Quiz IT certification exam

Question 1

Your company is planning to upload several important files to Cloud Storage. After the upload is completed, they want to verify that the uploaded content is identical to what they have on-premises. You want to minimize the cost and effort of performing this check. What should you do?

Become a Premium Member for full access

Unlock Premium Member

Accepted Answer

Use gsutil cp to download the uploaded files.

Answer

1. Use Linux shasum to compute a digest of files you want to upload.

Answer

Use gsutil -m to upload all the files to Cloud Storage.

Answer

Use Linux shasum to compute a digest of the downloaded files.

Answer

Compare the hashes.

Answer

1. Use gsutil -m to upload the files to Cloud Storage.

Answer

Develop a custom Java application that computes CRC32C hashes.

Answer

Use gsutil ls -L gs://[YOUR_BUCKET_NAME] to collect CRC32C hashes of the uploaded files.

Answer

Compare the hashes.

Answer

1. Use gsutil -m to upload all the files to Cloud Storage.

Answer

Use Linux diff to compare the content of the files.

Answer

1. Use gsutil -m to upload the files to Cloud Storage.

Answer

Use gsutil hash -c FILE_NAME to generate CRC32C hashes of all on-premises files.

Answer

Use gsutil ls -L gs://[YOUR_BUCKET_NAME] to collect CRC32C hashes of the uploaded files.

Answer

Compare the hashes.

Question 2

You have deployed an application on Anthos clusters (formerly Anthos GKE). According to the SRE practices at your company, you need to be alerted if request latency is above a certain threshold for a specified amount of time. What should you do?

Accepted Answer

Install Anthos Service Mesh on your cluster. Use the Google Cloud Console to define a Service Level Objective (SLO), and create an alerting policy based on this SLO.

Answer

Enable the Cloud Trace API on your project, and use Cloud Monitoring Alerts to send an alert based on the Cloud Trace metrics.

Answer

Use Cloud Profiler to follow up the request latency. Create a custom metric in Cloud Monitoring based on the results of Cloud Profiler, and create an Alerting policy in case this metric exceeds the threshold.

Answer

Configure Anthos Config Management on your cluster, and create a yaml file that defines the SLO and alerting policy you want to deploy in your cluster.

Question 3

Your company has a stateless web API that performs scientific calculations. The web API runs on a single Google Kubernetes Engine (GKE) cluster. The cluster is currently deployed in us-central1. Your company has expanded to offer your API to customers in Asia. You want to reduce the latency for users in Asia. What should you do?

Accepted Answer

Use a global HTTP(s) load balancer with Cloud CDN enabled.

Answer

Create a second GKE cluster in asia-southeast1, and expose both APIs using a Service of type LoadBalancer. Add the public IPs to the Cloud DNS zone.

Answer

Create a second GKE cluster in asia-southeast1, and use kubemci to create a global HTTP(s) load balancer.

Answer

Increase the memory and CPU allocated to the application in the cluster.

Question 4

You are migrating third-party applications from optimized on-premises virtual machines to Google Cloud. You are unsure about the optimum CPU and memory options. The applications have a consistent usage pattern across multiple weeks. You want to optimize resource usage for the lowest cost. What should you do?

Accepted Answer

Create an instance template with the smallest available machine type, and use an image of the third-party application taken from a current on-premises virtual machine. Create a managed instance group that uses average CPU utilization to autoscale the number of instances in the group. Modify the average CPU utilization threshold to optimize the number of instances running.

Answer

Create an App Engine flexible environment, and deploy the third-party application using a Dockerfile and a custom runtime. Set CPU and memory options similar to your application's current on-premises virtual machine in the app.yaml file.

Answer

Create multiple Compute Engine instances with varying CPU and memory options. Install the Cloud Monitoring agent, and deploy the third-party application on each of them. Run a load test with high traffic levels on the application, and use the results to determine the optimal settings.

Answer

Create a Compute Engine instance with CPU and memory options similar to your application's current on-premises virtual machine. Install the Cloud Monitoring agent, and deploy the third-party application. Run a load test with normal traffic levels on the application, and follow the Rightsizing Recommendations in the Cloud Console.

Question 5

Your company has a Google Cloud project that uses BigQuery for data warehousing. They have a VPN tunnel between the on-premises environment and Google Cloud that is configured with Cloud VPN. The security team wants to avoid data exfiltration by malicious insiders, compromised code, and accidental oversharing. What should they do?

Accepted Answer

Configure Private Google Access for on-premises only.

Answer

Perform the following tasks:

Answer

Create a service account.

Answer

Give the BigQuery JobUser role and Storage Reader role to the service account.

Answer

Remove all other IAM access from the project.

Answer

Configure VPC Service Controls and configure Private Google Access.

Answer

Configure Private Google Access.

Question 6

You are working at an institution that processes medical data. You are migrating several workloads onto Google Cloud. Company policies require all workloads to run on physically separated hardware, and workloads from different clients must also be separated. You created a sole-tenant node group and added a node for each client. You need to deploy the workloads on these dedicated hosts. What should you do?

Accepted Answer

Use node affinity labels based on the node group name when creating Compute Engine instances in order to host each workload on the correct node group.

Answer

Add the node group name as a network tag when creating Compute Engine instances in order to host each workload on the correct node group.

Answer

Add the node name as a network tag when creating Compute Engine instances in order to host each workload on the correct node.

Answer

Use node affinity labels based on the node name when creating Compute Engine instances in order to host each workload on the correct node.

Question 7

Your company has a Google Workspace account and Google Cloud Organization. Some developers in the company have created Google Cloud projects outside of the Google Cloud Organization.You want to create an Organization structure that allows developers to create projects, but prevents them from modifying production projects. You want to manage policies for all projects centrally and be able to set more restrictive policies for production projects.You want to minimize disruption to users and developers when business needs change in the future. You want to followGoogle-recommended practices. Now should you design the Organization structure?

Accepted Answer

Set the policies for all projects on both Organizations.

Answer

1. Create a second Google Workspace account and Organization.

Answer

Grant all developers the Project Creator IAM role on the new Organization.

Answer

Move the developer projects into the new Organization.

Answer

Additionally, set the production policies on the original Organization.

Answer

1. Create a folder under the Organization resource named "Production."

Answer

Grant all developers the Project Creator IAM role on the new Organization.

Answer

Move the developer projects into the new Organization.

Answer

Set the policies for all projects on the Organization.

Answer

Additionally, set the production policies on the "Production" folder.

Answer

1. Create folders under the Organization resource named "Development" and "Production."

Answer

Grant all developers the Project Creator IAM role on the "Development" folder.

Answer

Move the developer projects into the "Development" folder.

Answer

Set the policies for all projects on the Organization.

Answer

Additionally, set the production policies on the "Production" folder.

Answer

1. Designate the Organization for production projects only.

Answer

Ensure that developers do not have the Project Creator IAM role on the Organization.

Answer

Create development projects outside of the Organization using the developer Google Workspace accounts.

Answer

Set the policies for all projects on the Organization.

Answer

Additionally, set the production policies on the individual production projects.

Question 8

Your company has an application running on Compute Engine that allows users to play their favorite music. There are a fixed number of instances. Files are stored in Cloud Storage, and data is streamed directly to users. Users are reporting that they sometimes need to attempt to play popular songs multiple times before they are successful. You need to improve the performance of the application. What should you do?

Accepted Answer

Download popular songs in Cloud Filestore.

Answer

1. Mount the Cloud Storage bucket using gcsfuse on all backend Compute Engine instances.

Answer

Serve music files directly from the backend Compute Engine instance.

Answer

1. Create a Cloud Filestore NFS volume and attach it to the backend Compute Engine instances.

Answer

Serve music files directly from the backend Compute Engine instance.

Answer

1. Copy popular songs into CloudSQL as a blob.

Answer

Update application code to retrieve data from CloudSQL when Cloud Storage is overloaded.

Answer

1. Create a managed instance group with Compute Engine instances.

Answer

Create a global load balancer and configure it with two backends:Managed instance groupCloud Storage bucket

Answer

Enable Cloud CDN on the bucket backend.

Question 9

The operations team in your company wants to save Cloud VPN log events for one year. You need to configure the cloud infrastructure to save the logs. What should you do?

Accepted Answer

Set up a filter in Cloud Logging and a Cloud Storage bucket as an export target for the logs you want to save.

Answer

Enable the Compute Engine API, and then enable logging on the firewall rules that match the traffic you want to save.

Answer

Set up a Cloud Logging Dashboard titled Cloud VPN Logs, and then add a chart that queries for the VPN metrics over a one-year time period.

Answer

Set up a filter in Cloud Logging and a topic in Pub/Sub to publish the logs.

Question 10

You are working with a data warehousing team that performs data analysis. The team needs to process data from external partners, but the data contains personally identifiable information (PII). You need to process and store the data without storing any of the PIIE data. What should you do?

Accepted Answer

Create a Dataflow pipeline to retrieve the data from the external sources. As part of the pipeline, use the Cloud Data Loss Prevention (Cloud DLP) API to remove any PII data. Store the result in BigQuery.

Answer

Create a Dataflow pipeline to retrieve the data from the external sources. As part of the pipeline, store all non-PII data in BigQuery and store all PII data in a Cloud Storage bucket that has a retention policy set.

Answer

Ask the external partners to upload all data on Cloud Storage. Configure Bucket Lock for the bucket. Create a Dataflow pipeline to read the data from the bucket. As part of the pipeline, use the Cloud Data Loss Prevention (Cloud DLP)API to remove any PII data. Store the result in BigQuery.

Answer

Ask the external partners to import all data in your BigQuery dataset. Create a dataflow pipeline to copy the data into a new table. As part of the Dataflow bucket, skip all data in columns that have PII data

Question 11

You want to allow your operations team to store logs from all the production projects in your Organization, without including logs from other projects. All of the production projects are contained in a folder. You want to ensure that all logs for existing and new production projects are captured automatically. What should you do?

Accepted Answer

Create an aggregated export on the Organization resource. Set the log sink to be a Cloud Storage bucket in an operations project.

Answer

Create an aggregated export on the Production folder. Set the log sink to be a Cloud Storage bucket in an operations project.

Answer

Create log exports in the production projects. Set the log sinks to be a Cloud Storage bucket in an operations project.

Answer

Create log exports in the production projects. Set the log sinks to be BigQuery datasets in the production projects, and grant IAM access to the operations team to run queries on the datasets.

Question 12

Your company has an application that is running on multiple instances of Compute Engine. It generates 1 TB per day of logs.For compliance reasons, the logs need to be kept for at least two years. The logs need to be available for active query for 30 days. After that, they just need to be retained for audit purposes. You want to implement a storage solution that is compliant, minimizes costs, and follows Google-recommended practices. What should you do?

Accepted Answer

Create an Object Lifecycle rule to move files into a Coldline Cloud Storage bucket after one month.

Answer

1. Install a Cloud Logging agent on all instances.

Answer

Create a sink to export logs into a regional Cloud Storage bucket.

Answer

Configure a retention policy at the bucket level using bucket lock.

Answer

1. Write a daily cron job, running on all instances, that uploads logs into a Cloud Storage bucket.

Answer

Create a sink to export logs into a regional Cloud Storage bucket.

Answer

1. Install a Cloud Logging agent on all instances.

Answer

Create a sink to export logs into a partitioned BigQuery table.

Answer

Set a time_partitioning_expiration of 30 days.

Answer

1. Create a daily cron job, running on all instances, that uploads logs into a partitioned BigQuery table.

Answer

Set a time_partitioning_expiration of 30 days.

Question 13

Your company has just recently activated Cloud Identity to manage users. The Google Cloud Organization has been configured as well. The security team needs to secure projects that will be part of the Organization. They want to prohibit IAM users outside the domain from gaining permissions from now on. What should they do?

Accepted Answer

Create a technical user (e.g., crawler@yourdomain.com), and give it the project owner role at root organization level.Write a bash script that:- Lists all the IAM rules of all projects within the organization.- Deletes all users that do not belong to the company domain.Create a Compute Engine instance in a project within the Organization and configure gcloud to be executed with technical user credentials. Configure a cron job that executes the bash script every hour.

Answer

Configure an organization policy to restrict identities by domain.

Answer

Configure an organization policy to block creation of service accounts.

Answer

Configure Cloud Scheduler to trigger a Cloud Function every hour that removes all users that don't belong to the Cloud Identity domain from all projects.

Question 14

Your company has an application running on Google Cloud that is collecting data from thousands of physical devices that are globally distributed. Data is published to Pub/Sub and streamed in real time into an SSD Cloud Bigtable cluster via a Dataflow pipeline. The operations team informs you that your Cloud Bigtable cluster has a hotspot, and queries are taking longer than expected. You need to resolve the problem and prevent it from happening in the future. What should you do?

Accepted Answer

Review your RowKey strategy and ensure that keys are evenly spread across the alphabet.

Answer

Advise your clients to use HBase APIs instead of NodeJS APIs.

Answer

Delete records older than 30 days.

Answer

Double the number of nodes you currently have.

Question 15

Your company has a Google Cloud project that uses BigQuery for data warehousing. There are some tables that contain personally identifiable information (PII). Only the compliance team may access the PII. The other information in the tables must be available to the data science team. You want to minimize cost and the time it takes to assign appropriate access to the tables. What should you do?

Accepted Answer

Assign access controls to the dataset that contains the view.

Answer

1. From the dataset where you have the source data, create views of tables that you want to share, excluding PII.

Answer

Assign an appropriate project-level IAM role to the members of the data science team.

Answer

1. From the dataset where you have the source data, create materialized views of tables that you want to share, excluding PII.

Answer

Assign an appropriate project-level IAM role to the members of the data science team.

Answer

1. Create a dataset for the data science team.

Answer

Create views of tables that you want to share, excluding PII.

Answer

Assign an appropriate project-level IAM role to the members of the data science team.

Answer

Authorize the view to access the source dataset.

Answer

1. Create a dataset for the data science team.

Answer

Create materialized views of tables that you want to share, excluding PII.

Answer

Assign an appropriate project-level IAM role to the members of the data science team.

Answer

Authorize the view to access the source dataset.

Question 16

Your operations team currently stores 10 TB of data in an object storage service from a third-party provider. They want to move this data to a Cloud Storage bucket as quickly as possible, following Googlerecommended practices. They want to minimize the cost of this data migration. Which approach should they use?

Accepted Answer

Use the Storage Transfer Service to move the data.

Answer

Use the gsutil mv command to move the data.

Answer

Download the data to a Transfer Appliance, and ship it to Google.

Answer

Download the data to the on-premises data center, and upload it to the Cloud Storage bucket.

Question 17

Your company and one of its partners each nave a Google Cloud protect in separate organizations.Your company s protect (prj-a) runs in Virtual Private Cloud (vpc-a). The partner's project (prj-b) runs in vpc-b. There are two instances running on vpc-a and one instance running on vpc-b Subnets denned in both VPCs are not overlapping.You need to ensure that all instances communicate with each other via internal IPs minimizing latency and maximizing throughput. What should you do?<img alt="Google Professional Cloud Architect image Question 181 28522 09182024191247000000"   width="391" height="37" src="https://examgecko.com/getfile/714f8d2e-86ec-45f6-845e-d9bb6c94232f">

Accepted Answer

Configure IAP TCP forwarding on the instance in vpc b and then launch the following gcloud command from one of the instance in vpc-gcloud:

Answer

Set up a network peering between vpc-a and vpc-b

Answer

Set up a VPN between vpc-a and vpc-b using Cloud VPN

Answer

Create an additional instance in vpc-a

Answer

Create an additional instance n vpc-b

Answer

Instal OpenVPN in newly created instances

Answer

Configure a VPN tunnel between vpc-a and vpc-b with the help of OpenVPN

Question 18

Your company has an application running on Google Cloud that is collecting data from thousands ophysical devices that are globally distributed. Data is publish to Pub/Sub and streamed in real timinto an SSO Cloud Bigtable cluster via a Dataflow pipeline. The operations team informs you that youCloud Bigtable cluster has a hot-spot and queries are taking longer man expected You need to resolvthe problem and prevent it from happening in the future What should you do?

Accepted Answer

Review your RowKey strategy and ensure that keys are evenly spread across the alphabet.

Answer

Advise your clients to use HBase APIs instead of NodeJS APIs.

Answer

Delete records older than 30 days.

Answer

Double the number of nodes you currently have.

Question 19

Your company recently acquired a company that has infrastructure in Google Cloud. Each company has its own Google Cloud organization Each company is using a Shared Virtual Private Cloud (VPC) to provide network connectivity tor its applications Some of the subnets used by both companies overlap In order for both businesses to integrate, the applications need to have private network connectivity. These applications are not on overlapping subnets. You want to provide connectivity with minimal re-engineering. What should you do?

Accepted Answer

Configure SSH port forwarding on each application to provide connectivity between applications is the different Shared VPCs

Answer

Set up VPC peering and peer each Shared VPC together

Answer

Migrate the protects from the acquired company into your company's Google Cloud organization Re launch the instances in your companies Shared VPC

Answer

Set up a Cloud VPN gateway in each Shared VPC and peer Cloud VPNs

Question 20

Your operations team currently stores 10 TB of data m an object storage service from a third-party provider. They want to move this data to a Cloud Storage bucket as quickly as possible, following Google-recommended practices. They want to minimize the cost of this data migration. When approach should they use?

Accepted Answer

Use the Storage Transfer Service to move the data

Answer

Use the gsutil mv command lo move the data

Answer

Download the data to a Transfer Appliance and ship it to Google

Answer

Download the data to the on-premises data center and upload it to the Cloud Storage bucket

Question 21

You want to allow your operations learn to store togs from all the production protects in your Organization, without during logs from other projects All of the production projects are contained in a folder. You want to ensure that all logs for existing and new production projects are captured automatically. What should you do?

Accepted Answer

Create an aggregated export on the Organization resource. Set the tog sink to be a Cloud Storage bucket in an operations project.

Answer

Create an aggregated export on the Production folder. Set the log sink to be a Cloud Storage bucket in an operations project

Answer

Create log exports in the production projects. Set the log sinks to be a Cloud Storage bucket in an operations project.

Answer

Create tog exports in the production projects. Set the tog sinks to be BigQuery datasets in the production projects and grant IAM access to the operations team to run queries on the datasets

Question 22

You are configuring the cloud network architecture for a newly created project m Google Cloud that will host applications in Compote Engine Compute Engine virtual machine instances will be created in two different subnets (sub-a and sub-b) within a single region• Instances in sub-a win have public IP addresses• Instances in sub-b will have only private IP addressesTo download updated packages, instances must connect to a public repository outside the boundaries of Google Cloud You need to allow sub-b to access the external repository. What should you do?

Accepted Answer

Configure Cloud NAT and select sub b m the NAT mapping section

Answer

Enable Private Google Access on sub-b

Answer

Configure a bastion host instance in sub a to connect to instances in sub-b

Answer

Enable Identity Aware Proxy for TCP forwarding for instances in sub-b

Question 23

Your company has just recently activated Cloud Identity to manage users. The Google Cloud Organization has been configured as wed. The security learn needs to secure protects that will be part of the Organization. They want to prohibit IAM users outside the domain from gaining permissions from now on. What should they do?

Accepted Answer

Configure an organization policy to restrict identities by domain

Answer

Configure an organization policy to block creation of service accounts

Answer

Configure Cloud Scheduler to trigger a Cloud Function every hour that removes all users that don't belong to the Cloud identity domain from all projects.

Question 24

Your company has just recently activated Cloud Identity to manage users. The Google Cloud Organization has been configured as wed. The security learn needs to secure protects that will be part of the Organization. They want to prohibit IAM users outside the domain from gaining permissions from now on. What should they do?

Accepted Answer

Configure an organization policy to restrict identities by domain

Answer

Configure an organization policy to block creation of service accounts

Answer

Configure Cloud Scheduler o trigger a Cloud Function every hour that removes all users that don't belong to the Cloud identity domain from all projects.

Answer

Create a technical user (e g . crawler@yourdomain com), and give it the protect owner rote at root organization level Write a bash script that• Lists all me IAM rules of all projects within the organization• Deletes all users that do not belong to the company domain Create a Compute Engine instance m a project within the Organization and configure gcloud to be executed with technical user credentials Configure a cron job that executes the bash script every hour.

Question 25

You want to store critical business information in Cloud Storage buckets. The information is regularly changed but previous versions need to be referenced on a regular basis. You want to ensure that there is a record of all changes to any information in these buckets. You want to ensure that accidental edits or deletions can be easily roiled back. Which feature should you enable?

Accepted Answer

Object Versioning

Answer

Bucket Lock

Answer

Object change notification

Answer

Object Lifecycle Management

Question 26

You are working with a data warehousing team that performs data analysis. The team needs to process data from external partners, but the data contains personally identifiable information (PlI).You need to process and store the data without storing any of the Pll data. What should you do?

Accepted Answer

Create a Dataflow pipeline to retrieve the data from the external sources. As part of the pipeline use the Cloud Data Loss Prevention (Cloud DLP) API to remove any Pll data Store the result in BigQuery

Answer

Create a Dataflow pipeline to retrieve the data from the external sources. As part of the pipeline store all non-PII data in BigQuery and store all Pll data in a Cloud Storage bucket that has a retention policy set.

Answer

Ask the external partners to upload an data on Cloud Storage Configure Bucket Lock for the bucket Create a Dataflow pipeline to read the data from the bucket As part of the pipeline, use the Cloud Data Loss Prevention (Cloud DIP) API to remove any Pll data Store the result in BigQuery

Answer

Ask the external partners to import ail data in your BigQuery dataset Create a dataflow pipeline to copy the data into a new table As part of the Dataflow bucket skip all data in columns that have Pll data

Question 27

Your company wants to migrate their 10-TB on-premises database export into Cloud Storage You want to minimize the time it takes to complete this activity, the overall cost and database load The bandwidth between the on-premises environment and Google Cloud is 1 Gbps You want to follow Google-recommended practices What should you do?

Accepted Answer

Use the Data Transfer appliance to perform an offline migration

Answer

Use a commercial partner ETL solution to extract the data from the on-premises database and upload it into Cloud Storage

Answer

Develop a Dataflow job to read data directly from the database and write it into Cloud Storage

Answer

Compress the data and upload it with gsutii -m to enable multi-threaded copy

Question 28

You are responsible for the Google Cloud environment in your company Multiple departments need access to their own projects and the members within each department will have the same project responsibilities You want to structure your Google Cloud environment for minimal maintenance and maximum overview of 1AM permissions as each department's projects start and end You want to follow Google-recommended practices What should you do?

Accepted Answer

Create a Google Group per department and add all department members to their respective groups Create a folder per department and grant the respective group the required 1AM permissions at the folder level Add the projects under the respective folders

Answer

Grant all department members the required 1AM permissions for their respective projects

Answer

Create a Google Group per department and add all department members to their respective groups Grant each group the required I AM permissions for their respective projects

Answer

Create a folder per department and grant the respective members of the department the required 1AM permissions at the folder level. Structure all projects for each department under the respective folders

Question 29

You are managing several projects on Google Cloud and need to interact on a daily basis with BigQuery, Bigtable and Kubernetes Engine using the gcloud CLI tool You are travelling a lot and work on different workstations during the week You want to avoid having to manage the gcloud CLI manually What should you do?

Accepted Answer

Use Google Cloud Shell in the Google Cloud Console to interact with Google Cloud

Answer

Use a package manager to install gcloud on your workstations instead of installing it manually

Answer

Create a Compute Engine instance and install gcloud on the instance Connect to this instance via SSH to always use the same gcloud installation when interacting with Google Cloud

Answer

Install gcloud on all of your workstations Run the command gcloud components auto-update on each workstation

Question 30

The operations team in your company wants to save Cloud VPN log events (or one year You need to configure the cloud infrastructure to save the logs What should you do?

Accepted Answer

Set up a filter in Cloud Logging and a Cloud Storage bucket as an export target for the logs you want to save

Answer

Set up a filter in Cloud Logging and a topic in Pub/Sub to publish the logs

Answer

Set up a Cloud Logging Dashboard titled Cloud VPN Logs, and then add a chart that queries for the VPN metrics over a one-year time period

Answer

Enable the Compute Engine API and then enable logging on the firewall rules that match the traffic you want to save

Question 31

Your company has an application running as a Deployment in a Google Kubernetes Engine (GKE) cluster When releasing new versions of the application via a rolling deployment, the team has been causing outages The root cause of the outages is misconfigurations with parameters that are only used in production You want to put preventive measures for this in the platform to prevent outages What should you do?

Accepted Answer

Configure liveness and readiness probes in the Pod specification

Answer

Configure an uptime alert in Cloud Monitoring

Answer

Create a Scheduled Task to check whether the application is available

Answer

Configure health checks on the managed instance group

Question 32

Your company has a Google Cloud project that uses BlgQuery for data warehousing There are some tables that contain personally identifiable information (PI!) Only the compliance team may access the PH. The other information in the tables must be available to the data science team. You want to minimize cost and the time it takes to assign appropriate access to the tables What should you do?

Accepted Answer

1 Create a dataset for the data science team 2 Create views of tables that you want to share excluding Pll 3 Assign an appropriate project-level IAM role to the members of the data science team 4 Assign access controls to the dataset that contains the view 5 Authorize the view to access the source dataset

Answer

1 From the dataset where you have the source data, create views of tables that you want to share, excluding Pll 2 Assign an appropriate project-level IAM role to the members of the data science team 3 Assign access controls to the dataset that contains the view

Answer

1 From the dataset where you have the source data, create materialized views of tables that you want to share excluding Pll 2 Assign an appropriate project-level IAM role to the members of the data science team 3. Assign access controls to the dataset that contains the view.

Answer

1. Create a dataset for the data science team. 2. Create materialized views of tables that you want to share, excluding Pll 3. Assign an appropriate project-level IAM role to the members of the data science team 4 Assign access controls to the dataset that contains the view 5 Authorize the view to access the source dataset

Question 33

Your company has a Google Workspace account and Google Cloud Organization Some developers in the company have created Google Cloud projects outside of the Google Cloud OrganizationYou want to create an Organization structure that allows developers to create projects, but prevents them from modifying production projects You want to manage policies for all projects centrally and be able to set more restrictive policies for production projectsYou want to minimize disruption to users and developers when business needs change in the future You want to follow Google-recommended practices How should you design the Organization structure?

Accepted Answer

1 Create folders under the Organization resource named 'Development' and Production' 2 Grant all developers the Project Creator IAM role on the ''Development1 folder 3. Move the developer projects into the 'Development' folder 4 Set the policies for all projects on the Organization 5 Additionally set the production policies on the 'Production' folder

Answer

1 Create a second Google Workspace account and Organization 2 Grant all developers the Project Creator IAM role on the new Organization 3 Move the developer projects into the new Organization 4 Set the policies for all projects on both Organizations. 5 Additionally set the production policies on the original Organization

Answer

1 Create a folder under the Organization resource named 'Production ' 2 Grant all developers the Project Creator IAM role on the Organization 3. Move the developer projects into the Organization 4 Set the policies for all projects on the Organization 5 Additionally set the production policies on the 'Production' folder

Answer

1 Designate the Organization for production projects only 2 Ensure that developers do not have the Project Creator IAM role on the Organization 3 Create development projects outside of the Organization using the developer Google Workspace accounts 4 Set the policies for all projects on the Organization 5 Additionally set the production policies on the individual production projects

Question 34

For this question, refer to the TerramEarth case study. You are building a microservice-based application for TerramEarth. The application is based on Docker containers. You want to follow Google-recommended practices to build the application continuously and store the build artifacts. What should you do?

Accepted Answer

1 Create a Scheduler job to check the repo every minute. 2. For any new change, invoke Cloud Build to build container images for the microservices. 3. Tag the images using the current timestamp, and push them to the Artifact Registry.

Answer

1. Configure a trigger in Cloud Build for new source changes. 2. Invoke Cloud Build to build one container image, and tag the image with the label 'latest.' 3. Push the image to the Artifact Registry.

Answer

1. Configure a trigger in Cloud Build for new source changes. 2. Invoke Cloud Build to build container images for each microservice, and tag them using the code commit hash. 3. Push the images to the Artifact Registry.

Answer

1. Configure a trigger in Cloud Build for new source changes. 2. The trigger invokes build jobs and build container images for the microservices. 3. Tag the images with a version number, and push them to Cloud Storage.

Question 35

Your company has a Google Cloud project that uses BigQuery for data warehousing on a pay-per-use basis. You want to monitor queries in real time to discover the most costly queries and which users spend the most. What should you do?

Accepted Answer

1. Activate billing export into BigQuery. 2. Perform a BigQuery query on the billing table to extract the information you need.

Answer

1. Create a Cloud Logging sink to export BigQuery data access logs to Cloud Storage. 2. Develop a Dataflow pipeline to compute the cost of queries split by users.

Answer

1. Create a Cloud Logging sink to export BigQuery data access logs to BigQuery. 2. Perform a BigQuery query on the generated table to extract the information you need.

Answer

1. In the BigQuery dataset that contains all the tables to be queried, add a label for each user that can launch a query. 2. Open the Billing page of the project. 3. Select Reports. 4. Select BigQuery as the product and filter by the user you want to check.

Question 36

Your company has an application that is running on multiple instances of Compute Engine. It generates 1 TB per day of logs. For compliance reasons, the logs need to be kept for at least two years. The logs need to be available for active query for 30 days. After that, they just need to be retained for audit purposes. You want to implement a storage solution that is compliant, minimizes costs, and follows Google-recommended practices. What should you do?

Accepted Answer

1. Install the Cloud Ops agent on all instances. 2. Create a sink to export logs into a regional Cloud Storage bucket. 3. Create an Object Lifecycle rule to move files into a Coldline Cloud Storage bucket after one month. 4. Configure a retention policy at the bucket level to create a lock.

Answer

1. Install the Cloud Ops agent on all instances. 2. Create a sink to export logs into a partitioned BigQuery table. 3. Set a time_partitioning_expiration of 30 days.

Answer

1. Create a daily cron job, running on all instances, that uploads logs into a partitioned BigQuery table. 2. Set a time_partitioning_expiration of 30 days.

Answer

1. Write a daily cron job, running on all instances, that uploads logs into a Cloud Storage bucket. 2. Create a sink to export logs into a regional Cloud Storage bucket. 3. Create an Object Lifecycle rule to move files into a Coldline Cloud Storage bucket after one month.

Question 37

Your company has an application running on App Engine that allows users to upload music files and share them with other people. You want to allow users to upload files directly into Cloud Storage from their browser session. The payload should not be passed through the backend. What should you do?

Accepted Answer

1. Set a CORS configuration in the target Cloud Storage bucket where the base URL of the App Engine application is an allowed origin. 2. Assign the Cloud Storage WRITER role to users who upload files.

Answer

1. Set a CORS configuration in the target Cloud Storage bucket where the base URL of the App Engine application is an allowed origin. 2. Use the Cloud Storage Signed URL feature to generate a POST URL.

Answer

1. Use the Cloud Storage Signed URL feature to generate a POST URL. 2. Use App Engine default credentials to sign requests against Cloud Storage.

Answer

1. Assign the Cloud Storage WRITER role to users who upload files. 2. Use App Engine default credentials to sign requests against Cloud Storage.

Question 38

You are deploying an application to Google Cloud. The application is part of a system. The application in Google Cloud must communicate over a private network with applications in a non-Google Cloud environment. The expected average throughput is 200 kbps. The business requires:* 99.99% system availability* cost optimizationYou need to design the connectivity between the locations to meet the business requirements. What should you provision?

Accepted Answer

An HA Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway.

Answer

A Classic Cloud VPN gateway connected with one tunnel to an on-premises VPN gateway.

Answer

A Classic Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway.

Answer

Two HA Cloud VPN gateways connected to two on-premises VPN gateways. Configure each HA Cloud VPN gateway to have two tunnels, each connected to different on-premises VPN gateways.

Question 39

Your company uses Google Kubernetes Engine (GKE) as a platform for all workloads. Your company has a single large GKE cluster that contains batch, stateful, and stateless workloads. The GKE cluster is configured with a single node pool with 200 nodes. Your company needs to reduce the cost of this cluster but does not want to compromise availability. What should you do?

Accepted Answer

Configure a HorizontalPodAutoscaler for all stateless workloads and for all compatible stateful workloads. Configure the cluster to use node auto scaling.

Answer

Create a second GKE cluster for the batch workloads only. Allocate the 200 original nodes across both clusters.

Answer

Configure CPU and memory limits on the namespaces in the cluster. Configure all Pods to have a CPU and memory limits.

Answer

Change the node pool to use spot VMs.

Question 40

Your company has a Google Cloud project that uses BigQuery for data warehousing. The VPN tunnel between the on-premises environment and Google Cloud is configured with Cloud VPN. Your security team wants to avoid data exfiltration by malicious insiders, compromised code, and accidental oversharing. What should you do?

Accepted Answer

Configure VPC Service Controls and configure Private Google Access for on-premises hosts.

Answer

Create a service account, grant the BigQuery JobUser role and Storage Object Viewer role to the service account, and remove all other Identity and Access Management (1AM) access from the project.

Answer

Configure Private Google Access.

Answer

Configure Private Service Connect.

Google Professional Cloud Architect Practice Test 6

Google Professional Cloud Architect Practice Tests