and audit logging on GKE to meet PCI DSS requirements.

Why the other options are wrong:

• A. App Engine is not the only PCI DSS-compliant compute platform; multiple GCP services including GKE can be used for PCI DSS workloads.
• B. GKE is not categorically prohibited under PCI DSS; the shared responsibility model and proper configuration allow PCI DSS compliance.
• D. While Google Cloud is PCI DSS certified, not all services are automatically suitable for all use cases; proper configuration is still required.

Correct answer: B

Cloud Dataprep is Google's recommended tool for exploring, cleaning, and preparing data with anomaly detection capabilities. It is specifically designed for data quality issues and degraded data. After uploading files to Cloud Storage, Cloud Dataprep provides visual data profiling, transformation, and anomaly detection features that are ideal for detecting and fixing data quality issues. This aligns with Google-recommended practices for data preparation workflows.

Why the other options are wrong:

• A. Cloud Datalab is primarily for exploration and analysis, not specifically designed for data cleaning and anomaly detection at scale.
• C. Connecting Cloud Datalab to on-premises systems adds unnecessary complexity; data should be migrated to Cloud Storage first for better performance and reliability.
• D. While Cloud Dataprep could connect to on-premises systems, uploading to Cloud Storage first is the recommended practice for better performance and to avoid ongoing connectivity issues.

Correct answer: C

GCP IAM policies follow an inheritance model where the effective policy at any node is the union of the policy set at that node plus all policies inherited from ancestor nodes in the hierarchy. This means permissions are additive-a role granted at the organization level applies to all folders and projects below it, and additional roles can be granted at lower levels. The effective policy expands with each level down the hierarchy, never restricts it.

Why the other options are wrong:

• A. Policies are inherited from ancestors, not determined only by the node itself.
• B. Policies are not restricted by ancestor policies; they are additive and inherited downward.
• D. The intersection model would be too restrictive and not how GCP IAM hierarchy works; policies are cumulative, not intersecting.

Correct answer: C

When using Cloud VPN to connect on-premises systems to Google Cloud, the IP ranges must not overlap. Using overlapping IP ranges would cause routing conflicts and make it impossible for on-premises systems to reach resources in Google Cloud with the same IP range, breaking connectivity. Non-overlapping ranges allow the VPN gateway to route traffic correctly between the two networks. This is a fundamental requirement for site-to- site VPN connectivity.

Why the other options are wrong:

• A. Using the same IP range on both sides creates routing conflicts and prevents proper VPN communication.
• B. While secondary ranges could be non-overlapping, using the same primary range creates the same routing problem as option A.
• D. Using the same IP range for the secondary range on-premises still creates conflicts with the on-premises primary range and is unnecessarily complex.

Correct answer: A

The gcloud datastore create-indexes command is the correct tool to deploy index configurations from a YAML file to Cloud Datastore. This is the standard GCP CLI method for managing Datastore indexes programmatically. The command reads the index configuration file and creates the necessary indexes in Cloud Datastore, which resolves the missing index errors in the App Engine application.

Why the other options are wrong:

• B. Uploading to Cloud Storage and expecting automatic detection is not how Datastore indexes are deployed; this approach would not work.
• C. Using Datastore Admin to manually delete and upload indexes is a manual process and not the recommended programmatic approach; the gcloud tool is standard.
• D. Creating HTTP requests to built-in Python modules is not the appropriate method; the gcloud CLI tool provides the proper interface for index management.

Correct answer: C

For a robust disaster recovery plan across regions, you need instance groups (not just individual instances) to handle scaling and resilience within each region. HTTP Load Balancing can distribute traffic across instance groups in different regions, providing automatic failover when a regional outage occurs. Instance groups are the recommended unit for managing multiple instances, enabling health checks, and supporting rolling updates. Using the same project (not separate projects) simplifies management and billing while maintaining geographic redundancy.

Why the other options are wrong:

• A. Single instances lack the scalability and redundancy that instance groups provide; instance groups are the proper abstraction for production failover scenarios.
• B. On-premises failover defeats the purpose of cloud-based disaster recovery and introduces external dependency and latency issues.
• D. Separate projects complicate IAM configuration, billing, and management; a single project is sufficient and recommended for this architecture.

Correct answer: D

App Engine flexible environment supports VPC connector integration, enabling secure communication with on-premises resources via Cloud VPN without exposing the database to the public internet. App Engine firewall rules alone cannot create a secure tunnel to on- premises systems. Standard environment does not support VPC connectors for on- premises connectivity. Cloud VPN establishes an encrypted tunnel that keeps the on- premises database completely isolated from public internet access while allowing authenticated application traffic.

Why the other options are wrong:

• A. App Engine firewall rules do not provide secure on-premises connectivity; they only filter traffic within GCP.
• B. Standard environment lacks VPC connector support needed for secure on-premises database access.
• C. While flexible environment is correct, App Engine firewall rules alone cannot secure on-premises database connectivity without a VPN tunnel.

Correct answer: A

Private Google Access enables VMs with only internal IP addresses to access Google APIs and services (including Cloud Storage) without requiring external internet connectivity. Uploading installation files to Cloud Storage and using gsutil to download them provides a secure method that respects the no-public-internet requirement. Private Google Access routes traffic through Google's private network, keeping the VM completely isolated from the public internet while enabling necessary service access.

Why the other options are wrong:

• B. Firewall rules alone cannot provide the routing needed for Cloud Storage access from a private VM; Private Google Access is the proper mechanism.
• C. Cloud Source Repositories requires additional setup and is less efficient than Cloud Storage for simple file distribution.
• D. Cloud Source Repositories is not the recommended approach, and firewall rules don't solve the core connectivity problem without Private Google Access.

Correct answer: A

For 75 TB of data, Google recommends using Transfer Appliance, a physical device that you load with data on-premises and ship to Google, who then loads it into Cloud Storage. This is far more efficient than network transfers for petabyte-scale data and follows Google best practices. The Transfer Appliance Rehydrator is the correct tool for ingesting the data from the appliance into Cloud Storage. This approach minimizes network bandwidth usage and is the standard practice for very large data migrations.

Why the other options are wrong:

• B. Cloud Dataprep is a data cleaning and preparation tool, not a data ingestion mechanism for Transfer Appliance.
• C. gsutil resumable transfers are impractical for 75 TB across multiple servers; they are suitable for smaller datasets and do not align with Google's recommended practices for this scale.
• D. Streaming transfers via gsutil are not appropriate for 75 TB; they are designed for smaller datasets and lack the efficiency of Transfer Appliance for large migrations.

Correct answer: A

kubectl set image is the standard kubectl command for performing rolling updates to a deployment, which automatically manages the gradual replacement of old pods with new ones, ensuring minimal downtime. The command natively handles the rolling update strategy defined in the deployment spec. This approach maintains service availability throughout the update process by keeping some pods running while others are being updated.

Why the other options are wrong:

• B. Instance Group rolling updates are a lower-level GCP mechanism that bypasses Kubernetes orchestration; kubectl commands are the proper interface for Kubernetes deployments.
• C. Deleting and recreating a deployment causes downtime because all pods are terminated before new ones start; this is not a minimal downtime approach.
• D. Services expose applications but do not manage container images; updating the service definition does not update the running application code.

Correct answer: C

BigQuery jobUser on the billing project allows users to create and run queries (which incurs charges), while BigQuery dataViewer on the data projects allows read-only access to datasets without the ability to edit them. This configuration ensures all query costs are billed to a single project while users can query data across multiple projects. jobUser is necessary to execute queries, and dataViewer provides the required read-only access to the distributed datasets.

Why the other options are wrong:

• A. BigQuery user is a viewer role without query execution permissions; it does not grant the ability to run queries that would incur billing.
• B. BigQuery user on data projects is not the correct role; jobUser should be on the billing project to control where queries are executed and billed.
• D. dataViewer on the billing project is incorrect; jobUser should be on the billing project to enable query execution there, not on data projects.

Correct answer: B

Signed URLs are the standard Google Cloud mechanism for granting time-limited, credential-free access to Cloud Storage objects. A signed URL with a 24-hour expiration allows any user (with or without a Google Account) to upload images directly to Cloud Storage without authentication, and access automatically revokes after 24 hours. This is simpler than building a web application and aligns with Google Cloud best practices for temporary access scenarios.

Why the other options are wrong:

• A. Cloud Storage buckets do not support password protection; bucket access is controlled via IAM and signed URLs, not passwords.
• C. Building an App Engine application adds unnecessary complexity when signed URLs solve the problem more simply and efficiently.
• D. App Engine cannot automatically disable itself after 24 hours; this would require manual intervention or Cloud Scheduler. Signed URLs provide automatic expiration without operational overhead.

Correct answer: D

GDPR compliance is fundamentally a technical and organizational design responsibility that requires defining specific security and data handling measures tailored to your application's requirements. While Google provides compliant infrastructure and tools, you must architect your application to meet GDPR requirements such as data encryption, access controls, data retention policies, and breach notification procedures. No automated GCP setting can substitute for proper architectural design that accounts for data residency, processing, and user rights.

Why the other options are wrong:

• A. Using only native GCP services does not guarantee GDPR compliance; you must still design and implement compliant data handling practices specific to your application.
• B. There is no single "GDPR compliance setting" in GCP Console; compliance requires intentional architectural design across services.
• C. Cloud Security Scanner detects security vulnerabilities but does not ensure GDPR compliance; it is a security tool, not a compliance tool.