Google Cloud Certified MCQ 3 — Questions and Answers
Question 1: A financial services firm requires that encryption keys used for Cloud Storage buckets are rotated every 90 days and never leave their HSM. Which solution satisfies this?
- Google-managed encryption keys with automatic rotation
- Customer-managed encryption keys (CMEK) via Cloud KMS with rotation schedule
- Customer-supplied encryption keys (CSEK) stored in Cloud HSM
- Cloud External Key Manager (EKM) with keys hosted in their on-premises HSM (Correct answer)
Correct answer: Cloud External Key Manager (EKM) with keys hosted in their on-premises HSM
Cloud EKM allows Google Cloud to use encryption keys that physically reside in the customer's own HSM, ensuring keys never leave the customer's infrastructure.
Question 2: Your GKE workload needs to access a Cloud SQL instance securely without exposing the database to the public internet. What is the recommended approach?
- Assign a public IP to Cloud SQL and whitelist node IP ranges
- Use the Cloud SQL Auth Proxy as a sidecar container with Workload Identity (Correct answer)
- Open a VPN tunnel from each pod to the Cloud SQL instance
- Use Cloud SQL with a private IP and connect via the internal VPC
Correct answer: Use the Cloud SQL Auth Proxy as a sidecar container with Workload Identity
The Cloud SQL Auth Proxy sidecar handles IAM authentication and TLS, while Workload Identity eliminates the need to manage service account key files.
Question 3: A company uses multiple Google Cloud projects and wants centralized billing alerts when spend across all projects exceeds a threshold. What should they configure?
- A budget alert on each individual project
- A budget alert at the billing account level covering all linked projects (Correct answer)
- Cloud Monitoring uptime checks with cost thresholds
- Cloud Functions that query billing export data hourly
Correct answer: A budget alert at the billing account level covering all linked projects
A billing account-level budget aggregates spend across all linked projects and triggers Pub/Sub or email alerts when thresholds are crossed.
Question 4: An architect must design a system where a batch ML training job reads from BigQuery and writes model artifacts to Cloud Storage, running nightly. What is the best orchestration tool?
- Cloud Scheduler triggering a Cloud Run job directly
- Cloud Composer (Airflow) DAG with BigQuery and GCS operators (Correct answer)
- Pub/Sub message triggering a Dataflow pipeline
- App Engine cron job calling a Compute Engine API
Correct answer: Cloud Composer (Airflow) DAG with BigQuery and GCS operators
Cloud Composer (managed Airflow) provides robust DAG-based orchestration with built-in BigQuery and GCS operators, retry logic, and dependency management for complex batch workflows.
Question 5: Your application needs to serve users in Asia, Europe, and North America with sub-100ms latency for static assets. What is the optimal architecture?
- Deploy Compute Engine VMs in each region and use DNS load balancing
- Use Cloud CDN backed by a global external HTTP(S) load balancer with Cloud Storage origin (Correct answer)
- Deploy separate App Engine applications in each region
- Use multi-region Cloud Storage bucket without a CDN
Correct answer: Use Cloud CDN backed by a global external HTTP(S) load balancer with Cloud Storage origin
Cloud CDN caches content at Google's global edge PoPs, and the global load balancer routes users to the nearest cache, minimizing latency for static assets worldwide.
Question 6: A team needs to share read access to a sensitive dataset in BigQuery with external auditors without giving them Google Cloud project access. What is the correct approach?
- Create a service account key and share it with the auditors
- Use BigQuery authorized views to expose only specific columns/rows, granting access to the view (Correct answer)
- Export data to a public Cloud Storage bucket for auditors to download
- Add auditor email addresses as project Viewer on the Google Cloud project
Correct answer: Use BigQuery authorized views to expose only specific columns/rows, granting access to the view
Authorized views allow you to share a filtered, column-restricted subset of data without granting direct table access or any project-level IAM role.
Question 7: Which Google Cloud networking feature allows a VPC in one project to communicate with services in another project's VPC using private IPs without VPC peering?
- Shared VPC
- Cloud VPN
- Private Service Connect (Correct answer)
- Cloud Interconnect
Correct answer: Private Service Connect
Private Service Connect enables consumers to access managed services or services in other VPCs via a private endpoint in their own VPC, without peering or exposing services publicly.
Google Cloud Certified MCQ 3
A financial services firm requires that encryption keys used for Cloud Storage buckets are rotated every 90 days and never leave their HSM.
Which solution satisfies this?