Step2Study

Professional Cloud Architect practice questions

230 free questions with answers and explanations.

Practice test
  1. 151.A global pharmaceutical company is building a research data platform on Google Cloud that will store highly sensitive patient genomic data. They need to ensure that the data is protected from unauthorized access and exfiltration, even by privileged Google Cloud administrators. The company also requires that data access is restricted to specific applications running within a tightly controlled perimeter, preventing data movement to unauthorized networks. Which Google Cloud security service is purpose-built to address these requirements?Design for security and compliance
  2. 152.A healthcare provider is deploying a new patient records application on Google Cloud. The application will store Protected Health Information (PHI) and must comply with HIPAA regulations, which mandate strict access controls, auditability, and data integrity. The provider wants to implement a robust identity and access management strategy that aligns with the principle of least privilege, ensuring that users only have the minimum necessary permissions to perform their job functions. Which Google Cloud IAM feature is most appropriate for assigning granular permissions based on predefined job roles?Design for security and compliance
  3. 153.A large enterprise is migrating a highly regulated application to Google Cloud. This application processes sensitive personal data and requires strict controls over how data is processed, stored, and accessed. Due to compliance requirements, the customer must have explicit control and visibility over the encryption key lifecycle, including key generation, storage, and revocation, and must be able to prove that Google personnel cannot access the unencrypted data without explicit customer approval and audit trails. Which Google Cloud security feature best addresses these requirements for data in Google Cloud services?Design for security and compliance
  4. 154.A public sector agency is migrating its highly sensitive citizen data application to Google Cloud. They need to implement a security model where every access request, regardless of its origin (internal or external network, human or machine), is explicitly verified against context-aware policies before granting access. This model must consider device posture, user identity, and resource attributes. Which Google Cloud security framework is designed to achieve this 'never trust, always verify' approach?Design for security and compliance
  5. 155.A global financial institution is migrating its on-premises data centers to Google Cloud. They handle highly sensitive customer financial data and are subject to strict regulatory compliance requirements, including GDPR, CCPA, and PCI DSS. The institution needs to ensure that all data at rest is encrypted with customer-managed encryption keys (CMEK) and that key access is tightly controlled, audited, and geographically restricted to specific regions. They also require the ability to revoke access to data by disabling the encryption keys. Which Google Cloud service should be used to meet these key management requirements?Design for security and compliance
  6. 156.A financial services company is building a new application on Google Cloud that will process highly sensitive customer transaction data. They need to ensure that this data is isolated from the public internet and that all network traffic between their on-premises data centers and Google Cloud, as well as between services within Google Cloud, is private and secure, without exposing data to the public internet. Which Google Cloud networking service is primarily designed to create a secure, private perimeter for sensitive data and services?Design for security and compliance
  7. 157.A SaaS provider is building a multi-tenant application on Google Cloud. Each tenant's data and resources must be strictly isolated from other tenants, and the provider needs to apply different security policies and billing to each tenant. To achieve this, each tenant will have its own dedicated set of Google Cloud resources. Which organizational construct within Google Cloud is best suited to provide this strict isolation and independent management for each tenant?Design for security and compliance
  8. 158.A financial institution is migrating its core banking application to Google Cloud. They have a stringent compliance requirement to ensure that all sensitive customer data (e.g., account numbers, personally identifiable information) stored in Cloud Storage and BigQuery is automatically discovered, classified, and protected from accidental exposure or unauthorized sharing. They need a service that can scan existing data and continuously monitor new data for sensitive information. Which Google Cloud service is designed for this purpose?Design for security and compliance
  9. 159.A large enterprise is building a data lake on Google Cloud using Cloud Storage and BigQuery. They need to ensure that all data stored in these services is encrypted at rest using customer-supplied encryption keys (CSEK) for specific highly sensitive datasets, allowing them to manage their own encryption keys directly. They want to avoid using Google-managed or customer-managed encryption keys (CMEK) for these particular datasets, as their compliance framework mandates direct key control. How can this requirement be met for Cloud Storage?Design for security and compliance
  10. 160.A global enterprise needs to ensure that all their Google Cloud resources adhere to specific data residency requirements, mandating that customer data for European users must physically reside and be processed only within the EU. They also need to restrict where new resources can be deployed to enforce these geographical constraints. Which Google Cloud service and configuration should they utilize to meet these compliance mandates?Design for security and compliance
  11. 161.A software development company is building a new microservices application on Google Kubernetes Engine (GKE). They need a private Docker registry to store their container images securely and reliably. The registry must integrate with their CI/CD pipeline, allow fine-grained access control, and be highly available across regions. Which Google Cloud service should they use?Manage and provision solution infrastructure
  12. 162.A retail company is expanding its online presence globally and needs to ensure that its web application is highly available and responsive to users worldwide. The application uses a multi-region deployment on Google Kubernetes Engine (GKE). You need to configure a single global IP address for the application, with intelligent routing to the nearest healthy backend. Which Google Cloud load balancing solution should you use?Manage and provision solution infrastructure
  13. 163.A company is designing a new globally distributed application on Google Cloud that requires a highly scalable, strongly consistent, and transactional database. The application needs to handle millions of reads and writes per second with low latency across multiple continents. It also needs to support standard SQL for querying. Which Google Cloud database service should they choose?Manage and provision solution infrastructure
  14. 164.A financial services company is migrating its on-premises data warehouse to Google Cloud. They require a fully managed, petabyte-scale data warehouse that can handle complex analytical queries with high performance and support standard SQL. They also need to ensure data security and compliance with financial regulations. Which Google Cloud service is the most appropriate for this requirement?Manage and provision solution infrastructure
  15. 165.A large enterprise with a complex on-premises network is migrating several mission-critical applications to Google Cloud. These applications require dedicated, low-latency, and high-bandwidth connectivity to the on-premises data center. They also need to maintain private IP communication between the on-premises network and Google Cloud. Which network connectivity solution should they choose?Manage and provision solution infrastructure
  16. 166.A software development company is migrating its CI/CD pipelines to Google Cloud. They need a highly available and durable file storage solution that can be mounted by multiple Compute Engine instances simultaneously for build artifacts, shared configurations, and source code. The solution must support the NFS protocol. Which Google Cloud storage service meets these requirements?Manage and provision solution infrastructure
  17. 167.A security-conscious organization needs to ensure that all their Google Cloud resources (Compute Engine, Cloud Storage, BigQuery) are protected from data exfiltration and unauthorized access, especially when accessed from external networks. They want to create a security perimeter that restricts data access to only authorized services and IP ranges, even if an attacker compromises credentials. Which Google Cloud security control should they implement?Manage and provision solution infrastructure
  18. 168.A data analytics company needs to process large datasets (petabytes) for daily batch jobs. These jobs are computationally intensive, can tolerate interruptions, and require significant compute resources for only a few hours each day. The company wants to minimize costs. Which Compute Engine instance type and provisioning model should they use?Manage and provision solution infrastructure
  19. 169.A research institution is running computationally intensive simulations using numerous virtual machines on Compute Engine. They need to minimize the cost of these long-running, fault-tolerant workloads that can be interrupted and restarted without significant impact. Which type of Compute Engine instance is most cost-effective for this use case?Manage and provision solution infrastructure
  20. 170.A global gaming company is developing a new real-time multiplayer game. The game backend requires a database that can handle extremely high read and write throughput, provide low-latency access to player data from anywhere in the world, and scale horizontally to support millions of concurrent players. The data model is mostly key-value with some document-like structures, and strong consistency is not always required for all operations. Which Google Cloud database service should they choose?Manage and provision solution infrastructure
  21. 171.A research institution is running computationally intensive simulations that require a large number of virtual machines (VMs) for a few hours daily. These simulations are fault-tolerant and can be interrupted and restarted without significant loss of progress. The institution needs to minimize costs while maintaining sufficient compute capacity. Which type of Compute Engine VM instance should they primarily use?Manage and provision solution infrastructure
  22. 172.A media company is building a new content delivery platform on Google Cloud. They need to store large video files (several terabytes each) that are accessed frequently for streaming, requiring high throughput and low latency. The files must be highly durable and available across a region. Which Google Cloud storage class and location type should they choose?Manage and provision solution infrastructure
  23. 173.A healthcare provider is storing patient records in Cloud Storage. Due to strict regulatory compliance (e.g., HIPAA), they need to ensure that all data at rest is encrypted with customer-managed encryption keys (CMEK) and that access to these keys is tightly controlled and auditable. Which Google Cloud service combination should be used to manage the encryption keys and enforce access policies?Manage and provision solution infrastructure
  24. 174.A financial services company needs to process daily batch jobs that analyze market data. These jobs are computationally intensive, can tolerate flexible execution times (e.g., within a 24-hour window), and need to minimize infrastructure costs. The company wants to leverage machine images for consistent environments. Which Google Cloud compute solution should they use?Manage and provision solution infrastructure
  25. 175.A company is deploying a multi-region application on Google Cloud and needs to ensure that user traffic is directed to the closest healthy backend instance to minimize latency. They also require protection against DDoS attacks and advanced traffic management capabilities like URL-based routing. Which type of Cloud Load Balancing should they implement?Manage and provision solution infrastructure
  26. 176.A global IoT company collects vast amounts of time-series data from millions of devices. They need to ingest this data in real-time, process it to extract insights, and store it for long-term analysis. The solution must be highly scalable, fault-tolerant, and handle high throughput. Which combination of Google Cloud services would be most appropriate for this data pipeline?Manage and provision solution infrastructure
  27. 177.A financial services company is migrating its on-premises transactional database to Google Cloud. The database needs to support strong ACID properties, horizontal scalability across regions, and high availability with synchronous replication to ensure zero data loss in case of a regional outage. Which Google Cloud database service should the company choose?Manage and provision solution infrastructure
  28. 178.A global media company needs to store petabytes of video archive data that is rarely accessed (less than once a year) but must be retained for regulatory compliance for decades. When access is required, retrieval latency of a few minutes is acceptable. The company wants to minimize storage costs. Which Cloud Storage class should they choose?Manage and provision solution infrastructure
  29. 179.An analytics team needs to process massive datasets (petabytes) for complex, ad-hoc queries and generate business intelligence reports. The data is structured and semi-structured. They require a fully managed, serverless data warehouse that can scale automatically to handle fluctuating workloads, provide high query performance, and support standard SQL. Which Google Cloud service should they choose?Manage and provision solution infrastructure
  30. 180.A global gaming company is developing a new real-time multiplayer game. The game backend requires a low-latency, highly scalable database that can handle millions of concurrent read and write operations per second with predictable performance. The data model is relatively simple, consisting of key-value pairs representing player profiles and game state. Which Google Cloud database service is most suitable for this use case?Manage and provision solution infrastructure
  31. 181.A data analytics company processes large volumes of streaming data from IoT devices. They need a highly scalable, fully managed service to ingest and process this data in real-time before storing it in BigQuery for further analysis. The solution must support high throughput and low latency. Which Google Cloud service should they use for data ingestion and real-time processing?Manage and provision solution infrastructure
  32. 182.A software development company is building a new microservices application on Google Kubernetes Engine (GKE). They need to ensure that their application containers can pull images from a private container registry securely and efficiently, without exposing credentials directly in their Kubernetes manifests. Which Google Cloud service should they use for storing and managing their container images?Manage and provision solution infrastructure
  33. 183.A global e-commerce company is deploying a new web application on Google Cloud. The application will serve users worldwide and requires extremely low latency for content delivery, protection against DDoS attacks, and efficient caching of static assets at the edge. Which Google Cloud service should be used to meet these requirements?Manage and provision solution infrastructure
  34. 184.A media streaming company needs to deploy a global application with low-latency access for users worldwide. The application requires a highly available and consistent database that can scale horizontally across regions. Which Google Cloud database is best suited for this scenario?Manage and provision solution infrastructure
  35. 185.A manufacturing company is collecting sensor data from thousands of IoT devices globally. This data needs to be ingested in real-time, processed for anomalies, and stored for long-term analysis. The solution must be highly scalable, handle unpredictable spikes in data volume, and integrate seamlessly with other Google Cloud analytics services. Which architecture should they implement for the ingestion and initial processing of this streaming data?Manage and provision solution infrastructure
  36. 186.A global media company is migrating its video transcoding pipeline to Google Cloud. They need a highly scalable and cost-effective storage solution for large media files (hundreds of terabytes) that are accessed infrequently after an initial processing phase. The files must be durable and available across multiple regions for disaster recovery. Which Google Cloud storage class is most appropriate for this scenario?Manage and provision solution infrastructure
  37. 187.An organization is deploying a new application that requires a database with ACID transactions, strong consistency, and high availability, capable of scaling globally across multiple regions. The data model is relational, and the application anticipates rapid growth in data volume and transaction rate. Which Google Cloud database service should you recommend?Manage and provision solution infrastructure
  38. 188.A large e-commerce company is migrating its monolithic on-premises application to a microservices architecture on Google Kubernetes Engine (GKE). They need a persistent storage solution for their databases and stateful services that can be accessed by multiple pods concurrently, with high performance and low latency. The storage should also be highly available and support automatic failover within the GKE cluster. Which Google Cloud storage solution should they choose?Manage and provision solution infrastructure
  39. 189.A financial services company processes sensitive customer data and must adhere to strict regulatory compliance standards. They need to ensure that all data at rest in their Cloud Storage buckets is encrypted with customer-managed encryption keys (CMEK) and that access to these keys is tightly controlled. Which IAM role, at a minimum, is required for a service account to encrypt and decrypt objects using a CMEK key in Cloud KMS?Manage and provision solution infrastructure
  40. 190.A large enterprise is migrating its on-premises data warehouse to BigQuery. The existing data warehouse has complex ETL processes that involve orchestrating hundreds of interdependent jobs, conditional logic, and error handling. The company needs a fully managed service on Google Cloud to manage and monitor these workflows, integrating with various Google Cloud services and external systems. Which service should they use?Manage and provision solution infrastructure
  41. 191.An e-commerce company experiences significant traffic spikes during sales events, requiring their web servers to scale rapidly. They use Compute Engine instances and need to ensure that their application remains highly available and responsive during these peaks. What is the most effective approach to automatically scale their web server instances to handle fluctuating demand?Manage and provision solution infrastructure
  42. 192.A global media company is building a new content distribution platform on Google Cloud. They need to process large volumes of video and audio files, perform transcoding, and distribute content to various regions. The processing pipeline involves several steps, including ingestion, format conversion, quality checks, and packaging. They need a scalable, cost-effective solution for orchestrating these complex, long-running workflows with dependencies between tasks. Which Google Cloud service should they use?Manage and provision solution infrastructure
  43. 193.A large enterprise with a complex on-premises network is migrating a critical application to Google Cloud. The application needs to communicate with several existing services in different VPC networks within the same Google Cloud project, and also with on-premises resources via a Cloud VPN tunnel. All traffic between these networks must be routed efficiently without requiring individual VPN tunnels or peering connections for each service. Which networking feature should you implement to simplify routing?Manage and provision solution infrastructure
  44. 194.A company is designing a new microservices architecture on Google Kubernetes Engine (GKE). They need to ensure that traffic from the internet is routed to the correct GKE services and that external load balancing is handled efficiently. Which Google Cloud networking component is primarily responsible for exposing GKE services to external traffic and providing global load balancing?Manage and provision solution infrastructure
  45. 195.A healthcare provider is storing patient records in Cloud Storage and needs to ensure that access to these sensitive files is strictly controlled and audited. They require fine-grained access control based on user roles and the ability to track who accessed which file and when. Which combination of Google Cloud security features should they primarily use?Manage and provision solution infrastructure
  46. 196.A security-conscious organization needs to ensure that all virtual machine instances in their Google Cloud projects can only access a specific set of external Google APIs (e.g., Cloud Storage, BigQuery) and are prevented from accessing any other internet resources. They also need to ensure that no data can be exfiltrated to unauthorized external locations. Which security control should be implemented?Manage and provision solution infrastructure
  47. 197.A media company is building a new video processing pipeline on Google Cloud. They need a highly scalable, fully managed, serverless platform to run custom video encoding and transcoding jobs. These jobs are event-driven, triggered by new video uploads to Cloud Storage, and can take varying amounts of time to complete. Which Google Cloud service should they use?Manage and provision solution infrastructure
  48. 198.A multinational corporation needs to establish secure, high-bandwidth connectivity between its on-premises data centers in Europe and Asia and its Google Cloud VPC networks. The solution must provide dedicated, low-latency connections, bypass the public internet, and support enterprise-grade service level agreements (SLAs). Which Google Cloud networking product should they choose?Manage and provision solution infrastructure
  49. 199.A security-conscious organization requires all outbound internet traffic from their Compute Engine instances to pass through a centralized set of security appliances (e.g., firewalls, IDS/IPS) hosted in a dedicated VPC. They want to avoid assigning public IP addresses to their application instances. How should they configure their network to enforce this traffic flow?Manage and provision solution infrastructure
  50. 200.A global IoT company collects vast amounts of time-series data from millions of devices worldwide. They need a highly scalable, real-time data ingestion pipeline that can handle millions of events per second, process the data with custom business logic, and store it for both real-time dashboards and long-term analytics. Which combination of Google Cloud services should they use?Manage and provision solution infrastructure