Google Cloud Certified MCQ 5 — Questions and Answers
Question 1: A company needs to connect their on-premises data center to Google Cloud with 10 Gbps bandwidth, consistent latency, and an SLA. Which option is correct?
- Cloud VPN with high-availability tunnels
- Dedicated Interconnect with 10 Gbps circuit (Correct answer)
- Direct Peering with Google's edge network
- Partner Interconnect through a service provider
Correct answer: Dedicated Interconnect with 10 Gbps circuit
Dedicated Interconnect provides a direct physical connection to Google with a 99.99% SLA (with redundant circuits) and guaranteed bandwidth without traversing the public internet.
Question 2: An architect needs to implement a blue/green deployment for a Cloud Run service to allow instant rollback. What is the correct mechanism?
- Deploy two separate Cloud Run services and update DNS manually
- Use Cloud Run traffic splitting to route 100% traffic to the new revision, retaining the old revision (Correct answer)
- Use a global load balancer with two backend services
- Use Cloud Deploy with a canary deployment pipeline
Correct answer: Use Cloud Run traffic splitting to route 100% traffic to the new revision, retaining the old revision
Cloud Run revision traffic splitting allows atomic traffic shifts between revisions, and rolling back simply redirects 100% traffic to the prior revision instantly.
Question 3: A healthcare application must ensure that data never leaves a specific geographic region for compliance. Which combination of controls enforces this?
- Label all resources with the region name
- Use VPC Service Controls with a perimeter and resource location restrictions via Organization Policy (Correct answer)
- Deploy only in that region and trust developers to comply
- Enable Cloud Armor geo-blocking for API requests
Correct answer: Use VPC Service Controls with a perimeter and resource location restrictions via Organization Policy
VPC Service Controls restrict API access to within the perimeter, and the constraints/gcp.resourceLocations policy prevents resource creation outside approved regions.
Question 4: A team wants to use Terraform to manage Google Cloud infrastructure and prevent drift between the desired and actual state. What workflow best achieves this?
- Run terraform apply manually whenever changes are needed
- Store Terraform state in a Cloud Storage bucket, use a CI/CD pipeline to run terraform plan on PRs and terraform apply on merge (Correct answer)
- Keep Terraform state locally on each engineer's workstation
- Use Cloud Deployment Manager instead of Terraform for better drift detection
Correct answer: Store Terraform state in a Cloud Storage bucket, use a CI/CD pipeline to run terraform plan on PRs and terraform apply on merge
Remote state in Cloud Storage with CI/CD-enforced plan-then-apply workflow ensures state is shared, changes are reviewed, and applies are auditable.
Question 5: Your BigQuery costs are high due to analysts running full table scans on a large table frequently queried by date. What is the most cost-effective optimization?
- Enable flat-rate BigQuery reservations for all users
- Partition the table by date and require analysts to include the partition filter in queries (Correct answer)
- Move the table to Cloud Storage and use external tables
- Create a materialized view that pre-aggregates all possible queries
Correct answer: Partition the table by date and require analysts to include the partition filter in queries
Date partitioning restricts bytes scanned to only relevant partitions when a date filter is applied, directly reducing per-query cost.
Question 6: A team needs to run a GPU-accelerated ML training job that takes 8 hours and can tolerate restarts. How should they minimize cost?
- Use on-demand N1 VMs with attached GPUs
- Use Spot (preemptible) A2 GPU VMs with checkpointing enabled (Correct answer)
- Use Cloud TPUs with reserved capacity
- Use Cloud Run jobs with GPU support
Correct answer: Use Spot (preemptible) A2 GPU VMs with checkpointing enabled
Spot/preemptible GPU VMs cost up to 60-91% less than on-demand; checkpointing ensures restarts don't lose progress, making them viable for long fault-tolerant training jobs.
Question 7: A professional services firm needs to give clients temporary read access to specific BigQuery datasets that expires automatically after 30 days. What is the best approach?
- Manually remove IAM bindings after 30 days via a calendar reminder
- Use IAM Conditions with a date expression to grant time-bound access to the dataset (Correct answer)
- Create a new project for each client and delete it after 30 days
- Export the dataset to a signed Cloud Storage URL that expires in 30 days
Correct answer: Use IAM Conditions with a date expression to grant time-bound access to the dataset
IAM Conditions allow you to attach a time-based expression (request.time < timestamp) to any role binding, automatically making it invalid after the specified date.
