Managing and provisioning a solution infrastructure practice questions

Answer: A) Node pool auto-creation (node auto-provisioning) on top of the cluster autoscaler

Node pool auto-creation (node auto-provisioning) lets the cluster autoscaler create and remove node pools that match pending Pods' resource and hardware needs, such as GPUs. HPA and VPA scale Pods, not node hardware.

• ACorrect. Node pool auto-creation extends the cluster autoscaler so GKE creates node pools sized for the resource and hardware requests of pending Pods, including GPUs. It also removes auto-created pools when they are no longer needed. GPU limits must be configured for GPU pools to be created.
• BIncorrect. Autoscaling one oversized GPU pool runs general-purpose Pods on expensive GPU nodes. It does not provide right-sized machine types for each workload.
• CIncorrect. HPA changes the number of Pod replicas. It does not create nodes with GPUs or high-memory machine types, so Pods that need that hardware stay unschedulable.
• DIncorrect. VPA adjusts Pod CPU and memory requests. It does not create node pools with new machine types or accelerators.

Answer: A) A regional managed instance group across multiple zones, with autohealing based on a health check and an autoscaler

• AA regional MIG spreads instances across zones for zone-failure resilience, autohealing recreates failed instances that fail the health check, and autoscaling adjusts capacity to load.
• BOne VM in one zone is a single point of failure; snapshots speed rebuild but don't keep the service up.
• CA zonal MIG autoheals within a zone but is entirely lost if that zone fails.
• DAn unmanaged instance group has no autohealing, autoscaling, or coordinated updates.

Answer: A) Direct VPC egress or a Serverless VPC Access connector for the service

Serverless services such as Cloud Run need Direct VPC egress or a Serverless VPC Access connector to reach private IP resources in a VPC, such as Memorystore. Private Google Access, Cloud NAT and peering don't provide that path.

• ACorrect. Both options let Cloud Run send outbound traffic into a VPC network, so the service can reach internal IP addresses such as a Memorystore instance.
• BPrivate Google Access lets VMs without external IP addresses reach Google APIs and services. It doesn't give Cloud Run a path into the VPC.
• CCloud NAT gives private resources outbound internet access. It doesn't route traffic from Cloud Run into the VPC.
• DCloud Run services don't run inside a customer VPC by default, so there is no network to peer. The service needs Direct VPC egress or a connector to send traffic into the VPC.

Answer: A) An ingress rule with the app service account as source and the database service account as target

For tiers that scale constantly, write the ingress rule with the client tier's service account as source and the server tier's service account as target. Service accounts are access-controlled, so Google prefers them to network tags.

• AFirewall rules can match instances by their attached service account, so the rule keeps working as VMs are added or removed. Google recommends service accounts over network tags because only principals granted access to the service account can attach it, while instance admins can change tags freely.
• BThe subnet range also covers the other workloads in the subnet, so this rule would let non-application VMs reach the databases.
• CKeeping a list of IPs up to date with a script is fragile and lags behind autoscaling events. Matching on identity removes the need for IP lists altogether.
• DThe destination of an egress rule must be an IP range, not a tag. An egress rule on the app VMs would also do nothing to stop other VMs from connecting to the databases.

Answer: A) A machine image

• AA machine image captures a VM's configuration, metadata, permissions and data from all attached disks.
• BA disk snapshot captures one disk, not the whole VM configuration.
• CAn instance group manages a set of VMs; it isn't a capture of one VM.
• DA bucket stores objects; it doesn't capture VM configuration.

Answer: A) Shared VPC

Shared VPC lets a host project keep central control of a VPC's subnets, routes and firewalls, while attached service projects owned by other teams deploy workloads into those subnets.

• ACorrect. With Shared VPC, a host project contains the network, and a Shared VPC Admin attaches service projects to it. Service projects deploy resources into the shared subnets, while the network team keeps central control of subnets, routes and firewalls.
• BIncorrect. Peering connects separate VPC networks that are each managed by the project that owns them. It doesn't give one team control of a single network used by others, and peering isn't transitive.
• CIncorrect. Private Service Connect lets consumers reach specific published services or Google APIs through private endpoints. It doesn't let other projects deploy workloads into subnets of a centrally owned network.
• DIncorrect. Network Connectivity Center connects multiple separate networks as spokes of a hub. Each team would still own and manage its own VPC, which is not one centrally controlled network.

Answer: A) Shared VPC, with a host project and attached service projects

• AShared VPC centralizes network administration in a host project while application teams manage their own resources in service projects attached to it.
• BThat removes the centralized network governance the scenario requires.
• CVPC Service Controls create security perimeters around APIs; they do not provide the shared-network administration model described.
• DCloud CDN caches content; it does not provide shared network administration across projects.

Answer: A) The gcs backend, which locks the shared state stored in a Cloud Storage bucket

State locking prevents concurrent applies from corrupting shared state, and the Cloud Storage (gcs) backend provides it. Object Versioning helps you recover old state but does not prevent concurrent writes.

• ACorrect. With remote state in Cloud Storage, the gcs backend locks the state so only one operation can modify it at a time. A second, concurrent apply can't write to the state while another run holds the lock.
• BIncorrect. Object Versioning keeps earlier versions of the state file so you can recover them. It doesn't merge or serialize concurrent writes; locking is what prevents them.
• CIncorrect. Local state isn't shared or locked. Each machine ends up with its own view of the infrastructure, which makes conflicting changes more likely.
• DIncorrect. A refresh-only plan compares the state with the real infrastructure, but it gives no mutual exclusion between two applies running at the same time.

Answer: A) A custom mode VPC network, so you choose the regions that get subnets and plan CIDR ranges that avoid overlap

For production, especially when connecting to on-premises or peered networks, Google recommends custom mode VPC networks. You control subnet regions and IP ranges and avoid auto mode's fixed 10.128.0.0/9 subnets.

• AGoogle recommends custom mode for production, especially when the network connects to other environments. Custom mode gives full control over which regions have subnets and which IP ranges they use, so you can avoid conflicts with on-premises and peered networks.
• BAuto mode subnets come from the fixed 10.128.0.0/9 range. Any connected network that uses that range will conflict, which is a common problem with peering and hybrid connectivity.
• CSubnets added automatically for new regions can overlap with ranges you planned elsewhere. This lack of control is one reason Google advises against auto mode for production.
• DThe default network is an auto mode network, so it has the same fixed-range problem. Its prepopulated firewall rules are not designed to allow traffic from on-premises ranges.

Answer: A) Canary deployment

• AA canary sends a small slice of live traffic to the new version, so problems are caught with limited blast radius before a full rollout; it can be implemented with MIGs, GKE, or Cloud Run traffic splitting.
• BRecreate stops the old version and starts the new one for everyone at once — maximum blast radius and downtime.
• CCold standby is a disaster-recovery concept, not a progressive release technique.
• DThat is the opposite of a controlled, observed, reversible rollout.