Google Cloud Certification
59 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The Google Cloud Cloud Architect Google Cloud (Professional) certification validates professional expertise in Google Cloud technologies. This study guide covers all 59 practice questions from our Professional practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
You are designing a multi-region disaster recovery solution for a critical application. Which Google Cloud service should you use to replicate data across regions with minimal latency and automatic failover capabilities?
Cloud Spanner is specifically designed for multi-region deployments with strong consistency and automatic failover, making it ideal for critical applications requiring high availability across regions.
Your organization requires audit logging for compliance purposes across all GCP projects. What is the most efficient way to centralize and manage audit logs from multiple projects?
Cloud Logging sinks provide a centralized way to aggregate and manage audit logs from multiple projects into a single audit project, enabling efficient compliance management and long-term retention.
You need to implement network segmentation for a healthcare application handling sensitive patient data. Which Google Cloud networking feature best supports zero-trust security principles?
VPC Service Controls implements a zero-trust model by creating a security perimeter around Google Cloud services, controlling access based on identity and context rather than network location.
When designing a Kubernetes deployment on GKE, you need to ensure that workloads can access Google Cloud APIs securely without storing credentials. What should you configure?
Workload Identity enables secure, credential-free access to Google Cloud APIs by binding Kubernetes service accounts to Google service accounts, eliminating the need to manage and distribute credentials.
Your organization is migrating a large on-premises data warehouse to Google Cloud. You need to minimize downtime during the migration. Which approach combines data transfer with minimal application changes?
Datastream provides continuous data replication from on-premises sources to BigQuery, enabling near-zero-downtime migrations by maintaining data synchronization throughout the migration process.
You are designing a cost optimization strategy for a variable workload that spikes during business hours. Which combination of compute resources would be most cost-effective?
Combining committed use discounts for predictable baseline capacity with preemptible VMs for variable spikes provides optimal cost efficiency while maintaining reliability and performance.
You need to implement fine-grained access control where different teams can only access specific datasets in BigQuery. What is the recommended approach?
BigQuery IAM roles at the dataset level combined with custom roles provide scalable, maintainable fine-grained access control that aligns with team structures and security requirements.
Your application requires real-time event processing with exactly-once semantics. Which Google Cloud solution is best suited for this requirement?
Cloud Dataflow provides exactly-once processing semantics with Pub/Sub, ensuring reliable event processing without duplication or data loss in real-time pipelines.
You are architecting a solution where on-premises systems need to communicate with Google Cloud resources over a private connection. Which networking solution provides the most secure and reliable connection?
Dedicated Interconnect provides a private, high-bandwidth, low-latency connection with redundancy, offering superior security and reliability compared to VPN for hybrid cloud architectures.
You need to store sensitive encryption keys for your applications. Which Google Cloud service provides hardware security module (HSM) backed key management with automated rotation?
Cloud KMS with Cloud HSM provides cryptographic key management with hardware-backed security and automated rotation, meeting strict compliance requirements for sensitive key protection.
Your organization uses multiple Google Cloud projects across different departments. You need to implement centralized billing and cost tracking. What should you configure?
A single billing account with cost allocation tags enables centralized billing management while allowing departments to track their specific costs and resource usage across projects.
You are designing a CI/CD pipeline for microservices deployed on GKE. Which Google Cloud service should orchestrate builds, tests, and deployments?
Cloud Build is purpose-built for CI/CD pipelines with native Kubernetes support, enabling seamless building, testing, and deployment of containerized microservices to GKE.
Your application needs to process large amounts of unstructured data including images and PDFs. Which Google Cloud service combines storage with built-in AI/ML capabilities for document analysis?
Document AI provides specialized capabilities for processing unstructured documents with pre-built models and integrates directly with Cloud Storage, making it ideal for document analysis workloads.
You need to ensure that data cannot be modified or deleted for compliance reasons, even by administrators. Which Cloud Storage feature enforces this requirement?
Cloud Storage retention policies in compliance mode enforce immutability, preventing deletion or modification of objects even by project owners, meeting strict compliance requirements like WORM storage.
You are optimizing costs for a batch processing workload that can tolerate interruptions. Which compute option minimizes expenses while maintaining acceptable performance?
Preemptible or Spot VMs offer 60-90% cost savings for interruptible batch workloads, making them the most cost-effective option when tolerance for interruptions exists.
You need to implement a solution where end-users authenticate through their corporate identity provider. Which Google Cloud service enables federated identity management?
Cloud Identity with SAML integration enables federated authentication, allowing users to authenticate using existing corporate identity providers like Active Directory or Okta.
Your organization requires disaster recovery with a Recovery Time Objective (RTO) of less than 1 hour. Which backup and recovery strategy best meets this requirement?
Continuous replication with hot standby provides sub-hour RTO by maintaining synchronized copies ready for immediate failover, meeting aggressive recovery objectives.
You are designing a data lake solution in Google Cloud. Which service provides cost-effective storage with integrated analytics capabilities?
Cloud Storage provides cost-effective data lake storage while BigQuery enables powerful analytics on data without requiring expensive data movement or transformation.
You need to deploy containerized applications with minimal operational overhead. The workload pattern is unpredictable and occasionally very spiky. Which service is most appropriate?
Cloud Run provides fully managed, serverless container execution with automatic scaling to zero, making it ideal for unpredictable, spiky workloads while minimizing operational overhead.
Your organization needs to monitor compliance with security policies across multiple projects. Which Google Cloud service provides centralized security posture management?
Security Command Center provides centralized visibility and management of security posture across projects, offering findings, recommendations, and compliance assessments.
You need to implement a solution that automatically scales Kubernetes workloads based on custom business metrics beyond standard CPU and memory. What should you configure?
Horizontal Pod Autoscaler with custom metrics from Cloud Monitoring enables scaling based on business-specific metrics like transaction rates or queue depth, not just CPU/memory.
You are designing infrastructure for a multi-tenant SaaS application. Which approach best ensures data isolation between customers?
Combining shared resources with strong database-level row-level security and network firewalling provides efficient cost-effective isolation while maintaining data security boundaries.
You need to migrate a legacy monolithic application to Google Cloud while minimizing refactoring. Which approach is most appropriate?
Lift-and-shift migration to Compute Engine minimizes refactoring for legacy monolithic applications while providing immediate cloud benefits, with modernization possible later.
Your application requires global load balancing with automatic failover to the nearest healthy backend. Which Google Cloud load balancer should you use?
HTTP(S) Load Balancer provides global load balancing with automatic failover to healthy backends, CDN caching, and security features, ideal for modern web applications.
You are designing a multi-region application on Google Cloud. Users in different geographic regions experience latency issues. What is the most effective approach to reduce latency for global users?
Cloud CDN caches content at edge locations, and Cloud Load Balancing with geo-routing directs users to the nearest backend, reducing latency effectively. This is the standard approach for global applications.
Your organization requires that all data at rest must be encrypted with customer-managed encryption keys (CMEK). Which Google Cloud services support CMEK natively?
Cloud Storage, Cloud SQL, Compute Engine persistent disks, and BigQuery are key services that support CMEK. While many services support it, not all do (e.g., App Engine standard environment does not).
You need to ensure that a critical application maintains high availability during a regional outage. The application uses Cloud Spanner for its database. What is the recommended configuration?
Cloud Spanner with multi-region configuration provides automatic failover and strong consistency across regions, making it ideal for high-availability critical applications.
Your organization has strict compliance requirements that prohibit data from leaving a specific geographic region. Which of the following best addresses this requirement?
Cloud Storage location restrictions combined with VPC Service Controls provide comprehensive data residency enforcement. VPC Service Controls creates security perimeters that prevent data exfiltration across regions.
You are architecting a solution where users upload files that must be processed asynchronously. The processing is unpredictable in duration and volume. Which design pattern is most appropriate?
This architecture decouples upload, notification, and processing layers. Cloud Pub/Sub handles variable loads, and Cloud Run auto-scales based on demand, making it ideal for unpredictable workloads.
Your team has migrated applications to Google Cloud but needs to maintain compatibility with on-premises Active Directory for user authentication. What is the recommended approach?
Cloud Identity with AD FS bridge or Cloud Directory Sync maintains on-premises Active Directory synchronization while enabling cloud-based SSO. This is the enterprise-standard approach for hybrid authentication.
An application requires sub-millisecond response times for frequently accessed data. The data changes occasionally but reads are extremely high-frequency. Which architecture is optimal?
Memorystore for Redis provides sub-millisecond latency for read-heavy workloads. Placing it in front of the primary data store with appropriate cache invalidation strategies is the standard pattern for high-performance caching.
You need to implement fine-grained access control where different teams can access different datasets in BigQuery. What is the most scalable solution?
BigQuery Authorized Views allow you to grant access to specific views based on IAM roles, providing fine-grained control without data duplication or complex application logic.
Your organization wants to ensure that infrastructure changes go through a proper review process before deployment. Which solution provides built-in approval workflows for infrastructure changes?
Cloud Build can be configured with manual approval steps that require human review before deploying infrastructure changes, enabling controlled Infrastructure as Code deployments.
A startup wants to minimize operational overhead while running containerized microservices. They don't want to manage Kubernetes control planes. What is the best service?
Cloud Run eliminates the need to manage Kubernetes control planes or infrastructure entirely, automatically scaling based on demand and charging only for execution time.
You are designing a system that ingests millions of IoT sensor readings per second and needs to perform real-time aggregations. Which technology stack is most suitable?
Cloud Pub/Sub handles massive ingestion rates, Dataflow provides real-time stream processing with exactly-once semantics, and BigQuery enables interactive analysis of results.
Your organization mandates that all cloud resources must be tagged with cost center information for billing purposes. How can you enforce this requirement?
Cloud Build can validate labels as part of the deployment pipeline, and Cloud Asset Inventory provides continuous compliance monitoring. This enforces labeling at deployment time and audits adherence.
You need to migrate a large on-premises database (2TB+) to Google Cloud while minimizing downtime. Which approach is recommended?
Database Migration Service provides continuous replication and handles the complexity of database migrations, enabling minimal-downtime cutovers with validation and rollback capabilities.
A development team wants to quickly test code changes in an environment identical to production without manual setup. What should you implement?
Infrastructure as Code with Cloud Build enables automated, on-demand provisioning of identical test environments, allowing teams to validate changes safely and efficiently.
Your organization needs to export audit logs from Google Cloud to your on-premises SIEM system in real-time. What is the recommended architecture?
Cloud Pub/Sub provides reliable delivery of log events, and Dataflow or custom subscribers can transform and forward them to external SIEM systems in real-time.
You are designing a solution for a regulated financial institution that requires strict network isolation. Which approach best satisfies this requirement?
VPC Service Controls provide comprehensive network and data isolation, restricting which identities can access specific services. Combined with Private Service Connections, this creates strong network boundaries.
Your application experiences variable traffic, with peaks during business hours and low traffic at night. How should you optimize costs while maintaining performance?
Auto-scaling handles variable demand efficiently, while committed use discounts reduce costs for predictable baseline capacity. This combination optimizes both performance and cost.
You need to securely share a large dataset with external partners who should only access specific columns. What is the most secure approach?
BigQuery Authorized Views provide column-level filtering and can be shared with external identities through IAM, ensuring partners access only approved data without requiring data export.
Your organization wants to run containerized applications with GPU acceleration for machine learning workloads. What is the recommended service?
GKE with GPU node pools provides Kubernetes orchestration for containerized ML workloads, enabling automatic scaling and efficient resource management of expensive GPU resources.
You need to implement a disaster recovery solution with a target recovery time (RTO) of 1 hour and recovery point objective (RPO) of 15 minutes. Which strategy is most appropriate?
Continuous cross-region replication ensures RPO of 15 minutes and enables quick automated failover for RTO of 1 hour. Regular drills validate the recovery procedures.
A company wants to implement a machine learning pipeline that retrains models nightly using BigQuery data. What is the most efficient solution?
Cloud Scheduler provides reliable scheduling, Vertex AI pipelines handle model training at scale, and BigQuery integration avoids data movement, making this the most efficient approach.
You are designing a solution to detect and prevent data exfiltration attempts from your Google Cloud environment. Which service is most appropriate?
VPC Service Controls creates security perimeters that prevent data movement across boundaries, while Access Context Manager enforces context-based policies, providing proactive exfiltration prevention.
Your legacy application requires a static IP address that must not change. How should you implement this in Google Cloud?
Static external IP addresses in Google Cloud remain fixed and can be assigned to instances or load balancers, meeting the requirement for applications that depend on unchanging IPs.
You need to implement role-based access control (RBAC) where team members have different permissions based on their organizational roles. What is the best practice?
Predefined IAM roles provide standard permission sets for common functions, custom roles allow fine-tuning, and Cloud Audit Logs enable compliance verification. This approach is scalable and maintainable.
Your organization needs to ensure that developers cannot accidentally delete production databases. What control mechanism should you implement?
IAM roles with proper hierarchy and policy constraints provide infrastructure-level enforcement that prevents developers from having delete permissions on production resources, while administrators retain control.
Your organization needs to migrate a monolithic application to Google Cloud. The application has tightly coupled components with synchronous dependencies. Which decomposition strategy should you recommend first?
A proper migration strategy requires understanding the application's current structure and dependencies before decomposing it. Analyzing data flow and service boundaries ensures a successful incremental migration path.
You are designing a multi-region disaster recovery solution for a critical database. Your RTO is 1 hour and RPO is 15 minutes. Which combination of Cloud SQL features best meets these requirements?
Cross-region HA configuration provides automatic failover (meeting RTO), while automated backups combined with point-in-time recovery can achieve the 15-minute RPO requirement. This is the only option that addresses both RTO and RPO.
Your team is implementing Infrastructure as Code using Terraform for Google Cloud. What is the primary advantage of storing Terraform state in Cloud Storage with locking enabled?
State locking in Cloud Storage prevents race conditions when multiple team members or automated processes attempt to modify infrastructure simultaneously, ensuring state consistency and preventing conflicts.
You need to implement fine-grained access control for a team that manages multiple Google Cloud projects. The team members should have different permissions per project. Which IAM binding method is most efficient?
Using security groups enables scalable, maintainable access control. Groups can be managed centrally while IAM bindings at the folder or project level provide the fine-grained control needed for different permission requirements.
Your application experiences variable traffic patterns with peaks during specific hours. You've deployed it on GKE with Horizontal Pod Autoscaling (HPA). What metric should you prioritize for scaling decisions to ensure cost efficiency?
Custom metrics tied to application behavior provide better cost efficiency than generic CPU/memory metrics. Scaling based on request latency or queue depth ensures resources match actual demand rather than arbitrary resource thresholds.
You are designing a data analytics pipeline that ingests streaming data from IoT devices, requires real-time processing, and stores results for historical analysis. Which Google Cloud services combination is most appropriate?
Cloud Pub/Sub handles streaming ingestion, Cloud Dataflow provides real-time processing capabilities, and BigQuery serves as the data warehouse for historical analysis. This combination is specifically designed for streaming analytics pipelines.
Your organization requires all resources to encrypt data in transit using mutual TLS. You're running services on GKE. How should you implement this requirement across all services?
Istio service mesh automates mTLS implementation across all services through sidecar proxies, enforces policies consistently, and eliminates the burden of manual implementation in application code. This is the standard approach for service mesh security in Kubernetes.
You need to set up network connectivity between your on-premises data center and Google Cloud VPC. The connection must support failover and require minimal latency. Which solution is best suited?
Cloud Interconnect provides dedicated, low-latency connectivity, while the Cloud VPN backup ensures failover capability. This combination meets both the performance and redundancy requirements effectively.
Your organization is migating legacy applications that require specific OS-level configurations and kernel modules. Which compute option provides the most flexibility while maintaining cloud-native benefits?
GKE allows OS-level customization through custom node images and DaemonSets while maintaining Kubernetes orchestration benefits. This is better than Compute Engine for cloud-native approaches while addressing legacy system requirements.
You are implementing a compliance requirement where audit logs must be immutable once written. Which Google Cloud service and configuration meets this requirement?
Cloud Storage Object Lock prevents deletion or modification of objects after they are written, making it the appropriate storage mechanism for immutable audit logs. This ensures compliance with immutability requirements.
You've reviewed all 59 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free