MCQ Flashcards

A financial services firm requires that encryption keys used for Cloud Storage buckets are rotated every 90 days and never leave their HSM. Which solution satisfies this?

Answer: Cloud External Key Manager (EKM) with keys hosted in their on-premises HSM

Cloud EKM allows Google Cloud to use encryption keys that physically reside in the customer's own HSM, ensuring keys never leave the customer's infrastructure.

Your GKE workload needs to access a Cloud SQL instance securely without exposing the database to the public internet. What is the recommended approach?

Answer: Use the Cloud SQL Auth Proxy as a sidecar container with Workload Identity

The Cloud SQL Auth Proxy sidecar handles IAM authentication and TLS, while Workload Identity eliminates the need to manage service account key files.

A company uses multiple Google Cloud projects and wants centralized billing alerts when spend across all projects exceeds a threshold. What should they configure?

Answer: A budget alert at the billing account level covering all linked projects

A billing account-level budget aggregates spend across all linked projects and triggers Pub/Sub or email alerts when thresholds are crossed.

An architect must design a system where a batch ML training job reads from BigQuery and writes model artifacts to Cloud Storage, running nightly. What is the best orchestration tool?

Answer: Cloud Composer (Airflow) DAG with BigQuery and GCS operators

Cloud Composer (managed Airflow) provides robust DAG-based orchestration with built-in BigQuery and GCS operators, retry logic, and dependency management for complex batch workflows.

Your application needs to serve users in Asia, Europe, and North America with sub-100ms latency for static assets. What is the optimal architecture?

Answer: Use Cloud CDN backed by a global external HTTP(S) load balancer with Cloud Storage origin

Cloud CDN caches content at Google's global edge PoPs, and the global load balancer routes users to the nearest cache, minimizing latency for static assets worldwide.

A team needs to share read access to a sensitive dataset in BigQuery with external auditors without giving them Google Cloud project access. What is the correct approach?

Answer: Use BigQuery authorized views to expose only specific columns/rows, granting access to the view

Authorized views allow you to share a filtered, column-restricted subset of data without granting direct table access or any project-level IAM role.

Which Google Cloud networking feature allows a VPC in one project to communicate with services in another project's VPC using private IPs without VPC peering?

Answer: Private Service Connect

Private Service Connect enables consumers to access managed services or services in other VPCs via a private endpoint in their own VPC, without peering or exposing services publicly.