Google Cloud Certified MCQ 4 — Questions and Answers
Question 1: A company wants to ensure that Cloud Storage buckets never have public access enabled, even if a developer accidentally sets it. What is the most preventive control?
- Schedule daily audit scripts to detect public buckets
- Enable the constraints/storage.publicAccessPrevention organization policy (Correct answer)
- Configure VPC Service Controls around Cloud Storage
- Set up Cloud Monitoring alerts on bucket ACL changes
Correct answer: Enable the constraints/storage.publicAccessPrevention organization policy
The storage.publicAccessPrevention organization policy proactively blocks public access configuration at the API level, preventing the misconfiguration before it occurs.
Question 2: An e-commerce platform needs to process payment events in strict order per customer ID, with exactly-once semantics. Which Pub/Sub feature enables this?
- Pub/Sub Lite with zonal partitions
- Pub/Sub with message ordering enabled and an ordering key set to customer ID (Correct answer)
- Standard Pub/Sub with a Dataflow exactly-once pipeline
- Cloud Tasks with task deduplication IDs
Correct answer: Pub/Sub with message ordering enabled and an ordering key set to customer ID
Pub/Sub ordering keys guarantee that messages with the same key are delivered in order to a single subscriber, enabling per-customer ordered processing.
Question 3: A startup wants to run a containerized web app that scales to zero when unused to minimize costs. Which compute option is most appropriate?
- GKE Autopilot with cluster autoscaler
- Cloud Run (fully managed) with minimum instances set to 0 (Correct answer)
- Compute Engine managed instance group with autoscaling
- App Engine Standard with manual scaling
Correct answer: Cloud Run (fully managed) with minimum instances set to 0
Cloud Run (fully managed) with min-instances=0 scales down completely when idle, incurring no compute cost between requests.
Question 4: You need to migrate a stateful legacy application that uses local disk storage to Google Cloud with minimal code changes. Which approach preserves the local disk behavior?
- Rewrite the application to use Cloud Storage for all file operations
- Lift-and-shift to Compute Engine VM with a Persistent Disk attached (Correct answer)
- Deploy to Cloud Run with a mounted Cloud Storage FUSE volume
- Migrate to Cloud SQL and store files as BLOBs
Correct answer: Lift-and-shift to Compute Engine VM with a Persistent Disk attached
A Compute Engine VM with Persistent Disk provides a standard block device that behaves identically to on-premises local disk, requiring no application code changes.
Question 5: A data engineering team needs to detect anomalies in streaming sensor data in real-time and alert within 30 seconds. Which architecture is best?
- Batch export sensor data to BigQuery every hour and run anomaly queries
- Ingest via Pub/Sub, process with Dataflow streaming using windowing and anomaly detection, alert via Pub/Sub/Cloud Monitoring (Correct answer)
- Write sensor data to Firestore and trigger Cloud Functions on document creation
- Store in Bigtable and run periodic MapReduce jobs
Correct answer: Ingest via Pub/Sub, process with Dataflow streaming using windowing and anomaly detection, alert via Pub/Sub/Cloud Monitoring
Pub/Sub ingestion with a Dataflow streaming pipeline supports sub-minute latency windowing and can publish anomaly events immediately for alerting.
Question 6: A team is designing a microservices architecture on GKE and needs service-to-service authentication without managing credentials. What is the recommended approach?
- Use shared API keys stored in Kubernetes Secrets
- Use Workload Identity with service account impersonation and mTLS via Anthos Service Mesh (Correct answer)
- Whitelist pod IP ranges in service firewall rules
- Store JWT signing keys in Cloud KMS and share across services
Correct answer: Use Workload Identity with service account impersonation and mTLS via Anthos Service Mesh
Workload Identity binds Kubernetes service accounts to Google service accounts, and Anthos Service Mesh provides mTLS between services, eliminating credential management entirely.
Question 7: Your organization needs a landing zone for multiple business units on Google Cloud. Which resource hierarchy is most aligned with Google's recommended best practices?
- One project per business unit with folders grouping environments
- Organization → Folders (by business unit) → Folders (by environment) → Projects (by workload) (Correct answer)
- Organization → Projects (flat, labeled by business unit and environment)
- One organization per business unit
Correct answer: Organization → Folders (by business unit) → Folders (by environment) → Projects (by workload)
Google recommends an Organization → BU folders → Environment folders → Workload projects hierarchy, which allows IAM and policy inheritance at the right granularity.
Google Cloud Certified MCQ 4
A company wants to ensure that Cloud Storage buckets never have public access enabled, even if a developer accidentally sets it.
What is the most preventive control?