Google Cloud Professional Cloud Architect practice questions

Question 1 · Designing and planning a cloud solution architecture

Larkfield Transit sells rail tickets across three continents. Its inventory service must accept writes in Europe, Asia, and North America simultaneously, and a seat can be sold exactly once — a double-sell is a regulatory incident. Traffic grows roughly 40% each year and the team wants to keep SQL joins. Which storage design fits these requirements?

1. A.Deploy Cloud SQL for PostgreSQL with cross-region read replicas and route writes to the primary
2. B.Deploy a Cloud Spanner multi-region instance configuration and let it serialize writes with external consistency
3. C.Deploy Bigtable with a replicated instance and use a row key built from the seat identifier
4. D.Deploy Firestore in Native mode and wrap each seat purchase in a single-document transaction

Question 2 · Managing and provisioning a cloud solution infrastructure

You maintain a managed instance group named api-mig running instance template api-tpl-11. A new template api-tpl-12 is ready and the service owner insists that capacity never drops below the current size during rollout, with at most two extra VMs in flight. Which command performs the update?

1. A.gcloud compute instance-groups managed rolling-action start-update api-mig --version=template=api-tpl-12 --max-surge=2 --max-unavailable=0
2. B.gcloud compute instance-groups managed rolling-action start-update api-mig --version=template=api-tpl-12 --max-surge=0 --max-unavailable=2
3. C.gcloud compute instance-groups managed rolling-action replace api-mig --template=api-tpl-12 --max-unavailable=2
4. D.gcloud compute instance-groups managed set-instance-template api-mig --template=api-tpl-12 --max-surge=2

Question 3 · Designing for security and compliance

Ferro Labs runs a GitHub Actions pipeline that deploys to Google Cloud. It currently authenticates with a downloaded service account key stored as a repository secret, and the security team has flagged the long-lived credential. What should replace it?

1. A.Workload Identity Federation, exchanging the pipeline's OIDC token for short-lived Google credentials
2. B.An API key scoped to the deployment APIs and restricted by the runner's source IP range
3. C.A user-managed service account with the key encrypted by Cloud KMS before being stored as a secret
4. D.A new service account key rotated automatically every 30 days by a Cloud Scheduler job

Question 4 · Analyzing and optimizing technical and business processes

A finance review of Ilsabet Logistics shows 120 n2-standard-8 VMs whose utilisation has stayed between 55% and 70% for 14 months, plus a batch fleet that runs only in December. The CFO wants a durable reduction in the compute bill without performance risk. What should the architect recommend?

1. A.Purchase committed use discounts sized to the steady 120-VM baseline and leave the December fleet on-demand
2. B.Migrate the steady fleet to Spot VMs and keep the December fleet on committed use discounts
3. C.Rely on sustained use discounts for the baseline and reserve capacity in advance for December
4. D.Purchase committed use discounts sized to the December peak so the busiest month is fully covered

Question 5 · Managing implementation

A team's Cloud Build pipeline builds an image and deploys it. Auditors require that a named release manager approve the production step, and that the approval be recorded. The build and deploy steps should remain in one automated flow. What should be configured?

1. A.A branch protection rule requiring the release manager to review the merge into the main branch
2. B.A Cloud Build trigger with manual approval required, so the run pauses for an authorized approver
3. C.A build step that emails the release manager and waits for a reply before the deploy step continues
4. D.A separate production trigger that only the release manager holds permission to run manually

Question 6 · Ensuring solution and operations excellence

A payments API must be reliable enough that customers do not complain, and the team wants an explicit, measurable target to arbitrate between shipping features and doing reliability work. Which formulation should the architect define?

1. A.An alert that pages the on-call engineer whenever backend CPU utilisation exceeds 85% for five minutes
2. B.An SLI of the proportion of requests served under 300 ms, with an SLO of 99.9% over a rolling 28 days
3. C.An SLA promising 99.9% availability, with service credits paid to customers who experience a breach
4. D.A monthly report of total incident count and cumulative outage minutes, reviewed by engineering leads

Question 7 · Designing and planning a cloud solution architecture

Perrin Diagnostics runs a lab results portal on regional managed instance groups in europe-west4 with a Cloud SQL primary. The business signs off on an RTO of 20 minutes and an RPO of 5 minutes for a full regional outage, and finance rejects a second always-on production footprint. Which disaster recovery pattern satisfies both constraints most economically?

1. A.Hot active-active: identical instance groups serving live traffic in two regions behind a global load balancer
2. B.Warm standby: a scaled-down instance group plus a cross-region read replica that is promoted during failover
3. C.Backup and restore: nightly snapshots copied to a second region and restored by the on-call engineer
4. D.Cold standby: images and database exports in a second region, with infrastructure built by pipeline at failover time

Question 8 · Managing and provisioning a cloud solution infrastructure

Cadenza Foods wants one central network team to own subnets, firewall rules, and Cloud Router, while six application teams deploy VMs from their own projects into those subnets. The application teams must not be able to edit routes or firewall rules. How should this be provisioned?

1. A.Enable Shared VPC on the host project and grant teams compute.networkUser on specific subnets
2. B.Enable Shared VPC on the network project and grant each application team compute.networkAdmin on the host project
3. C.Create a VPC per application project and peer each one with the central network project's VPC
4. D.Create one VPC in each application project and connect them with HA VPN tunnels to the network project