Google Google Certifications PROFESSIONAL-CLOUD-ARCHITECT Questions & Answers

• Question 21:

  You have an application that will run on Compute Engine. You need to design an architecture that takes into account a disaster recovery plan that requires your application to fail over to another region in case of a regional outage. What should you do?

  A. Deploy the application on two Compute Engine instances in the same project but in a different region. Use the first instance to serve traffic, and use the HTTP load balancing service to fail over to the standby instance in case of a disaster.

  B. Deploy the application on a Compute Engine instance. Use the instance to serve traffic, and use the HTTP load balancing service to fail over to an instance on your premises in case of a disaster.

  C. Deploy the application on two Compute Engine instance groups, each in the same project but in a different region. Use the first instance group to serve traffic, and use the HTTP load balancing service to fail over to the standby instance group in case of a disaster.

  D. Deploy the application on two Compute Engine instance groups, each in separate project and a different region. Use the first instance group to server traffic, and use the HTTP load balancing service to fail over to the standby instance in case of a disaster.

  Correct Answer: C

• Question 22:

  Your company is developing a new application that will allow globally distributed users to upload pictures and share them with other selected users. The application will support millions of concurrent users. You want to allow developers to focus on just building code without having to create and maintain the underlying infrastructure. Which service should you use to deploy the application?

  A. App Engine

  B. Cloud Endpoints

  C. Compute Engine

  D. Google Kubernetes Engine

  Correct Answer: A

  https://cloud.google.com/terms/services https://cloud.google.com/appengine/docs/standard/go/how-requests-are-handled

• Question 23:

  Your organization has decided to restrict the use of external IP addresses on instances to only approved instances. You want to enforce this requirement across all of your Virtual Private Clouds (VPCs). What should you do?

  A. Remove the default route on all VPCs. Move all approved instances into a new subnet that has a default route to an internet gateway.

  B. Create a new VPC in custom mode. Create a new subnet for the approved instances, and set a default route to the internet gateway on this new subnet.

  C. Implement a Cloud NAT solution to remove the need for external IP addresses entirely.

  D. Set an Organization Policy with a constraint on constraints/compute.vmExternalIpAccess. List the approved instances in the allowedValues list.

  Correct Answer: D

  https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address

  https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address#disableexternalip

  You might want to restrict external IP address so that only specific VM instances can use them. This option can help to prevent data exfiltration or maintain network isolation. Using an Organization Policy, you can restrict external IP addresses to specific VM instances with constraints to control use of external IP addresses for your VM instances within an organization or a project.

• Question 24:

  You are migrating third-party applications from optimized on-premises virtual machines to Google Cloud. You are unsure about the optimum CPU and memory options. The application have a consistent usage patterns across multiple weeks. You want to optimize resource usage for the lowest cost. What should you do?

  A. Create a Compute engine instance with CPU and Memory options similar to your application's current on-premises virtual machine. Install the cloud monitoring agent, and deploy the third party application. Run a load with normal traffic levels on third party application and follow the Rightsizing Recommendations in the Cloud Console

  B. Create an App Engine flexible environment, and deploy the third party application using a Docker file and a custom runtime. Set CPU and memory options similar to your application's current on-premises virtual machine in the app.yaml file.

  C. Create an instance template with the smallest available machine type, and use an image of the third party application taken from the current on-premises virtual machine. Create a managed instance group that uses average CPU to autoscale the number of instances in the group. Modify the average CPU utilization threshold to optimize the number of instances running.

  D. Create multiple Compute Engine instances with varying CPU and memory options. Install the cloud monitoring agent and deploy the third-party application on each of them. Run a load test with high traffic levels on the application and use the results to determine the optimal settings.

  Correct Answer: A

  Create a Compute engine instance with CPU and Memory options similar to your application's current on-premises virtual machine. Install the cloud monitoring agent, and deploy the third party application. Run a load with normal traffic levels on third party application and follow the Rightsizing Recommendations in the Cloud Console https://cloud.google.com/migrate/compute-engine/docs/4.9/concepts/planning-a-migration/cloud-instance-rightsizing?hl=en

• Question 25:

  The operations manager asks you for a list of recommended practices that she should consider when migrating a J2EE application to the cloud. Which three practices should you recommend? Choose 3 answers

  A. Port the application code to run on Google App Engine.

  B. Integrate Cloud Dataflow into the application to capture real-time metrics.

  C. Instrument the application with a monitoring tool like Stackdriver Debugger.

  D. Select an automation framework to reliably provision the cloud infrastructure.

  E. Deploy a continuous integration tool with automated testing in a staging environment.

  F. Migrate from MySQL to a managed NoSQL database like Google Cloud Datastore or Bigtable.

  Correct Answer: AEF

  References: https://cloud.google.com/appengine/docs/standard/java/tools/uploadinganapp https://cloud.google.com/appengine/docs/standard/java/building-app/cloud-sql

• Question 26:

  You have found an error in your App Engine application caused by missing Cloud Datastore indexes. You have created a YAML file with the required indexes and want to deploy these new indexes to Cloud Datastore.

  What should you do?

  A. Point gcloud datastore create-indexes to your configuration file

  B. Upload the configuration file the App Engine's default Cloud Storage bucket, and have App Engine detect the new indexes

  C. In the GCP Console, use Datastore Admin to delete the current indexes and upload the new configuration file

  D. Create an HTTP request to the built-in python module to send the index configuration file to your application

  Correct Answer: A

• Question 27:

  Your company places a high value on being responsive and meeting customer needs quickly. Their primary business objectives are release speed and agility. You want to reduce the chance of security errors being accidentally introduced.

  Which two actions can you take? Choose 2 answers

  A. Ensure every code check-in is peer reviewed by a security SME.

  B. Use source code security analyzers as part of the CI/CD pipeline.

  C. Ensure you have stubs to unit test all interfaces between components.

  D. Enable code signing and a trusted binary repository integrated with your CI/CD pipeline.

  E. Run a vulnerability security scanner as part of your continuous-integration /continuous-delivery (CI/CD) pipeline.

  Correct Answer: BE

  https://docs.microsoft.com/en-us/vsts/articles/security-validation-cicd-pipeline?view=vsts

• Question 28:

  Your company has decided to build a backup replica of their on-premises user authentication PostgreSQL database on Google Cloud Platform. The database is 4 TB, and large updates are frequent. Replication requires private address

  space communication.

  Which networking approach should you use?

  A. Google Cloud Dedicated Interconnect

  B. Google Cloud VPN connected to the data center network

  C. A NAT and TLS translation gateway installed on-premises

  D. A Google Compute Engine instance with a VPN server installed connected to the data center network

  Correct Answer: A

  https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations Google Cloud Dedicated Interconnect provides direct physical connections and RFC 1918 communication between your on-premises network and Google's

  network. Dedicated Interconnect enables you to transfer large amounts of data between networks, which can be more cost effective than purchasing additional bandwidth over the public Internet or using VPN tunnels.

  Benefits:

  Traffic between your on-premises network and your VPC network doesn't traverse the public Internet. Traffic traverses a dedicated connection with fewer hops, meaning there are less points of failure where traffic might get dropped or

  disrupted.

  Your VPC network's internal (RFC 1918) IP addresses are directly accessible from your on-premises network. You don't need to use a NAT device or VPN tunnel to reach internal IP addresses. Currently, you can only reach internal IP

  addresses over a dedicated connection. To reach Google external IP addresses, you must use a separate connection.

  You can scale your connection to Google based on your needs. Connection capacity is delivered over one or more 10 Gbps Ethernet connections, with a maximum of eight connections (80 Gbps total per interconnect). The cost of egress

  traffic from your VPC network to your on-premises network is reduced. A dedicated connection is generally the least expensive method if you have a high-volume of traffic to and from Google's network.

  References: https://cloud.google.com/interconnect/docs/details/dedicated

• Question 29:

  Your company uses the Firewall Insights feature in the Google Network Intelligence Center. You have several firewall rules applied to Compute Engine instances. You need to evaluate the efficiency of the applied firewall ruleset. When you bring up the Firewall Insights page in the Google Cloud Console, you notice that there are no log rows to display. What should you do to troubleshoot the issue?

  A. Enable Virtual Private Cloud (VPC) flow logging.

  B. Enable Firewall Rules Logging for the firewall rules you want to monitor.

  C. Verify that your user account is assigned the compute.networkAdmin Identity and Access Management (IAM) role.

  D. Install the Google Cloud SDK, and verify that there are no Firewall logs in the command line output.

  Correct Answer: B

  Reference: https://cloud.google.com/network-intelligence-center/docs/firewall-insights/how-to/using-firewall-insights

• Question 30:

  Your company has an application running on a deployment in a GKE cluster. You have a separate cluster for development, staging and production. You have discovered that the team is able to deploy a Docker image to the production cluster without first testing the deployment in development and then staging. You want to allow the team to have autonomy but want to prevent this from happening. You want a Google Cloud solution that can be implemented quickly with minimal effort. What should you do?

  A. Create a Kubernetes admission controller to prevent the container from starting if it is not approved for usage in the given environment

  B. Configure a Kubernetes lifecycle hook to prevent the container from starting if it is not approved for usage in the given environment

  C. Implement a corporate policy to prevent teams from deploying Docker image to an environment unless the Docker image was tested in an earlier environment

  D. Configure the binary authorization policies for the development, staging and production clusters. Create attestations as part of the continuous integration pipeline"

  Correct Answer: D

  https://cloud.google.com/architecture/prep-kubernetes-engine-for-prod#binary-authorization The most common Binary Authorization use cases involve attestations. An attestation certifies that a specific image has completed a previous stage, as described previously. You configure the Binary Authorization policy to verify the attestation before allowing the image to be deployed. At deploy time, instead of redoing activities that were completed in earlier stages, Binary Authorization only needs to verify the attestation. https://cloud.google.com/binary-authorization/docs/overview