Mixed Deck — All Google Cloud Certified - Professional Cloud Architect Topics Flashcards

A Kubernetes deployment on GKE needs to ensure pods are spread across multiple zones for high availability. Which feature achieves this?

Answer: Topology Spread Constraints

Topology Spread Constraints control how pods are distributed across topology domains like zones, ensuring high availability.

A team needs to run a GPU-accelerated ML training job that takes 8 hours and can tolerate restarts. How should they minimize cost?

Answer: Use Spot (preemptible) A2 GPU VMs with checkpointing enabled

Spot/preemptible GPU VMs cost up to 60-91% less than on-demand; checkpointing ensures restarts don't lose progress, making them viable for long fault-tolerant training jobs.

An architect must design a system where a batch ML training job reads from BigQuery and writes model artifacts to Cloud Storage, running nightly. What is the best orchestration tool?

Answer: Cloud Composer (Airflow) DAG with BigQuery and GCS operators

Cloud Composer (managed Airflow) provides robust DAG-based orchestration with built-in BigQuery and GCS operators, retry logic, and dependency management for complex batch workflows.

The focus of the least privilege principle is:

Answer: Minimizing the amount of privileges that a single user has to the bare minimum needed to perform their job duties

Explanation: Making sure that your users have access to only what is necessary to perform their job obligations is the aim of the least privilege.

You examined TerramEarth's need for downtime reduction and discovered that they can save the majority of the time by cutting down on client wait times for parts. You made the decision to concentrate on cutting the total reporting time for the three weeks. Which process changes for the company should you suggest?

Answer: 80% more fleet cellular connectivity, a move from FTP to streaming transport, and the development of metrics machine learning analysis.

Explanation: Since the data is now only collected when the machines are down for maintenance, having cellular connectivity will significantly increase how recent the data is when it is utilized for analysis. Using streaming transport as opposed to recurrent FTP will further tighten the feedback loop. Workloads requiring predictive maintenance are perfect for machine learning.

A Professional Cloud Architect must ensure traffic between microservices in GKE is encrypted in transit. Which solution is best?

Answer: Use Anthos Service Mesh or Istio mTLS

Anthos Service Mesh (based on Istio) provides mutual TLS (mTLS) to encrypt and authenticate traffic between services in GKE.

What is the purpose of a GCE Instance Template?

Answer: Define a reusable VM configuration for Managed Instance Groups

Instance templates define the machine type, boot disk image, network settings, and labels used to create VMs in a Managed Instance Group.

Which GCP compute service is best suited for running stateful, long-running background workers that don't need HTTP endpoints?

Answer: Cloud Run Jobs

Cloud Run Jobs are designed for batch or script-style workloads that run to completion without needing to serve HTTP requests.

Which type of Cloud VPN is recommended for high-availability production workloads?

Answer: HA VPN

HA VPN provides a 99.99% SLA by using two VPN gateways with redundant tunnels, making it suitable for production environments.

A company wants to run a batch data processing job on GCP that needs to start quickly and complete within a few hours at lowest cost. Which VM option is most appropriate?

Answer: Preemptible VMs (Spot VMs)

Preemptible (Spot) VMs offer significant discounts (up to 91%) for short-lived workloads that can tolerate interruption, ideal for batch processing.

What is the purpose of Workload Identity Federation in Google Cloud?

Answer: It allows external workloads to access GCP resources without service account keys by exchanging short-lived tokens

Workload Identity Federation lets external workloads (AWS, Azure, on-prem) authenticate to GCP by exchanging their provider credentials for short-lived GCP tokens, eliminating the need for service account keys.

A financial services firm requires that encryption keys used for Cloud Storage buckets are rotated every 90 days and never leave their HSM. Which solution satisfies this?

Answer: Cloud External Key Manager (EKM) with keys hosted in their on-premises HSM

Cloud EKM allows Google Cloud to use encryption keys that physically reside in the customer's own HSM, ensuring keys never leave the customer's infrastructure.

For your pods, you must use a standard set of host names. Which feature ought to you employ?

Answer: Stateful Sets

Explanation: You may provide each of your pods with a consistent set of distinctive host names by using stateful sets

A retail company wants real-time inventory updates visible globally with strong consistency. Which Cloud Spanner feature addresses this requirement?

Answer: Multi-region instance with TrueTime-based external consistency

Cloud Spanner multi-region instances use TrueTime to provide external consistency (linearizability) across all regions simultaneously.

On Google Cloud Platform, your company has a 3-tier web application installed on the same network. The web, API, and database tiers can scale separately from one another. The web should be the conduit for network traffic that travels to the API tier and ultimately to the database tier. The database and web tiers shouldn't be in communication with one another. How should the network be configured?

Answer: Add tags to each tier and set up firewall rules to allow the desired traffic flow

Explanation: Each instance will have the same tag to identify the tier as it grows. Since tags can be used for both the target and the source, firewall rules can make use of them to allow or restrict traffic as needed.

An e-commerce platform needs to process payment events in strict order per customer ID, with exactly-once semantics. Which Pub/Sub feature enables this?

Answer: Pub/Sub with message ordering enabled and an ordering key set to customer ID

Pub/Sub ordering keys guarantee that messages with the same key are delivered in order to a single subscriber, enabling per-customer ordered processing.

A startup needs a fully managed, serverless NoSQL document database for a mobile app with real-time sync. Which service fits best?

Answer: Firestore

Firestore is a serverless, NoSQL document database with real-time synchronization, ideal for mobile and web applications.

Which Google Cloud networking feature allows a VPC in one project to communicate with services in another project's VPC using private IPs without VPC peering?

Answer: Private Service Connect

Private Service Connect enables consumers to access managed services or services in other VPCs via a private endpoint in their own VPC, without peering or exposing services publicly.

Which IAM approach best follows the principle of least privilege for a Cloud Run service that only needs to read from one Cloud Storage bucket?

Answer: Create a custom role with storage.objects.get and storage.objects.list on that specific bucket

A custom role scoped to only the needed permissions on the specific bucket minimizes the blast radius of any credential compromise.

A team wants to receive alerts when their GKE cluster CPU utilization exceeds 80% for 5 minutes. Which tool should they configure?

Answer: Cloud Monitoring alerting policies

Cloud Monitoring alerting policies let you define metric-based conditions and notification channels for infrastructure and application metrics.