Google Cloud Certified MCQ 3

Question 1

A financial services firm requires that encryption keys used for Cloud Storage buckets are rotated every 90 days and never leave their HSM. Which solution satisfies this?

Accepted Answer

Cloud External Key Manager (EKM) with keys hosted in their on-premises HSM

Answer

Google-managed encryption keys with automatic rotation

Answer

Customer-managed encryption keys (CMEK) via Cloud KMS with rotation schedule

Answer

Customer-supplied encryption keys (CSEK) stored in Cloud HSM

Question 2

Your GKE workload needs to access a Cloud SQL instance securely without exposing the database to the public internet. What is the recommended approach?

Accepted Answer

Use the Cloud SQL Auth Proxy as a sidecar container with Workload Identity

Answer

Assign a public IP to Cloud SQL and whitelist node IP ranges

Answer

Open a VPN tunnel from each pod to the Cloud SQL instance

Answer

Use Cloud SQL with a private IP and connect via the internal VPC

Question 3

A company uses multiple Google Cloud projects and wants centralized billing alerts when spend across all projects exceeds a threshold. What should they configure?

Accepted Answer

A budget alert at the billing account level covering all linked projects

Answer

A budget alert on each individual project

Answer

Cloud Monitoring uptime checks with cost thresholds

Answer

Cloud Functions that query billing export data hourly

Question 4

An architect must design a system where a batch ML training job reads from BigQuery and writes model artifacts to Cloud Storage, running nightly. What is the best orchestration tool?

Accepted Answer

Cloud Composer (Airflow) DAG with BigQuery and GCS operators

Answer

Cloud Scheduler triggering a Cloud Run job directly

Answer

Pub/Sub message triggering a Dataflow pipeline

Answer

App Engine cron job calling a Compute Engine API

Question 5

Your application needs to serve users in Asia, Europe, and North America with sub-100ms latency for static assets. What is the optimal architecture?

Accepted Answer

Use Cloud CDN backed by a global external HTTP(S) load balancer with Cloud Storage origin

Answer

Deploy Compute Engine VMs in each region and use DNS load balancing

Answer

Deploy separate App Engine applications in each region

Answer

Use multi-region Cloud Storage bucket without a CDN

Question 6

A team needs to share read access to a sensitive dataset in BigQuery with external auditors without giving them Google Cloud project access. What is the correct approach?

Accepted Answer

Use BigQuery authorized views to expose only specific columns/rows, granting access to the view

Answer

Create a service account key and share it with the auditors

Answer

Export data to a public Cloud Storage bucket for auditors to download

Answer

Add auditor email addresses as project Viewer on the Google Cloud project

Question 7

Which Google Cloud networking feature allows a VPC in one project to communicate with services in another project's VPC using private IPs without VPC peering?

Accepted Answer

Private Service Connect

Answer

Shared VPC

Answer

Cloud VPN

Answer

Cloud Interconnect

Google Cloud Certified MCQ 3

What Practice Test Geeks adds beyond an AI chat for Google Cloud Certified - Professional Cloud Architect

Sources & references