Google Google Certifications PROFESSIONAL-CLOUD-ARCHITECT Questions & Answers

• Question 151:

  Your company is developing a web-based application. You need to make sure that production deployments are linked to source code commits and are fully auditable. What should you do?

  A. Make sure a developer is tagging the code commit with the date and time of commit

  B. Make sure a developer is adding a comment to the commit that links to the deployment.

  C. Make the container tag match the source code commit hash.

  D. Make sure the developer is tagging the commits with :latest

  Correct Answer: C

  From: https://cloud.google.com/architecture/best-practices-for-building-containers Under: Tagging using the Git commit hash (bottom of page almost)

  "In this case, a common way of handling version numbers is to use the Git commit SHA-1 hash (or a short version of it) as the version number. By design, the Git commit hash is immutable and references a specific version of your software.

  You can use this commit hash as a version number for your software, but also as a tag for the Docker image built from this specific version of your software. Doing so makes Docker images traceable: because in this case the image tag is immutable, you instantly know which specific version of your software is running inside a given container."

• Question 152:

  Your organization wants to control IAM policies for different departments independently, but centrally.

  Which approach should you take?

  A. Multiple Organizations with multiple Folders

  B. Multiple Organizations, one for each department

  C. A single Organization with Folder for each department

  D. A single Organization with multiple projects, each with a central owner

  Correct Answer: C

  Folders are nodes in the Cloud Platform Resource Hierarchy. A folder can contain projects, other folders, or a combination of both. You can use folders to group projects under an organization in a hierarchy. For example, your organization might contain multiple departments, each with its own set of GCP resources. Folders allow you to group these resources on a per-department basis. Folders are used to group resources that share common IAM policies. While a folder can contain multiple folders or resources, a given folder or resource can have exactly one parent.

  References: https://cloud.google.com/resource-manager/docs/creating-managing-folders

• Question 153:

  The application reliability team at your company has added a debug feature to their backend service to send all server events to Google Cloud Storage for eventual analysis. The event records are at least 50 KB and at most 15 MB and are expected to peak at 3,000 events per second. You want to minimize data loss.

  Which process should you implement?

  A. ?Append metadata to file body. ?Compress individual files. ?Name files with serverName-Timestamp. ?Create a new bucket if bucket is older than 1 hour and save individual files to the new bucket. Otherwise, save files to existing bucket

  B. ?Batch every 10,000 events with a single manifest file for metadata. ?Compress event files and manifest file into a single archive file. ?Name files using serverName-EventSequence. ?Create a new bucket if bucket is older than 1 day and save the single archive file to the new bucket. Otherwise, save the single archive file to existing bucket.

  C. ?Compress individual files. ?Name files with serverName-EventSequence. ?Save files to one bucket ?Set custom metadata headers for each object after saving.

  D. ?Append metadata to file body. ?Compress individual files. ?Name files with a random prefix pattern. ?Save files to one bucket

  Correct Answer: D

  In order to maintain a high request rate, avoid using sequential names. Using completely random object names will give you the best load distribution. Randomness after a common prefix is effective under the prefix https://cloud.google.com/storage/docs/request-rate

• Question 154:

  A development manager is building a new application He asks you to review his requirements and identify what cloud technologies he can use to meet them. The application must

  1.

  Be based on open-source technology for cloud portability

  2.

  Dynamically scale compute capacity based on demand

  3.

  Support continuous software delivery

  4.

  Run multiple segregated copies of the same application stack

  5.

  Deploy application bundles using dynamic templates

  6.

  Route network traffic to specific services based on URL

  Which combination of technologies will meet all of his requirements?

  A. Google Container Engine, Jenkins, and Helm

  B. Google Container Engine and Cloud Load Balancing

  C. Google Compute Engine and Cloud Deployment Manager

  D. Google Compute Engine, Jenkins, and Cloud Load Balancing

  Correct Answer: A

  Helm for managing Kubernetes

  Kubernetes can base on the URL to route traffic to different location (path)

  https://cloud.google.com/kubernetes-engine/docs/tutorials/http-balancer eg.apiVersion: networking.k8s.io/v1beta1

  kind: Ingress

  metadata:

  name: fanout-ingress

  spec:

  rules:

  -http:

  paths:

  -path: /*

  backend:

  serviceName: web

  servicePort: 8080

  -path: /v2/*

  backend:

  serviceName: web2

  servicePort: 8080

• Question 155:

  You need to ensure reliability for your application and operations by supporting reliable task a scheduling for compute on GCP. Leveraging Google best practices, what should you do?

  A. Using the Cron service provided by App Engine, publishing messages directly to a message-processing utility service running on Compute Engine instances.

  B. Using the Cron service provided by App Engine, publish messages to a Cloud Pub/Sub topic. Subscribe to that topic using a message-processing utility service running on Compute Engine instances.

  C. Using the Cron service provided by Google Kubernetes Engine (GKE), publish messages directly to a message-processing utility service running on Compute Engine instances.

  D. Using the Cron service provided by GKE, publish messages to a Cloud Pub/Sub topic.

  Subscribe to that topic using a message-processing utility service running on Compute Engine instances.

  Correct Answer: B

  https://cloud.google.com/solutions/reliable-task-scheduling-compute-engine

• Question 156:

  You have a Python web application with many dependencies that requires 0.1 CPU cores and 128 MB of memory to operate in production. You want to monitor and maximize machine utilization. You also to reliably deploy new versions of the application. Which set of steps should you take?

  A. Perform the following: 1) Create a managed instance group with f1-micro type machines. 2) Use a startup script to clone the repository, check out the production branch, install the dependencies, and start the Python app. 3) Restart the instances to automatically deploy new production releases.

  B. Perform the following: 1) Create a managed instance group with n1-standard-1 type machines. 2) Build a Compute Engine image from the production branch that contains all of the dependencies and automatically starts the Python app. 3) Rebuild the Compute Engine image, and update the instance template to deploy new production releases.

  C. Perform the following: 1) Create a Kubernetes Engine cluster with n1-standard-1 type machines. 2) Build a Docker image from the production branch with all of the dependencies, and tag it with the version number. 3) Create a Kubernetes Deployment with the imagePullPolicy set to "IfNotPresent" in the staging namespace, and then promote it to the production namespace after testing.

  D. Perform the following: 1) Create a Kubernetes Engine (GKE) cluster with n1-standard-4 type machines. 2) Build a Docker image from the master branch will all of the dependencies, and tag it with "latest". 3) Create a Kubernetes Deployment in the default namespace with the imagePullPolicy set to "Always". Restart the pods to automatically deploy new production releases.

  Correct Answer: D

  https://cloud.google.com/compute/docs/instance-templates

• Question 157:

  Your company has a Google Workspace account and Google Cloud Organization Some developers in the company have created Google Cloud projects outside of the Google Cloud Organization

  You want to create an Organization structure that allows developers to create projects, but prevents them from modifying production projects You want to manage policies for all projects centrally and be able to set more restrictive policies for production projects

  You want to minimize disruption to users and developers when business needs change in the future You want to follow Google-recommended practices How should you design the Organization structure?

  A. 1 Create a second Google Workspace account and Organization 2 Grant all developers the Project Creator IAM role on the new Organization 3 Move the developer projects into the new Organization 4 Set the policies for all projects on both Organizations. 5 Additionally set the production policies on the original Organization

  B. 1 Create a folder under the Organization resource named "Production ' 2 Grant all developers the Project Creator IAM role on the Organization 3. Move the developer projects into the Organization 4 Set the policies for all projects on the Organization 5 Additionally set the production policies on the 'Production" folder

  C. 1 Create folders under the Organization resource named "Development" and Production' 2 Grant all developers the Project Creator IAM role on the ""Development1 folder 3. Move the developer projects into the "Development" folder 4 Set the policies for all projects on the Organization 5 Additionally set the production policies on the "Production" folder

  D. 1 Designate the Organization for production projects only 2 Ensure that developers do not have the Project Creator IAM role on the Organization 3 Create development projects outside of the Organization using the developer Google Workspace accounts 4 Set the policies for all projects on the Organization 5 Additionally set the production policies on the individual production projects

  Correct Answer: C

  This option can help create an organization structure that allows developers to create projects, but prevents them from modifying production projects. Folders are containers for projects and other folders within Google Cloud organizations. Folders allow resources to be structured hierarchically and inherit policies from their parent resources. By creating folders under the organization resource named "Development" and "Production", you can organize your projects by environment and apply different policies to them. By granting all developers the Project Creator IAM role on the "Development" folder, you can allow them to create projects under that folder, but not under the "Production" folder. By moving the developer projects into the "Development" folder, you can ensure that they are subject to the policies set on that folder. By setting the policies for all projects on the organization, you can manage policies centrally and efficiently. By additionally setting the production policies on the "Production" folder, you can enforce more restrictive policies for production projects and prevent developers from modifying them. The other options are not optimal for this scenario, because they either create a second Google Workspace account and organization, which increases complexity and cost (A), or do not use folders to organize projects by environment, which makes it harder to manage policies and permissions (B, D). References: https://cloud.google.com/resource-manager/docs/creating-managing-folders https://cloud.google.com/architecture/framework/system-design

• Question 158:

  Your company recently acquired a company that has infrastructure in Google Cloud. Each company has its own Google Cloud organization Each company is using a Shared Virtual Private Cloud (VPC) to provide network connectivity tor its applications Some of the subnets used by both companies overlap In order for both businesses to integrate, the applications need to have private network connectivity. These applications are not on overlapping subnets. You want to provide connectivity with minimal re-engineering. What should you do?

  A. Set up VPC peering and peer each Shared VPC together

  B. Configure SSH port forwarding on each application to provide connectivity between applications i the different Shared VPCs

  C. Migrate the protects from the acquired company into your company's Google Cloud organization Re launch the instances in your companies Shared VPC

  D. Set up a Cloud VPN gateway in each Shared VPC and peer Cloud VPNs

  Correct Answer: B

• Question 159:

  You have developed an application using Cloud ML Engine that recognizes famous paintings from uploaded images. You want to test the application and allow specific people to upload images for the next 24 hours. Not all users have a Google Account. How should you have users upload images?

  A. Have users upload the images to Cloud Storage. Protect the bucket with a password that expires after 24 hours.

  B. Have users upload the images to Cloud Storage using a signed URL that expires after 24 hours.

  C. Create an App Engine web application where users can upload images. Configure App Engine to disable the application after 24 hours. Authenticate users via Cloud Identity.

  D. Create an App Engine web application where users can upload images for the next 24 hours. Authenticate users via Cloud Identity.

  Correct Answer: A

  https://cloud.google.com/blog/products/storage-data-transfer/uploading-images-directly-to-cloud-storage-by-using-signed-url

• Question 160:

  Your company is planning to upload several important files to Cloud Storage. After the upload is completed, they want to verify that the upload content is identical to what they have on-premises. You want to minimize the cost and effort of performing this check. What should you do?

  A. 1) Use gsutil-m to upload all the files to Cloud Storage. 2) Use gsutil cp to download the uploaded files 3) Use Linux diff to compare the content of the files

  B. 1) Use gsutil-m to upload all the files to Cloud Storage. 2) Develop a custom Java application that computes CRC32C hashes 3) Use gsutil ls-L gs://[YOUR_BUCKET_NAME] to collect CRC32C hashes of the uploaded files 4)Compare the hashes

  C. 1) Use Linux shasum to compute a digest of files you want to upload 2) Use gsutil-m to upload all the files to the Cloud Storage 3) Use gsutil cp to download the uploaded files 4) Use Linux shasum to compute a digest of the downloaded files 5.Compre the hashes

  D. 1)Use gsutil-m to upload all the files to Cloud Storage. 2)Use gsutil hash-c FILE_NAME to generate CRC32C hashes of all on-premises files 3)Use gsutil ls-L gs://[YOUR_BUCKET_NAME] to collect CRC32C hashes of the uploaded files 4)Compare the hashes

  Correct Answer: D

  https://cloud.google.com/storage/docs/gsutil/commands/hash