MCQ Flashcards

A company wants to ensure that Cloud Storage buckets never have public access enabled, even if a developer accidentally sets it. What is the most preventive control?

Answer: Enable the constraints/storage.publicAccessPrevention organization policy

The storage.publicAccessPrevention organization policy proactively blocks public access configuration at the API level, preventing the misconfiguration before it occurs.

An e-commerce platform needs to process payment events in strict order per customer ID, with exactly-once semantics. Which Pub/Sub feature enables this?

Answer: Pub/Sub with message ordering enabled and an ordering key set to customer ID

Pub/Sub ordering keys guarantee that messages with the same key are delivered in order to a single subscriber, enabling per-customer ordered processing.

A startup wants to run a containerized web app that scales to zero when unused to minimize costs. Which compute option is most appropriate?

Answer: Cloud Run (fully managed) with minimum instances set to 0

Cloud Run (fully managed) with min-instances=0 scales down completely when idle, incurring no compute cost between requests.

You need to migrate a stateful legacy application that uses local disk storage to Google Cloud with minimal code changes. Which approach preserves the local disk behavior?

Answer: Lift-and-shift to Compute Engine VM with a Persistent Disk attached

A Compute Engine VM with Persistent Disk provides a standard block device that behaves identically to on-premises local disk, requiring no application code changes.

A data engineering team needs to detect anomalies in streaming sensor data in real-time and alert within 30 seconds. Which architecture is best?

Answer: Ingest via Pub/Sub, process with Dataflow streaming using windowing and anomaly detection, alert via Pub/Sub/Cloud Monitoring

Pub/Sub ingestion with a Dataflow streaming pipeline supports sub-minute latency windowing and can publish anomaly events immediately for alerting.

A team is designing a microservices architecture on GKE and needs service-to-service authentication without managing credentials. What is the recommended approach?

Answer: Use Workload Identity with service account impersonation and mTLS via Anthos Service Mesh

Workload Identity binds Kubernetes service accounts to Google service accounts, and Anthos Service Mesh provides mTLS between services, eliminating credential management entirely.

Your organization needs a landing zone for multiple business units on Google Cloud. Which resource hierarchy is most aligned with Google's recommended best practices?

Answer: Organization → Folders (by business unit) → Folders (by environment) → Projects (by workload)

Google recommends an Organization → BU folders → Environment folders → Workload projects hierarchy, which allows IAM and policy inheritance at the right granularity.