A new service must handle expected peak demand and keep working when a planned dependency fails. Which two preproduction activities provide the most relevant evidence?
A code review of the service's error-handling paths
Representative load testing against the performance targets
A successful deployment to a staging environment
Controlled fault injection that disables the dependency and observes recovery
B
Load tests show behavior at the expected peak, and fault injection shows how the service behaves when the dependency fails. Code reviews, a staging deployment, and mocked unit tests are useful but do not exercise real load or failure.
Ensuring solution and operations excellence
25
Select Two
D
A stateless Cloud Run service is releasing a new revision. The database change is backward compatible. The team wants to send about 5% of requests to the new revision first and, if error rates rise, return traffic to the previous revision quickly without redeploying. Which approach fits?
Deploy the revision with 100% of traffic and redeploy the old image if errors rise
Split traffic between revisions, monitor, then promote or route back
Deploy the new revision as a separate service behind a new domain name
Delete the previous revision after deployment to avoid confusion
B
Cloud Run can send a percentage of requests to a new revision and shift traffic back without a redeploy, because the old revision stays available. The shift takes a short time to apply, and a request percentage is not the same as a percentage of distinct users. Sending all traffic at once removes staged exposure, and deleting the previous revision removes the rollback target.
Ensuring solution and operations excellence
24
Select One
Several engineers apply Terraform changes to the same Google Cloud environment. State must be shared, protected against concurrent writes, and recoverable if it is corrupted. Which setup fits?
A gcs backend on a bucket with object versioning enabled
Local state files committed to the Git repository after each apply
State stored as a secret in Secret Manager and downloaded before each run
A separate local state file on each engineer's laptop
A
The gcs backend stores shared state and supports state locking, and bucket versioning allows recovery of earlier state. Committing state to Git risks conflicts and exposes secrets, and separate local states diverge.
Managing implementation
23
Select One
Developers want to run integration tests for a Pub/Sub-based application on their laptops without creating cloud resources or incurring cost. What should the architect recommend?
A shared test project with a topic for each developer
Cloud Shell sessions connected to the production topics
Firestore collections used as a substitute for message queues
The Pub/Sub emulator, started with the gcloud CLI
D
The emulator runs Pub/Sub locally so that tests use the client libraries without cloud resources or cost. A shared test project still incurs cost and coordination, and production topics must not be used for tests.
Managing implementation
22
Select One
A company wants to expose APIs to external partners with API keys and OAuth, per-partner quotas, a developer portal, usage analytics, and monetization. Which service fits best?
An external Application Load Balancer with Cloud Armor rate limiting
Cloud Endpoints with an OpenAPI specification
Apigee API Management
Cloud Run services with custom authentication code
C
Apigee provides API proxies with key and OAuth security, quotas, a developer portal, analytics, and monetization. Cloud Endpoints and load balancer rate limiting cover only parts of this, and custom code adds maintenance.
Managing implementation
21
Select One
The same checkout outage has happened three times this quarter. Each time, the team restarted a service and closed the incident. What should the architect recommend?
Add more replicas of the failing service and close the incident when alerts clear
Hold a blameless postmortem with root cause analysis and owned follow-up actions
Identify the engineer who approved the last change and require extra sign-offs
Increase the alerting threshold so that the outage pages fewer people
B
A blameless postmortem identifies contributing causes and assigns owned actions to prevent recurrence. More replicas may hide the symptom, blame discourages reporting, and higher thresholds reduce visibility.
Analyzing and optimizing technical and business processes
20
Select One
A product team asks to raise an internal reporting tool's availability target from 99.9% to 99.99%. The change would triple infrastructure cost. What should the architect do first?
Compare the user and business impact of downtime with the cost of the higher target
Approve the change because a higher availability target is always safer
Deploy the tool in three additional regions and set the SLO afterward
Reject the change and keep the current availability target without any further analysis
A
Availability targets should reflect what users and the business need, weighed against cost and complexity. Each additional nine costs more, so neither automatic approval nor rejection without analysis is sound.
Analyzing and optimizing technical and business processes
19
Select One
A service needs a steady baseline of 40 vCPUs around the clock for the next three years, plus unpredictable traffic peaks that sometimes double capacity for a few hours. Customer-facing requests must not be interrupted. Which two actions minimize cost while meeting these needs?
Purchase committed use discounts sized to the steady baseline
Purchase committed use discounts sized to the highest observed peak
Run the peak capacity on Spot VMs
Use autoscaling managed instance groups to add capacity for peaks
A
Commitments discount the predictable baseline, and autoscaling adds on-demand capacity only while peaks last. Committing to the peak pays for idle capacity, Spot VMs can interrupt customer-facing requests, and sole-tenant nodes add cost.
Analyzing and optimizing technical and business processes
18
Select Two
D
A company has a written disaster recovery plan with an RTO of 4 hours and an RPO of 15 minutes. It has never been executed. What is the most valuable next step to confirm readiness?
Confirm that recent backup objects exist in the backup bucket
Restore one database in a test project and assume the rest will behave the same
Review the plan's documentation with each team lead and sign it off
Run a controlled recovery exercise and measure the achieved RTO and RPO
D
Only an end-to-end exercise shows whether the targets are achievable and reveals missing dependencies. Checking that backups exist, testing one component, or reviewing documents does not demonstrate recovery.
Analyzing and optimizing technical and business processes
17
Select One
A GKE production cluster must run only container images that were built by the company's CI system and passed its vulnerability checks. Which service enforces this at deployment time?
Artifact Analysis vulnerability scanning with findings reviewed weekly
Kubernetes RBAC that limits who can create Deployments
Binary Authorization with a policy that requires attestations
Pod Security Admission set to the restricted profile
C
Binary Authorization blocks deployments of images that lack the attestations required by policy, such as those created by CI after checks pass. Scanning alone does not block deployments, and RBAC and Pod Security Admission do not verify image provenance.
Designing for security and compliance
16
Select One
A company stores regulated data in BigQuery and Cloud Storage. Security wants to prevent data from being copied to projects outside the organization, even by a user with valid credentials and the required IAM roles. Which control fits?
IAM Conditions that restrict role bindings to business hours
A VPC Service Controls perimeter around the projects
VPC firewall egress rules that deny traffic to the internet
Customer-managed encryption keys for all datasets and buckets
B
VPC Service Controls blocks API calls that would move data across the perimeter, even for authorized identities. IAM Conditions limit when roles apply, firewall rules do not govern Google API data paths, and encryption does not stop copies by authorized users.
Designing for security and compliance
15
Select One
Most BigQuery queries on a 20 TB events table filter on the last 7 days and on customer_id, but every query scans the whole table. Which change most directly reduces bytes scanned?
Partition by event date and cluster by customer_id
Create a materialized view that selects all rows and columns of the table
Increase the number of slots reserved for the project
Copy the table into a new dataset in the same region every week
A
Date partitioning lets queries skip partitions outside the 7-day filter, and clustering reduces the blocks read for customer_id filters. Slots change compute capacity, not bytes scanned, and a view of the whole table does not prune data.
Managing and provisioning a cloud solution infrastructure
14
Select One
An ML team repeatedly prepares data, trains a model, and evaluates it. It needs each run to be reproducible, with the artifacts and lineage of every step recorded. Which managed capability fits best?
Workflows that call each step's API in sequence
Cloud Scheduler triggering a Cloud Run job for each step
Notebooks run manually by team members in order
Agent Platform Pipelines
D
Agent Platform Pipelines orchestrates ML workflows and records the artifacts, parameters, and lineage of each run. Workflows and scheduled Cloud Run jobs can sequence steps but do not track ML metadata, and manual notebooks are not reproducible.
Managing and provisioning a cloud solution infrastructure
13
Select One
Workloads in many consumer VPC networks must reach a service that a partner publishes from its own VPC. The IP ranges overlap, and the partner does not allow VPC Network Peering. Which design fits?
VPC Network Peering between each consumer VPC and the partner's VPC
A Shared VPC host project that includes the partner's network as a service project
Private Service Connect endpoints to the partner's service attachment
Cloud VPN tunnels from each consumer VPC to the partner's VPC
C
Private Service Connect lets consumers reach a published service through an endpoint IP in their own VPC, which works with overlapping ranges and without peering. Peering and VPN require non-overlapping ranges, and Shared VPC cannot span another organization's network.
Managing and provisioning a cloud solution infrastructure
12
Select One
An application depends on Kubernetes custom resources and operators. The organization wants Google to manage nodes, scaling, and security hardening, and to pay per Pod resource request. Which platform fits?
GKE Standard with node auto-provisioning
GKE Autopilot
Cloud Run with the Knative serving API
Self-managed Kubernetes on Compute Engine
B
Autopilot is a full Kubernetes platform in which Google manages nodes, scaling, and hardening, and billing is based on Pod resource requests. GKE Standard leaves node management with the customer, and Cloud Run does not expose the full Kubernetes API or custom resources.
Designing and planning a cloud solution architecture
11
Select One
A nightly batch job writes checkpoints to Cloud Storage and can resume after an interruption. Cost is the main concern, and finishing an hour later is acceptable. Which compute design fits best?
Standard VMs covered by a three-year committed use discount sized for the job
Sole-tenant nodes reserved for the batch job's exclusive use
Standard VMs in a managed instance group that keeps peak capacity running all day
Spot VMs with restart logic that resumes from the latest checkpoint
D
Spot VMs offer the deepest discounts for fault-tolerant work, and checkpoints make preemption acceptable. A three-year commitment suits steady usage rather than a nightly job, and sole-tenant nodes and always-on peak capacity cost more.
Designing and planning a cloud solution architecture
10
Select One
Before planning a data center migration, a company needs an inventory of its on-premises VMs, their utilization, and a cost estimate for running them on Google Cloud. Which service should the architect use first?
Migration Center discovery and assessment
Migrate to Virtual Machines, replicating every VM to begin testing
Storage Transfer Service for the VMs' disk images
Database Migration Service for every server in the data center
A
Migration Center discovers assets, collects utilization data, and produces cost estimates to support migration planning. Migrate to Virtual Machines performs migrations after planning, and the transfer and database services do not assess a VM estate.
Designing and planning a cloud solution architecture
9
Select One
A global inventory service needs a relational schema, strongly consistent transactions, and horizontal write scaling across multiple regions. Which database should the architect choose?
Cloud SQL for PostgreSQL with cross-region read replicas
AlloyDB for PostgreSQL with a cross-region secondary cluster
Spanner with a multi-region instance configuration
Firestore in Native mode with a multi-region location
C
Spanner provides relational schemas, strongly consistent transactions, and horizontal scale, and multi-region configurations replicate across regions. Cloud SQL and AlloyDB secondaries are read-only, and Firestore is a document database rather than a relational one.
Designing and planning a cloud solution architecture
8
Select One
Altostrat Media wants concise summaries generated automatically for podcasts, interviews, and documentaries stored in Cloud Storage. The team wants to avoid building and training its own models. Which approach fits best?
Train a custom summarization model from scratch on GKE nodes with GPUs
A multimodal Gemini model on Agent Platform, reading the media from Cloud Storage
Speech-to-Text transcripts saved as the summary for each file, with no further processing
A BigQuery ML linear regression model trained on viewing statistics
B
Gemini models accept audio, video, and documents and can summarize them without custom training, matching the case's summarization requirement. Training from scratch is costly, a raw transcript is not a summary, and regression does not generate text.
Designing and planning a cloud solution architecture
7
Select One
Altostrat Media is launching a customer-facing chatbot built on a large language model. Security requires screening user prompts for prompt injection and screening model responses for harmful content before they reach users. Which control addresses this directly?
Google Cloud Armor security policies on the chatbot's load balancer
A VPC Service Controls perimeter around the project that hosts the model
Sensitive Data Protection inspection of every prompt for credit card numbers
Model Armor templates applied to prompts and responses
D
Model Armor screens LLM prompts and responses for prompt injection, jailbreaks, harmful content, and sensitive data. Cloud Armor protects web traffic at the load balancer, VPC Service Controls prevent data exfiltration, and credit card inspection alone is too narrow.
Designing for security and compliance
6
Select One
Altostrat Media wants to lower Cloud Storage costs for its growing media library. Access patterns vary widely: some content stays popular for years while most is rarely viewed after release. Content must stay highly available. Which approach fits best?
Enable Autoclass on the media buckets
Move every object to Coldline storage as soon as it is uploaded
Store the media on Persistent Disk volumes attached to the GKE nodes
Move all buckets to a single region to avoid multi-region storage pricing
A
Autoclass moves each object to colder storage classes based on its actual access and back to Standard when it is read, which suits unpredictable patterns. Coldline everywhere adds retrieval costs for popular content, and a single region reduces availability.
Managing and provisioning a cloud solution infrastructure
5
Select One
EHR Healthcare manages users in Microsoft Active Directory. Employees should sign in to Google Cloud with their existing corporate credentials, and access should end automatically when an account is disabled in AD. What should the architect recommend?
Create separate Google accounts manually and ask employees to set new passwords
Deploy Managed Service for Microsoft Active Directory and join it to the corporate forest for console sign-in
Federate Cloud Identity with AD: sync accounts with Google Cloud Directory Sync and use SAML SSO
Give each employee a service account key that maps to their AD user name
C
Directory Sync provisions and deprovisions users from AD, and SAML SSO keeps AD as the source of credentials. Managed Microsoft AD supports AD-dependent workloads but does not provide console sign-in, and service account keys are not user credentials.
Designing for security and compliance
4
Select One
EHR Healthcare wants to reduce database administration costs for its MySQL and Microsoft SQL Server workloads while meeting its 99.9% availability target. The applications should need minimal changes. Which option fits best?
Cloud SQL for MySQL and Cloud SQL for SQL Server with high availability
Self-managed MySQL and SQL Server on Compute Engine VMs with regional disks
Spanner for both workloads after rewriting the data access layer
Bigtable for both workloads, with the schemas redesigned as wide-column tables
A
Cloud SQL supports both engines as managed services, and its regional high-availability configuration supports a 99.9% target with minimal application change. Self-managed VMs keep the administration burden, and Spanner or Bigtable would require rewrites.
Designing and planning a cloud solution architecture
3
Select One
EHR Healthcare's alerts are sent by email and are often ignored, and the company wants consistent logging, log retention, monitoring, and alerting. Which approach best addresses this?
Keep the existing open-source tools and forward their alert emails to a shared mailbox
Export all logs to BigQuery and ask teams to run daily queries to find incidents
Enable Cloud Trace on the containerized applications and remove other monitoring
Central logging with set retention, and alerts routed to on-call channels
D
Cloud Logging buckets with configured retention and Cloud Monitoring alerting policies with suitable notification channels, such as a paging service, give consistent and actionable alerting. Forwarding the same emails, relying on manual queries, or using only tracing does not fix ignored alerts.
Ensuring solution and operations excellence
2
Select One
For EHR Healthcare, which connectivity design best meets the requirement for a secure, high-performance connection between the on-premises insurance integrations and Google Cloud?
HA VPN tunnels over the public internet between the data center and a Cloud Router
Redundant Cloud Interconnect connections, with Cloud Router and dynamic routing
Direct Peering with Google at the nearest edge location for all integration traffic
A single Classic VPN tunnel with static routes for each insurance provider's subnet
B
Cloud Interconnect provides private, high-bandwidth, low-latency connectivity, and redundant connections support the availability target. HA VPN is secure but limited by internet paths and tunnel throughput, and Direct Peering reaches Google public services rather than VPC networks. Interconnect traffic is private but not encrypted by default; if encryption is required, add MACsec for Cloud Interconnect or HA VPN over Cloud Interconnect.
Managing and provisioning a cloud solution infrastructure
1
Select One
.png)
.svg)
