What Printable Professional-Cloud-Architect Preparation Is

NEW QUESTION 1

For this question, refer to the Dress4Win case study. You are responsible for the security of data stored in
Cloud Storage for your company, Dress4Win. You have already created a set of Google Groups and assigned the appropriate users to those groups. You should use Google best practices and implement the simplest design to meet the requirements.
Considering Dress4Win’s business and technical requirements, what should you do?

• A. Assign custom IAM roles to the Google Groups you created in order to enforce security requirements.Encrypt data with a customer-supplied encryption key when storing files in Cloud Storage.
• B. Assign custom IAM roles to the Google Groups you created in order to enforce security requirements.Enable default storage encryption before storing files in Cloud Storage.
• C. Assign predefined IAM roles to the Google Groups you created in order to enforce security requirements.Utilize Google’s default encryption at rest when storing files in Cloud Storage.
• D. Assign predefined IAM roles to the Google Groups you created in order to enforce security requirement
• E. Ensure that the default Cloud KMS key is set before storing files in Cloud Storage.

Answer: D

Explanation:
https://cloud.google.com/iam/docs/understanding-service-accounts

NEW QUESTION 2

You are designing a Data Warehouse on Google Cloud and want to store sensitive data in BigQuery. Your company requires you to generate encryption keys outside of Google Cloud. You need to implement a solution. What should you do?

• A. Generate a new key in Cloud Key Management Service (Cloud KMS). Store all data in Cloud Storage using the customer-managed key option and select the created ke
• B. Set up a Dataflow pipeline to decrypt the data and to store it in a BigQuery dataset.
• C. Generate a new key in Cloud Key Management Service (Cloud KMS). Create a dataset in BigQuery using the customer-managed key option and select the created key
• D. Import a key in Cloud KM
• E. Store all data in Cloud Storage using the customer- managed key option and select the created ke
• F. Set up a Dataflow pipeline to decrypt the data and to store it in a new BigQuery dataset.
• G. Import a key in Cloud KM
• H. Create a dataset in BigQuery using the customer-supplied key option and select the created key.

Answer: D

Explanation:
https://cloud.google.com/bigquery/docs/customer-managed-encryption

NEW QUESTION 3

You have created several preemptible Linux virtual machine instances using Google Compute Engine. You want to properly shut down your application before the virtual machines are preempted. What should you do?

• A. Create a shutdown script named k99.shutdown in the /etc/rc.6.d/ directory.
• B. Create a shutdown script registered as a xinetd service in Linux and configure a Stackdnver endpoint check to call the service.
• C. Create a shutdown script and use it as the value for a new metadata entry with the key shutdown-script in the Cloud Platform Console when you create the new virtual machine instance.
• D. Create a shutdown script, registered as a xinetd service in Linux, and use the gcloud compute instances add-metadata command to specify the service URL as the value for a new metadata entry with the key shutdown-script-url

Answer: C

NEW QUESTION 4

You are responsible for the Google Cloud environment in your company Multiple departments need access to their own projects and the members within each department will have the same project responsibilities You want to structure your Google Cloud environment for minimal maintenance and maximum overview of 1AM permissions as each department's projects start and end You want to follow Google-recommended practices What should you do?

• A. Create a Google Group per department and add all department members to their respective groups Create a folder per departmentand grant the respective group the required 1AM permissions at the folder level Add the projects under the respective folders
• B. Grant all department members the required 1AM permissions for their respective projects
• C. Create a Google Group per department and add all department members to theirrespective groups Grant each group the required I AM permissions for their respective projects
• D. Create a folder per department and grant the respective members of the department the required 1AM permissions at the folder leve
• E. Structure all projects for each department under the respective folders

Answer: A

Explanation:
This option follows the Google-recommended practices for structuring a Google Cloud environment for minimal maintenance and maximum overview of IAM permissions. By creating a Google Group per department and adding all department members to their respective groups, you can simplify user management and avoid granting IAM permissions to individual users. By creating a folder per department and granting the respective group the required IAM permissions at the folder level, you can enforce consistent policies across all projects within each department and avoid granting IAM permissions at the project level. By adding the projects under the respective folders, you can organize your resources hierarchically and leverage inheritance of IAM policies from folders to projects. The other options are not optimal for this scenario, because they either require granting IAM permissions to individual users (B, C), or do not use Google Groups to manage users (D). References:
✑ https://cloud.google.com/architecture/framework/system-design
✑ https://cloud.google.com/architecture/identity/best-practices-for-planning
✑ https://cloud.google.com/resource-manager/docs/creating-managing-folders

NEW QUESTION 5

You are deploying an application to Google Cloud. The application is part of a system. The application in Google Cloud must communicate over a private network with applications in a non-Google Cloud environment. The expected average throughput is 200 kbps. The business requires:
• 99.99% system availability
• cost optimization
You need to design the connectivity between the locations to meet the business requirements. What should you provision?

• A. A Classic Cloud VPN gateway connected with one tunnel to an on-premises VPN gateway.
• B. A Classic Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway.
• C. An HA Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway.
• D. Two HA Cloud VPN gateways connected to two on-premises VPN gateway
• E. Configure each HA CloudVPN gateway to have two tunnels, each connected to different on-premises VPN gateways.

Answer: C

Explanation:
https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies#configurations_that_support_9999_availability

NEW QUESTION 6

You have broken down a legacy monolithic application into a few containerized RESTful microservices. You want to run those microservices on Cloud Run. You also want to make sure the services are highly available with low latency to your customers. What should you do?

• A. Deploy Cloud Run services to multiple availability zone
• B. Create Cloud Endpoints that point to the service
• C. Create a global HTIP(S) Load Balancing instance and attach the Cloud Endpoints to its backend.
• D. Deploy Cloud Run services to multiple regions Create serverless network endpoint groups pointing to the service
• E. Add the serverless NE Gs to a backend service that is used by a global HTIP(S) Load Balancing instance.
• F. Cloud Run services to multiple region
• G. In Cloud DNS, create a latency-based DNS name that points to the services.
• H. Deploy Cloud Run services to multiple availability zone
• I. Create a TCP/IP global load balance
• J. Add the Cloud Run Endpoints to its backend service.

Answer: B

Explanation:
https://cloud.google.com/run/docs/multiple-regions

NEW QUESTION 7

Your company is using Google Cloud. You have two folders under the Organization: Finance and Shopping. The members of the development team are in a Google Group. The development team group has been assigned the Project Owner role on the Organization. You want to prevent the development team from creating resources in projects in the Finance folder. What should you do?

• A. Assign the development team group the Project Viewer role on the Finance folder, and assign the development team group the Project Owner role on the Shopping folder.
• B. Assign the development team group only the Project Viewer role on the Finance folder.
• C. Assign the development team group the Project Owner role on the Shopping folder, and remove the development team group Project Owner role from the Organization.
• D. Assign the development team group only the Project Owner role on the Shopping folder.

Answer: C

Explanation:
https://cloud.google.com/resource-manager/docs/cloud-platform-resource- hierarchy
"Roles are always inherited, and there is no way to explicitly remove a permission for a lower-level resource that is granted at a higher level in the resource hierarchy. Given the above example, even if you were to remove the Project Editor role from Bob on the "Test GCP Project", he would still inherit that role from the "Dept Y" folder, so he would still have the permissions for that role on "Test GCP Project"."
Reference: https://cloud.google.com/resource-manager/docs/creating-managing-folders

NEW QUESTION 8

Your customer support tool logs all email and chat conversations to Cloud Bigtable for retention and analysis.
What is the recommended approach for sanitizing this data of personally identifiable information or payment
card information before initial storage?

• A. Hash all data using SHA256
• B. Encrypt all data using elliptic curve cryptography
• C. De-identify the data with the Cloud Data Loss Prevention API
• D. Use regular expressions to find and redact phone numbers, email addresses, and credit card numbers

Answer: A

Explanation:
Reference: https://cloud.google.com/solutions/pci-dss-compliance-ingcp#

NEW QUESTION 9

You have an outage in your Compute Engine managed instance group: all instance keep restarting after 5 seconds. You have a health check configured, but autoscaling is disabled. Your colleague, who is a Linux expert, offered to look into the issue. You need to make sure that he can access the VMs. What should you do?

• A. Grant your colleague the IAM role of project Viewer
• B. Perform a rolling restart on the instance group
• C. Disable the health check for the instance grou
• D. Add his SSH key to the project-wide SSH keys
• E. Disable autoscaling for the instance grou
• F. Add his SSH key to the project-wide SSH Keys

Answer: C

Explanation:
https://cloud.google.com/compute/docs/instance-groups/autohealing-instances-in-migs Health checks used for autohealing should be conservative so they don't preemptively delete and recreate your instances. When an autohealer health check is too aggressive, the autohealer might mistake busy instances for failed instances and unnecessarily restart them, reducing availability

NEW QUESTION 10

You are using a single Cloud SQL instance to serve your application from a specific zone.
You want to
introduce high availability. What should you do?

• A. Create a read replica instance in a different region
• B. Create a failover replica instance in a different region
• C. Create a read replica instance in the same region, but in a different zone
• D. Create a failover replica instance in the same region, but in a different zone

Answer: B

Explanation:
https://cloud.google.com/sql/docs/mysql/high-availability

NEW QUESTION 11

For this question, refer to the Mountkirk Games case study.
Mountkirk Games' gaming servers are not automatically scaling properly. Last month, they rolled out a new feature, which suddenly became very popular. A record number of users are trying to use the service, but many of them are getting 503 errors and very slow response times. What should they investigate first?

• A. Verify that the database is online.
• B. Verify that the project quota hasn't been exceeded.
• C. Verify that the new feature code did not introduce any performance bugs.
• D. Verify that the load-testing team is not running their tool against production.

Answer: B

Explanation:
503 is service unavailable error. If the database was online everyone would get the 503 error.
https://cloud.google.com/docs/quota#capping_usage

NEW QUESTION 12

Auditors visit your teams every 12 months and ask to review all the Google Cloud Identity and Access Management (Cloud IAM) policy changes in the previous 12 months. You want to streamline and expedite the analysis and audit process. What should you do?

• A. Create custom Google Stackdriver alerts and send them to the auditor.
• B. Enable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor.
• C. Use cloud functions to transfer log entries to Google Cloud SQL and use ACLS and views to limit an auditor's view.
• D. Enable Google Cloud Storage (GCS) log export to audit logs Into a GCS bucket and delegate access to the bucket.

Answer: D

Explanation:
Export the logs to Google Cloud Storage bucket - Archive Storage, as it will not be used for 1 year, price for which is $0.004 per GB per Month. The price for long term storage in BigQuery is $0.01 per GB per Month (250% more). Also for analysis purpose, whenever Auditors are there(once per year), you can use BigQuery and use GCS bucket as external data source. BigQuery supports querying Cloud Storage data from these storage classes:
Standard Nearline Coldline Archive

NEW QUESTION 13

Your company is using BigQuery as its enterprise data warehouse. Data is distributed over several Google Cloud projects. All queries on BigQuery need to be billed on a single
project. You want to make sure that no query costs are incurred on the projects that contain the data. Users should be able to query the datasets, but not edit them.
How should you configure users’ access roles?

• A. Add all users to a grou
• B. Grant the group the role of BigQuery user on the billing project and BigQuerydataViewer on the projects that contain the data.
• C. Add all users to a grou
• D. Grant the group the roles of BigQuery dataViewer on the billing project andBigQuery user on the projects that contain the data.
• E. Add all users to a grou
• F. Grant the group the roles of BigQuery jobUser on the billing project and BigQuery dataViewer on the projects that contain the data.
• G. Add all users to a grou
• H. Grant the group the roles of BigQuery dataViewer on the billing project andBigQuery jobUser on the projects that contain the data.

Answer: A

Explanation:
Reference: https://cloud.google.com/bigquery/docs/running-queries

NEW QUESTION 14

You set up an autoscaling instance group to serve web traffic for an upcoming launch. After configuring the instance group as a backend service to an HTTP(S) load balancer, you notice that virtual machine (VM) instances are being terminated and re-launched every minute. The instances do not have a public IP address. You have verified the appropriate web response is coming from each instance using the curl command. You want to ensure the backend is configured correctly. What should you do?

• A. Ensure that a firewall rule exists to allow source traffic on HTTP/HTTPS to reach the load balancer.
• B. Assign a public IP to each instance and configure a firewall rule to allow the load balancer to reach the instance public IP.
• C. Ensure that a firewall rule exists to allow load balancer health checks to reach the instances in the instance group.
• D. Create a tag on each instance with the name of the load balance
• E. Configure a firewall rule with the name of the load balancer as the source and the instance tag as the destination.

Answer: C

Explanation:
https://cloud.google.com/vpc/docs/using-firewalls
The best practice when configuration a health check is to check health and serve traffic on the same port. However, it is possible to perform health checks on one port, but serve traffic on another. If you do use two different ports, ensure that firewall rules and services running on instances are configured appropriately. If you run health checks and serve traffic on the same port, but decide to switch ports at some point, be sure to update both the backend service and the health check.
Backend services that do not have a valid global forwarding rule referencing it will not be health checked and will have no health status.
References: https://cloud.google.com/compute/docs/load-balancing/http/backend-service

NEW QUESTION 15

The application reliability team at your company has added a debug feature to their backend service to send all server events to Google Cloud Storage for eventual analysis. The event records are at least 50 KB and at most 15 MB and are expected to peak at 3,000 events per second. You want to minimize data loss.
Which process should you implement?

• A. • Append metadata to file body.• Compress individual files.• Name files with serverName-Timestamp.• Create a new bucket if bucket is older than 1 hour and save individual files to the new bucke
• B. Otherwise, save files to existing bucket
• C. • Batch every 10,000 events with a single manifest file for metadata.• Compress event files and manifest file into a single archive file.• Name files using serverName-EventSequence.• Create a new bucket if bucket is older than 1 day and save the single archive file to the new bucke
• D. Otherwise, save the single archive file to existing bucket.
• E. • Compress individual files.• Name files with serverName-EventSequence.• Save files to one bucket• Set custom metadata headers for each object after saving.
• F. • Append metadata to file body.• Compress individual files.• Name files with a random prefix pattern.• Save files to one bucket

Answer: D

Explanation:
In order to maintain a high request rate, avoid using sequential names. Using completely random object names will give you the best load distribution. Randomness after
a common prefix is effective under the prefix https://cloud.google.com/storage/docs/request-rate

NEW QUESTION 16

Your company is running a stateless application on a Compute Engine instance. The application is used
heavily during regular business hours and lightly outside of business hours. Users are reporting that the application is slow during peak hours. You need to optimize the application’s performance. What should you do?

• A. Create a snapshot of the existing dis
• B. Create an instance template from the snapshot.Create anautoscaled managed instance group from the instance template.
• C. Create a snapshot of the existing dis
• D. Create a custom image from the snapsho
• E. Create an autoscaled managed instance group from the custom image.
• F. Create a custom image from the existing dis
• G. Create an instance template from the custom imag
• H. Create an autoscaled managed instance group from the instance template.
• I. Create an instance template from the existing dis
• J. Create a custom image from the instance template.Create an autoscaled managed instance group from the custom image.

Answer: B

Explanation:
https://cloud.google.com/compute/docs/instance-templates/create-instance- templates

NEW QUESTION 17

Google Cloud Platform resources are managed hierarchically using organization, folders, and projects. When Cloud Identity and Access Management (IAM) policies exist at these different levels, what is the effective policy at a particular node of the hierarchy?

• A. The effective policy is determined only by the policy set at the node
• B. The effective policy is the policy set at the node and restricted by the policies of its ancestors
• C. The effective policy is the union of the policy set at the node and policies inherited from its ancestors
• D. The effective policy is the intersection of the policy set at the node and policies inherited from its ancestors

Answer: B

Explanation:
Reference: https://cloud.google.com/resource-manager/docs/cloud-platform-resource- hierarchy

NEW QUESTION 18

You are designing an application for use only during business hours. For the minimum viable product release, you’d like to use a managed product that automatically “scales to zero” so you don’t incur costs when there is no activity.
Which primary compute resource should you choose?

• A. Cloud Functions
• B. Compute Engine
• C. Kubernetes Engine
• D. AppEngine flexible environment

Answer: A

Explanation:
https://cloud.google.com/serverless-options

NEW QUESTION 19

As part of implementing their disaster recovery plan, your company is trying to replicate their production
MySQL database from their private data center to their GCP project using a Google Cloud VPN connection.
They are experiencing latency issues and a small amount of packet loss that is disrupting the replication. What should they do?

• A. Configure their replication to use UDP.
• B. Configure a Google Cloud Dedicated Interconnect.
• C. Restore their database daily using Google Cloud SQL.
• D. Add additional VPN connections and load balance them.
• E. Send the replicated transaction to Google Cloud Pub/Sub.

Answer: B

NEW QUESTION 20
......