Professional Cloud Architect

Last checked October 22, 2026 against the official Google Cloud exam page.

1. Question 1Design and plan a cloud solution architecture

   A retailer runs its order system on-premises and is moving to Google Cloud. The business needs an order database with strong consistency, very high availability across regions, and automatic horizontal scaling. Which service should the architect choose?

   1. AFirestore in Native mode with a single-region location near headquarters
   2. BCloud SQL for PostgreSQL with cross-region read replicas in each continent
   3. CBigtable with replication enabled in three regions and a single cluster per region
   4. DCloud Spanner in a multi-region configuration
   Show answer and explanationHide answer

   Correct answer: D

   Cloud Spanner provides relational transactions with strong consistency, horizontal scaling and a multi-region configuration built for the highest availability. Cross-region Cloud SQL replicas do not give globally consistent writes, because writes still go to one primary. Bigtable is not a relational store with multi-row transactions, and a single-region Firestore location does not meet the cross-region goal.

2. Question 2Manage and provision the cloud solution infrastructure

   A company uses a Shared VPC across several projects. Each application team must create its own Compute Engine instances, but it must not be able to change the network configuration. Which design is correct?

   1. AA separate VPC per service project, peered, so each team manages its own network settings
   2. BHost project owns the network, and service projects get Network User on selected subnets
   3. CGive each application team the Editor role on the host project, so that they can create networks as needed
   4. DThe default network in each project, with firewall rules managed by each team in its own project
   Show answer and explanationHide answer

   Correct answer: B

   In Shared VPC the host project owns the network, and service projects receive the Network User role on specific subnets, so teams deploy without changing network configuration. Editor on the host project allows network changes. Peered VPCs duplicate management, and default networks are not governed centrally.

3. Question 3Analyze and optimize technical and business processes

   A company runs a steady, predictable batch workload on Compute Engine for three years and wants to cut cost without changing the architecture. Which option gives the largest saving?

   1. ACommitted use discounts for the compute the workload needs steadily
   2. BSpot VMs for the database servers, which are the largest part of the monthly bill
   3. CPreemptible VMs for every instance, since Google can reclaim them at any time
   4. DA larger machine type, so that the job finishes faster and uses fewer hours overall
   Show answer and explanationHide answer

   Correct answer: A

   Committed use discounts reduce the price of steady usage for a fixed term, which suits a three-year batch workload. Preemptible or Spot VMs can be reclaimed at any time and are unsuitable for databases or steady work. A larger machine type costs more per hour and does not reduce the bill.

4. Question 4Design for security and compliance

   A healthcare company must prevent its BigQuery data from being copied to projects outside its organisation, even by administrators who hold the owner role in a project. Which control best fits?

   1. AAn organisation policy that restricts the regions in which BigQuery datasets can be created
   2. BA custom IAM role that removes the export permission from every user in the organisation
   3. CA Cloud Audit Logs export to Cloud Storage, so that any copy to an outside project is visible afterwards
   4. DA VPC Service Controls perimeter around the projects that hold the data
   Show answer and explanationHide answer

   Correct answer: D

   A VPC Service Controls perimeter blocks data movement out of the perimeter even when identities have IAM permissions, which addresses the exfiltration risk. Region restrictions do not stop copies, and an owner can reassign a removed permission. Audit logs record copies after the fact but do not prevent them.

5. Question 5Ensure solution and operations excellence

   A company wants an alert when its checkout service is on track to breach a 99.9 percent availability target over 30 days, with an early warning when the error budget is burning quickly. Which Cloud Monitoring capability fits?

   1. AA CPU utilisation alert that fires when any VM exceeds 80 percent for five minutes
   2. BAn uptime check every minute from one region, paging the on-call phone
   3. CA log-based metric that counts every log line containing the word error, emailed daily
   4. DService-level objectives with error budget burn-rate alerting policies
   Show answer and explanationHide answer

   Correct answer: D

   SLOs in Cloud Monitoring measure availability against a target over a window, and burn-rate alerts warn before the budget is exhausted. CPU alerts do not measure user-facing availability, and daily log counts are too slow. A single-region uptime check sees reachability from one vantage point only.