Free Professional Cloud Architect practice test: 30 questions with answers

Cloud Spanner provides relational transactions with strong consistency, horizontal scaling and a multi-region configuration built for the highest availability. Cross-region Cloud SQL replicas do not give globally consistent writes, because writes still go to one primary. Bigtable is not a relational store with multi-row transactions, and a single-region Firestore location does not meet the cross-region goal.

Storage Transfer Service uses the existing 10 Gbps link for a managed, resumable transfer, and Archive storage suits cold data that is rarely read. A Transfer Appliance is for when bandwidth is the constraint, and this link is already available. A laptop copy over the internet is slow and fragile at this volume, and a FUSE mount is not a migration path.

Dedicated or Partner Interconnect provides private, high-bandwidth connections that avoid the public internet, which meets the requirement. HA VPN still crosses the internet, even when encrypted, and does not guarantee consistent bandwidth. Cloud NAT is for outbound access from private instances, and consumer broadband is not an enterprise link.

Keeping EU data in EU regional resources and routing EU users to them satisfies residency and keeps latency low. Encryption with local keys does not change where the data is stored. Copying data nightly to every region spreads residency-protected data everywhere, and a CDN caches content but does not satisfy a rule about where customer records are stored.

Rehosting with minimal change gets the workload into Google Cloud quickly, and refactoring later reduces risk. A full rewrite before migration delays the benefit and raises risk. Replacing the system with SaaS is a business decision the scenario does not support, and keeping it on-premises does not complete the move.

In Shared VPC the host project owns the network, and service projects receive the Network User role on specific subnets, so teams deploy without changing network configuration. Editor on the host project allows network changes. Peered VPCs duplicate management, and default networks are not governed centrally.

Terraform with per-environment state and a plan step makes changes reviewable and shows drift as a difference between declared and actual state. Console creation and quarterly exports do not detect drift in time. Hand-run scripts are not repeatable, and copying a deployment by hand bypasses the template.

Cloud NAT with reserved static addresses gives outbound traffic a fixed source IP without giving nodes public addresses. Ephemeral node addresses change, so the allowlist would break. A load balancer handles inbound traffic in the wrong direction, and a VPN to the pod network does not give the provider a stable source address.

Private Google Access on the subnet, with the restricted API endpoint, lets VMs without external IPs reach Google APIs over Google's network. External IPs contradict the requirement, and Cloud NAT sends traffic out to the internet. A VPN back to the data centre adds a detour that does not reach Google APIs privately.

Cloud Run is fully managed, runs containers serverlessly and scales to zero, which matches the requirements. GKE needs cluster operation and does not scale to zero by default. Managed instance groups require VM management, and flexible App Engine keeps a minimum number of instances running.

Committed use discounts reduce the price of steady usage for a fixed term, which suits a three-year batch workload. Preemptible or Spot VMs can be reclaimed at any time and are unsuitable for databases or steady work. A larger machine type costs more per hour and does not reduce the bill.

Lifecycle rules that move objects to colder classes after the active period cut cost, and a retention policy enforces the seven-year requirement. Deleting objects breaks compliance, and Archive from upload makes the active first 30 days expensive to read. Versioning adds cost and does not enforce retention.

Recommender analyses usage and suggests rightsizing, idle resource removal and committed-use options. A budget alert reports spend rather than recommending changes. Logs and uptime checks describe activity and availability, not optimisation opportunities.

Dataproc runs Hadoop and Spark with little change to the jobs, and ephemeral clusters can be deleted after each nightly run so they cost nothing while idle. A custom GKE image is significant effort, and a full SQL rewrite is not needed for a first phase. Hand-run VMs lose the automation benefit.

Acting on Recommender suggestions for idle or oversized resources removes waste directly, and autoscaling with scale-in removes capacity that demand no longer needs. Large machine types cost more per hour, and always-on development environments waste money. Committing to peak capacity for the whole year pays for unused capacity.

A VPC Service Controls perimeter blocks data movement out of the perimeter even when identities have IAM permissions, which addresses the exfiltration risk. Region restrictions do not stop copies, and an owner can reassign a removed permission. Audit logs record copies after the fact but do not prevent them.

Customer-managed encryption keys in Cloud KMS let the company control rotation and disable keys to cut off access. Google-managed keys are operated by Google, so the company cannot disable them. Per-engineer passwords are hard to govern, and business-hours conditions do not control the key itself.

Cloud Armor policies on the external load balancer filter traffic at Google's edge before it reaches the backend, and rules change without redeploying the application. Cloud NAT handles outbound traffic and does not filter inbound requests. Interconnect is a private link, and bucket policies do not protect an application backend.

Uniform bucket-level access with public access prevention keeps access under IAM and blocks public exposure. Access Transparency logs show when Google personnel access customer data, which regulated reviews require. Broad admin roles, public buckets and ignoring compliance profiles all weaken the controls.

Disabling and deleting the exposed key stops its use at once, restricting key creation prevents repeats, and attached identities remove long-lived keys from workloads. Annual rotation and IP restrictions do not stop an attacker who holds the key, and audit logs only show what happened. Commit history is copied and cached elsewhere, and keys do not expire on their own.

SLOs in Cloud Monitoring measure availability against a target over a window, and burn-rate alerts warn before the budget is exhausted. CPU alerts do not measure user-facing availability, and daily log counts are too slow. A single-region uptime check sees reachability from one vantage point only.

A 30-day Logging bucket serves day-to-day queries, and a sink to a locked Cloud Storage bucket with retention meets the long-term requirement and resists tampering. Keeping everything in Logging for seven years costs far more than needed. Spreadsheets are editable and not a tamper-resistant record, and metrics do not replace event logs.

Alerting on SLO burn rate focuses pages on user impact, and runbook links with removal of unused alerts reduce noise and speed response. Paging for every warning and sending everything to everyone increase fatigue. CPU alone is not a reliable signal of user-facing health.

A Pub/Sub notification channel delivers alert events to a topic that automation can subscribe to, which allows an immediate automated response. Email to a shared inbox depends on human reading. A log sink and dashboard polling both add delay and do not deliver the alert as an event.

A canary with automated analysis against an SLO catches regressions on a small share of traffic and rolls back without waiting for complaints. Manual rollback reacts late, and Friday freezes do not detect problems. A one-step night deployment exposes the whole fleet at once.

Database Migration Service supports continuous replication from MySQL into Cloud SQL, which allows a short, planned cutover. Nightly dumps and manual imports produce long downtime. Storage Transfer Service copies files rather than a consistent live database, and a daily script on a hand-built VM gives poor consistency.

Allowing 443 publicly to the web tier and limiting database access to the application tier's service account gives least exposure and uses identity rather than IP ranges. Relying on a password while exposing the database is unsafe. Tag-wide rules permit every port between tiers.

Building once and promoting the same digest after approval keeps the production artifact identical to the tested one. Rebuilding in production means the tested artifact is not the one deployed. Separate builds from the same branch can differ, and a workstation deploy bypasses the approval gate.

At 200 Mbps, 80 TB would take far longer than a typical migration window even at full utilisation, so shipping the data on a Transfer Appliance is the faster route. Continuous transfer over the same link, a laptop stream and daily rsync are all bounded by the same bandwidth.

A full rehearsal in a staging copy measures real timings and proves that rollback works before production. Reading the plan only checks the wording, and a night cutover without tests adds risk. Skipping rollback removes the safety net exactly when it is needed.