Google Professional Cloud Architect (PR000213) Exam Questions Instant Access

Question 1

You have an outage in your Compute Engine managed instance group: all instance keep restarting after 5 seconds. You have a health check configured, but autoscaling is disabled. Your colleague, who is a Linux expert, offered to look into the issue. You need to make sure that he can access the VMs. What should you do?

AGrant your colleague the IAM role of project Viewer

BPerform a rolling restart on the instance group

CDisable the health check for the instance group. Add his SSH key to the project-wide SSH keys

DDisable autoscaling for the instance group. Add his SSH key to the project-wide SSH Keys

Answer : C

https://cloud.google.com/compute/docs/instance-groups/autohealing-instances-in-migs

Health checks used for autohealing should be conservative so they don't preemptively delete and recreate your instances. When an autohealer health check is too aggressive, the autohealer might mistake busy instances for failed instances and unnecessarily restart them, reducing availability

Question 2

Your organization wants to control IAM policies for different departments independently, but centrally.

Which approach should you take?

AMultiple Organizations with multiple Folders

BMultiple Organizations, one for each department

CA single Organization with Folder for each department

DA single Organization with multiple projects, each with a central owner

Answer : C

Folders are nodes in the Cloud Platform Resource Hierarchy. A folder can contain projects, other folders, or a combination of both. You can use folders to group projects under an organization in a hierarchy. For example, your organization might contain multiple departments, each with its own set of GCP resources. Folders allow you to group these resources on a per-department basis. Folders are used to group resources that share common IAM policies. While a folder can contain multiple folders or resources, a given folder or resource can have exactly one parent.

Question 3

For this question, refer to the TerramEarth case study. TerramEarth has decided to store data files in Cloud Storage. You need to configure Cloud Storage lifecycle rule to store 1 year of data and minimize file storage cost.

Which two actions should you take?

ACreate a Cloud Storage lifecycle rule with Age: ''30'', Storage Class: ''Standard'', and Action: ''Set to Coldline'', and create a second GCS life-cycle rule with Age: ''365'', Storage Class: ''Coldline'', and Action: ''Delete''.

BCreate a Cloud Storage lifecycle rule with Age: ''30'', Storage Class: ''Coldline'', and Action: ''Set to Nearline'', and create a second GCS life-cycle rule with Age: ''91'', Storage Class: ''Coldline'', and Action: ''Set to Nearline''.

CCreate a Cloud Storage lifecycle rule with Age: ''90'', Storage Class: ''Standard'', and Action: ''Set to Nearline'', and create a second GCS life-cycle rule with Age: ''91'', Storage Class: ''Nearline'', and Action: ''Set to Coldline''.

DCreate a Cloud Storage lifecycle rule with Age: ''30'', Storage Class: ''Standard'', and Action: ''Set to Coldline'', and create a second GCS life-cycle rule with Age: ''365'', Storage Class: ''Nearline'', and Action: ''Delete''.

Answer : A

Question 4

You are a cloud architect for a financial services company that is migrating to Google Cloud. The company needs to create a multi-tenant landing zone for its business units and must adhere to strict regulatory compliance. The security team wants to use VPC Service Controls to create a zero-trust perimeter. However, the business wants you to accelerate the migration to quickly start developing new applications. How can you design a deployment and release management process to meet these competing requirements?

AImplement a centralized CI/CD pipeline that uses pre-approved Infrastructure as Code (IaC) templates. To maximize agility, allow business units to clone and modify these templates freely, and use a phased rollout for VPC Service Controls.

BUse a single CI/CD pipeline for all business units that deploys directly to a single, shared project. Rely on IAM permissions to isolate workloads within the project. Turn on VPC Service Controls perimeter for the production environment.

CGrant each business unit autonomy to create their own CI/CD pipelines and infrastructure, and conduct periodic security audits to ensure compliance with VPC Service Controls. Enforce IAM inheritance from the folder level.

DEstablish a centralized CI/CD pipeline with automated policy and security validation at each stage. Define the VPC Service Controls perimeter in a 'dry run' mode in the development environment to audit and test for violations. Turn on VPC Service Controls perimeter for the production environment.

Answer : D

Designing a security landing zone for financial migrations requires balancing business agility with strict infrastructure perimeters. VPC Service Controls (VPC-SC) can inadvertently block legitimate service requests if misconfigured, causing application disruptions during migrations. To avoid these issues, Google Cloud recommends using the VPC-SC 'Dry Run' mode feature.

Dry Run mode allows security teams to configure perimeters and evaluate prospective violations against active workloads by logging telemetry to Cloud Logging without blocking actual API invocations. Embedding this validation into a centralized CI/CD pipeline ensures automated policy validation runs alongside application deployments. Developers can iterate quickly without experiencing perimeter blockages, while the architecture team gathers the data required to build a zero-trust perimeter before enforcing it in production. Granting unvalidated template access or omitting dry-run protections introduces severe risks of perimeter-induced application downtime.

Question 5

You are designing a new insurance claims processing application that will be deployed on Google Kubernetes Engine (GKE). Your company's compliance team requires a complete and non-repudiable audit trail for all administrative actions from day one. Your application must capture who deploys a new container image, who modifies the GKE cluster's configuration, and who interacts with running pods or Kubernetes secrets using kubectl. What should you do?

AEnable Binary Authorization on the GKE cluster and create a policy that requires all deployed container images to be signed by a trusted attestor.

BEnable GKE Audit Logging to send Kubernetes API server logs to Cloud Logging, and ensure Cloud Audit Logs are enabled for the project.

CActivate the Security Command Center Premium tier to analyze GKE logs and detect threats, vulnerabilities, and misconfigurations in real time.

DDeploy a DaemonSet to every node in the GKE cluster that runs a logging agent to collect and forward all container logs to Cloud Logging.

Answer : B

According to GKE Security documentation, Kubernetes API Server Audit Logging is the primary source of truth for administrative actions within a cluster. This feature captures every call made to the API server, including those made via kubectl, the Cloud Console, or automated controllers.

By enabling GKE Audit Logging and ensuring Cloud Audit Logs (specifically Admin Activity and Data Access logs) are active, you fulfill the requirement for a non-repudiable trail. This log will contain:

Who: The identity of the caller (the IAM user or service account).

What: The action taken (e.g., create pod, get secret, patch deployment).

When: The timestamp of the operation.

Option A (Binary Authorization) is a preventative control, not an audit logging tool. Option C (Security Command Center) is for threat detection, not for maintaining a raw audit trail. Option D (DaemonSet) collects application logs from within containers, but cannot capture administrative API calls like 'modifying cluster configuration' or 'accessing secrets' made through the Kubernetes control plane.

Question 6

Your organization uses Google Kubernetes Engine (GKE) and Amazon Elastic Kubernetes Service (EKS) to manage a complex Kubernetes environment across multiple cloud providers. You need to deploy a solution that streamlines configuration management, enforces security policies, and ensures consistent application deployment across all of the environments. You want to follow Google-recommended practices. What should you do?

ALeverage Argo CD for GitOps-based continuous delivery and Open Policy Agent (OPA) for policy enforcement, and develop a controller for multi-cluster configuration management.

BDeploy Customize for configuration customization. Config Sync with multiple Git repositories, and a script to enforce security policies.

CUtilize Config Sync as part of GKE to synchronize configurations from a centralized repository, and utilize Policy Controller to enforce policies using OPA Gatekeeper.

DDeploy Crossplane for managing cloud resources as Kubernetes objects. FluxCD for GitOps-based configuration synchronization, and Kyverno for policy enforcement.

Answer : C

According to Google Cloud's Anthos (now GKE Enterprise) documentation, Config Sync and Policy Controller are the official tools for multi-cluster and multi-cloud management. These tools allow for a GitOps approach to infrastructure and configuration.

Config Sync: Automatically synchronizes Kubernetes configurations (like YAML files for Namespaces, Roles, or Deployments) from a central Git repository to all registered clusters, whether they are in GKE or EKS. This ensures consistency across providers.

Policy Controller: Built on the open-source Gatekeeper project (using Open Policy Agent), it enforces security policies and compliance at scale. For example, it can prevent a developer from deploying a container that runs as root or requires excessive resources across both AWS and Google Cloud environments.

While Option A uses similar open-source technologies, Option C is the 'Google-recommended' integrated solution that is fully managed and supported. This centralized management reduces the complexity of maintaining custom controllers (as mentioned in A) or scripts (as mentioned in B), providing a robust, enterprise-grade framework for hybrid and multi-cloud governance.

Question 7

During a high traffic portion of the day, one of your relational databases crashes, but the replica is never promoted to a master. You want to avoid this in the future. What should you do?

AUse a different database.

BChoose larger instances for your database.

CCreate snapshots of your database more regularly.

DImplement routinely scheduled failovers of your databases.

Answer : D

https://cloud.google.com/solutions/dr-scenarios-planning-guide

Google Cloud Architect Professional Professional Cloud Architect (PR000213) Exam Questions