Google Cloud Certified - Professional Cloud Architect — Questions and Answers

Question 1: Which App Engine environment automatically scales to zero instances when no traffic is received?

App Engine Standard (Correct answer)
Neither environment
Both environments
App Engine Flexible

Correct answer: App Engine Standard

App Engine Standard can scale to zero instances during periods of no traffic, reducing costs, while Flexible maintains at least one instance.

Question 2: What term best sums up a Google Cloud Architect's job?

A technical subject matter expert that knows business and technological requirements and is able to translate those requirements into technical designs
A person with the ability to create, manage, and use strong, secure, scalable, highly available, and dynamic solutions to advance business goals (Correct answer)
An individual within an organization who architects
An engineer who is interested in designing robust solutions in an enterprise

Correct answer: A person with the ability to create, manage, and use strong, secure, scalable, highly available, and dynamic solutions to advance business goals

Explanation: <br> Although all answers are technically valid, the question is seeking the best definition of the work of a Google Cloud Architect, which is an individual who can design, construct and manage resilient, secure, scalable, highly available, and dynamic solutions to drive business objectives.

Question 3: Which GCP feature provides network traffic analysis by capturing metadata about IP flows into and out of VMs?

Cloud Trace
Cloud Armor logs
VPC Flow Logs (Correct answer)
Firewall Insights

Correct answer: VPC Flow Logs

VPC Flow Logs capture metadata (source, destination, ports, bytes) for network flows in your VPC for monitoring and security analysis.

Question 4: Which resource hierarchy level is the LOWEST at which an IAM policy can be set in Google Cloud?

Folder
Individual resource (Correct answer)
Organization
Project

Correct answer: Individual resource

IAM policies can be set at the individual resource level (e.g., a specific Cloud Storage bucket or BigQuery dataset), which is the most granular level in the resource hierarchy.

Question 5: A team needs to migrate an existing MySQL database to GCP with minimal changes. Which managed service should they use?

Cloud Bigtable
AlloyDB
Cloud Spanner
Cloud SQL for MySQL (Correct answer)

Correct answer: Cloud SQL for MySQL

Cloud SQL for MySQL is a fully managed relational database that supports MySQL, enabling lift-and-shift migrations with minimal modification.

Question 6: What is the default log retention period for audit logs in Cloud Logging?

400 days (Correct answer)
7 days
1 year
30 days

Correct answer: 400 days

By default, Cloud Audit Logs (Admin Activity and System Event) are retained for 400 days in Cloud Logging.

Question 7: A team needs to share read access to a sensitive dataset in BigQuery with external auditors without giving them Google Cloud project access. What is the correct approach?

Create a service account key and share it with the auditors
Add auditor email addresses as project Viewer on the Google Cloud project
Export data to a public Cloud Storage bucket for auditors to download
Use BigQuery authorized views to expose only specific columns/rows, granting access to the view (Correct answer)

Correct answer: Use BigQuery authorized views to expose only specific columns/rows, granting access to the view

Authorized views allow you to share a filtered, column-restricted subset of data without granting direct table access or any project-level IAM role.

Question 8: When using Cloud Bigtable, what is the best practice for row key design to avoid hotspotting?

Use the user's email address directly
Use high-cardinality, evenly distributed keys such as salted or reversed strings (Correct answer)
Use timestamps as the leading component
Use sequential integer IDs as row keys

Correct answer: Use high-cardinality, evenly distributed keys such as salted or reversed strings

Hotspotting occurs when many reads/writes hit the same tablet; using salted or reversed keys distributes load evenly across nodes.

Question 9: An application requires access to Cloud SQL from GKE pods. Which approach BEST follows Google's security best practices?

Use a static username and password stored in environment variables
Grant the GKE node pool's default service account Cloud SQL Editor
Mount a service account key as a Kubernetes secret
Use Workload Identity to bind a Kubernetes service account to a GCP service account (Correct answer)

Correct answer: Use Workload Identity to bind a Kubernetes service account to a GCP service account

Workload Identity is the recommended approach for GKE because it binds Kubernetes service accounts to GCP service accounts, enabling fine-grained access without key files.

Question 10: A company runs a legacy application on physical servers and wants to migrate to GCP with minimal refactoring. Which compute option is most appropriate?

Compute Engine VMs (Correct answer)
App Engine Standard
Google Kubernetes Engine
Cloud Run

Correct answer: Compute Engine VMs

Compute Engine provides full control over VM configuration, making it the best choice for lift-and-shift migrations of legacy applications.

Question 11: A data engineering team needs to detect anomalies in streaming sensor data in real-time and alert within 30 seconds. Which architecture is best?

Write sensor data to Firestore and trigger Cloud Functions on document creation
Batch export sensor data to BigQuery every hour and run anomaly queries
Ingest via Pub/Sub, process with Dataflow streaming using windowing and anomaly detection, alert via Pub/Sub/Cloud Monitoring (Correct answer)
Store in Bigtable and run periodic MapReduce jobs

Correct answer: Ingest via Pub/Sub, process with Dataflow streaming using windowing and anomaly detection, alert via Pub/Sub/Cloud Monitoring

Pub/Sub ingestion with a Dataflow streaming pipeline supports sub-minute latency windowing and can publish anomaly events immediately for alerting.

Question 12: Which GCP multi-region option for Cloud Storage ensures data is stored redundantly across at least two geographic regions?

Regional storage class
Coldline multi-AZ
Dual-region or Multi-region location (Correct answer)
Nearline cross-region

Correct answer: Dual-region or Multi-region location

Dual-region and multi-region Cloud Storage locations replicate data across geographically separated regions for highest durability and availability.

Question 13: An architect needs to ensure that a multi-project GCP environment sends all security findings to a single Security Operations Center. Which service aggregates findings?

Security Command Center (SCC) (Correct answer)
Cloud Logging sink to BigQuery
Cloud Monitoring workspace
VPC Service Controls

Correct answer: Security Command Center (SCC)

Security Command Center (SCC) provides a centralized view of security and compliance findings across all GCP projects in an organization.

Question 14: Which IAM approach best follows the principle of least privilege for a Cloud Run service that only needs to read from one Cloud Storage bucket?

Use the default Compute Engine service account with Editor role
Grant the service account roles/storage.admin on the project
Create a custom role with storage.objects.get and storage.objects.list on that specific bucket (Correct answer)
Grant roles/storage.objectViewer at the project level

Correct answer: Create a custom role with storage.objects.get and storage.objects.list on that specific bucket

A custom role scoped to only the needed permissions on the specific bucket minimizes the blast radius of any credential compromise.

Question 15: When designing a disaster recovery plan on Google Cloud, what does an RTO (Recovery Time Objective) measure?

The maximum acceptable time to restore service after a disaster (Correct answer)
The percentage of traffic that must remain available during a failover
The maximum amount of data loss measured in time that is acceptable after an outage
The cost of recovery operations per hour of downtime

Correct answer: The maximum acceptable time to restore service after a disaster

RTO is the maximum acceptable elapsed time from a disaster event to the restoration of service to an acceptable performance level.

Question 16: Which AlloyDB feature makes it significantly faster than standard Cloud SQL PostgreSQL for analytical queries?

Columnar engine for HTAP workloads (Correct answer)
Automatic sharding
Multi-region synchronous writes
Built-in Redis cache

Correct answer: Columnar engine for HTAP workloads

AlloyDB's columnar engine accelerates analytical queries by storing data in a column-oriented format in memory alongside the row store.

Question 17: A team wants to receive alerts when their GKE cluster CPU utilization exceeds 80% for 5 minutes. Which tool should they configure?

Error Reporting notifications
Cloud Trace latency alerts
Cloud Logging log-based alerts
Cloud Monitoring alerting policies (Correct answer)

Correct answer: Cloud Monitoring alerting policies

Cloud Monitoring alerting policies let you define metric-based conditions and notification channels for infrastructure and application metrics.

Question 18: A team is designing a microservices architecture on GKE and needs service-to-service authentication without managing credentials. What is the recommended approach?

Whitelist pod IP ranges in service firewall rules
Use shared API keys stored in Kubernetes Secrets
Use Workload Identity with service account impersonation and mTLS via Anthos Service Mesh (Correct answer)
Store JWT signing keys in Cloud KMS and share across services

Correct answer: Use Workload Identity with service account impersonation and mTLS via Anthos Service Mesh

Workload Identity binds Kubernetes service accounts to Google service accounts, and Anthos Service Mesh provides mTLS between services, eliminating credential management entirely.

Question 19: What is the purpose of a Cloud Monitoring workspace?

Manage billing for monitored resources
Define IAM roles for Logging access
Provide a unified monitoring view across multiple GCP projects (Correct answer)
Store audit log archives

Correct answer: Provide a unified monitoring view across multiple GCP projects

A Cloud Monitoring workspace aggregates metrics and dashboards from multiple GCP projects into a single monitoring interface.

Question 20: Which Google Cloud resource hierarchy level is the recommended attachment point for Organization Policy constraints that must apply universally with no exceptions?

Folder level
Project level
Organization node (root) (Correct answer)
Individual resource level

Correct answer: Organization node (root)

Policies attached at the organization node apply to all folders, projects, and resources within the organization and cannot be overridden lower in the hierarchy.

Question 21: A financial services firm requires that encryption keys used for Cloud Storage buckets are rotated every 90 days and never leave their HSM. Which solution satisfies this?

Google-managed encryption keys with automatic rotation
Customer-supplied encryption keys (CSEK) stored in Cloud HSM
Customer-managed encryption keys (CMEK) via Cloud KMS with rotation schedule
Cloud External Key Manager (EKM) with keys hosted in their on-premises HSM (Correct answer)

Correct answer: Cloud External Key Manager (EKM) with keys hosted in their on-premises HSM

Cloud EKM allows Google Cloud to use encryption keys that physically reside in the customer's own HSM, ensuring keys never leave the customer's infrastructure.

Question 22: Which GCP service collects application performance data such as latency and request traces across distributed services?

Cloud Logging
Error Reporting
Cloud Monitoring
Cloud Trace (Correct answer)

Correct answer: Cloud Trace

Cloud Trace collects distributed tracing data to help analyze latency across microservices and identify performance bottlenecks.

Question 23: On Google Cloud Platform, your company has a 3-tier web application installed on the same network. The web, API, and database tiers can scale separately from one another. The web should be the conduit for network traffic that travels to the API tier and ultimately to the database tier. The database and web tiers shouldn't be in communication with one another. How should the network be configured?

Add each tier to a different subnetwork.
Add tags to each tier and set up routes to allow the desired traffic flow
Add tags to each tier and set up firewall rules to allow the desired traffic flow (Correct answer)
Set up software-based firewalls on individual VMs

Correct answer: Add tags to each tier and set up firewall rules to allow the desired traffic flow

Explanation: <br> Each instance will have the same tag to identify the tier as it grows. Since tags can be used for both the target and the source, firewall rules can make use of them to allow or restrict traffic as needed.

Question 24: Which GKE feature helps ensure a minimum number of pods remain available during voluntary disruptions like node upgrades?

Resource Quotas
Pod Disruption Budget (PDB) (Correct answer)
Horizontal Pod Autoscaler
LimitRange

Correct answer: Pod Disruption Budget (PDB)

Pod Disruption Budgets define the minimum number of pods that must remain available during voluntary disruptions, preventing outages during maintenance.

Question 25: What is a key characteristic of a Warm Standby disaster recovery strategy?

A scaled-down version of the environment runs continuously and can scale up quickly (Correct answer)
Backups are replicated but no compute runs in the DR region
The standby environment is identical to production and always running at full capacity
The environment is created only after a disaster is declared

Correct answer: A scaled-down version of the environment runs continuously and can scale up quickly

Warm Standby keeps a reduced-capacity version of the environment running, allowing faster recovery than a cold standby but at lower cost than hot standby.

Question 26: What is the Recovery Time Objective (RTO) in the context of disaster recovery planning?

The maximum acceptable time to restore service after a disaster (Correct answer)
The minimum number of replicas required for redundancy
The time interval between backups
The maximum acceptable amount of data loss measured in time

Correct answer: The maximum acceptable time to restore service after a disaster

RTO defines the maximum tolerable downtime — how quickly the service must be restored after a disaster occurs.

Question 27: Which GCP feature allows you to create scheduled, automated snapshots of Persistent Disks for backup?

Cloud Backup and DR service
Snapshot Schedules (Correct answer)
Managed Instance Group autohealing
Disk cloning

Correct answer: Snapshot Schedules

Snapshot Schedules in Compute Engine automate the creation and retention of Persistent Disk snapshots on a defined schedule.

Question 28: A Cloud Architect needs to prevent any project in the organization from creating service account keys. Which service should be used?

VPC Service Controls
Organization Policy Service with constraints/iam.disableServiceAccountKeyCreation (Correct answer)
Cloud Armor
Cloud Identity

Correct answer: Organization Policy Service with constraints/iam.disableServiceAccountKeyCreation

The Organization Policy Service with the iam.disableServiceAccountKeyCreation constraint can be applied at the organization level to prevent any project from creating service account keys.

Question 29: What is the purpose of Cloud SQL Read Replicas?

Replace the primary for writes automatically
Offload read traffic and improve read performance (Correct answer)
Enable real-time sync to BigQuery
Provide multi-region writes

Correct answer: Offload read traffic and improve read performance

Cloud SQL Read Replicas serve read queries, reducing load on the primary instance and improving overall read throughput.

Question 30: Which layer does a Google Cloud External HTTP(S) Load Balancer operate at?

Layer 7 (Application) (Correct answer)
Layer 2 (Data Link)
Layer 4 (Transport)
Layer 3 (Network)

Correct answer: Layer 7 (Application)

External HTTP(S) Load Balancer is a Layer 7 load balancer that routes traffic based on URL maps, headers, and other HTTP attributes.

Question 31: What is the primary purpose of a VPC Shared network in Google Cloud?

To connect on-premises networks to Google Cloud
To allow multiple projects to share a single VPC network managed by a host project (Correct answer)
To peer two separate VPC networks for transitive routing
To encrypt all traffic between VM instances

Correct answer: To allow multiple projects to share a single VPC network managed by a host project

Shared VPC lets an organization connect resources from multiple projects to a common VPC network hosted in a single host project.

Google Cloud Certified - Professional Cloud Architect

The Professional Cloud Architect certification validates the ability to design, develop, and manage robust, secure, scalable, and cost-effective cloud solutions on Google Cloud. It tests knowledge of cloud architecture, infrastructure management, security, compliance, and the Google Cloud Well-Architected Framework.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds