Google Cloud Professional Cloud Architect Practice Exam

• A. Provision a Dedicated Interconnect circuit with capacity for peak throughput
• B. Use on-demand, usage-billed resources with autoscaling that tracks traffic Correct answer
• C. Reserve sole-tenant nodes sized for the holiday season and keep them year round
• D. Purchase three-year committed use discounts for the projected peak footprint

Option B is correct because on-demand, usage-billed resources with autoscaling make spend track actual seasonal demand. Dedicated Interconnect capacity, year-round sole-tenant nodes and three-year commitments sized for peak all pay for peak capacity when it is not needed.

• A. Recovery time objective
• B. Service level objective
• C. Recovery point objective Correct answer
• D. Maximum tolerable downtime

Option C is correct because the recovery point objective defines the maximum acceptable data loss, here 15 minutes of committed transactions. RTO measures how long recovery takes, an SLO is a service target, and maximum tolerable downtime concerns outage duration, not data loss.

• A. Run the image on the App Engine flexible environment with automatic scaling enabled
• B. Run the image on a GKE Autopilot cluster with a horizontal pod autoscaler targeting CPU utilization
• C. Deploy the image to Cloud Run with minimum instances set to zero and request-based autoscaling Correct answer
• D. Deploy the image to a regional managed instance group of Container-Optimized OS VMs with autoscaling

Option C is correct because Cloud Run runs a stateless container, scales to zero with minimum instances at zero, and bills per request without any cluster or VM to manage. App Engine flexible cannot scale to zero, GKE Autopilot is still a cluster with a baseline, and a MIG means managing VMs.

• A. Performance optimization Correct answer
• B. Operational excellence Correct answer
• C. Application portability
• D. Observability
• E. Elasticity

Options A and B are correct because Performance optimization and Operational excellence are two of the Google Cloud Well-Architected Framework pillars, alongside security, privacy and compliance, reliability, and cost optimization. Application portability, observability and elasticity are design goals or capabilities addressed within pillars, not pillars themselves.

• A. Run the existing notebooks on a Compute Engine VM from Cloud Scheduler and keep the execution logs in Cloud Logging.
• B. Save each model file to a versioned Cloud Storage bucket and record the training table name in the object metadata.
• C. Register each approved model as a version in Model Registry, linked to the pipeline run that produced it. Correct answer
• D. Commit the notebooks to a Git repository and tag each commit with the date the model was deployed.
• E. Define preprocessing, training and evaluation as an Agent Platform pipeline so every run records its inputs, parameters and artifacts as metadata. Correct answer

Options C and E are correct because a pipeline run records the inputs, parameters and artifacts as metadata, and registering each approved model version linked to that run gives auditors the full lineage from deployed model back to data, parameters and code. Options A, B and D keep logs, file metadata or Git tags, but none of them ties a deployed model to the exact data and parameters that produced it in a queryable, enforced way.

• A. Add a default route whose next hop is the default internet gateway and apply its network tag to the VMs
• B. Configure Cloud NAT on a Cloud Router in europe-west2 for the subnet Correct answer
• C. Put the VMs behind an external passthrough Network Load Balancer so outbound requests use its address
• D. Enable Private Google Access on the subnet so the VMs can reach public repositories

Option B is correct because Cloud NAT on a Cloud Router gives VMs without external IPs outbound access to the internet for patches, while the NAT gateway drops unsolicited inbound connections and needs no proxy instances. Option A fails because a default route to the internet gateway does not help VMs that have no external IP. Option C is wrong because a passthrough load balancer does not provide outbound NAT for backends. Option D only reaches Google APIs and services, not public package repositories.

• A. Make the vendor's network a Shared VPC host project and attach each customer's project as a service project
• B. Peer the vendor's VPC network with each customer's VPC network and export subnet routes in both directions
• C. Create an HA VPN tunnel pair from the vendor's network to each customer's network and exchange routes dynamically
• D. Publish the service with a Private Service Connect service attachment and let each customer create an endpoint in its VPC network Correct answer

Option D is correct because Private Service Connect lets each consumer create an endpoint with an IP address in its own VPC network that maps to the producer's service attachment, so overlapping consumer ranges are not a problem and consumers reach only the published service. Option A (Shared VPC) cannot span 30 separate organizations. Option B (VPC Network Peering) does not allow overlapping IP ranges and exposes the whole network. Option C could work only with heavy per-customer effort, cannot handle overlapping ranges with dynamic route exchange, and exposes more than the service.

• A. Create a VPC Network Peering connection directly between net-a and net-c Correct answer
• B. Connect net-a and net-c with HA VPN tunnels and a Cloud Router in each network
• C. Turn on custom route import and export on both existing peerings so net-c routes pass through net-b
• D. Add a static route in net-a for the net-c range with the peering to net-b as the next hop

Option A is correct because VPC Network Peering is not transitive, so net-a cannot reach net-c through net-b, and a direct peering between net-a and net-c is the cheapest and simplest private connection. Option B works but adds VPN tunnel cost and Cloud Router management. Option C does not help because peering never passes peered routes on to a third network. Option D is invalid because a peering cannot be used as a static route next hop for a destination that is not in the peer's own routes.

• A. A Cloud Audit Logs alert on data reads from unrecognized source IP addresses, routed to the security on-call
• B. Private Google Access on the corporate subnets so that API calls travel over Google's internal network
• C. A VPC Service Controls perimeter with an access level that admits only the corporate IP ranges Correct answer
• D. A domain restricted sharing organization policy so that only corporate identities can be granted roles on the projects

Option C is correct because a VPC Service Controls perimeter with an access level limited to corporate IP ranges blocks API calls to BigQuery and Cloud Storage from outside, even when the caller holds valid IAM permissions. Option A only alerts after the fact, B does not restrict who can call the APIs, and D limits which identities get roles but not where calls originate.

• A. An organization policy that applies the resource locations constraint with the EU value group Correct answer
• B. A Cloud Asset Inventory feed that alerts the security team when a resource appears in a non-EU location
• C. A VPC Service Controls perimeter that contains the projects and restricts them to EU regions
• D. An IAM deny policy on the organization that removes bucket and dataset creation permissions for users outside the EU

Option A is correct because the organization policy resource locations constraint, with an EU value group, prevents creating resources outside the EU at creation time. Option B only detects after the resource exists, C controls data exfiltration rather than where resources are created, and D is not how location is restricted.

• A. Keep the key in Secret Manager and have the workflow read it with a short-lived token for the deployment
• B. Configure Workload Identity Federation for GitHub and have the workflow impersonate the service account Correct answer
• C. Rotate the key every 30 days with a Cloud Scheduler job that creates a new key and updates the repository secret
• D. Apply the iam.serviceAccountKeyExpiryHours organization policy constraint so that every new key expires within a day

Option B is correct because Workload Identity Federation lets GitHub Actions exchange its OIDC token for short-lived Google credentials by impersonating the service account, so no long-lived key exists. Options A and C still depend on a service account key, and D only shortens key lifetime while keeping keys outside Google Cloud.

• A. Artifact Registry Correct answer
• B. Cloud Deploy
• C. Cloud Build
• D. Secret Manager

Option A is correct because Artifact Registry stores versioned container images and language packages, so every environment pulls identical artifacts. Cloud Deploy orchestrates releases, Cloud Build builds artifacts, and Secret Manager stores secrets, so none of them serve as the artifact store.

• A. Organization Policy constraints
• B. Active Assist cost recommendations
• C. Cloud Billing budget alerts Correct answer
• D. Committed use discounts

Option C is correct because Cloud Billing budgets with threshold alert rules email billing contacts when actual spend reaches a set percentage of the budget. Organization Policy constraints restrict resource configuration, Active Assist gives recommendations, and committed use discounts reduce price; none of them send spend alerts.

• A. Use GKE rolling updates in one cluster with separate namespaces and revert with kubectl rollout undo
• B. Write a Terraform pipeline that applies the Kubernetes manifests to each cluster in sequence and pauses for a reviewer
• C. Create a Cloud Build trigger per environment branch and have engineers run kubectl apply for production after peer review
• D. Define a Cloud Deploy delivery pipeline with the three targets and require approval on the production target Correct answer

Option D is correct because a Cloud Deploy delivery pipeline natively models dev, staging and production targets, supports an approval requirement on the production target, and offers one-step rollback. The other options need custom orchestration, or keep all environments in one cluster, which does not give true promotion between environments.

• A. Binary Authorization
• B. Cloud Deploy
• C. Artifact Registry Correct answer
• D. Container Threat Detection

Option C is correct because Artifact Registry is the managed regional repository for container images and language packages (Maven, npm, Python and others) that Cloud Build can push to. Binary Authorization enforces deploy-time policy, Cloud Deploy orchestrates releases, and Container Threat Detection detects runtime threats; none of them stores artifacts.

• A. Create an API key restricted to the Cloud Storage API and send it with each request
• B. Federate the VM with an external identity provider through Workload Identity Federation
• C. Attach a user-managed service account to the VM and use Application Default Credentials Correct answer
• D. Run gcloud auth login on the VM with an administrator account and reuse the cached token

Option C is correct because a service account attached to the VM supplies short-lived credentials automatically through Application Default Credentials, so no key file is distributed. An API key does not identify a principal for Cloud Storage access, Workload Identity Federation is meant for workloads outside Google Cloud, and reusing a cached administrator login is insecure and over-privileged.

• A. Deploy the new revision with 100% of traffic and redeploy the previous revision if error-rate alerts fire
• B. Deploy the new revision with a low maximum instance count so that it only receives a small share of requests
• C. Deploy with no traffic, split traffic 95/5 between revisions, and raise the share as errors stay low Correct answer
• D. Deploy the new revision with no traffic and send testers to its tagged revision URL before shifting traffic

Option C is correct because Cloud Run lets you deploy a revision with no traffic and then split traffic by percentage, such as 95/5, and move it back to the previous revision instantly. Deploying at 100% exposes every user, a low max-instance count limits capacity rather than giving a controlled traffic share, and a tagged URL only tests with testers rather than exposing 5% of production requests.

• A. Declare the infrastructure in Terraform and apply changes through a reviewed pipeline Correct answer
• B. Export the load balancer configuration before each manual change so it can be restored if needed
• C. Limit console access to one on-call engineer who makes changes after manager approval
• D. Record every manual change in a shared runbook and have a second engineer verify it afterward

Option A is correct because declaring infrastructure as code in Terraform and applying it through a reviewed pipeline makes every change repeatable, reviewable in version control and reversible by reverting a commit. Exporting configs, restricting console access, or logging manual changes in a runbook still leave hand edits that are not reliably repeatable or easily reversed.

• A. Hold a blameless postmortem and track each contributing factor as an action item with an owner Correct answer
• B. Add a mandatory canary stage to the deployment pipeline and close the review once it ships
• C. Name the engineer in the report and have them present the corrective plan to the department
• D. Require a second engineer to approve every production configuration push going forward

Option A is correct because a blameless postmortem focuses on the systemic causes of the outage and turns each contributing factor into an owned action item, which is what the operational excellence pillar asks for. Naming and shaming the engineer discourages honest reporting, and adding only a canary stage or an approval step addresses one factor without a full review of the others.

• A. Count of Dataflow workers running at peak load
• B. Dataflow worker CPU utilization stays below 70% across the job
• C. Freshness: events visible in BigQuery within 2 minutes of publication Correct answer
• D. Percentage of Dataflow job launches that complete without an error
• E. Correctness: events written with the expected enriched values Correct answer

Options C and E are correct because freshness and correctness are what the dashboard users actually experience from a data pipeline, and both can be measured as good events over total events. Worker count and CPU utilization are resource measures that say nothing about whether users get timely, accurate data, and job launch success describes deployments rather than the data flowing through the pipeline.