Google Cloud Certified Introduction to Google Cloud Certified - Professional Cloud Architect 4 — Questions and Answers
Question 1: Which Google Cloud service should be used to centrally manage and enforce security policies across an entire organization's GCP resource hierarchy?
- Cloud Armor
- Security Command Center
- Organization Policy Service (Correct answer)
- Cloud Identity
Correct answer: Organization Policy Service
The Organization Policy Service lets administrators centrally constrain how Google Cloud resources can be configured across all projects in an organization.
Question 2: A data engineering team needs to run Apache Spark jobs without managing clusters. Which Google Cloud service is the best fit?
- Cloud Dataflow
- Dataproc Serverless (Correct answer)
- Cloud Composer
- Datastream
Correct answer: Dataproc Serverless
Dataproc Serverless lets you run Spark workloads without provisioning or managing clusters, automatically scaling resources as needed.
Question 3: An architect is designing for 99.99% availability for a critical web application. Which architecture best achieves this SLO?
- Single-region deployment with a managed instance group and health checks
- Multi-region active-active deployment with a global load balancer and regional failover (Correct answer)
- Single-region deployment with Cloud Run and automatic scaling
- Multi-zone deployment within one region using a regional load balancer
Correct answer: Multi-region active-active deployment with a global load balancer and regional failover
A multi-region active-active deployment with global load balancing provides the highest availability by tolerating full regional failures.
Question 4: What is the key difference between Cloud Pub/Sub and Cloud Tasks in Google Cloud?
- Pub/Sub is for real-time streaming fan-out; Cloud Tasks is for explicit, controlled task delivery with retries and rate limits (Correct answer)
- Cloud Tasks supports push subscriptions; Pub/Sub only supports pull
- Pub/Sub is serverless; Cloud Tasks requires provisioned workers
- Cloud Tasks stores messages for 7 days by default; Pub/Sub stores for 24 hours
Correct answer: Pub/Sub is for real-time streaming fan-out; Cloud Tasks is for explicit, controlled task delivery with retries and rate limits
Pub/Sub is designed for high-throughput event streaming and fan-out, while Cloud Tasks provides explicit, managed, and rate-limited task queue delivery.
Question 5: A company wants to allow developers to deploy to Google Cloud without granting them broad IAM roles. Which approach best follows the principle of least privilege?
- Grant the 'Editor' role at the project level to all developers
- Use predefined roles scoped to specific resources and services developers need (Correct answer)
- Create a single shared service account with Owner permissions for all deployments
- Grant the 'Viewer' role at org level and Owner at project level
Correct answer: Use predefined roles scoped to specific resources and services developers need
Predefined roles scoped to specific resources grant only the permissions needed for defined job functions, enforcing least privilege.
Question 6: Which Google Cloud network tier should a latency-sensitive, globally distributed application use to route traffic across Google's backbone?
- Standard Tier
- Premium Tier (Correct answer)
- Basic Tier
- Edge Tier
Correct answer: Premium Tier
Premium Tier routes traffic over Google's global, high-quality network from the point of ingress, minimizing latency for globally distributed users.
Question 7: A Professional Cloud Architect is reviewing a system that stores PII data. Which Google Cloud service can automatically discover, classify, and protect sensitive data?
- Cloud DLP (Sensitive Data Protection) (Correct answer)
- Cloud Armor
- Security Command Center
- Chronicle
Correct answer: Cloud DLP (Sensitive Data Protection)
Cloud DLP (now called Sensitive Data Protection) provides managed services to discover, classify, and de-identify sensitive data stored in Google Cloud.
Google Cloud Certified Introduction to Google Cloud Certified - Professional Cloud Architect 4
Which Google Cloud service should be used to centrally manage and enforce security policies across an entire organization's GCP resource hierarchy?