Google Cloud Certified Introduction to Google Cloud Certified - Professional Cloud Architect 3 — Questions and Answers
Question 1: A startup wants to deploy a containerized web application that scales to zero when idle to minimize costs. Which service is the best fit?
- Google Kubernetes Engine (GKE)
- Cloud Run (Correct answer)
- Compute Engine with managed instance groups
- App Engine Standard
Correct answer: Cloud Run
Cloud Run automatically scales containerized applications to zero when there is no traffic, making it the most cost-effective option for variable or idle workloads.
Question 2: Which Google Cloud feature allows you to create a private connection between your VPC and Google APIs without traffic traversing the public internet?
- Cloud VPN
- Private Google Access (Correct answer)
- VPC Peering
- Cloud Interconnect
Correct answer: Private Google Access
Private Google Access allows VM instances without external IP addresses to reach Google APIs and services using internal IP addresses.
Question 3: An architect must choose a solution to migrate a large Oracle database to Google Cloud with minimal re-platforming effort. What is the most appropriate choice?
- Cloud Spanner
- Cloud SQL for PostgreSQL with ora2pg
- Bare Metal Solution (Correct answer)
- BigQuery
Correct answer: Bare Metal Solution
Bare Metal Solution provides dedicated hardware running Oracle Database in Google Cloud data centers, enabling lift-and-shift with no re-platforming.
Question 4: What is the recommended practice for managing service account keys in Google Cloud?
- Rotate keys every 90 days and store them in Cloud Storage
- Avoid downloading keys and use Workload Identity Federation or attached service accounts instead (Correct answer)
- Encrypt keys with Cloud KMS and embed them in application code
- Store keys in Secret Manager and reference them at runtime
Correct answer: Avoid downloading keys and use Workload Identity Federation or attached service accounts instead
Google recommends avoiding user-managed service account keys entirely by using Workload Identity Federation or attaching service accounts to resources.
Question 5: A company has regulatory requirements to ensure all data at rest is encrypted with customer-managed keys. Which Google Cloud feature enables this?
- Cloud HSM
- Customer-Managed Encryption Keys (CMEK) via Cloud KMS (Correct answer)
- Default Google-managed encryption
- VPC Service Controls
Correct answer: Customer-Managed Encryption Keys (CMEK) via Cloud KMS
CMEK allows customers to control the encryption keys used by Google Cloud services through Cloud Key Management Service.
Question 6: Which load balancer type in Google Cloud operates at Layer 7 and supports content-based routing across global backends?
- Network Load Balancer (passthrough)
- External Application Load Balancer (global) (Correct answer)
- Internal TCP/UDP Load Balancer
- Regional External TCP Proxy Load Balancer
Correct answer: External Application Load Balancer (global)
The External Application Load Balancer (global) is an HTTP(S) Layer 7 load balancer that routes requests based on URL paths and headers across globally distributed backends.
Question 7: What is the purpose of a Google Cloud Landing Zone?
- A managed Kubernetes deployment template for microservices
- A pre-configured, opinionated GCP environment establishing security, governance, and networking foundations for enterprise workloads (Correct answer)
- A Terraform module specifically for deploying Cloud SQL instances
- A Cloud Storage bucket template for data lake architectures
Correct answer: A pre-configured, opinionated GCP environment establishing security, governance, and networking foundations for enterprise workloads
A Landing Zone is a well-architected, multi-account Google Cloud environment that serves as the foundation for enterprise cloud adoption with governance guardrails.
Google Cloud Certified Introduction to Google Cloud Certified - Professional Cloud Architect 3
A startup wants to deploy a containerized web application that scales to zero when idle to minimize costs.
Which service is the best fit?