Professional Cloud Architect practice questions with answers

Answer: A) Define BigLake tables over the files using a BigQuery connection, and apply row-level and column-level access policies

BigLake tables let BigQuery query open-format files in Cloud Storage in place. A connection with access delegation reads the data, so users don't need bucket permissions, and row-level and column-level security are enforced on the table.

• ACorrect. BigLake tables query data in place in Cloud Storage. Access delegation means the connection's service account reads the files, so users need access only to the table. Row-level and column-level security, and dynamic data masking, are enforced on the table.
• BIncorrect. Standard external tables query the data in place but don't provide access delegation, so users need permissions on the underlying files. That breaks the no-bucket-access requirement, and they don't offer the fine-grained governance that BigLake tables provide.
• CIncorrect. Native tables support fine-grained security, but loading copies the data into BigQuery storage. That breaks the requirement to keep the data only in Cloud Storage.
• DIncorrect. Cloud Storage IAM controls access to buckets or objects, not to individual rows or columns. Analysts would also be given direct bucket access, which the requirements prohibit.

Answer: A) Firestore

• AFirestore is a serverless document database with real-time listeners, on-device offline persistence and sync, and client SDKs — designed for mobile and web app back ends.
• BCloud SQL is a managed relational database with no built-in client real-time sync or offline mode for mobile apps.
• CBigQuery is an analytics warehouse for large-scale SQL queries, not an operational app database with client sync.
• DBigtable is a wide-column store for high-throughput analytical/operational workloads; it has no client SDK real-time sync or offline support.

Answer: A) Publish events to Pub/Sub, transform them in a streaming Dataflow pipeline, and write to BigQuery with the Storage Write API

For real-time transformation with SQL analytics within seconds, use Pub/Sub for ingestion, streaming Dataflow for transformation, and BigQuery (Storage Write API) for analysis. Batch loads and non-SQL stores can't meet the latency or query requirement.

• ACorrect. Pub/Sub absorbs high-volume event ingestion, and Dataflow transforms the stream continuously. Records written to BigQuery with the Storage Write API can be queried with SQL as soon as they're written.
• BIncorrect. Hourly batch processing adds up to an hour of delay, so data isn't queryable within seconds.
• CIncorrect. A Cloud Storage subscription only writes raw messages to files, so there's no transformation step, and daily loads are far too slow for queries within seconds.
• DIncorrect. Memorystore for Redis is a fast in-memory key-value store, but it isn't an analytical warehouse and doesn't support ad hoc SQL analysis.

Answer: A) A private ASN as defined in RFC 6996, such as one from the 64512–65534 range

For HA VPN, Dedicated Interconnect, and Router appliance, Cloud Router must use a private ASN as defined in RFC 6996. Only Partner Interconnect requires Google's public ASN 16550.

• ACorrect. A Cloud Router that manages BGP sessions for Dedicated Interconnect VLAN attachments, HA VPN tunnels, or Router appliances must use a private ASN (16-bit 64512–65534 or 32-bit 4200000000–4294967294).
• BIncorrect. ASN 16550 is required only for Cloud Routers that manage Partner Interconnect VLAN attachments, and such a router can manage only Partner Interconnect sessions. It doesn't apply to HA VPN or Dedicated Interconnect.
• CIncorrect. The company's registered public ASN can identify its on-premises peer, but the Cloud Router's own local ASN for these connection types must be private.
• DIncorrect. You don't configure Cloud Router with Google's backbone ASN. HA VPN and Dedicated Interconnect require a private ASN that you choose.

Answer: A) A Cloud NAT gateway on a Cloud Router in the VPC network's region

Cloud NAT is the managed, regional service that lets VMs without external IPs reach the internet for outbound traffic while blocking unsolicited inbound connections. Private Google Access only reaches Google APIs.

• ACloud NAT gives source NAT to VMs without external IPs so they can start outbound connections to the internet. It only lets in responses to connections the VMs started, never unsolicited inbound connections.
• BPrivate Google Access lets VMs without external IPs reach Google APIs and services. It does not give them a path to third-party repositories on the public internet.
• CFirewall rules only allow or deny traffic; they do not translate addresses. A VM with no external IP still needs NAT to reach the internet, and egress is already allowed by the implied rule.
• DAn external load balancer spreads incoming client traffic across backends. It does not give backend VMs a way to start outbound connections to the internet.

Answer: A) A private zone for the cloud names, a forwarding zone for corp.example.com, and an inbound server policy

For hybrid DNS, use private zones for cloud names, a forwarding zone to send on-premises domains to on-premises resolvers, and an inbound server policy so on-premises hosts can query Cloud DNS private zones.

• AThe private zone serves the cloud names to the VPC. The forwarding zone sends corp.example.com queries to the on-premises name servers. The inbound server policy creates entry points that on-premises resolvers can query to resolve the VPC's private zones.
• BPeering zones send lookups to another VPC network's name resolution, not to on-premises servers. An alternative name server policy sends every query on-premises, which loses Compute Engine internal DNS, and it still doesn't let on-premises hosts query Cloud DNS.
• CA public zone would publish internal names on the internet, which breaks the requirement that they not be public. DNSSEC authenticates responses but doesn't provide private hybrid resolution.
• DThis covers resolution from the VPC to on-premises. Response policies, however, only change answers for clients inside the VPC. They don't give on-premises hosts a way to send queries into Cloud DNS, so an inbound server policy is still needed.

Answer: A) An organization-level sink with includeChildren set, filtered to audit logs and routed to a central log bucket, BigQuery, or Cloud Storage

An organization-level aggregated sink with includeChildren collects audit logs from every current and future project. Routing it to a central log bucket, BigQuery, or Cloud Storage with long retention meets the multi-year compliance requirement.

• ACorrect. An aggregated sink at the organization with includeChildren routes matching logs from all child folders and projects, including projects created later. The central destination can be set to keep logs for years.
• BIncorrect. A project-level sink only sees log entries that originate in its own project. It can't collect logs from other projects, however broad its filter is.
• CIncorrect. includeChildren defaults to false, so the sink would route only logs owned by the organization resource itself, not logs from its folders and projects.
• DIncorrect. The retention period of the _Required bucket can't be changed. Per-project buckets also don't automatically cover new projects in one central store.

Answer: A) Admin Activity logs, which are always written; Data Access logs, which must be explicitly enabled

Admin Activity audit logs are always written and capture resource configuration changes. Data Access audit logs capture data reads and must be explicitly enabled for most services (BigQuery is the exception) because they can be high-volume and billable.

• AAdmin Activity audit logs record configuration and metadata changes, such as creating or deleting a bucket. They are always written and can't be disabled. Data Access audit logs record reads of user data. Except for BigQuery they are off by default because they can be very high-volume, so they must be enabled explicitly.
• BThis swaps the two types. Admin Activity logs are always on. Data Access logs are opt-in for most services, including Cloud Storage.
• CSystem Event audit logs record Google Cloud system actions that change resource configuration. They don't record user-initiated actions like a person creating or deleting a bucket.
• DPolicy Denied logs record access refused because of a security policy violation, not successful object reads. Capturing reads requires Data Access logs.

Answer: A) VPC Service Controls establishing a service perimeter around the sensitive resources

• AVPC Service Controls create a boundary that blocks data movement to unauthorized networks or projects, even for users with valid IAM permissions.
• BIAM controls who can query but does not by itself stop data from being copied outside an approved network boundary.
• CThat is the opposite of the required protection.
• DRemoving logs reduces detection ability and does not prevent exfiltration.

Answer: A) Add a pipeline stage that load-tests the new revision in a staging environment and fails the build if p95 latency exceeds the established baseline

Add an automated load test with a latency threshold to the CI/CD pipeline so performance regressions fail the build before release. Production alerting and profiling find problems only after users are affected, and unit-test coverage doesn't measure performance.

• ACorrect. An automated performance gate in the pipeline compares each release with a baseline and stops regressions before production. This is the shift-left testing approach the Well-Architected Framework recommends for preventing regressions.
• BIncorrect. Production alerting is useful, but it fires only after the slower release is already serving users. The requirement is to catch the regression before production traffic.
• CIncorrect. Unit-test coverage measures how much code functional tests exercise. It doesn't measure latency under load, so performance regressions can still pass.
• DIncorrect. Profiler helps find the cause of a slowdown, but it works on production after the release is live. It doesn't stop a regressed release from reaching users.

Answer: A) Add an On-Demand Scanning step to the Cloud Build pipeline that fails the build when vulnerabilities of chosen severities are found

Shift-left security means testing during CI. Running On-Demand Scanning in Cloud Build and failing the build on chosen severities stops vulnerable images before they're pushed. The other options detect or reduce risk only after deployment.

• ACorrect. This shifts security testing left. On-Demand Scanning runs inside the CI build, and when it finds vulnerabilities at the specified severities, the build step fails and Cloud Build doesn't push the image to Artifact Registry.
• BIncorrect. This only finds problems after the images are deployed and running, which is exactly the late detection the company wants to avoid.
• CIncorrect. Web Security Scanner checks running web applications for issues such as XSS. It runs after release and doesn't inspect image OS packages or dependencies during the build.
• DIncorrect. Cloud Armor gives runtime protection at the edge. It can reduce exposure, but it doesn't find or stop vulnerable dependencies during development.

Answer: A) Add the new columns and tables additively, release code that works with both schemas, and drop the old columns in a later release

To keep app rollback safe across a schema change, keep the schema backward compatible with both versions. Make additive changes first, deploy code that handles both, and drop the old elements only in a later release.

• ACorrect. This is expand/contract (parallel change). Both the old and new app versions work with the expanded schema, so rolling the app back during the bake period is just a redeploy. The destructive cleanup happens only after the new version is trusted, which follows Google's advice to separate schema changes from code changes and remove the old schema after full rollout.
• BIncorrect. Once the old columns are dropped, the previous app version can't run against the database. Restoring a backup to get it back means downtime, and every write made since the backup is lost.
• CIncorrect. A down-migration can't bring back data in columns that were dropped. Rows written in the new shape during the bake period would need lossy conversion. Running the script also takes another maintenance window, so the no-downtime requirement fails.
• DIncorrect. After cutover, new writes go only to the clone, and the original falls further behind. Rolling back to the original after a day or two would lose all data written in that time.

Answer: A) Create a named gcloud configuration for each environment and switch between them with gcloud config configurations activate

Named gcloud configurations group the account, project, and other properties together. Activating a configuration switches all of them in one step, which lowers the risk of running a command in the wrong environment.

• AA named configuration stores properties such as the account, project, and default zone together. Activating a configuration switches all of them at once.
• BThis changes only the project property in the current configuration. The active account stays the same, so the engineer could still use the wrong identity.
• CThis overrides only the project, and the value stays fixed until the engineer edits the profile. It does not switch the account and does not make frequent switching easier.
• DApplication Default Credentials are used by client libraries and applications. They do not change the account or project that gcloud commands use.

Answer: A) A readiness probe

• AThe pod receives traffic only after the readiness probe succeeds.
• BA liveness probe restarts unhealthy containers; it doesn't hold back traffic during warm-up.
• CNode selectors choose where pods run.
• DConfigMaps hold configuration data.

Answer: A) Configure a canary strategy in the delivery pipeline with percentage phases such as 10 and 50, and enable verification for each phase

A canary strategy sends only a set percentage of real production traffic to the new revision in each phase, with verification gating each step. The other options either expose all users before checks run or never test the new revision on real traffic.

• AWith a Cloud Deploy canary strategy, the new Cloud Run revision gets a set percentage of traffic in each phase while the old revision serves the rest. A verify step can run automated metric checks before the next phase starts. A failed check stops the progression, and the release can be rolled back while most users are still on the old revision.
• BA tagged revision with no traffic is useful for pre-release testing, but it gets no real production requests. The cutover then moves every user at once, so the release never serves a small share of real users first.
• CIn a standard strategy, verification runs only after the new version is serving all traffic. Every user is exposed before the checks run, which is the problem the team wants to prevent.
• DStaging tests with synthetic traffic are useful, but they don't send any share of real production requests to the new revision, so production-only regressions can still reach all users at once.