Planning and implementing a cloud solution practice questions

Answer: A) The instance edition: Developer, Basic, or Enterprise

You choose a Cloud Data Fusion edition (Developer, Basic, or Enterprise) when you create the instance. The edition sets the instance's hourly price and its features, such as RBAC in Enterprise.

• ACorrect. The edition is chosen when the instance is created (gcloud --edition=developer|basic|enterprise). It sets the hourly instance price and the feature set. For example, Enterprise is meant for large, mission-critical pipelines and includes RBAC.
• BIncorrect. You do pick a region for each instance, but the region only sets where the instance runs. It does not decide the feature tier or whether RBAC is available.
• CIncorrect. A private instance controls how the instance connects to your VPC network. It does not set the edition's price or features.
• DIncorrect. Compute profiles set the Dataproc clusters that run pipelines, which affects Dataproc costs. They are not the instance-level setting that decides the instance's hourly price or RBAC availability.

Answer: A) The region, the machine series, the amounts of vCPUs and memory, and a 1-year or 3-year term

A resource-based CUD commits to quantities of resources, such as vCPUs and memory, for one machine series in one region, for a 1-year or 3-year term.

• ACorrect. Resource-based commitments are bought per region. They apply to a specific machine series in that region, commit to minimum amounts of resources such as vCPUs and memory, and last 1 or 3 years.
• BIncorrect. Commitments are bought per region, not per zone, and aren't tied to specific VM instances. The discount applies to eligible usage of that machine series anywhere in the region.
• CIncorrect. Resource-based commitments can't be global; they're bought per region. The term is 1 or 3 years, not a monthly renewal, even though billing happens monthly.
• DIncorrect. A dollar spend commitment describes a spend-based CUD. A resource-based CUD commits to quantities of resources such as vCPUs and memory.

Answer: A) Cloud SQL

For a fully managed relational database running MySQL or PostgreSQL with standard SQL and ACID transactions, choose Cloud SQL. Firestore also offers ACID transactions, but it is a NoSQL document database.

• ACorrect. Cloud SQL is a fully managed relational database service for MySQL, PostgreSQL, and SQL Server. It supports standard SQL, relational schemas, and ACID transactions, so it fits an operational order-processing workload.
• BIncorrect. Firestore does support ACID transactions, but it is a NoSQL document database. It is not a relational database with a relational schema, and it can't run as MySQL or PostgreSQL.
• CIncorrect. BigQuery is a serverless data warehouse built for large-scale analytical queries. It is not meant to be the operational transactional database for an order-processing application, and it isn't MySQL or PostgreSQL.
• DIncorrect. Memorystore is a managed in-memory key-value store, typically used for caching. It is not a relational database that supports standard SQL and relational schemas.

Answer: A) It automates extracting the existing app into containers for GKE or Cloud Run without a rewrite, often in days instead of months

Migrate to Containers automates moving VM-based apps into containers on GKE or Cloud Run without a rewrite, which makes the first move much faster and less risky than manual refactoring. It does not re-architect the app into microservices.

• ACorrect. Migrate to Containers automates moving workloads from VMs into containers that run on GKE or Cloud Run, without rewriting or re-architecting the app. Google positions this as much faster than manual refactoring. The team can still refine the containers later.
• BIncorrect. Migrate to Containers containerizes the existing application as it is. It does not redesign a monolith into microservices, which still takes manual re-architecture work.
• CIncorrect. GKE and Cloud Run run any compatible container image, including ones built by hand from a Dockerfile. Migrate to Containers is optional.
• DIncorrect. Managed instance groups are a Compute Engine VM feature. Migrate to Containers targets containers on GKE or Cloud Run, not VM instance groups.

Answer: A) Create a Serverless VPC Access connector in the VPC and configure the function to use it

A serverless function needs VPC egress to reach private IP resources. A Serverless VPC Access connector provides that, and Direct VPC egress is the newer, recommended alternative. Cloud NAT, authorized networks, and Private Google Access don't.

• ACorrect. A Serverless VPC Access connector lets serverless workloads send traffic into a VPC network, so the function can reach resources with internal IP addresses, such as the Cloud SQL private IP. Direct VPC egress is a newer alternative that Google now recommends, but it isn't one of the options here.
• BIncorrect. Cloud NAT translates outbound traffic from resources inside the VPC to reach the internet. It gives the serverless function no path into the VPC's internal addresses.
• CIncorrect. Authorized networks control access to an instance's public IP address. This instance has only a private IP, so the setting gives the function no path to it.
• DIncorrect. Private Google Access lets VMs without external IPs reach Google APIs and services. It doesn't connect a serverless function to internal IP addresses in the VPC.

Answer: A) Standard environment with automatic scaling

The App Engine standard environment with automatic scaling provides Google-managed language runtimes and can scale to zero. The flexible environment always keeps at least one instance running, and manual scaling uses a fixed instance count.

• AThe standard environment runs code in Google-provided runtimes for supported language versions. With automatic scaling, it scales quickly with traffic and can scale down to zero instances when idle.
• BWith manual scaling, the team sets a fixed number of instances that keep running regardless of load, so the app doesn't scale automatically with traffic or down to zero.
• CFlexible environment instances run in Docker containers on Compute Engine VMs and use the Compute Engine autoscaler. Each active version needs at least one instance, so the app can't scale to zero.
• DA custom runtime makes the team responsible for defining the runtime in a Dockerfile, which they want to avoid. It also runs on the flexible environment, which keeps at least one instance running.

Answer: A) Create a custom mode VPC network and add subnets only in us-east1 and europe-west1, using ranges that don't overlap 10.130.0.0/16

Use a custom mode VPC network when you need to choose the regions and IP ranges, for example to avoid overlapping an on-premises range. Auto mode networks, including the default network, create a subnet in every region with predefined ranges from 10.128.0.0/9.

• ACorrect. Google Cloud creates no subnets in a custom mode network. You decide which regions get subnets and which IP ranges they use, so the team can create just the two subnets with ranges that don't overlap the on-premises network.
• BIncorrect. Auto mode creates a subnet in every region using predefined ranges inside 10.128.0.0/9. That block contains 10.130.0.0/16, so overlap is possible. Auto mode also doesn't let the team choose the regions or the ranges.
• CIncorrect. The default network is an auto mode network. It has a subnet in every region, and the predefined ranges come from 10.128.0.0/9 instead of the team's IP plan.
• DIncorrect. Converting an auto mode network to custom mode keeps every existing subnet with the same names and IP ranges. The unneeded subnets and the predefined 10.128.0.0/9 ranges would still be there.

Answer: A) A runtime environment variable in the function's deployment configuration, read by the code when it runs

Use runtime environment variables in the deployment configuration to give a Cloud Run function settings that differ by environment without code changes. A change to a variable is applied by deploying a new revision. Secrets belong in Secret Manager.

• ACorrect. Runtime environment variables are part of the function's deployment configuration and the code reads them from its environment. Each environment can set its own value with the same code. Changing the value still means deploying a new revision, but the source code stays the same. Sensitive values like API keys should come from Secret Manager instead.
• BIncorrect. Labels are key-value metadata for organizing resources and breaking down costs. Their values are not passed into the function's runtime environment. Label values also have character limits that don't allow full URLs.
• CIncorrect. Build-time environment variables only exist while the container image is being built. They are not available to the function at runtime, which is when this function needs the value.
• DIncorrect. A Scheduler payload only reaches invocations that Scheduler triggers. It is not a configuration mechanism, and invocations from other sources would not get the value.

Answer: A) Enable PSC on the instance with the consumer project in its allowed projects list, then create a PSC endpoint in that VPC targeting the instance's service attachment

With Cloud SQL PSC, you enable PSC on the instance, list the allowed consumer projects, and create an endpoint (internal IP plus forwarding rule) in the consumer VPC that targets the instance's service attachment. VPC peering and an allocated IP range are not needed.

• ACorrect. A PSC-enabled Cloud SQL instance publishes a service attachment (pscServiceAttachmentLink). You can only create endpoints from projects in the instance's allowed consumer projects list. The endpoint is an internal IP address plus a forwarding rule in the consumer VPC that points to the service attachment. No peering is needed.
• BIncorrect. This is private services access, which gives the instance a private IP through VPC Network Peering with Google's service producer network. That is the peering-based approach the team wants to avoid, not PSC.
• CIncorrect. A Serverless VPC Access connector lets serverless services such as Cloud Run reach resources in a VPC. It is not attached to Cloud SQL instances and does not create PSC connectivity for VMs.
• DIncorrect. This sends traffic to the instance's public IP. It doesn't give private connectivity, and it doesn't use Private Service Connect.

Answer: A) Infrastructure Manager, which deploys Terraform configurations

Infrastructure Manager is Google Cloud's managed infrastructure-as-code service, built on Terraform, with deployments, revisions, and previews. Deployment Manager reached end of support on March 31, 2026, and Google recommends migrating to Infrastructure Manager.

• ACorrect. Infrastructure Manager is a managed service that deploys and manages Google Cloud resources from Terraform configurations. It records each update as a revision, and its previews run a Terraform plan so you can see changes before you apply them.
• BIncorrect. Deployment Manager is deprecated. Support ended on March 31, 2026, it gets no new features, and Google tells customers to migrate to Infrastructure Manager. A new project should not adopt it.
• CIncorrect. Cloud Build is a CI/CD service that runs build steps. It does not track infrastructure deployments, revisions, or change previews by itself.
• DIncorrect. Cloud Asset Inventory lets you view, search, and export metadata and history for existing resources. It does not deploy or update infrastructure from configuration files.