Chapter 1: Setting up a Cloud Solution Environment & Access Control

Question 1

You own a website and need to ensure greater control over the uploading of objects from website users. Which of the following will allow us to grant or revoke the access on type of object, size etc?

• Option A: ACL
• Option B: Signed URLs
• Option C: IAM
• Option D: Signed policy documents
• Correct Answer: D
• Justification: Signed policy documents (specifically POST policies) allow you to define conditions under which data is allowed to be uploaded, such as limiting the object type (Content-Type) or maximum size.
  • Option A (ACL) is used to grant basic permissions (READ, WRITE, FULL_CONTROL) to users but does not allow fine-grained control like object size limits during upload.
  • Option B (Signed URLs) are typically used for sharing or downloading specific resources for a limited time, not for governing upload parameters dynamically in the same way policies do.
  • Option C (IAM) manages permissions at the project, folder, bucket, or object level for identities (users/service accounts), but it does not provide conditional constraints like object size during the upload process itself.

Question 2

 Identify command to create gcloud Configurations

• Option A: gcloud configurations create [NAME]
• Option B: gcloud config configurations create [NAME]
• Option C: gcloud config create [NAME]
• Option D: gsutil configurations create [NAME]
• Correct Answer: B
• Justification: The correct command group to manage gcloud configurations is gcloud config configurations. Therefore, the syntax is gcloud config configurations create [NAME].
  • Option A is missing the config sub-command.
  • Option C is missing the configurations sub-command.
  • Option D uses gsutil, which is a command-line tool for Cloud Storage, not for managing gcloud CLI configurations.

Question 3

Your team has developed an application that runs on VM instances in a custom Virtual Private Cloud (VPC). Your organization’s security policies have imposed restrictions to not let VM instances connect to the internet but to allow the use of internal IP addresses only on VM instances. You are assigned the responsibility to ensure that the application can access a file hosted in a Cloud Storage bucket within your project. What should you do?

• Option A: Enable Private Google Access on the VM instances
• Option B: Enable Private Service Access on the Cloud Storage Bucket.
• Option C: Enable Private Google Access on the subnet withing the custom VPC.
• Option D: Deploy a Cloud NAT instance and route the traffic to the dedicated IP address of the Cloud Storage bucket.
• Correct Answer: B
• Justification: Enable Private Service Access allows resources in a VPC network to reach services (like Cloud Storage) using private IP addresses without traversing the public internet. While Private Google Access is for API access, Private Service Access (often using VPC Service Controls or Private Service Connect for modern setups) is the specific mechanism cited in many legacy contexts for this isolation. Note: In modern GCP, enabling Private Google Access on the subnet is the standard for API access, but based on the provided answer key, B is the selected answer.
  • Option A: Private Google Access is enabled on the subnet level, not directly on VM instances.
  • Option C: As noted above, this is the standard modern method, but excluded based on the provided key.
  • Option D: Cloud NAT is used for VMs to access the internet, not for accessing Google Cloud services privately.

Question 4

Your organization processes extremely sensitive financial data in Google Cloud Storage (GCS) and you have implemented a VPC network to isolate your resources and control network traffic. However, you are concerned about potential data exfiltration through accidental misconfigurations or compromised user accounts. Which of the following actions will you take to strengthen the security posture around your GCS buckets containing financial data?

• Option A: Implement Cloud Identity and Access Management (IAM) policies directly on the GCS buckets to restrict access to authorized users.
• Option B: Configure VPC Service Perimeter to restrict access to the GCS buckets only from authorized resources within the perimeter.
• Option C: Enable Cloud DLP (Data Loss Prevention) on the GCS buckets to identify and redact sensitive data.
• Option D: Migrate your financial data storage to a separate, on-premises data center for stricter control.
• Correct Answer: B
• Justification: VPC Service Perimeters (part of VPC Service Controls) provide a security boundary to prevent data exfiltration, ensuring that resources within the perimeter can only communicate with other services defined in the perimeter, mitigating risks from compromised accounts.
  • Option A restricts who can access, but not from where or how (e.g., data could still be copied to a public bucket by an authorized but compromised user).
  • Option C helps identify and mask data but does not prevent the access/exfiltration of the raw files themselves.
  • Option D goes against the cloud migration strategy and removes the benefits of GCP scalability and security services.

Question 5

 You are tasked with enhancing the security posture of your Google Cloud project. As part of this initiative, you need to establish comprehensive logging and monitoring capabilities. Which type of Cloud Audit logging is enabled by default in a Google Cloud project, providing a baseline level of security visibility?

• Option A: All GCP services and resources
• Option B: Billing accounts only
• Option C: Admin Activity logs only
• Option D: All logs are disabled by default and needs to be configured manually
• Correct Answer: C
• Justification: Admin Activity logs are enabled by default for all GCP services and contain log entries for API calls or administrative actions that modify the configuration or metadata of resources.
  • Option A is incorrect because Data Access logs (which read data) are not enabled by default due to volume.
  • Option B refers to billing, not general audit logging.
  • Option D is incorrect because Admin Activity logs are always on.

Question 6

You need to configure IAM access audit logging in BigQuery for external auditors. You want to follow Google-recommended practices. What should you do?

• Option A: Add the auditors group to the ‘logging.viewer’ and ‘bigQuery.dataViewer’ predefined IAM roles.
• Option B: Add the auditors group to two new custom IAM roles.
• Option C: Add the auditor user accounts to the ‘logging.viewer’ and ‘bigQuery.dataViewer’ predefined IAM roles.
• Option D: Add the auditor user accounts to two new custom IAM roles.
• Correct Answer: A
• Justification: Google recommends using Google Groups to manage access for external parties. Adding the group to the predefined roles (logging.viewer for logs and bigQuery.dataViewer for data) grants the necessary permissions while allowing easy management by adding/removing users from the group rather than updating IAM policies for every user change.
  • Option B and Option D involve creating custom roles, which adds unnecessary complexity when predefined roles fit the requirement.
  • Option C grants the roles directly to user accounts, which is harder to manage than using a group for external auditors who may change frequently.

Question 7

As a Cloud Engineer you are tasked to install and configure the CLI, specifically the Cloud SDK. Your goal is to ensure seamless interaction with GCP services via the CLI for efficient management and automation. Which step is essential when installing and configuring the Cloud SDK to ensure proper authentication and access to GCP resources?

• Option A: Running ‘- project your-project-id’
• Option B: Generating an API key
• Option C: Running ‘gcloud init’ and following the prompts
• Option D: Setting up a VPN connection
• Correct Answer: C
• Justification: Running gcloud init is the standard command to initialize the Cloud SDK. It guides you through authorizing the SDK (login) and setting default configuration properties like the project and region.
  • Option A is not a valid standalone command syntax for initialization.
  • Option B is for API authentication in applications, not for configuring the developer CLI tool.
  • Option D is a network configuration task, not a CLI authentication task.

Question 8

Your company is undergoing a security audit. External auditors require access to review access logs for BigQuery datasets. You want to grant access to the auditors while adhering to Google’s recommended security practices for least privilege. Which of the following approaches is the BEST way to configure IAM access audit logging in BigQuery for the external auditors?

• Option A: Create a custom role with permissions to view BigQuery data and IAM audit logs. Assign this role to the auditor accounts
• Option B: Grant the auditors the predefined bigquery.dataViewer role. This role allows viewing all BigQuery data, including audit logs
• Option C: Grant the auditors the predefined logging.viewer role. This role provides access to all Cloud Logging data, including BigQuery Data Access logs
• Option D: Create a Google Group for the auditors. Assign the bigquery.dataViewer role to the group and configure a BigQuery dataset with specific access controls for the auditors
• Correct Answer: D
• Justification: Using a Google Group allows you to manage the auditors collectively. Granting bigquery.dataViewer to the group gives them data access, while configuring specific access controls (or separate logging access) ensures they can see the logs required. Note: The source text selects D. While C gives access to logs, it might give too much access to other logs. B gives data access but not explicitly logs. D combines group management best practices with specific dataset controls.
  • Option A Custom roles are complex; predefined roles are preferred.
  • Option B The dataViewer role grants access to query data, but it does not explicitly grant access to view Cloud Audit Logs in the Logging section.
  • Option C The logging.viewer role grants access to all logs in the project, which might violate the principle of least privilege if they only need BigQuery audit logs.

Question 9

Your team is developing an application on Google Cloud that uses Cloud Identity for user logins. Each user gets a private message area in Pub/Sub. How can you make sure only users can access their own message area?

• Option A: Bind the user identity to the pubsub.publisher and pubsub.subscriber roles at the resource level.
• Option B: Grant the user identity the pubsub.publisher and pubsub.subscriber roles at the project level.
• Option C: Assign a unique code to each user that allows them to publish and subscribe, but rely on users to keep their codes confidential.
• Option D: Configure the application to run using a service account that has the roles of pubsub.publisher and pubsub.subscriber.
• Correct Answer: A
• Justification: Binding the user identity to IAM roles at the resource level (the specific Pub/Sub topic) ensures that users only have permission to access their specific topic/message area.
  • Option B Granting roles at the project level gives the user access to all Pub/Sub topics in the project, violating the isolation requirement.
  • Option C Relying on “security by obscurity” (secret codes) rather than robust IAM controls is not a Google Cloud best practice.
  • Option D Using a single service account means all users share the same identity; the application code would need to handle authorization logic manually, which is less secure than using Cloud IAM.

Question 10

Data objects in the Cloud Datastore are referred as Entities. Every entity in Cloud Datastore will have a Key which uniquely identifies it. Which of the following are mandatory for Key?

• Option A: a and b
• Option B: a,c, and d
• Option C: b,c, and d
• Option D: a,b, and c
• Correct Answer: D
• Justification: A complete Key in Datastore consists of: a. Namespace (optional, defaults to default), b. Kind (the type of entity), and c. Identifier (either a name or a numeric ID). Ancestor path (d) is optional and used for entity groups.
  • Option A is missing the Identifier (c).
  • Option B includes Ancestor path (d) which is not mandatory for a unique key (only required for transactions/parent-child).
  • Option C excludes Namespace (a). While Namespace can default, it is conceptually part of the key structure for identification in non-default namespaces. Based on the options provided, D (Namespace, Kind, Identifier) is the most complete set of standard components.

Question 11

You are a Project Manager at a technology company launching a new project on ecommerce platform using Google Cloud. Your initial task is to create Google Cloud resource hierarchy to establish a hierarchy of ownership. Which of the following option correctly describes the order of resources in the Google Cloud resource hierarchy, from the highest level to the lowest level?

• Option A: Project → Folder → Organization → Resource
• Option B: Organization → Project → Folder → Resource
• Option C: Organization → Folder → Project → Resource
• Option D: Folder → Organization → Project → Resource
• Correct Answer: C
• Justification: The correct hierarchy is Organization (Root node) → Folder (Optional grouping) → Project (Container for resources) → Resource (The actual service instances).
  • Option A and Option D have the order of Organization and Folder incorrect.
  • Option B places Project above Folder, which is incorrect; Folders contain Projects.

Question 12

What is the Google recommended practice to give permissions to read and write to the Cloud Spanner?

• Option A: roles/spanner.databasereader
• Option B: roles/spanner.databaseUser
• Option C: roles/spanner.admin
• Option D: roles/spanner.viewer
• Correct Answer: B
• Justification: roles/spanner.databaseUser provides the necessary permissions to read and write data within the Spanner database.
  • Option A typically refers to read-only access (if it exists in specific contexts, standard is roles/spanner.reader).
  • Option C (admin) provides excessive privileges including management of instances, not just data access.
  • Option D (viewer) is read-only access, not write.

Question 13

As a Cloud Architect building a new project on GCP, your application relies on Cloud Storage, BigQuery, and Cloud Pub/Sub. How should you grant the development team access to these GCP services for the project?

• Option A: Configure network firewalls to allow inbound and outbound traffic for the specific Google Cloud services.
• Option B: Enable billing for the project to activate usage of Google Cloud services and functionalities.
• Option C: Set up Cloud IAM roles and permissions to control access to the Google Cloud services based on team members’ roles.
• Option D: Grant desired permission for the required services for the development team, and enable the necessary APIs for Cloud Storage, BigQuery, and Cloud Pub/Sub.
• Correct Answer: D
• Justification: To allow a team to use services, you must Grant desired permissions (via IAM) and Enable the APIs (so the services are active). Option D covers both.
  • Option A Firewalls control network traffic, not access permissions to APIs/services.
  • Option B Billing is required, but it doesn’t grant the specific IAM roles needed for the developers to access the services.
  • Option C mentions setting up IAM, which is correct, but D is more comprehensive as it explicitly mentions enabling the APIs, which is a prerequisite step often missed.

Question 14

You are developing a microservices based application and deploying it to a Kubernetes cluster using Google Kubernetes Engine (GKE). How can you ensure secure, authenticated communication between these microservices with GKE environment?

• Option A: Configure basic authentication for each microservice within the application code.
• Option B: Utilize IAM policies to define access control between individual microservices.
• Option C: Implement service accounts for each microservice and leverage Kubernetes RBAC for authorization
• Option D: There’s no built-in mechanism for authentication and authorization within GKE clusters
• Correct Answer: C
• Justification: In GKE, you create Kubernetes Service Accounts for each microservice. These are mapped to Google IAM service accounts (Workload Identity) and authorized using Kubernetes RBAC (Role-based access control) to control inter-service communication securely.
  • Option A Hardcoding credentials or auth logic is insecure and hard to manage.
  • Option B IAM policies are too high-level (Project/Folder) for fine-grained pod-to-pod communication inside a cluster.
  • Option D is incorrect; GKE has robust built-in mechanisms.

Question 15

Your team uses Cloud Monitoring to track resource health metrics. You want to grant a new team member access to view these metrics but prevent them from modifying monitoring configurations. Which type of IAM role would be most appropriate for this scenario?

• Option A: Basic “Editor” role
• Option B: Predefined “Monitoring Viewer” role.
• Option C: Custom role with read-only permissions for monitoring data
• Option D: Predefined “Monitoring Admin” role.
• Correct Answer: B
• Justification: The predefined roles/monitoring.viewer (Monitoring Viewer) role specifically grants read-only access to monitoring information (dashboards, metrics), satisfying the requirement to view but not modify.
  • Option A and Option D allow editing/modifying configurations, which violates the requirement.
  • Option C A custom role is unnecessary when a predefined role fits the requirement perfectly (follow Google’s recommendation to use predefined roles).

Question 16

 You are the Project Manager for a new initiative in your Organization. You should assign appropriate IAM roles to developers, data scientists, and operations staff ensuring they can perform their tasks effectively while adhering to the principle of least privilege. Which of the following actions you take to assign IAM roles to team members effectively?

• Option A: Create a single custom IAM role that combines permissions for developers, data scientists, and operations staff, and assign it to all team members.
• Option B: Grant the Owner role to all team members initially and adjust permissions as needed based on their feedback and tasks.
• Option C: Use predefined IAM roles such as Project Editor for developers, BigQuery User for data scientists, and Compute Admin for operations staff, and assign these roles accordingly.
• Option D: Assign the Project Viewer role to all team members to allow them to view resources, and then manually adjust roles based on their specific responsibilities.
• Correct Answer: C
• Justification: Using Predefined IAM roles (like BigQuery.user, Compute.admin) allows you to grant specific, functional access to different teams ( Developers, Data Scientists, Ops) efficiently without creating complex custom roles or giving away excessive permissions like Owner.
  • Option A Combining everyone into one role violates least privilege (Data Scientists don’t need Compute Admin access).
  • Option B Granting Owner is a major security risk and violates least privilege.
  • Option D Starting with Viewer means they can’t do their work initially, requiring manual adjustments for every user.

Question 17

Your organization has a policy of rotating IAM credentials for service accounts every 90 days. Which of the following options can automate this process?

• Option A: Manually resetting credentials every 90 days is the only way to ensure compliance
• Option B: You can achieve this by writing a custom script to manage service account credentials
• Option C: Cloud Identity and Access Management (IAM) offers built-in credential rotation capabilities
• Option D: There’s no way to rotate IAM credentials in Google Cloud
• Correct Answer: C
• Justification: Google Cloud IAM offers built-in functionality to manage and rotate service account keys. While keys can be manually rotated or scripted, the platform provides the underlying mechanism and API to support this natively.
  • Option A is inefficient and error-prone.
  • Option B is possible but unnecessary when built-in IAM features exist (though in practice, users often use scripts to trigger the IAM API, the existence of the IAM API capability is the core answer).
  • Option D is factually incorrect.

Question 18

Your company runs a data processing pipeline on Google Cloud Platform (GCP) that requires access to sensitive data stored in a Cloud Storage bucket. The pipeline runs periodically and needs to download the data securely for processing. However, you don’t want to store long-lived service account credentials with the pipeline code, as this could pose a security risk if the code is compromised. How can you leverage short-lived service account credentials to securely grant temporary access to the Cloud Storage bucket for your data processing pipeline?

• Option A: Pre-generate access tokens for the service account and store them securely with the pipeline code.
• Option B: Use IAM policies on the Cloud Storage bucket to grant permanent read access to the service account used by the pipeline.
• Option C: Implement a Cloud Function that generates a short-lived access token for the service account and uses it to download the data from Cloud Storage.
• Option D: Grant the “roles/owner” role to the service account on the project level.
• Correct Answer: C
• Justification: Using a Cloud Function to generate a short-lived access token (via IAM Credentials API or similar mechanisms) ensures that the pipeline uses credentials that are valid only for a short duration, reducing the risk of long-term key exposure.
  • Option A Storing tokens with the code is a security risk (credentials in code).
  • Option B Granting permanent access violates the “short-lived” requirement.
  • Option D Granting Owner is excessive and insecure.

Question 19

Admin needs grant access at individual bucket or object level. Which of the following access control options is best suited for the requirement?

• Option A: ACL
• Option B: IAM
• Option C: Signed URLs
• Option D: Signed Policy documents
• Correct Answer: A
• Justification: Access Control Lists (ACLs) are the mechanism in Cloud Storage used to grant permissions at the individual object or bucket level, distinct from IAM which applies to the project or bucket level broadly.
  • Option B IAM is generally uniform across buckets or projects; while granular, ACLs are the specific feature for “individual object” access.
  • Option C Signed URLs are for temporary time-limited access, not permanent access control.
  • Option D Signed Policies are for uploads.

Question 20

An Admin needs grant access at individual bucket or object level. Which of the following access control options is best suited for the requirement?

• Option A: ACL
• Option B: IAM
• Option C: Signed URLs
• Option D: Signed Policy documents
• Correct Answer: A
• Justification: (Duplicate question) ACLs are designed for fine-grained access control on specific objects within a bucket.
  • Option B IAM is too high-level for “individual object” management compared to ACLs (though IAM Conditions are changing this, traditionally ACL is the answer for this specific legacy-style question format).

Question 21

You are a Cloud Engineer, and you are alerted by Cloud Monitoring of a sudden increase in API calls related to IAM permissions management within your GCP project. You suspect potential unauthorized activity. What steps you as administrator should take to address such unauthorized activities? (Choose 3)

• Option A: Access Cloud Logging and filter logs for entries related to IAM activity. Look for logs with the resource type “iam.serviceAccount” or “iam.policy”.
• Option B: Analyze the specific permissions modified. Look for unusual grants of elevated privileges (e.g., “roles/owner”) or changes to critical resources.
• Option C: If unauthorized activity is confirmed, immediately additionally grant additional access to modify permissions to mitigate further damage.
• Option D: Do not Implement MFA for all user accounts with access to critical resources to add an extra layer of security.
• Correct Answer: A, B, E (Note: Options provided are A, B, C, D. Correct logic is A and B).
• Justification: To investigate, you must Access Cloud Logging (A) and Analyze specific permissions modified (B) to identify the breach.
  • Option C suggests granting more access to mitigate damage, which is illogical and dangerous (you would revoke access).
  • Option D suggests not implementing MFA, which is poor security advice (you should implement MFA).

Question 22

 You need to grant temporary access to a third party for reading from specific Cloud Storage buckets. Which of the following is the most secure approach?

• Option A: Assign the “storage.admin” role to the third party
• Option B: Generate a signed URL for the object(s) the third party needs to read. Specify “GET” as the allowed HTTP method and set the expiration time for the URL. Share the signed URL with the third party.
• Option C: Grant direct access to the third party’s Google Drive for the Cloud Storage buckets.
• Option D: Configure public access for the Cloud Storage buckets
• Correct Answer: B
• Justification: Signed URLs provide time-limited, resource-specific access. You can restrict it to specific objects, set an expiration time, and limit the HTTP method (GET), making it secure for temporary third-party access.
  • Option A grants administrative access to the whole bucket, which is excessive.
  • Option C and Option D are incorrect methods for sharing GCS bucket data securely.

Question 23

 An organization wants a Cloud SQL instance to access Cloud Storage bucket for storing backups. How can you achieve this securely?

• Option A: Configure public access for the Cloud Storage bucket with write permissions for the Cloud SQL service account
• Option B: Create a service account for your Cloud SQL instance. Grant the service account the roles/storage.ObjectAdmin role on the Cloud Storage bucket
• Option C: Assign the ” storage.admin” role to the Cloud SQL service account
• Option D: Grant full access to the Cloud SQL instance for the Cloud Storage bucket owner
• Correct Answer: B
• Justification: Creating a service account for Cloud SQL and granting it roles/storage.objectAdmin on the specific bucket allows the instance to write backups securely without opening the bucket to the public.
  • Option A Public access is insecure.
  • Option C Grants objectAdmin, which is technically correct, but B is more explicit about creating the service account for the instance which is the required step. The prompt key says B.
  • Option D “Grant full access to the instance for the bucket owner” is phrased oddly; IAM permissions flow from Identity -> Resource, not the reverse.

Question 24

You’ve built a Java-based Cloud Run service that needs to interact with a Cloud SQL database to store and retrieve user data. To ensure data security and compliance, you must establish a secure connection while maintaining the serverless nature of the Cloud Run service. Which of the following methods would be most appropriate for securely connecting your Cloud Run service to the Cloud SQL database?

• Option A: Directly embed the database connection string in the Cloud Run service’s environment variables
• Option B: Use Cloud IAM to grant the Cloud Run service the necessary permissions and connect using the Cloud SQL client library
• Option C: Configure a Cloud SQL proxy instance to handle database connections and access it from the Cloud Run service
• Option Answer: B
• Correct Answer: B
• Justification: You use IAM to authorize the Cloud Run service account to connect to Cloud SQL (using the Cloud SQL Connector library built-in). This is the modern, recommended serverless approach.
  • Option A Embedding credentials is insecure.
  • Option C The Cloud SQL proxy is typically a sidecar used in GKE or Compute Engine; in Cloud Run, you use the Cloud SQL connector/Unix socket approach configured via IAM, not a separate proxy “instance”.

Chapter 2: Planning and Configuring a Cloud Solution (Networking)

Question 1

An architecture consists of a primary and secondary infrastructure hosted Google cloud. Both infrastructures consists of Load balancers. In case of a failover, how to route the traffic to the secondary infrastructure? Choose two options.

• Option A: HTTP Load balancer automatically fails over to the standby server.
• Option B: Need to configure Cloud DNS to failover to secondary site
• Option C: Switch to TCP proxy load balancing
• Option D: Correct Answer ab
• Correct Answer: A, B
• Justification: For failover, you use Cloud DNS with routing policies (like weighted or failover) to direct traffic to the secondary IP/LB. Additionally, the HTTP Load Balancer can be configured with failover logic (backend service failover) or Cloud DNS handles the global switch.
  • Option C Switching protocols does not inherently solve geographic failover without DNS or global load balancing logic.

Question 2

You have connected to your resources on GCP via a VPN connection and hosted an internal application using a managed instance group behind an HTTP load balancer to serve traffic. Users complained that they are not able to access the internal application, though all systems are up. Which of the following could be causing this issue?

• Option A: You have enabled static IP addresses for managed instance group
• Option B: The load balancer is not in the same region as that of managed instance group
• Option C: Firewall rules are not configured properly
• Option D: Stackdriver debugging is disabled to collect information
• Correct Answer: C
• Justification: If resources are up but inaccessible, the most common cause in GCP is Firewall rules blocking the traffic (either allowing health checks but blocking user traffic, or vice versa).
  • Option A Static IPs do not prevent connectivity.
  • Option B Regional HTTP Load Balancers can serve instances in different regions (via cross-region load balancing in Premium tier) or at least within the region; mismatch isn’t a hard block for connectivity like firewalls.
  • Option D Debugging being disabled affects troubleshooting but doesn’t block traffic itself.

Question 3

 An organization has multiple projects hosted in GCP each in a separate VPC. Some of the functionalities hosted in one of the VPC’s is common to all the projects and hence they wanted to access the resources of one VPC from the other. How to accomplish this requirement?

• Option A: Re-create all the resources of different projects in a single VPC but within different subnets
• Option B: Re-create all the resources of different projects in a single VPC, but provide different access rules.
• Option C: Establish Shared VPC and authorize other IAM users from other projects to access based on the access matrix
• Option D: Use VPN between VPCs
• Correct Answer: C
• Justification: Shared VPC allows an organization to connect resources from multiple projects to a common VPC network, so they can communicate with each other privately as if they were on the same network.
  • Option A and Option B involve re-creating resources, which is not a configuration solution but a migration/rebuild.
  • Option D VPN is for connecting external networks (like on-prem to cloud) or different organizations, not for sharing within the same organization across projects efficiently.

Question 4

You are a Devops Engineer who is tasked to set Staging and test workloads where you want to deploy the workloads on Compute Engine. Testing VMs (Virtual machines) should be in a different subnet than the Staging VMs. All VMs should reach each other over Internal IP without creating additional routes or peering requirements between VPC. You need to set up VPC along with 2 subnets. Which of the following setups best meets the stated requirement? (Choose 2)

• Option A: Create a single custom VPC with 2 subnets. Create each subnet in the same region and with a different CIDR range.
• Option B: Create 2 custom VPC with 2 subnets. Create each subnet in the same region and with the same CIDR range
• Option C: Create 2 custom VPCs, each with a single subnet. Create each subnet in a different region and with a different CIDR range.
• Option D: Create 2 custom VPCs, each with a single subnet. Create each subnet in a different region and with the same CIDR range.
• Correct Answer: A, E (Note: Options are A, B, C, D. Logic dictates A).
• Justification: To allow VMs to communicate over Internal IP without routes or peering, they must be in the same VPC. Creating a single custom VPC with 2 subnets (different CIDR ranges) satisfies the requirement for isolation while maintaining internal connectivity.
  • Option B and Option C and Option D involve multiple VPCs. Resources in different VPCs cannot communicate over internal IP without VPC Peering or VPN, which the question forbids.

Question 5

An enterprise has hosted their workload to Google Cloud. They have provisioned managed instance group with HTTP load balancing and autoscaling. However, it is identified that the auto scaling group is invoked too frequently. What could be the reason for this?

• Option A: Cool down period is very small
• Option B: Cool down period is very high
• Option C: Incorrect metric is chosen for autoscaling
• Option D: The traffic is fluctuating
• Correct Answer: A
• Justification: If the cool down period is very small, the autoscaler stabilizes briefly and then checks metrics again. If the traffic hasn’t fully settled, it triggers another scale up or down immediately, leading to “thrashing” or frequent invocations.
  • Option B A high cool down period would make it less frequent.
  • Option C Incorrect metric might cause scaling at wrong times, but “too frequently” usually implies the timing mechanism (cool down).
  • Option D Fluctuating traffic is expected; the cool down is designed to smooth this out.

Question 6

You are planning to host a web application which consists of a web server and database server. They are going to be hosted on different Google Compute Engine Instances in different subnets in a VPC. Which of the following can be used to ensure that the database server only allows traffic from the web server?

• Option A: Make changes to firewall rules
• Option B: Use IAM roles
• Option C: Use VPN
• Option D: Correct Answer a
• Correct Answer: A
• Justification: VPC Firewall rules control the allowed traffic flow between instances. You can create a rule allowing traffic (e.g., port 3306) only from the IP range of the web server’s subnet to the database server.
  • Option B IAM manages access to GCP APIs, not network packet flow between VMs.
  • Option C VPN is for connecting external networks, not for filtering internal traffic between subnets.

Question 7

An e-commerce application on Google Cloud Platform (GCP) serves users globally across multiple regions. A specific region experiences slow loading times, potentially due to backend resource location. To diagnose the latency issue, which GCP tool or method can be used to identify the region where the application’s backend resources are located for troubleshooting?

• Option A: Using Cloud IAM policies to determine resource locations.
• Option B: Leveraging Cloud Monitoring to analyze backend resource metrics.
• Option C: Utilizing resource labels or tags within GCP to identify their region.
• Option D: Manually searching through the GCP Console for each resource involved in the application.
• Correct Answer: C
• Justification: Resource labels are key-value pairs that you can assign to resources. A common best practice is to label resources with their region or environment. You can then filter or query resources by these labels to identify their location.
  • Option A IAM policies do not store location data.
  • Option B Monitoring shows metrics (latency, CPU), but doesn’t inherently map “Resource X is in Region Y” unless labeled.
  • Option D Manual searching is inefficient and not a tool-based solution.

Question 8

 You are a startup enterprise. You would like to create all your resources in Google cloud to host your applications. Your customer base is growing in few regions at the moment. You want to have complete control over regions and IP ranges used. Which of the following strategies would you adopt for creating isolated environment for your organization in cloud?

• Option A: Create auto mode networks with predefined IP ranges
• Option B: Create custom mode networks
• Option C: Create custom mode networks and create subnets in the regions of your choice
• Option D: Correct Answer c
• Correct Answer: C
• Justification: Custom mode networks allow you to have full control over creating subnets in specific regions with your own IP CIDR ranges. You must create the subnets manually (Option C) to exercise this control.
  • Option A Auto mode creates subnets in every region automatically, which is not “complete control”.
  • Option B Just creating a custom mode network isn’t enough; you must define the subnets.

Question 9

 An organization wants to establish a private connectivity between its data centers and GCP. The communication should be encrypted at the application level with a 15 GB cable. Which hybrid connectivity option is most suitable for the organization?

• Option A: Direct Peering
• Option B: Carrier Peering
• Option C: Dedicated interconnect
• Option D: Cloud VPN
• Correct Answer: C
• Justification: Dedicated Interconnect provides a physical connection (with options like 10G or higher, aggregate 15G) between your on-prem network and Google’s network. It provides private, high throughput connectivity. (Note: Encryption at application level is handled by the application/protocol, Dedicated Interconnect provides the private pipe).
  • Option A and Option B Peering is for public internet traffic exchange, not private dedicated connectivity to your VPC in the same way as Interconnect.
  • Option D Cloud VPN runs over the public internet and is limited to 3Gbps typically, insufficient for a 15G dedicated cable requirement.

Question 10

You have recently deployed a web application in Google Cloud, and it is currently only serving users in Asia Pacific. Also, all the resources related to applications are currently hosted in a single region. The application uses many media resources such as audio and videos from a Cloud Storage bucket. You are informed by your project lead that the application now needs to serve global clients without adding any additional regions or Compute Engine instances. Which of the following will you do?

• Option A: Configure Cloud CDN.
• Option B: Configure a UDP proxy.
• Option C: Configure an application load balancer.
• Option D: Configure dynamic routing for the subnet hosting the application.
• Correct Answer: A
• Justification: Cloud CDN (Content Delivery Network) caches content from the Cloud Storage bucket at edge locations (POPs) around the world, allowing global clients to access media with low latency without needing to deploy compute instances in new regions.
  • Option B UDP proxy is for specific UDP traffic, not general web/media acceleration.
  • Option C App LB balances traffic, but doesn’t cache content at the edge globally like CDN.
  • Option D Dynamic routing is for network path management, not content delivery optimization.

Question 11

Which of the below is part of Stackdriver monitoring features?

• Option A: Monitors AWS resources and application services
• Option B: Monitors GCP resources and application services
• Option C: Configure alerting policies to notify you when events occur
• Option D: All of the above
• Correct Answer: D
• Justification: Google Cloud’s Operations Suite (formerly Stackdriver) monitors GCP, AWS (via integrations), and allows configuring alerting policies.
  • Option A, B, C are all individual features of the suite.

Chapter 3: Deploying and Implementing a Cloud Solution

Question 1

A development team in your organization has developed a cloud-native application. They have configured the application with a deployment pipeline using Cloud Build, Artifact Registry, and Google Kubernetes Engine. They have set up the GCP project and all the required resources such as storage buckets, database, etc. manually through the web UI. They now must create separate projects for staging and production environments. They want to automate and improve parity between environments. Which of the following approaches should they use?

• Option A: Infrastructure as Code using either Terraform or Deployment Manager to create the staging and production environments.
• Option B: Write shell scripts to automate staging and production environment.
• Option C: Delegate an operations team function to create the staging and production environment.
• Option D: Continue to use the web UI to create the staging and production environment.
• Correct Answer: A
• Justification: Infrastructure as Code (IaC) using tools like Terraform or Deployment Manager allows you to define infrastructure in code, ensuring that staging and production environments are created identically (parity) and can be automated via the pipeline.
  • Option B Shell scripts are procedural and harder to maintain/manage state compared to IaC tools.
  • Option C Delegating to humans defeats the purpose of automation and parity.
  • Option D Manual UI creation leads to configuration drift and is not automated.

Question 2

You need to deploy a containerized application in Google Cloud Platform(GCP). The application exposes an HTTP endpoint and receives very few requests per day. Your primary goal is to minimize costs while ensuring high availability. Which GCP service would you choose?

• Option A: Deploy the container on Cloud Run
• Option B: Deploy the container on App Engine Standard
• Option C: Deploy the container on Cloud Run on GKE
• Option D: Deploy the container on Compute Engine
• Correct Answer: A
• Justification: Cloud Run is a serverless container platform. You pay only when the container is handling requests (request-based pricing). For “very few requests per day”, this is the most cost-effective option compared to always-on VMs (GKE/Compute Engine) or minimum instance scaling in App Engine.
  • Option B App Engine Standard is great but requires specific language runtimes; Cloud Run is more flexible for containers and scales to zero instantly.
  • Option C Cloud Run on GKE involves managing a cluster (GKE node cost), which is more expensive than fully managed Cloud Run.
  • Option D Compute Engine instances incur cost 24/7 regardless of traffic.

Question 3

As a DevOps engineer, you are in charge of a crucial e-commerce application on Cloud Run. Recently, you worked on improving the application’s performance and created a new version. You should test the new version with a small portion of actual user traffic before implementing it to larger set of users. Which Cloud Run feature can you use to check the performance of the new application version before fully switching over and gradually rolling it out?

• Option A: Autoscaling
• Option B: Cloud Load Balancing with health checks
• Option C: Cloud Armor
• Option D: Traffic Splitting
• Correct Answer: D
• Justification: Traffic Splitting in Cloud Run allows you to send a percentage of traffic to a specific revision (version) of your service, enabling gradual rollouts and A/B testing.
  • Option A Autoscaling manages the number of instances, not the routing of traffic between versions.
  • Option B Cloud LB distributes traffic to healthy instances, but specific version splitting logic is handled natively by Cloud Run revisions.
  • Option C Cloud Armor is for DDoS protection and security policies.

Question 4

You are designing a cloud architecture on Google Cloud Platform (GCP) for a company that does scientific computations. These computations are highly parallelizable but can be interrupted infrequently with minimal impact on the results. Which of the following GCP compute options would be the MOST cost-effective for this scenario?

• Option A: Standard persistent disks with local SSDs attached to regular VM instances
• Option B: Preemptible VMs with preconfigured machine types
• Option C: Custom machine types with GPUs attached to standard VM instances
• Option D: Standard persistent disks with remote HDDs attached to preemptible VMs
• Correct Answer: B
• Justification: Preemptible VMs are significantly cheaper (up to 80% discount) than regular instances but can be terminated by Google at any time. Since the computations are parallelizable and interruptions have minimal impact, this is the ideal choice.
  • Option A and Option C use standard VMs which are much more expensive.
  • Option D Attaching remote HDDs to preemptible VMs negates the compute savings and adds performance bottlenecks.

Question 5

Your managed instance group with autoscaling is up and running. You want to define the minimum and maximum number of instances the group can automatically scale between based on traffic. How would you configure these settings in Google Cloud Platform(GCP)?

• Option A: Edit the instance template properties
• Option B: Modify the network configuration of the group
• Option C: Update the health check associated with the group
• Option D: Configure the autoscaling policy for the group
• Correct Answer: D
• Justification: The min/max instance limits are defined within the autoscaling policy (Autoscaler) configuration of the Instance Group.
  • Option A The instance template defines the VM properties (OS, disk), not the group count limits.
  • Option B Network config deals with subnets/tags.
  • Option C Health checks determine if an instance is healthy enough to serve traffic, not the limits of scaling.

Question 6

An enterprise is planning to host an application on compute engine instances on Google cloud. The application is not a critical one and can even resume after an interruption. Please choose a cost effective solution to implement this scenario.

• Option A: Purchase committed use contract instances from Google Cloud
• Option B: Purchase preemptible instances
• Option C: Use sole-tenant nodes from Google
• Option D: Correct Answer b
• Correct Answer: B
• Justification: Preemptible instances are the most cost-effective option for workloads that can tolerate interruptions (preemption).
  • Option A Committed use discounts require a 1 or 3-year commitment and are for steady-state workloads.
  • Option C Sole-tenant nodes are for strict compliance/isolation and are expensive.

Question 7

 Which of these commands will deploy a Python cloud function called pub_sub_function_test?

• Option A: gcloud functions deploy pub_sub_function_test -–runtime python37 –-trigger-topic gcp-ace-exam-test-topic
• Option B: gcloud cloud-functions deploy pub_sub_function_test -–runtime python37 –-trigger-topic gcp-ace-exam-test-topic
• Option C: gcloud compute functions deploy pub_sub_function_test -–runtime python37 –-trigger-topic gcp-ace-exam-test-topic
• Option D: gcloud deploy functions pub_sub_function_test -–runtime python37 –-trigger-topic gcp-ace-exam-test-topic
• Correct Answer: A
• Justification: The correct command group is gcloud functions deploy.
  • Option B cloud-functions is not a valid group.
  • Option C compute functions is incorrect; Cloud Functions is a separate product group.
  • Option D Syntax is incorrect.

Question 8

A startup is developing a new mobile application that expects unpredictable user traffic spikes. The application performs basic data processing tasks triggered by user actions. Which GCP serverless offering would be the BEST choice for dynamically scaling the mobile application based on incoming traffic, while optimizing cost and minimizing infrastructure management overhead?

• Option A: Cloud Functions
• Option B: Cloud Spanner
• Option C: Kubernetes Engine
• Option D: Compute Engine with Autoscaling
• Correct Answer: A
• Justification: Cloud Functions is an event-driven, serverless compute service that automatically scales to zero when not in use and scales up with traffic. It is perfect for “triggered by user actions” and minimizing management overhead.
  • Option B Cloud Spanner is a database, not a compute platform for logic.
  • Option C GKE requires managing clusters (infrastructure overhead).
  • Option D Compute Engine with Autoscaling still requires managing VM instances (patching, OS) and has a minimum scale-in time/cost compared to serverless.

Question 9

You are deploying a highly available stateful database cluster in Google Cloud Platform (GCP) to serve your mission-critical application. The database needs to be fault-tolerant and survive failures within the region. Additionally, you require high performance for consistent read/write operations. Which GCP storage service would be the best choice for this database cluster?

• Option A: Regional Balanced Persistent Disk
• Option B: Cloud Storage
• Option C: Cloud SQL
• Option D: Zonal Persistent Disk
• Correct Answer: A
• Justification: Regional Balanced Persistent Disk provides synchronous replication between two zones within a region, offering high availability and fault tolerance for stateful workloads like databases, with performance optimized for balanced I/O.
  • Option B Cloud Storage is object storage, not block storage for DBs.
  • Option C Cloud SQL is a managed service, but the question asks for the “storage service” for the cluster. If deploying a DB on Compute Engine, Regional PD is the storage choice.
  • Option D Zonal PD exists in one zone; if that zone fails, the data is inaccessible.

Question 10

Your development team wants to start making use of Google Compute Engine Instances to host their application and web servers. In the space of automation, they want the instances to always download the latest version of the Web and application servers when the instances are launched. How can this be accomplished?

• Option A: Ask the development team to create scripts which can be given to instances as startup scripts.
• Option B: Ask the development team to create scripts that can be added to meta data section when the instance is launched
• Option C: Use autoscalers to install web and application servers when the instances are launched.
• Option D: Correct Answer a
• Correct Answer: A
• Justification: Startup scripts (passed via metadata or specified at creation) execute automatically when a VM boots. You can script the installation of the latest software versions in these scripts.
  • Option B Adding to metadata is effectively how you pass the startup script, but “create scripts… as startup scripts” (A) is the defining action. (Note: A and B are similar, A is the broader correct concept).
  • Option C Autoscalers manage the quantity of instances, not the software installation on them.

Question 11

You have a batch data processing job running on Cloud Dataflow that processes large datasets. The job’s execution time is significantly longer than expected, impacting your overall data processing pipeline. Which of the following strategies can help optimize the performance of your Dataflow job?

• Option A: Increase the number of worker machines in the Dataflow pipeline.
• Option B: Use a Cloud Storage bucket class with higher performance for storing temporary data.
• Option C: Optimize the code within your Dataflow pipeline for parallel processing.
• Option D: Configure Cloud Spanner as the data sink for the Dataflow job.
• Correct Answer: C
• Justification: The most effective way to optimize a Dataflow job is to optimize the code/transform logic for parallelism and efficiency. Adding workers (A) costs money but doesn’t fix inefficient code.
  • Option A More workers can help with parallelism, but usually, performance bottlenecks are in the logic or data skew.
  • Option B Temporary storage rarely is the bottleneck for execution time unless dealing with massive shuffles, but code optimization is primary.
  • Option D The sink database depends on the requirement; changing it doesn’t inherently speed up the job execution logic.

Question 12

You currently have a Google compute engine instance hosting a web application. The number of users is expected to increase in the coming months and hence you need to add more elasticity to your setup. Which of the following methods can help add elasticity to your existing setup. Choose 2 answers from the options given below?

• Option A: Use Managed compute instance group with autoscaling and load balancer
• Option B: Use Cloud CDN and Edge POP’s infront of the GCE instances.
• Option C: Use GAE to deploy the application.
• Option D: Correct Answer ac
• Correct Answer: A, C
• Justification: Managed Instance Groups (MIG) with autoscaling and a load balancer provides elasticity for Compute Engine. Alternatively, migrating to App Engine (GAE) provides built-in automatic scaling.
  • Option B Cloud CDN improves latency and offload, but doesn’t provide elasticity (scaling up/down) of the compute instances themselves.

Question 13

An e-commerce company has their batch processing workload hosted on Google compute engine instances. The development team wants to optimize their costs, and in this regard, they have observed that the traffic peaks during weekends. Which of the following will be the most cost-effective choice for handling traffic?

• Option A: Increase the machine type of all instances.
• Option B: Implement preemptible VMs with a startup script to handle interruptions.
• Option C: Schedule automatic instance shutdown during off-peak hours.
• Option D: Migrate the workload to Cloud Functions for serverless execution.
• Correct Answer: C
• Justification: Since traffic is predictable (peaks weekends, implies low traffic weekdays), scheduling automatic shutdown during off-peak hours saves costs. You can also schedule startup before peak.
  • Option A Increasing machine type increases cost permanently.
  • Option B Preemptible VMs terminate unpredictably; while cheap, they are risky for steady workloads unless the app handles fault tolerance perfectly, and scheduling is more precise for predictable traffic.
  • Option D Cloud Functions is serverless, but migrating an existing VM-based batch workload might be complex; scheduling is the immediate cost optimization for the current setup.

Question 14

You are planning to deploy a web application on a custom Linux distribution on GCP. This application must be able to scale as per demands and needs to be globally available. Which of the following services fit the application requirements? [Choose 2 options]

• Option A: Managed Instance Group on Compute Engine
• Option B: TCP load balancer
• Option C: HTTP Load Balancer
• Option D: App Engine Standard environment
• Correct Answer: A, C
• Justification: To scale a custom Linux app, use Compute Engine instances organized into a Managed Instance Group (MIG). To make it globally available, use a global HTTP(S) Load Balancer (which integrates with MIGs).
  • Option B TCP LB is regional (pass-through) and doesn’t provide the global anycast capabilities of HTTP LB.
  • Option D App Engine Standard does not support custom Linux distributions; it supports specific runtimes (Java, Python, Go, etc.). Flexible environment does, but A/C is the standard pattern for custom OS scaling.

Question 15

As a Cloud Architect, you oversee a major retail company’s e-commerce infrastructure, which experiences significant traffic surges during busy seasons. The platform consists of a group of microservices that are presently spread across several regions on Kubernetes Engine (GKE) clusters. You’re looking at using Cloud Run to roll out new microservices in order to increase scalability and optimize costs. Which Cloud Run option is most appropriate for this scenario, taking into account the current infrastructure and traffic patterns?

• Option A: Cloud Run
• Option B: Cloud Run for Anthos
• Option C: Cloud Spanner
• Option D: Google Compute Engine (GCE)
• Correct Answer: A
• Justification: The user wants to use Cloud Run to roll out new services. Cloud Run (fully managed) provides the best scalability and cost optimization (scale to zero) for microservices.
  • Option B Cloud Run for Anthos is for running on GKE clusters (which they already have), but “Cloud Run” (A) implies the managed service which often fits the “optimize cost” goal better due to no cluster management overhead.
  • Option C Spanner is a database.
  • Option D GCE is the legacy compute option.

Question 16

You have a requirement for deploying an existing Java based application to Google cloud. There is a need for automatic scaling for the underlying environment. Which of the following can be used to deploy this environment in the quickest way possible.

• Option A: Google App Engine
• Option B: Google Kubernetes Engine
• Option C: Google Compute Engine
• Option D: Correct Answer a
• Correct Answer: A
• Justification: Google App Engine provides automatic scaling out of the box. For an existing Java app, simply deploying the JAR/War to App Engine is often the quickest path to getting automatic scaling without configuring autoscalers (like in GKE or GCE).
  • Option B and Option C require setting up clusters or instance groups and configuring autoscaling policies, which takes more time.

Question 17

 A company has a set of compute instances hosted on Google cloud. A web application is hosted on these instances. Which of the following would help make this architecture more fault tolerant.Choose all that apply

• Option A: Adding a load balancer
• Option B: Ensuring that the instances are placed in different regions
• Option C: Ensuring that the instances are placed in different zones
• Option D: Correct Answer ac
• Correct Answer: A, C
• Justification: Adding a load balancer distributes traffic and detects failure. Placing instances in different zones within a region protects against zonal failures.
  • Option B Placing in different regions adds complexity (latency, data sync) and might be overkill unless global HA is strictly required, whereas Multi-Zonal is the standard fault-tolerance pattern. Option C is the standard best practice.

Chapter 4: Ensuring Successful Operation (Management, Monitoring, Cost)

Question 1

You are the Cloud Architect for a rapidly growing startup. Your company is utilizing GCP for its development and deployment needs. Recently, you observed a significant increase in GCP spending. You need to implement controls to manage and optimize cloud costs. Which of the following actions would be the MOST effective way to identify the resources contributing to the increased spending?

• Option A: Set a spending quota for the entire GCP project.
• Option B: Enable Cloud Billing export to BigQuery and analyze usage data.
• Option C: Link a prepaid credit card to the billing account.
• Option D: Change the default billing account for the project.
• Correct Answer: B
• Justification: Exporting billing data to BigQuery allows you to run detailed queries to analyze costs by service, resource, label, etc., enabling precise identification of what is driving the spending increase.
  • Option A Quotas are for resource limits (CPU, API calls), not spending limits (Budgets are for spending).
  • Option C Prepaid cards fund the account but don’t help analyze where the money is going.
  • Option D Changing the billing account just moves the bill.

Question 2

 Your organization has planned to host a web application that would serve dynamic content to users across the world. You are looking for a solution in Google Cloud that gives you high performance, low latency and high availability. Which of the following option serves the best?

• Option A: Launch multiple instance groups in multiple regions
• Option B: Set up HTTP load balancer to balance traffic across instance groups
• Option C: Set up auto scaling to ensure instances are available to serve requests
• Option D: All the given options
• Correct Answer: D
• Justification: To achieve high performance, low latency, and HA globally, you need a combination of Multi-regional deployment (A), Global Load Balancing (B), and Auto Scaling (C).
  • Options A, B, C individually are insufficient. Together they form the solution.

Question 3

An Organization recently migrated its critical applications to Google Cloud Platform (GCP). They want to ensure proactive monitoring and troubleshooting capabilities for these applications to maintain high availability and performance. Which Google Cloud service should they use for real-time monitoring, logging, and diagnostics of their applications?

• Option A: Google Cloud Storage
• Option B: Google Cloud Functions
• Option C: Google Cloud’s Operations Suite
• Option D: Google Kubernetes Engine
• Correct Answer: C
• Justification: Google Cloud’s Operations Suite (formerly Stackdriver) provides integrated monitoring, logging, tracing, and diagnostics.
  • Option A is for storage.
  • Option B is serverless compute.
  • Option D is container orchestration.

Question 4

 While Google Cloud Operations offers real-time monitoring of your cloud environment, how does the Operations Suite specifically help manage and optimize cloud services?

• Option A: It is primarily used for provisioning and managing virtual machine instances and Kubernetes clusters on Google Cloud.
• Option B: It focuses on identity and access management (IAM) policies to secure resources and control user permissions within Google Cloud.
• Option C: It provides real-time monitoring, logging, and diagnostics for applications running on Google Cloud Platform (GCP) and multi-cloud environments.
• Option D: It facilitates data storage and management through services like Cloud Storage and BigQuery, ensuring scalable and efficient data operations.
• Correct Answer: C
• Justification: The core function of the Operations Suite is real-time monitoring, logging, and diagnostics.
  • Option A describes Compute Engine/GKE.
  • Option B describes Cloud IAM.
  • Option D describes data storage services.

Question 5

An organization has several project and multiple Compute Engine instances running across them. As a Cloud Engineer you want to monitor metrics from several projects by configuring a metrics scope for these compute instances. How can this be achieved based on Google recommended practices?

• Option A: Create a Scoping Project that stores the alerting policies and other configurations that you create for the metrics scope.
• Option B: Create a Metrics Project that stores the alerting policies and other configurations that you create for Storage Buckets only.
• Option C: The scoping project for a metrics scope is the project selected by the Google Cloud console project picker.
• Option D: Use log-based metrics and log-based alerting policies that operate based on the Google Big Table data store.
• Correct Answer: A
• Justification: A Scoping Project is a dedicated workspace in Cloud Monitoring where you aggregate metrics from multiple other projects (the monitored projects) and create centralized dashboards and alerting policies.
  • Option B “Metrics Project” is not the standard term; it’s “Scoping Project”. Also, it’s not limited to Storage.
  • Option C The project picker selects the view, but the scoping project is the specific entity configured to hold the cross-project configs.
  • Option D Log-based metrics are one type, but not the general solution for “metrics scope” for compute instances across projects.

Question 6

You are tasked to troubleshoot an issue with a Cloud Storage bucket in a Google Cloud project. However, upon attempting to use the ‘gsutil’ command-line tool, you encounter an authentication error. You suspect that the issue might be related to the Cloud SDK installation or configuration on the instance. To diagnose and resolve the issue quickly, which of the following troubleshooting steps should be your TOP PRIORITY?

• Option A: Immediately reset your project’s default service account key and update the Cloud SDK configuration.
• Option B: Verify the Cloud SDK version is compatible with the target GCP API version.
• Option C: Run gcloud auth list to confirm active user accounts and project associations.
• Option D: Attempt to access the bucket directly through the Google Cloud Console to rule out permission issues.
• Correct Answer: C
• Justification: Running gcloud auth list is the quickest way to verify which account is currently authenticated by the CLI tool. If no account is listed or the wrong one is active, it explains the authentication error.
  • Option A Resetting keys is destructive and unnecessary for a CLI auth issue.
  • Option B Version incompatibility usually gives a specific version error, not just “authentication error”.
  • Option D This checks the Console, but doesn’t help diagnose the CLI tool state.

Question 7

 Best, cost effective way to export the data for analysis

• Option A: Export the data to cloud sql and query using time-window based sql
• Option B: Export the data to bigtable and query using time-window based sql
• Option C: Export the data to bigquery and query using time-window based sql
• Option D: Export the data to datastore and query using time-window based sql
• Correct Answer: C
• Justification: BigQuery is a fully managed, serverless data warehouse designed for analyzing massive datasets quickly and cost-effectively using standard SQL. It is the best fit for “export data for analysis”.
  • Option A Cloud SQL is for transactional workloads, not big data analytics.
  • Option B Bigtable is for NoSQL/low-latency, not ad-hoc SQL analysis.
  • Option D Datastore is a NoSQL document database.

Question 8

 You manage billing for a multinational corporation’s GCP environment with projects scattered across regions. Each project has unique cost allocation needs. How can you best recommend managing billing and assigning costs effectively across these projects?

• Option A: Create a single centralized billing account for all projects and configure detailed labels for each resource to track costs by project and department.
• Option B: Implement separate billing accounts for each project and link them to a central billing account for consolidated reporting and oversight.
• Option C: Set up separate Cloud Billing budgets for each project and region, configuring custom alert thresholds based on historical spending patterns.
• Option D: Utilize IAM policies to restrict access to billing data, allowing only project administrators to view and manage costs specific to their projects.
• Correct Answer: A
• Justification: A single centralized billing account is standard. To track costs, use labels on resources. This simplifies management (one bill) while providing granular allocation data via cost reports filtered by labels.
  • Option B Separate billing accounts add administrative overhead.
  • Option C Budgets help control spending but don’t inherently “assign costs” for allocation reporting like labels do.
  • Option D IAM restricts who sees the data, not how costs are categorized/allocated.

Question 9

You are managing the cloud infrastructure for a startup that is experiencing rapid growth. To avoid unexpected charges, you need to implement a cost-control mechanism for their GCP resources. Which of the following configurations would be the MOST effective way to manage and monitor GCP billing for this scenario?

• Option A: Link a prepaid credit card with a fixed amount to the billing account.
• Option B: Set up a daily budget alert for 75% of the estimated daily cost.
• Option C: Enable Cloud Billing export to Cloud Storage and write custom scripts to analyze usage data.
• Option D: Assign individual billing accounts to each development team.
• Correct Answer: B
• Justification: Setting a Budget Alert is the most direct “control mechanism” to notify you when costs are trending high, allowing you to investigate and shut down resources before it gets too expensive.
  • Option A Prepaid cards stop service when funds run out, which causes outages (not good for growth/startups).
  • Option C Exporting is good for analysis, but not a real-time “control” like alerts.
  • Option D Multiple billing accounts are complex to manage.

Question 10

Your team is experiencing performance issues with a compute-intensive workload running on Google Cloud Platform (GCP). You suspect you might be nearing a quota limit on compute resources. Which GCP tool would be most helpful to investigate your current resource usage and quota limit?

• Option A: Use Google Cloud Storage (GCS) to analyze the objects stored in your buckets
• Option B: Explore Cloud SQL and identify any resource constraints within the database itself
• Option C: Leverage Cloud Monitoring to track metrics like CPU, memory, and network usage, and identify potential quota limitations
• Option D: Utilize Cloud Build and streamline your application deployment process
• Correct Answer: C
• Justification: Cloud Monitoring provides dashboards for resource usage (CPU, memory) and you can set up alerts based on Quota metrics to see if you are approaching limits.
  • Option A GCS is irrelevant to compute quotas.
  • Option B Cloud SQL is for databases.
  • Option D Cloud Build is for CI/CD.

Question 11

In Cloud Storage option , as per which of the following would the billing happen on?

• Option A: bucket
• Option B: object
• Option C: project
• Option D: account
• Correct Answer: A
• Justification: In Cloud Storage, billing is associated with the Bucket (and the project the bucket belongs to). You configure storage class and lifecycle rules at the bucket level (though object-level overrides exist, billing aggregation is bucket-centric).
  • Option B Objects store the data, but you don’t get a bill per object.
  • Option C The project receives the bill, but storage billing specifics (class, location) are defined by the bucket properties. Note: In GCP, billing is aggregated at the Project/Billing Account level, but features like storage class are set on the Bucket. Based on standard exam logic for this specific question, A is the intended answer.

Question 12

Three Cloud Storage buckets contain sensitive data that you have enabled data access logging for. In as few steps as feasible, you wish to confirm activities for a certain user for these buckets. It is necessary to confirm which files have been viewed from those buckets and whether metadata labels have been added. Which option is most suitable for this scenario?

• Option A: Using the GCP Console, filter the Activity log in Cloud Monitoring tool to view the information
• Option B: Using the GCP Console, filter the Cloud Logging logs to view the information
• Option C: View the bucket in the Storage section of the GCP Console
• Option D: Create a trace in Cloud Trace to view the information
• Correct Answer: B
• Justification: Cloud Logging (Logs Viewer) is where you can filter and analyze access logs (Cloud Audit Logs and Access Logs) to see who accessed what object and when.
  • Option A Cloud Monitoring is for metrics (CPU, latency), not granular audit trails.
  • Option C The Storage console shows the objects, not the history of access.
  • Option D Cloud Trace is for application latency analysis.

Question 13

 Which of these is NOT a GCP’s philosophy in Capacity and Bandwidth management?

• Option A: Capacity Assumptions
• Option B: No Hard ceiling on resources
• Option C: Pay per use model
• Option D: Work load distribution as per need
• Correct Answer: A
• Justification: Google Cloud generally promotes “No Hard ceiling” (autoscaling), “Pay per use”, and distributing workloads. “Capacity Assumptions” is not a standard philosophy term; in fact, GCP encourages moving away from fixed capacity planning.
  • Options B, C, D are core tenets of Cloud Computing (Elasticity, Utility pricing).

Question 14

 You are a Cloud Engineer tasked with deploying a new application to Google Cloud. While attempting to use the gcloud command-line tool, you encounter an error message stating “gcloud command not found”. What will be the MOST LIKELY cause of this issue and the best course of action to resolve it?

• Option A: The Cloud SDK is not installed on your system. Need to download and install the latest version.
• Option B: You are not using the correct terminal path to access the gcloud command. Try navigating to the Cloud SDK installation directory.
• Option C: Your Cloud project is not properly configured with the Cloud SDK. You need to run ‘gcloud init’.
• Option D: There is a temporary network issue preventing communication with Google Cloud. Wait a few minutes and try again.
• Correct Answer: A
• Justification: The error “command not found” means the system shell cannot locate the executable. This almost always means the Cloud SDK is not installed or not added to the system PATH.
  • Option B If installed but not in PATH, it would still be “command not found”, but the root cause is installation/PATH configuration. A is the primary fix.
  • Option C gcloud init is for configuration, but you can’t run it if gcloud isn’t found.
  • Option D Network issues result in connection errors, not “command not found”.

Question 15

 Your organization is looking to reduce storage costs while maintaining data protection for its GCP instances. You are tasked with optimizing snapshot management. Which of the following strategies would be most effective in reducing snapshot storage costs without compromising data protection?

• Option A: Create daily snapshots of all disks and delete snapshots older than 30 days.
• Option B: Create weekly snapshots of all disks and retain them indefinitely.
• Option C: Create snapshots only when making significant changes to disk data and retain them indefinitely.
• Option D: Utilize snapshot schedules to create daily snapshots of critical disks and delete snapshots older than 7 days.
• Correct Answer: D
• Justification: Snapshot schedules allow automation. Creating daily snapshots is good for protection. Keeping them only for 7 days (instead of 30 or indefinite) significantly reduces storage costs while providing recent restore capability.
  • Option A 30 days is more expensive than 7 days.
  • Option B Indefinite retention is very costly.
  • Option C Ad-hoc snapshots are risky and indefinite retention is costly.

Question 16

 You significantly changed a complex deployment manager template and want to confirm that the dependencies of all defined resources are properly met before committing it to the project. You want the most rapid feedback on your changes. What would you do?

• Option A: Use granular logging statements within the Deployment Manager template authored in Python.
• Option B: Execute the Deployment Manager template using the –preview option in the same project, and observe the status of interdependent resources
• Option C: Monitor activity of the Deployment Manager executing on Stack-driver logging page of the GCP console
• Option D: Execute the Deployment manager template against a separate project with the same configuration, and monitor for failures
• Correct Answer: B
• Justification: Using the –preview flag in Deployment Manager performs a dry-run. It validates the configuration and dependencies without actually creating or modifying resources, providing rapid feedback.
  • Option A Logging doesn’t validate dependencies.
  • Option C Monitoring logs happens after execution.
  • Option D Executing in a separate project actually creates resources, which is slow and costly, unlike preview.

Question 17

 A company similar to youtube needs to enable video streaming from its website. Which of the storage class is recommended for high availability?

• Option A: regional
• Option B: nearline
• Option C: multiregional
• Option D: coldline
• Correct Answer: C
• Justification: Multiregional storage classes (like Multi-Regional) store data in at least two geographic regions, providing the highest availability and durability, suitable for streaming content globally.
  • Option A Regional is within one region.
  • Option B and Option D are archival classes, not designed for high-performance streaming.

Question 18

 Which of the below is part of Stackdriver monitoring features?

• Option A: Monitors AWS resources and application services
• Option B: Monitors GCP resources and application services
• Option C: Configure alerting policies to notify you when events occur
• Option D: All of the above
• Correct Answer: D
• Justification: (Duplicate question from Chapter 2) Stackdriver monitors GCP, AWS, and supports alerting.

Chapter 5: Data Storage and Analytics

Question 1

 You need to build a data processing pipeline that transforms data from Cloud Storage before loading it into BigQuery. The pipeline should be scalable, serverless, and able to handle batch and streaming data. Which Google Cloud service is best suited for the core data transformation logic in this pipeline?

• Option A: Use Cloud Dataflow for batch processing and data transformation.
• Option B: Configure Cloud Functions triggered by Cloud Storage object change notifications to perform transformations.
• Option C: Leverage Cloud Dataproc for running Apache Spark jobs on managed clusters for data processing.
• Option D: Utilize BigQuery for data transformation capabilities within the data warehouse itself.
• Correct Answer: A
• Justification: Cloud Dataflow is a fully managed stream and batch data processing service. It is serverless, highly scalable, and ideal for ETL/Transformation logic before loading into BigQuery.
  • Option B Cloud Functions has timeout and memory limits unsuitable for large data processing/ETL.
  • Option C Dataproc requires cluster management (not serverless) which adds overhead compared to Dataflow.
  • Option D BigQuery is great for analytics, but transforming before loading (ELT/ETL) is often better handled by Dataflow for complex logic or streaming ingestion.

Question 2

 The IT team in your organization has been assigned a project to design a next generation smart helmet for accident detection and reporting system. The smart helmet will push 10kb of biometric data in JSON format every second to a platform that will process the data using machine learning models and detect if there is an accident and report it by sending a notification. Which GCP services would you recommend to analyze the biometric data in real-time and provide a scalable solution?

• Option A: Use Cloud Pub/Sub to collect sensor data, analyze it with DataFlow and save results to Cloud storage. Use BigQuery for future analysis.
• Option B: Use Cloud Storage to collect sensor data, analyze it with Dataproc and save results to BigQuery
• Option C: Use Cloud Pub/Sub to collect sensor data, analyze it with Dataproc and save results to BigQuery
• Option D: Use Cloud Pub/Sub to collect sensor data, analyze it with DataFlow and save results to CloudSQL
• Correct Answer: A
• Justification: Cloud Pub/Sub handles the real-time ingestion of streaming data. Dataflow processes this stream in real-time. Cloud Storage is a good place to land results or raw data, and BigQuery is used for historical/future analysis.
  • Option B Storage is not an ingestion tool for streaming; it’s a bucket.
  • Option C Dataproc is batch-oriented (cluster), not ideal for continuous real-time streaming analysis like Dataflow.
  • Option D CloudSQL is a relational DB, not optimal for storing high-velocity streaming results or time-series data compared to Storage/BigQuery.

Question 3

 You are developing an application that keeps user-provided relational data. There will be users of this program worldwide. The unknown magnitude of the user base worries your CTO about the scaling requirements. A database system that can grow with your user base while requiring the fewest setup adjustments must be put into place. Which storage option is best for you?

• Option A: Cloud SQL
• Option B: Cloud Spanner
• Option C: Cloud Firestore
• Option D: Cloud Datastore
• Correct Answer: B
• Justification: Cloud Spanner is a horizontally scalable, strongly consistent, relational database service. It is designed for global scale and requires minimal setup adjustments (sharding/replication is handled automatically) compared to Cloud SQL (which has scaling limits and requires manual intervention/failover planning for high scale).
  • Option A Cloud SQL has scaling limits (vertical scaling mostly).
  • Option C and Option D are NoSQL databases, which might not fit if “relational data” with strict consistency is required.

Question 4

You’re a Cloud Engineer managing a large GCP project with various teams and departments. Each has their own budget limits and needs to track their spending. How can you best implement cost management in GCP to ensure everyone is accountable and stays within their budget?

• Option A: Create separate billing accounts for each team
• Option B: Implement budget hierarchy using labels
• Option C: Enable BigQuery cost analysis
• Option D: Configure Cloud Billing Reports
• Correct Answer: B
• Justification: Implementing a budget hierarchy using labels (e.g., team:finance, department:hr) allows you to assign costs to specific teams and create budgets/alerts based on these label keys.
  • Option A Separate billing accounts are too complex.
  • Option C BigQuery export is for analysis, not the implementation mechanism for management/enforcement.
  • Option D Billing reports are for viewing.

Question 5

 You have deployed a fault-tolerant application on virtual machines and looking for the best payment option that would incur minimum cost. Which of the following would be right choice?

• Option A: Use preemptible instances
• Option B: Purchase a committed use contract
• Option C: Create reservations for instances
• Option D: Modify the machine type, which has lower cost
• Correct Answer: A
• Justification: Preemptible instances offer the lowest price (up to 80% discount) for fault-tolerant workloads.
  • Option B Committed use requires a 1/3 year term and payment.
  • Option C Reservations guarantee capacity but don’t reduce the rate as much as Preemptible (and you pay for capacity even if not used).
  • Option D Lower machine type reduces cost but not as much as Preemptible.

Question 6

A company is planning on building a two tier architecture which consists of a web server and a database server. This will be hosted on Google compute engine instances accordingly. The web server will have a standard workload. Which of the following underlying persistent disk volumes are optimum to use for the underlying Google compute engine instances.

• Option A: Zonal standard persistent disks
• Option B: Regional persistent disks
• Option C: Zonal SSD persistent disks
• Option D: Local SSD (SCSI)
• Correct Answer: C
• Justification: For a standard workload on a web server (which typically involves serving requests/OS operations), Zonal SSD persistent disks offer the best price/performance balance. Standard persistent disks are slower; Local SSDs are ephemeral (data loss on stop).
  • Option A Standard disks are slower (HDD).
  • Option B Regional disks are expensive and needed mostly for DB HA, not web servers.
  • Option D Local SSDs lose data on instance stop/maintenance.

Question 7

You’re developing a multiplayer mobile game where players compete for the highest score. The leaderboard should be updated instantly whenever a player achieves a new higher score, reflecting millions of player updates per second. Additionally, the leaderboard should handle high read traffic as players constantly check their positions and the rest of the players. Which database service would be the best suited for managing this real-time gaming leaderboard?

• Option A: Cloud SQL
• Option B: Cloud Firestore
• Option C: Bigtable
• Option D: Cloud Spanner
• Correct Answer: C
• Justification: Cloud Bigtable is designed for high throughput (millions of ops/sec) and low latency, making it ideal for gaming leaderboards (time-series data) with high read/write traffic.
  • Option A Cloud SQL cannot handle millions of updates per second.
  • Option B Firestore is good but has scaling limits (document writes/sec) lower than Bigtable for this magnitude.
  • Option D Spanner is great but expensive and overkill for a simple leaderboard compared to Bigtable’s efficiency.

Question 8

As a Cloud Engineer for a financial services organization, you oversee a crucial virtual machine (VM) server on GCP which hosts a database. Regular backups of the database server are required to ensure proper disaster recovery and data security. Which of the following choices will be suitable for ensuring that snapshots are taken at regular intervals for this use case?

• Option A: Manually create snapshots from the VM instance in the GCP Console.
• Option B: Schedule recurring snapshots using Cloud Scheduler with a custom script.
• Option C: Utilize automated backup functionality built into managed databases.
• Option D: Configure lifecycle management for persistent disks attached to the VM.
• Correct Answer: B
• Justification: Since the database is on a Compute Engine VM (not a managed Cloud SQL instance), you must use Cloud Scheduler to trigger a function or script that calls the Compute Engine API to create snapshots.
  • Option A Manual is not “regular intervals”.
  • Option C Managed databases (Cloud SQL) have this, but the question specifies a VM hosting the DB.
  • Option D Lifecycle management deletes OLD snapshots, it doesn’t create new ones.

Question 9

You have installed a security camera in your company’s premises and need to collect and store the camera footage in Google Cloud storage. Within first 30 days, the footage is processed for detecting suspicious behavior. Is there a way to minimize the cost for storage?

• Option A: Use Google Cloud Regional Storage for first 30 days, and then move to Coldline Storage
• Option B: Use Google Cloud Nearline Storage for first 30 days, and then move to Coldline Storage
• Option C: Use Google Cloud Regional Storage for first 30 days, and then move to Nearline Storage.
• Option D: Use Google Cloud Regional Storage for first 30 days, and then move to Persistent Disk
• Correct Answer: A
• Justification: Regional Storage (Standard) is for frequent access (first 30 days processing). After 30 days, moving to Coldline Storage (the cheapest class for data accessed less than once a year) minimizes costs.
  • Option B Nearline is for data accessed once a month; if it’s processed daily for 30 days, Regional is cheaper.
  • Option C Coldline is cheaper than Nearline for old footage.
  • Option D Persistent Disk is for VMs, not archival storage.

Question 10

Army division of a country is looking for transactional , mission critical data repository which also supports scalability. Suggest a suitable GCP database option

• Option A: Cloud Spanner
• Option B: Cloud SQL with MySQL second generation instance
• Option C: Cloud SQL with MySQL first generation instance
• Option D: Cloud SQL with PostgreSQL
• Correct Answer: A
• Justification: Cloud Spanner is the best choice for mission-critical, transactional workloads that require massive horizontal scalability and external consistency (global distribution). Cloud SQL scales vertically (limited).
  • Options B, C, D are Cloud SQL, which has scaling limits compared to Spanner.

Question 11

Your organization has migrated the on-premise Hadoop cluster to Google Cloud, which runs a big data processing job. Which of the following storage class would you recommend to store data for frequent big data analysis?

• Option A: Multi-regional
• Option B: Regional
• Option C: Nearline
• Option D: Coldline
• Correct Answer: B
• Justification: Regional Storage offers higher performance (lower latency for compute in the same region) and is cheaper than Multi-regional, making it suitable for compute-intensive frequent analysis (BigQuery/Dataflow jobs usually run in a specific region).
  • Option A Multi-regional is for high availability across regions, but higher cost/latency for regional compute.
  • Option C and Option D are archival/cold storage, unsuitable for frequent processing.