Google Cloud Associate Cloud Engineer Practice Test – 311 Free Exam Questions with Answers

Correct answer: A. Grant the developer the roles/iam.serviceAccountTokenCreator role on the service account and instruct them to use the –impersonate-service-account flag.

Granting the Token Creator role enables the developer to generate short-lived credentials via impersonation. Downloading JSON or P12 keys introduces severe security risks, while the Service Account User role only allows attaching identities to resources, not local impersonation.

Correct answer: A. Configure Workload Identity to bind the Kubernetes Service Account (KSA) to a Google Service Account (GSA) with the Artifact Registry Reader role.

Configuring Workload Identity allows pods to securely impersonate a dedicated Google service account without managing long-lived keys. For the exam, always select Workload Identity over static JSON keys or node-level configurations to enforce least privilege in GKE.

Correct answer: D. Configure a Lifecycle rule to change the storage class to Archive Storage after 60 days.

Configuring an object lifecycle rule to transition logs to Archive Storage directly minimizes costs for long-term, rarely accessed compliance data. Moving files to Standard Storage or BigQuery increases expenses, as those services are optimized for frequently accessed, active workloads.

Correct answer: C. Cloud Bigtable

Cloud Bigtable is the correct choice because it handles massive write throughput and time-series workloads with sub-millisecond latency. BigQuery is optimized for analytical reporting rather than real-time ingestion, and Cloud SQL cannot scale efficiently to millions of writes per second.

Correct answer: B. Enable detailed usage cost data export to BigQuery.

Enabling detailed usage cost data export to BigQuery automatically streams granular billing data for SQL analysis. Exporting to Google Sheets or downloading CSVs lacks the necessary automation, while using the API requires unnecessary custom pipeline maintenance.

Correct answer: C. Configure an Organization Policy with the gcp.resourceLocations constraint and set the allowed values to the European regions.

Configuring an Organization Policy with the gcp.resourceLocations constraint immediately prevents resource creation outside allowed regions. IAM conditions or deny policies require massive administrative overhead, while reactive deletion functions fail to block non-compliant resources immediately.

Correct answer: D. Workload A: Cloud TPU. Workload B: GPU.

Cloud TPUs are optimized for large-scale matrix operations with fixed shapes, making them perfect for Workload A. GPUs are the correct choice for Workload B because they handle custom PyTorch operations and rapid iteration without the overhead of graph compilation.

Correct answer: B. Run the job on Compute Engine Spot VMs and use a shutdown script to save the checkpoint.

Running the job on Compute Engine Spot VMs minimizes costs while handling preemption via checkpointing. Shut down scripts capture the preemption notice to save progress, whereas serverless options like Cloud Run or App Engine lack the cost efficiency for long-running batch jobs.

Correct answer: C. Deploy Managed Instance Groups (MIGs) in each region and add them as backends to a Global External HTTP(S) Load Balancer.

A Global External HTTP(S) Load Balancer provides a single anycast IP and instantly routes traffic to the closest healthy region. DNS-based routing relies on TTLs causing delays during failover, and Cloud CDN alone lacks the necessary health checking backend routing capabilities.

Correct answer: B. compute.instances.get and compute.instances.list

Including compute.instances.get and list grants strictly read-only access to view machine configurations. Granting start, stop, or wildcard permissions violates the requirement, while setMetadata is a write operation that could allow unauthorized privilege escalation.

Correct answer: B. Create a firewall rule with the target service account of the database VMs and source service account of the application VMs.

Using service accounts for both source and target filtering ensures only the specific application VMs access the database. Network tags present security vulnerabilities since users could attach them to unauthorized machines, while static IPs break during autoscaling.

Correct answer: B. Create a Log Router sink to export the audit logs to a BigQuery dataset.

Creating a Log Router sink to BigQuery satisfies both long-term retention and complex SQL analysis requirements. Cloud Storage archives logs but complicates SQL queries, while relying on Cloud Logging's custom retention is expensive and less analytically capable.

Correct answer: C. Create a VPC Network Peering connection between the two VPC networks.

VPC Network Peering provides internal IP connectivity between two networks, keeping traffic on Google's private backbone with minimal latency. Shared VPC requires complex resource migration to a host project, resulting in significantly higher operational overhead than peering.

Correct answer: B. kubectl rollout undo deployment/frontend-app

The kubectl rollout undo command instantly reverts a deployment to its previous stable revision using built-in history. Applying an older YAML file works technically but requires locating the exact file, which introduces unnecessary delay during a production outage.

Correct answer: A. Enable Uniform Bucket-Level Access (UBLA) on the bucket.

Enabling Uniform Bucket-Level Access disables Access Control Lists, ensuring permissions are managed exclusively through bucket-level IAM policies. Setting default object ACLs to private leaves the ACL system active, meaning users could still modify individual object permissions later.

Correct answer: D. Configure a Cloud Monitoring Alerting Policy with a metric threshold condition for the MIG, setting the duration to 5 minutes.

A Cloud Monitoring Alerting Policy natively tracks infrastructure metrics and sends notifications when sustained thresholds are breached. Writing custom Cloud Run Functions to poll APIs duplicates existing managed services and introduces unnecessary code maintenance.

Correct answer: C. Use Premium Tier for the production project and Standard Tier for the development project.

Premium Tier routes traffic over Google's private global backbone using cold-potato routing, providing the lowest latency for your production environment. Standard Tier uses cheaper public ISP routing, making it the most cost-effective choice for your development environment where performance is less critical.

Correct answer: B. Create separate repositories for Maven and npm, as each Artifact Registry repository supports only a single format that cannot be changed after creation

Artifact Registry repositories are immutable and permanently bound to a single format specified at creation. You must create separate repositories for Docker, Maven, and npm packages because Google enforces strict one-to-one mappings between repositories and artifact formats.

Correct answer: B. GKE Autopilot

GKE Autopilot is a fully managed mode where Google handles node provisioning, scaling, and security patching. Standard mode fails the requirements because you still manage the underlying node pools and retain SSH access to the nodes.

Correct answer: A. Create a custom image from the source VM's boot disk and reference this image in your Instance Templates.

Creating a custom image from the boot disk lets you reference it globally within instance templates for immediate deployments. Using startup scripts increases boot times because they must download and install dependencies every time a new VM initializes.

Correct answer: C. Cloud Run with autoscaling and min-instances set to 0.

Cloud Run natively supports scaling to zero when idle and rapidly scales up to handle unpredictable traffic spikes. App Engine Flexible cannot scale to zero, and GKE requires additional tooling to achieve similar scale-from-zero behavior.

Correct answer: C. Create a Snapshot Schedule in Compute Engine with the required frequency and retention policy, and attach it to the persistent disks.

Compute Engine snapshot schedules provide native automated backups with configurable frequencies and retention policies, satisfying the requirements without custom scripts. Avoid cron jobs or Cloud Functions, which require you to write and maintain custom code for creation and deletion.

Correct answer: B. CACHE_ALL_STATIC – automatically caches static content based on Content-Type, even when origin doesn't set cache headers

The CACHE_ALL_STATIC mode caches static content based on Content-Type headers even if the origin provides no cache directives. The USE_ORIGIN_HEADERS mode fails here because the origin currently sets no headers, meaning nothing would be cached.

Correct answer: A. Create a Budget with a Pub/Sub topic, and trigger a Cloud Run Function to remove IAM bindings.

Cloud Budgets can publish notifications to Pub/Sub when spending thresholds are crossed, allowing an automated Cloud Run Function to revoke IAM permissions. Email alerts fail the requirement because they require manual human intervention to enforce the access changes.

Correct answer: A. Configure the firewall rules to use Service Accounts as the source and target.

Using service accounts as targets in VPC firewall rules binds security to VM identity rather than mutable network tags. Tags defined in instance templates work for basic deployments, but service accounts provide stronger cryptographic identity and avoid manual tag management.

Correct answer: C. Enable OS Login by setting the metadata enable-oslogin=TRUE at the project level, and grant developers the roles/compute.osLogin role.

Enabling OS Login links Linux accounts to Google Cloud identities, automatically managing SSH keys through IAM without manual metadata updates. While IAP TCP forwarding secures network connectivity, it does not handle operating system authentication, making OS Login the required component.

Correct answer: C. gcloud config set project my-core-app · E. gcloud auth login

Use gcloud auth login to authenticate interactively with user credentials, and gcloud config set project to define the default project. Avoid application-default login because it provisions credentials for application code libraries rather than the CLI itself.

Correct answer: B. HorizontalPodAutoscaler (HPA)

The HorizontalPodAutoscaler automatically adjusts the number of pod replicas based on observed CPU utilization. The VerticalPodAutoscaler fails this requirement because it adjusts CPU and memory requests instead of scaling the replica count horizontally.

Correct answer: A. Attach a Service Account to the instance with the roles/monitoring.metricWriter role.

Attach a dedicated service account with the monitoring.metricWriter role to grant write permissions via Application Default Credentials. Avoid downloading JSON keys, as Google recommends against manual key management when native service account attachment is available.

Correct answer: B. Create a Cloud Armor security policy with a rate-based ban rule that blocks IPs exceeding 100 requests per minute for a specified ban duration

Cloud Armor rate-based ban rules automatically block IPs exceeding a specified request threshold, mitigating DDoS attacks at the network edge. Manually adding deny rules fails the automation requirement because it is reactive and cannot scale against rapidly changing attackers.

Correct answer: C. Use Google Cloud Managed Service for Apache Kafka.

Google Cloud Managed Service for Apache Kafka provides native API compatibility and exactly-once delivery semantics without operational overhead. Self-managing Kafka on Compute Engine or GKE fails the operational efficiency requirement because your team must handle all patching and clustering manually.

Correct answer: B. Grant the roles/compute.instanceAdmin.v1 role to the developer group on the my-app-dev project.

Granting compute.instanceAdmin.v1 on the specific project perfectly enforces least privilege, allowing developers to manage VMs without affecting production. Avoid granting broad primitive roles like Editor, or granting permissions at the organization level, which violates your security boundaries.

Correct answer: C. Use the Reports view in the Cloud Billing Console and group by "Label".

The Reports view in the Cloud Billing Console provides native visualization of cost trends grouped by labels. Exporting to BigQuery is useful for advanced reporting, but it is unnecessary for quickly viewing a month of spending directly in the console.

Correct answer: D. Grant the auditor roles/storage.objectViewer at the organisation level.

Granting roles at the organization level leverages resource hierarchy inheritance, automatically applying permissions to all current and future folders and projects. Granting access at the folder or project level requires repeating the process manually whenever new resources are created.

Correct answer: B. Compute Engine

Compute Engine provides full administrative control over the operating system, allowing you to install specific kernel modules and customize configurations. Fully managed platforms like Cloud Run or App Engine abstract the underlying operating system and restrict kernel-level access.

Correct answer: D. Grant the Compute Engine service account the Service Account Token Creator role on storage-admin@other-project.iam.gserviceaccount.com, then use the generateAccessToken API to create short-lived credentials

Granting the Token Creator role allows the VM service account to impersonate the target account and generate short-lived access tokens. This avoids downloading static JSON keys, which pose security risks, and keeps cross-project access securely auditable.

Correct answer: C. Use the gcloud compute networks subnets expand-ip-range command to increase the prefix length to /21.

The expand-ip-range command lets you increase a subnet capacity in place without disrupting existing running instances. Secondary ranges are only for alias IPs and containers, not for assigning primary internal IPs to new Compute Engine VMs.

Correct answer: A. Config Connector

Config Connector is a Kubernetes add-on that lets you manage Google Cloud resources using standard YAML manifests via kubectl. Terraform flows in the opposite direction, while Deployment Manager uses entirely different configuration templates.

Correct answer: A. Deploy a Memorystore for Redis instance and configure the application to cache results there.

Memorystore for Redis provides a fully managed in-memory caching layer that natively supports the Redis protocol. Self-managing a cluster on GKE or VMs adds unnecessary operational overhead, while Memcached does not support the required protocol.

Correct answer: A. Configure an Object Lifecycle Management rule to downgrade storage class to Nearline after 30 days and to Coldline after 365 days.

Object Lifecycle Management automatically transitions storage classes based on age, minimizing costs without custom code. Jumping directly to Archive after thirty days incurs early deletion fees if accessed before the mandatory year elapses.

Correct answer: B. Create a BI Engine reservation with sufficient memory capacity and designate the key dashboard tables as preferred tables

Creating a BI Engine reservation with preferred tables accelerates repeated dashboard queries by caching table data in memory. BigQuery result caching only works for exact duplicate queries, whereas BI Engine accelerates similar queries across your preferred tables.

Correct answer: B. Configure a Lifecycle rule with the action Delete and condition Age: 90 days.

Configuring a Lifecycle rule with a Delete action and an age condition automatically removes old objects without custom scripts. Retention policies prevent deletion for compliance, which is the exact opposite of the required automatic cleanup behavior.

Correct answer: C. Workforce Identity Federation, by creating a workforce identity pool and an Okta OIDC or SAML 2.0 provider, so employees can use SSO with short-lived tokens and no Cloud Identity accounts are required.

Workforce Identity Federation allows employees to sign in using external identity providers with short-lived tokens, avoiding separate Cloud Identity accounts. Workload Identity Federation is designed for automated workloads and code pipelines, not interactive human users.

Correct answer: B. Gemini Enterprise Agent Platform, which provides managed custom model training and a fully managed online prediction service that deploys models to endpoints without requiring infrastructure management.

Vertex AI provides a fully managed environment for custom model training and deploys models to online prediction endpoints without infrastructure management. BigQuery ML is excellent for training models using SQL on structured data but does not serve real-time custom TensorFlow endpoints.

Correct answer: B. Apply a specific network tag (e.g., web-app) to the application VMs. Create a VPC firewall rule allowing ingress traffic to subnet-b from the source tag web-app.

Applying a network tag to your application VMs and using it as the source in a firewall rule provides the required strict access control. Filtering by subnet range is too broad because it would allow future VMs in that subnet to access the database.

Correct answer: B. AlloyDB for PostgreSQL

AlloyDB for PostgreSQL is fully managed and delivers high transaction throughput while maintaining one hundred percent compatibility with native PostgreSQL extensions. Spanner's PostgreSQL interface lacks support for stored procedures, requiring substantial application refactoring.

Correct answer: D. Gemini CLI, an open-source AI agent that runs in the terminal and uses a reason-and-act loop to complete coding tasks, run commands, and manipulate files through natural-language prompts.

Gemini CLI is an open-source AI agent that runs locally in your terminal to manipulate files and execute commands. Gemini Cloud Assist operates exclusively within the Google Cloud console and cannot interact with your local codebase.

Correct answer: B. Create separate Terraform directories (or workspaces) for each environment and reuse shared modules for infrastructure resources.

Using separate directories with shared modules ensures complete state isolation and minimizes code duplication. Monolithic files with conditional logic create a massive blast radius, and using a single project violates the requirement for strict environmental isolation.

Correct answer: D. Disable billing on the project.

Disabling billing on the project immediately stops all billable services and terminates running compute resources. Deleting the compromised service account halts new authentications, but existing access tokens remain valid for up to an hour, so disabling billing is the fastest way to stop incurring charges.

Correct answer: B. A URL Map to define routing rules for incoming requests. · D. A Backend Service with a configured health check.

A backend service distributes traffic by relying on health checks to route requests only to available instances. The URL map is also mandatory because it defines the routing rules that direct incoming requests to the correct backend service.

Correct answer: B. Use VM Manager to apply an OS policy that installs and configures the Ops Agent on all VMs.

Applying an OS policy via VM Manager installs and configures the Ops Agent at scale without manual SSH access. Startup scripts only run during boot, meaning they cannot easily update the agent on already running instances.

Correct answer: D. resource.type="gce_instance" AND resource.labels.instance_id="[INSTANCE_ID]" AND severity="ERROR" (Assume [INSTANCE_ID] matches web-server-1)

The correct filter uses the exact resource type and the numeric instance ID along with the structured severity field. Filtering by the instance name fails because the labels require the unique numeric identifier rather than the human-readable string.

Correct answer: B. Create a Google Service Account (GSA) with the roles/storage.objectCreator role, bind it to a Kubernetes Service Account (KSA) using Workload Identity, and annotate the KSA.

Workload Identity federates Kubernetes service accounts with Google service accounts to provide short-lived, automatically rotating credentials. Avoid downloading static JSON keys because managing long-lived secrets introduces severe security risks and violates Google Cloud best practices.

Correct answer: A. Configure a Storage Transfer Service job with a daily schedule.

Storage Transfer Service natively supports scheduled, incremental syncs between Cloud Storage buckets without managing custom code. Avoid building custom pipelines with Cloud Composer or Cloud Run because they introduce unnecessary operational overhead for a straightforward transfer job.

Correct answer: C. Deploy a Cloud Run job and schedule it using Cloud Scheduler to run at 2 AM daily

Cloud Run jobs are specifically designed for run-to-completion batch tasks that don't require HTTP requests, stopping automatically when finished. Pairing them with Cloud Scheduler handles the timing perfectly, whereas Cloud Run services bill continuously for idle compute.

Correct answer: C. Create a reusable Terraform module for the shared infrastructure and use separate .tfvars files to supply environment-specific values.

Using a reusable Terraform module with separate tfvars files prevents duplication while allowing environment-specific customization. Avoid managing all environments in a single state file with conditional logic, as this increases complexity and blast radius.

Correct answer: D. Use Cloud Batch to define the job requirements and let it automatically provision and scale the instances.

Cloud Batch is a fully managed service that handles resource provisioning, scheduling, and queuing for massive parallel tasks automatically. Deploying a standard Google Kubernetes Engine cluster would violate the requirement by forcing you to manage the underlying infrastructure.

Correct answer: B. Use Filestore to provide a fully managed NFS file system mounted to all VMs.

Filestore provides a fully managed Network File System that natively supports concurrent access and POSIX-compliant file locking. Cloud Storage FUSE lacks robust file locking semantics, making it unsuitable for legacy applications requiring strict consistency.

Correct answer: C. The deletion is denied, because IAM evaluates deny policies before allow policies, and a deny always overrides a grant.

Identity and Access Management deny policies are evaluated first and always override allow policies, regardless of hierarchy specificity. A deny policy attached to a parent folder successfully prevents the deletion action, even if the project grants admin rights.

Correct answer: C. Create an IAM Allow Policy with a conditional binding that restricts access based on an Access Level containing the corporate IP.

Identity and Access Management Conditions evaluate access levels to restrict control plane API calls based on the corporate IP address. VPC firewall rules operate at the data plane and cannot restrict Google Cloud API calls like instance creation.

Correct answer: D. Use Compute Engine Spot VMs and implement a shutdown script to save the job state to Cloud Storage upon preemption.

Spot virtual machines offer the deepest compute discounts for fault-tolerant workloads and provide a short termination notice to save state. Committed use discounts are incorrect here because they require paying for continuous capacity you rarely use.

Correct answer: A. Create a Hierarchical Firewall Policy at the Organization level with a "Deny" rule for egress port 25 and set action: deny.

Hierarchical firewall policies let you create centralized deny rules at the organization or folder level that override lower-level VPC firewall rules. Remember that VPC rules are always evaluated after hierarchical policies, ensuring your organization-wide traffic blocks cannot be bypassed by project owners.

Correct answer: A. Use the Filestore Enterprise tier.

Filestore Enterprise tier uses synchronous regional replication across multiple zones, providing automatic failover and a zero recovery point objective. Zonal tiers or manual synchronization tools cannot guarantee zero data loss during an outage, making them unsuitable for strict high-availability requirements.

Correct answer: D. Configure the initial delay (initial-delay-sec) in the MIG's autohealing policy to 45 seconds.

Setting the initial delay in the managed instance group's autohealing policy gives instances a grace period to boot before health checks begin. Simply increasing the health check interval would slow down the detection of genuinely failed instances across your entire application.

Correct answer: A. Configure the application to use Cloud Profiler.

Cloud Profiler continuously collects CPU and memory usage data from production applications, mapping resource consumption directly to specific code functions. Cloud Trace is used for analyzing distributed request latency, not for identifying internal code inefficiencies driving up compute costs.

Correct answer: C. Project Billing Manager (roles/billing.projectManager) on the Project AND Billing Account User (roles/billing.user) on the Billing Account.

Linking a project to an existing billing account requires combined permissions to associate the resources. Project Billing Manager modifies the project's billing association, while Billing Account User grants permission to link projects to the target billing account.

Correct answer: A. kubectl get pods –all-namespaces -o wide

Using the wide output format with the all-namespaces flag is the standard kubectl method to list pods across the cluster alongside their assigned nodes and IP addresses. The gcloud command-line tool queries infrastructure rather than Kubernetes objects running inside the cluster.

Correct answer: A. Configure the Vertical Pod Autoscaler (VPA) in Auto or Recommendation mode to analyze and adjust the pod resource requests.

The Vertical Pod Autoscaler analyzes historical usage and automatically adjusts CPU and memory requests to prevent crashes. Remember the scaling axes: Horizontal scales pod count, Vertical scales pod size, and Cluster Autoscaler scales nodes.

Correct answer: B. Create a new node pool with GPU-enabled machine types and use node selectors or taints to schedule the ML workloads onto it.

Creating a separate node pool with GPU machine types isolates your hardware workloads without disrupting existing applications. GKE automatically taints GPU nodes, ensuring only pods requesting GPUs get scheduled there, preventing wasted resources.

Correct answer: A. Deploy the new revision and use Cloud Run traffic management to route 90% of traffic to the current revision and 10% to the new revision.

Cloud Run provides native traffic splitting capabilities, allowing you to route exact percentages of requests to different revisions. Revision tags create unique testing URLs but do not provide percentage-based routing on the main service endpoint.

Correct answer: C. Configure Workload Identity Federation with a Workload Identity Pool that trusts Okta as an external identity provider. Use attribute mappings and attribute conditions to control which applications can impersonate which Service Accounts based on their Okta claims.

Workload Identity Federation lets external applications use short-lived tokens from providers like Okta to impersonate service accounts. Workforce Identity Federation is for human users, while workload federation handles automated programmatic access.

Correct answer: A. Refactor the container image to use multi-stage builds, pre-installing all dependencies and models into the image during the build process.

Pre-installing dependencies into the container image during the build process eliminates heavy runtime initialization, ensuring fast startup times. Increasing the request timeout does not fix the underlying cold start delay, leaving users waiting.

Correct answer: D. Configure a HorizontalPodAutoscaler object with minReplicas: 3, maxReplicas: 20, and targetCPUUtilizationPercentage: 70.

The Horizontal Pod Autoscaler scales the number of pod replicas up or down based on metrics like CPU utilization. The Vertical Pod Autoscaler adjusts resource requests per pod, while the Cluster Autoscaler provisions underlying nodes.

Correct answer: D. Use Storage Transfer Service with "Transfer Service for on-premises data" agents.

Storage Transfer Service with on-premises data agents is the managed solution optimized for moving terabytes of network data, handling retries and integrity checks natively. Use gsutil only for smaller, ad-hoc transfers because it requires custom scripts and manual error handling.

Correct answer: B. Assign the IAP-Secured Tunnel User (roles/iap.tunnelResourceAccessor) role to the developers and use gcloud compute ssh with the –tunnel-through-iap flag.

The IAP-secured Tunnel User role grants the exact permission needed to route SSH traffic through Identity-Aware Proxy to private VMs. Avoid the IAP Policy Admin role because it manages overall IAP settings rather than granting the actual access needed to establish tunnels.

Correct answer: A. Create a Multi-region bucket. Configure a Lifecycle Rule to SetStorageClass to Archive after 1 day.

A multi-region bucket ensures geo-redundancy, while transitioning objects to Archive storage after one day minimizes costs for data rarely accessed. Choose Nearline or Coldline only for more frequent access patterns, like once per month or once per quarter respectively.

Correct answer: B. Use the Premium Tier for customer-facing services and the Standard Tier for internal or non-critical workloads.

Premium Tier routes traffic over Google's fast, reliable global backbone, making it optimal for user-facing applications. Standard Tier uses public internet routing, costing less and making it perfect for internal or non-critical workloads where latency is less important.

Correct answer: B. Assign the Monitoring Viewer (roles/monitoring.viewer) role to the engineer.

The Monitoring Viewer role grants read-only access to dashboards and metrics without allowing changes to alerting policies, satisfying least privilege. Avoid broad primitive roles like Viewer because they grant unnecessary read access across all project resources.

Correct answer: B. Public Access Prevention · D. Uniform Bucket-Level Access

Enabling Public Access Prevention blocks any attempt to share the bucket publicly, while Uniform Bucket-Level Access disables legacy object ACLs. Remember that Requester Pays handles billing shifts, not security, and fine-grained ACLs actively contradict the requirement.

Correct answer: D. Requirement 1: Workforce Identity Federation. Requirement 2: Workload Identity Federation.

Workforce Identity Federation provides syncless, interactive access for human users needing to authenticate with external corporate identity providers. Workload Identity Federation allows external automated pipelines to exchange OIDC tokens for short-lived Google Cloud access, eliminating risky long-lived keys.

Correct answer: C. Configure the Production environment to use the Premium Tier and the Development environment to use the Standard Tier.

The Premium Tier routes traffic over Google's fast, global backbone network, making it optimal for low-latency, worldwide production applications. The Standard Tier uses lower-cost public internet routing, which is perfectly adequate for regional development environments.

Correct answer: D. Use Secure Tags (IAM-governed tags) bound to the VM instances.

Secure Tags provide IAM governance, ensuring that only authorized principals can attach or modify tags used in firewall policies. Network tags lack IAM controls, allowing VM administrators to bypass security restrictions by altering instance metadata.

Correct answer: C. Use an External Application Load Balancer for the Frontend tier and an Internal Application Load Balancer for the API Backend tier.

An External Application Load Balancer correctly exposes the Frontend tier to the public internet. An Internal Application Load Balancer keeps the API Backend private, ensuring it is only accessible from within the VPC and maintaining proper security segmentation.

Correct answer: C. Create two separate patch deployment policies: one with a Sunday schedule filtering for production VMs, and another with a Friday schedule filtering for development VMs.

Creating separate patch deployment policies allows you to define distinct schedules and target specific VMs using instance filters. Remember that a single policy cannot split schedules dynamically, so separating them by environment is required.

Correct answer: A. –service-account=gke-sa@my-project.iam.gserviceaccount.com

The service account flag configures the specific IAM identity that the cluster nodes use. The impersonate flag only affects the identity running the gcloud command, not the underlying virtual machines being provisioned.

Correct answer: C. Instrument the application to send data to Cloud Trace and analyze the waterfall latency graphs.

Cloud Trace provides distributed tracing that maps out request waterfalls to isolate exact latency bottlenecks across microservices. Cloud Profiler analyzes CPU and memory consumption, which does not effectively track network or wait delays.

Correct answer: A. Configure an Object Lifecycle Management rule with Action: Delete and Condition: Age: 2555 days.

Object Lifecycle Management directly automates the deletion of data based on an age condition, permanently removing objects after the specified days. A retention policy only prevents deletion until the period expires, meaning objects will remain unless manually deleted afterward.

Correct answer: D. Change the billing setting to instance-based billing (CPU always allocated)

Enabling CPU always allocated keeps the CPU available for the container's entire lifecycle, allowing asynchronous background tasks to finish after returning a response. The default request-based billing setting immediately throttles CPU once a response is sent, interrupting execution.

Correct answer: C. Create an OS policy assignment in VM Manager that defines the desired state (packages and files) and sets the mode to enforcement.

OS policies in enforcement mode continuously monitor VMs and automatically remediate configuration drift, such as removed packages. Startup scripts only run during boot, so they cannot fix drift that happens later while the VM is running.

Correct answer: C. Create a Batch Dataflow pipeline.

A Dataflow batch pipeline is optimized for bounded datasets, automatically scaling workers for high throughput and shutting down upon completion. Streaming pipelines are designed for continuous, low-latency data and would leave workers idling.

Correct answer: D. Create an OS policy assignment that installs and validates the agent package on Ubuntu VMs

OS policy assignments in VM Manager allow you to define a desired state, like required packages, and enforce it continuously. Startup scripts only run once at boot, whereas OS policies actively monitor and remediate drift for the VM's lifetime.

Correct answer: B. Grant roles/cloudkms.cryptoKeyEncrypterDecrypter on the CryptoKey in project-kms to the BigQuery service agent for project-data.

Granting the Cloud KMS CryptoKey Encrypter Decrypter role to the BigQuery service agent allows the backend service to perform cryptographic operations. Remember that the human user creating the dataset needs standard BigQuery permissions, not KMS access, because the service agent handles encryption.

Correct answer: C. Create a Google Service Account in project-a, bind it to the GKE workload, and grant this Service Account the roles/cloudsql.client role in project-b.

The Google Service Account should be created in the same project as the GKE workload. You then grant this service account the Cloud SQL Client role in the project hosting the database. Remember that VPC peering handles network connectivity, not IAM authorization.

Correct answer: B. Create a Private Cluster with private nodes and configure Master Authorized Networks restricted to 10.50.0.0/16.

Creating a private cluster ensures that compute nodes only receive internal IP addresses, isolating them from the internet. Configuring Master Authorized Networks restricts control plane access to your specified corporate CIDR block, meeting the network security requirements.

Correct answer: B. gcloud compute instances create web-server-1 –image-family=debian-11 –image-project=debian-cloud –metadata-from-file=startup-script=./setup.sh

The metadata-from-file flag reads the local script content and correctly uploads it as startup-script metadata. Using the standard metadata flag simply passes the literal file path string, preventing the script from executing during the boot process.

Correct answer: C. gcloud storage buckets update gs://my-archive-bucket –lifecycle-file=lifecycle.json

The gcloud storage buckets update command with the lifecycle-file flag correctly applies configurations to existing buckets. Although older questions might feature gsutil, gcloud storage is the current standard, making it the preferred answer.

Correct answer: C. Set the min-instances to 2 or 3 and use Cloud Scheduler to trigger a job that updates this configuration at 9 AM (scale up) and 6 PM (scale down).

Setting minimum instances keeps containers warm to eliminate cold starts, and using Cloud Scheduler to automate this schedule minimizes overnight costs. Keeping ten instances permanently active would prevent cold starts but incurs unnecessary off-hours billing.

Correct answer: C. Add the command kubectl rollout status deployment/web-app after the apply command.

The rollout status command blocks the pipeline until the deployment completes or times out. Using a sleep command is fragile because it uses a hardcoded time rather than checking the actual cluster state.

Correct answer: D. Gemini Cloud Assist, which is embedded in the Google Cloud console and provides contextual AI assistance for troubleshooting and optimizing Google Cloud resources on the current page.

Gemini Cloud Assist is embedded directly in the Google Cloud console and provides contextual troubleshooting and optimization recommendations for your current resource page. The command-line interface operates outside the graphical console and lacks direct contextual awareness of the active webpage.

Correct answer: B. Edit the /etc/google-cloud-ops-agent/config.yaml file. Configure a prometheus receiver in the metrics section pointing to the local endpoint.

The Ops Agent uses a prometheus receiver in its metrics configuration to scrape OpenMetrics endpoints and ingest them into Cloud Monitoring. Avoid writing custom API scripts, as the native receiver handles collection automatically and efficiently.

Correct answer: A. Create an ingress firewall rule with action: allow, sourceServiceAccounts: [Frontend-SA], and targetServiceAccounts: [Backend-SA].

Using source and target service accounts in a firewall rule creates an identity-based security model that seamlessly handles autoscaling. Service accounts are strictly governed by IAM, making them more secure than network tags, which Compute Engine admins can alter.

Correct answer: C. Enable Google Cloud Managed Service for Prometheus on the GKE cluster.

Google Cloud Managed Service for Prometheus provides native PromQL querying and managed collection without the operational overhead of maintaining your own storage. Avoid manually installing the Ops Agent on GKE nodes, as cluster monitoring is handled by system agents.

Correct answer: D. VPC-native cluster (using Alias IPs) · E. Secondary IP ranges for Pods and Services

VPC-native clusters use alias IP ranges, giving pods natively routable VPC addresses for better scalability and enabling pod-level firewall controls. Defining secondary IP ranges for pods and services within the subnet is a required configuration step when setting up this architecture.

Correct answer: A. Agent Runtime on Gemini Enterprise Agent Platform, which provides a fully managed, serverless environment for deploying and scaling agents in production.

Agent Runtime provides a fully managed, serverless environment specifically designed to deploy and scale AI agents in production without infrastructure overhead. While Cloud Run hosts containers, it requires more manual configuration compared to a purpose-built agent runtime.

Correct answer: C. Use a wildcard URI (e.g., gs://my-bucket/export-.csv) in the export destination to split the data into multiple files.

BigQuery enforces a strict one-gigabyte limit for single exported CSV or JSON files. Using a wildcard URI in the destination bucket path shards the output into multiple smaller files, bypassing the limit. This is a standard console operation requiring no extra pipelines or quota increases.

Correct answer: C. Create a Binary Authorization Policy that sets the "enforcement mode" to ENFORCED_BLOCK_AND_AUDIT_LOG and requires the specific Attestor.

Binary Authorization enforces deploy-time security by blocking unsigned images at the GKE control plane based on configured attestors. Pipeline verification alone is insufficient because it cannot prevent users with cluster access from manually deploying unauthorized images outside the build process.

Correct answer: D. The developer retains roles/editor on the project, and additionally inherits any roles that the folder admin or others have granted at the engineering folder level.

Moving a project into a folder does not remove existing project-level role bindings, so the developer retains their editor role. IAM policies are additive and inherited downward, meaning the developer also gains any permissions granted at the new parent folder level.

Correct answer: C. Cloud Run, which is designed for stateless containerised services that scale automatically and require no infrastructure management.

Cloud Run is the managed compute service built specifically for stateless HTTP containers that scale to zero. GKE Autopilot adds Kubernetes complexity that is unnecessary for a single containerized microservice.

Correct answer: B. Enable Secure Boot in the Shielded VM settings.

Secure Boot cryptographically verifies bootloader and kernel signatures, halting the VM if modifications are detected. vTPM only records boot measurements for later analysis without actively blocking compromised software.

Correct answer: A. Enable the Secret Manager add-on for GKE (using the CSI driver). Create a SecretProviderClass referencing the secret, and mount it in the Pod definition.

The Secret Manager CSI driver mounts secrets directly into GKE pods as file volumes while keeping them synchronized. The External Secrets Operator works but typically syncs to native Kubernetes secrets stored in etcd.

Correct answer: B. Create a Folder for each department (Engineering, Marketing, Sales) under the Organization, and nest their respective projects inside. Apply IAM policies at the Folder level.

Folders provide hierarchical isolation and automatic IAM policy inheritance for all nested projects, enforcing governance automatically. Labels are for billing and filtering, not security boundaries, because IAM policies cannot attach to them.

Correct answer: B. Use Cloud Spanner.

Cloud Spanner uniquely combines ACID transactions with global horizontal scalability for regional write throughput. Cloud SQL is restricted to a single primary instance per region, preventing global write scaling.

Correct answer: A. Create a Role with full permissions in the dev namespace. Bind it to the group using a RoleBinding in the dev namespace.

Kubernetes RBAC isolates permissions by using a Role and RoleBinding to restrict access strictly to the dev namespace. Google Cloud IAM roles operate cluster-wide and cannot restrict access to individual Kubernetes namespaces.

Correct answer: C. Create a Serverless VPC Access Connector in the same region and VPC. Configure the Cloud Function to use this connector.

First-generation Cloud Functions require a Serverless VPC Access Connector to route traffic to internal IP addresses. While Direct VPC Egress simplifies this task, you must remember that it is exclusively available for second-generation functions and Cloud Run services.

Correct answer: B. Generate a Signed URL (V4) for the object with a 15-minute expiration. Give the URL to the user.

Generating a Signed URL grants time-limited access to a specific object without requiring a Google account or altering IAM. The cryptographic signature ensures the link expires exactly when configured. Sharing service account keys violates security best practices by providing overly broad access.

Correct answer: D. Enable Object Versioning on the bucket.

Object Versioning maintains a history of object generations, allowing instant restoration of overwritten files. This is the correct choice for recovering from accidental data modifications. Soft Delete and Retention Policies protect against deletions, but do not easily rollback overwrites.

Correct answer: D. Verify domain ownership in the Google Admin console, then create a Cloud Identity or Google Workspace account.

Verifying domain ownership and creating a Cloud Identity or Workspace account automatically provisions the Organization resource. This root node allows you to centrally manage IAM policies and billing. You cannot build an organization upwards from individual projects using a billing migrate tool.

Correct answer: A. In the IAM & Admin > Quotas & System Limits page, select the specific CPU quota, click "Edit Quotas," enter the new limit of 200, and submit the request.

The standard process for requesting more resources is using the Edit Quotas button on the Quotas page. This built-in self-service workflow is the fastest method and often processes automatically. Filing a critical support ticket is intended for active production outages, not standard capacity planning.

Correct answer: D. Use Shared VPC. Designate the Platform project as the "Host Project" and the Application projects as "Service Projects".

Shared VPC allows a host project to share network subnets with service projects without granting network admin rights. Application teams can deploy compute instances using the Network User role but cannot alter firewalls. VPC peering lacks this centralized control and is harder to scale.

Correct answer: B. When publishing, provide an Ordering Key (e.g., product_id). On the Subscription, enable Message Ordering.

Providing an Ordering Key and enabling Message Ordering on the subscription guarantees sequence delivery. Pub/Sub handles this natively when configured correctly. Client-side buffering is an unnecessary anti-pattern, and Google Cloud does not use a distinct FIFO topic type like other clouds.

Correct answer: D. You are exceeding the API Rate Quota (requests per second) for write operations on the bucket.

The 429 error indicates you are hitting the Cloud Storage API write request rate limit. This is a throughput constraint, not a total storage capacity limit. To fix this, you should batch uploads or introduce jitter into your application's upload timing to distribute requests evenly.

Correct answer: B. Enable High Availability (HA) in the instance configuration. This creates a standby instance in a secondary zone and uses synchronous replication.

Enabling High Availability in Cloud SQL provisions a standby instance in a secondary zone with synchronous replication, guaranteeing zero data loss. The failover process is entirely automatic during a zonal outage. Read replicas use asynchronous replication and require manual promotion, risking data loss.

Correct answer: C. Create an Eventarc trigger filtering on the google.cloud.storage.object.v1.finalized event type for the specific bucket.

Eventarc is the native eventing standard for second-generation Cloud Run Functions, providing direct, managed integration with Cloud Storage without requiring manual Pub/Sub configuration. While Pub/Sub notifications remain valid for legacy architectures, Eventarc is the modern, unified approach expected for native integrations.

Correct answer: B. Configure Traffic Splitting by Cookie (GOOGAPPUID). Set version v2 to 10% and v1 to 90%.

Splitting traffic by cookie guarantees session affinity by issuing a unique tracking cookie to the client, ensuring a user remains on the same version. IP address splitting is imprecise because corporate proxies and mobile networks cause IP changes, breaking session consistency.

Correct answer: A. Grant the developer the Service Account Token Creator role on the privileged Service Account. Instruct them to use gcloud auth print-access-token –impersonate-service-account.

Granting the Service Account Token Creator role enables impersonation, allowing the developer to generate short-lived access tokens without handling static keys. Generating a temporary key violates the strict policy because the downloaded JSON file risks leakage and persists until manually deleted.

Correct answer: B. Initiate a Point-in-Time Recovery (PITR) to a new Cloud SQL instance, specifying the timestamp 9:55 AM. Once verified, export the data and import it back to the primary, or promote the new instance.

Point-in-time recovery creates a new Cloud SQL instance using transaction logs, allowing you to verify the data integrity before routing traffic. Performing recovery on the existing instance is destructive and prevents forensic analysis of the current production database state.

Correct answer: C. In Project B, grant the roles/storage.objectViewer role to the member serviceAccount:app-sa@project-a.iam.gserviceaccount.com.

IAM policies attach directly to the resource being accessed, so grant the service account from Project A the Object Viewer role inside Project B. Granting roles in Project A only grants access to resources within Project A.

Correct answer: A. Create a Cloud DNS Private Zone for internal.example.com. Add an A record for db. Authorize the zone for your VPC.

Cloud DNS private zones provide managed internal resolution restricted to your VPC. Public zones publish records to the internet, while IAM roles only control administrative edits, not DNS query visibility.

Correct answer: C. Cloud Hub, which provides DevOps and SRE teams a centralized view of active events, health data, deployment status, and resource insights for Google Cloud projects and applications.

Cloud Hub is the correct Google Cloud service for SREs to view consolidated operational data, including incidents, alerts, and deployment statuses. Cloud Monitoring is excellent for metrics but lacks this unified operational single-pane view.

Correct answer: D. Create a Partitioned Table based on the timestamp column.

Partitioning a table by timestamp physically segments the data, allowing BigQuery to prune entire partitions and drastically reduce bytes scanned during date-filtered queries. Clustering helps organize data within partitions but lacks the same hard billing guarantees.

Correct answer: C. A real-time object detection model that processes video frames with variable input resolutions, producing tensors with dynamic shapes at each step.

Cloud TPUs require ahead-of-time graph compilation, making them poorly suited for workloads with dynamic tensor shapes. GPUs handle variable input resolutions natively without recompilation, avoiding severe performance bottlenecks.

Correct answer: C. Workforce identity pools are an organization-level resource and must be created at the organization node, not inside a project. The administrator should navigate to the organization in the console and create the pool there.

Workforce identity pools are organization-level resources, not project-level resources. For the exam, remember that federated identity pools are created at the organization node so they can be used across multiple projects. Creating them inside a folder or project will fail.

Correct answer: B. Use Cloud Asset Inventory with the gcloud asset search-all-resources command and a query filter.

Cloud Asset Inventory lets you search resources across an entire organization with a single command. Scripting loops through hundreds of projects is inefficient and hits API limits, whereas Deployment Manager only tracks resources it deployed.

Correct answer: C. Create one HA VPN Gateway in Google Cloud. Configure four tunnels: Interface 0 to on-prem IP 1, Interface 0 to on-prem IP 2, Interface 1 to on-prem IP 1, and Interface 1 to on-prem IP 2.

Configuring a full mesh of four tunnels provides the required 99.99 percent uptime SLA for an HA VPN. A two-tunnel configuration only provides a 99.9 percent SLA, because losing one path leaves no redundancy for subsequent failures.

Correct answer: A. Apply Clustering to the table on the customer_id column.

Applying clustering to the table on the customer ID column physically sorts data within partitions to speed up filtered queries. Partitioning by a high cardinality column like customer ID exceeds the maximum partition limit, making clustering the correct optimization.

Correct answer: A. Create a Scheduled Query in the BigQuery console that runs the SQL query.

Scheduled Queries handle SQL-to-SQL transformations with minimal operational overhead. Dataflow is for complex ETL pipelines, while Cloud Run functions require writing custom code and managing multiple resources for a simple scheduled task.

Correct answer: A. Instruct them to use the –dry_run flag in the CLI or view the 'Query Validator' estimate in the Console before running.

Using the dry run flag or Query Validator in BigQuery calculates exact data processing volumes without executing the job. Adding a LIMIT clause is a common trap because BigQuery still scans the full column before applying the limit.

Correct answer: D. Create a Custom Machine Type with 6 vCPUs and 20 GB of RAM.

Creating a Custom Machine Type provisions the exact hardware needed. For the exam, remember that billing relies on provisioned resources, so startup scripts masking CPUs won't lower costs, and CUDs merely discount existing configurations rather than eliminating waste.

Correct answer: C. Configure the Cloud Run Function with a Pub/Sub Trigger (Push Subscription). Ensure the function returns a 200 OK status only upon success and a 500 error on failure.

Using a Pub/Sub trigger with a push subscription natively handles retries. If the function returns a non-200 status code, Pub/Sub automatically redelivers the message. Avoid pulling messages manually inside an ephemeral Cloud Run Function, as it introduces complex lifecycle management.

Correct answer: C. Attach a Regional Persistent Disk to the primary instance.

Attaching a Regional Persistent Disk synchronously replicates data across two zones, achieving a zero Recovery Point Objective. You can force attach the disk to a standby instance in the secondary zone during an outage. Standard snapshots or local SSDs cannot provide immediate, zero-loss failover.

Correct answer: C. Create an IAM Deny Policy attached to the Production folder. Add a rule denying the resourcemanager.projects.delete permission for principalSet: allUsers.

An IAM Deny policy explicitly overrides any inherited allow policies, ensuring that even Organization Administrators cannot delete the projects. Custom roles fail this requirement because standard IAM permissions are additive, meaning existing Owner rights cannot be subtracted away.

Correct answer: B. Use Basic Scaling in the App Engine configuration.

Basic scaling is the correct choice because it supports long request timeouts up to twenty-four hours, accommodating intensive video encoding tasks. Automatic scaling enforces a strict ten-minute timeout that would kill the process before completion, making it unsuitable for sporadic long-running requests.

Correct answer: D. Enable the Service Networking API. Allocate an IP range in your VPC for Google services. Create a Private Connection (VPC Peering) to the Google service producer. Configure Cloud SQL to use 'Private IP'.

Enabling Private Service Access allocates an IP range and establishes a VPC peering connection to the Google-managed network, allowing internal traffic. Remember that Serverless VPC Access is only used to connect serverless compute services to your VPC, not to configure database networking.

Correct answer: C. Create a Dedicated Interconnect connection. Order a "Cross-Connect" from your colocation provider using the LOA-CFA.

Ordering a Dedicated Interconnect directly connects your on-premises routers to Google's edge, generating the LOA-CFA needed for physical cross-connects. Use Partner Interconnect when you need lower bandwidth or lack a direct presence in a supported colocation facility.

Correct answer: B. The VM was created with the default Access Scope (Allow Default), which only allows Read access to Storage. You must verify the scopes.

Default Compute Engine access scopes restrict Cloud Storage API calls to read-only, overriding any broader IAM write permissions. To fix this without deleting the instance, stop the virtual machine and change its access scopes to allow full API access.

Correct answer: B. Create a Private Service Connect (PSC) endpoint in your VPC that targets the Cloud SQL service attachment. Access the endpoint IP from on-premises.

Creating a Private Service Connect endpoint maps the managed database to a local IP address in your VPC, bypassing transitive peering limits. While Private Service Access exists, it struggles with complex transitive routing from on-premises environments without custom route exports.

Correct answer: D. Create a Read Replica instance. Configure the analytics applications to connect to the replica's IP address instead of the primary.

Creating a Read Replica isolates heavy analytical queries from the primary transactional database, preventing CPU and table locking on your production instance. Vertical scaling only provides temporary relief and does not fix the underlying resource contention issue.

Correct answer: D. gcloud compute instances create web-server –zone=us-central1-a –machine-type=e2-medium

The correct gcloud command follows the standard service, resource, and verb structure, using the zone and machine type flags. A practical exam cue is to verify the resource path and location flag match, because using a region flag for a zonal resource will cause deployment errors.

Correct answer: D. Navigate to the IAM & Admin > Quotas page in the Console, and filter by "Service: Compute Engine API" and "Location: us-central1".

The IAM and Admin Quotas page displays exact resource capacity limits and usage for specific services in a chosen region. Billing reports show historical costs rather than technical capacity, and trial deployments fail without revealing exact limits.

Correct answer: D. Use Gemini Cloud Assist in the Google Cloud Console.

Gemini Cloud Assist is a console-based assistant that handles natural language queries about infrastructure and cost optimization. Gemini Code Assist is for software development, while BigQuery requires writing SQL, which non-technical stakeholders want to avoid.

Correct answer: A. Increase the maximum concurrent requests per instance setting from the default of 80

Increasing the maximum concurrent requests per instance setting allows each container to process more traffic simultaneously. Raising the minimum instances setting keeps containers warm but actually increases baseline costs rather than optimizing them.

Correct answer: C. You cannot remove the access at the project level because IAM policies are additive. You must use an IAM Deny Policy or restructure the hierarchy.

Cloud IAM allow policies are purely additive, meaning inherited folder permissions cannot be revoked directly at the child project level. To pass this scenario, recognize that you must either restructure the resource hierarchy or apply a specific IAM deny policy.

Correct answer: D. Boot disk image/source (e.g., Debian, Rocky Linux, or custom image) · E. Machine type (e.g., e2-medium, n2-standard-4)

Specifying a machine type defines the virtual CPU and RAM hardware capacity, while selecting a boot disk image provides the base operating system. External IP addresses and startup scripts are optional configurations, as instances can run privately without internet access or custom boot scripts.

Correct answer: D. The Cloud KMS key ring was created in a different region than the Cloud SQL instance.

The Cloud KMS key ring must reside in the exact same region as the Cloud SQL instance, or instance creation will immediately fail. A key ring cannot be global or multi-regional, though the Cloud SQL service agent inherits its permissions from the key ring level.

Correct answer: D. Subnets with IP ranges (e.g., 10.0.1.0/24) · E. Firewall rules (to allow internal/external traffic)

Subnets provide regional IP addressing for instances, while firewall rules are mandatory to bypass Google's default implied deny ingress policy. Cloud NAT and Cloud Router are only necessary later for outbound internet connectivity or advanced dynamic routing.

Correct answer: A. Provision a Sole-tenant Node Group and launch your VMs onto it.

Provisioning a Sole-tenant Node Group provides exclusive access to physical servers, satisfying compliance and enabling per-core BYOL reporting. Standard Compute Engine reservations guarantee capacity but still place your virtual machines on shared multi-tenant hardware.

Correct answer: C. Create a NetworkPolicy resource selecting the database pods, with an ingress rule allowing traffic only from pods with the label app: frontend.

Applying a Kubernetes NetworkPolicy restricts pod traffic by selecting specific labels, ensuring the database only accepts ingress from the frontend. VPC firewalls apply to entire nodes rather than individual pods, making them too coarse for microsegmentation.

Correct answer: B. Configure the cluster as a Private Cluster (private nodes). · E. Enable Workload Identity Federation for GKE.

Private clusters remove nodes from the public internet, and Workload Identity Federation eliminates the security risks of managing static service account keys in pods. For the exam, immediately eliminate legacy GKE authentication options like ABAC and Basic Authentication, as they are deprecated and insecure.

Correct answer: B. Deploy a Cloud Function (2nd gen) triggered by Eventarc for Cloud Storage events.

Cloud Functions triggered by Eventarc provide a fully serverless, event-driven architecture that executes only when files are uploaded. Avoid polling architectures like cron jobs or Cloud Run on a schedule, because they introduce unnecessary latency and incur continuous compute costs.

Correct answer: B. Implement a Service Mesh (like Cloud Service Mesh) to manage mTLS and authorization.

A service mesh uses sidecar proxies to manage mutual TLS and fine-grained authorization without complex IP-based firewall rules. Traditional firewall policies operate at layers three and four, making them incapable of handling layer seven identity verification needed for zero trust.

Correct answer: D. Disable the specific Cloud KMS CryptoKey version protecting the dataset.

Disabling the specific Cloud KMS CryptoKey version immediately blocks BigQuery from decrypting the dataset. This approach is preferred because the key version can simply be re-enabled later, ensuring the data remains fully recoverable. Destroying the key would permanently destroy the data.

Correct answer: C. Create a workload identity pool and provider in your Google Cloud project, configure it to trust GitHub's OIDC tokens, and grant the GitHub identity roles/iam.workloadIdentityUser on a service account so the workflow exchanges its OIDC token for a short-lived Google Cloud access token.

Workload Identity Federation allows external systems like GitHub to exchange native OIDC tokens for short-lived Google Cloud access tokens. This eliminates the security risk of storing long-lived service account JSON keys in third-party platforms. Automating key rotation still leaves vulnerable credentials in your pipelines.

Correct answer: A. Configure an initialDelaySec (Initialization period) of 240 seconds on the MIG's autohealing policy.

Setting a high initial delay in the autohealing policy gives the instances enough time to initialize before health checks begin. Increasing the check interval globally is a strong distractor, because it would severely delay detecting legitimate application crashes during normal operations.

Correct answer: C. Use an External Passthrough Network Load Balancer.

An external passthrough network load balancer operates at layer four, routing traffic directly while preserving the client's original IP address. Proxy load balancers terminate connections and mask client IPs, failing the prompt's strict source visibility and low latency requirements.

Correct answer: A. Install the Storage Transfer Service (STS) agent on-premises and configure a Transfer Job.

Storage Transfer Service is the managed tool designed for large-scale, on-premises to cloud migrations over a high-speed network. Avoid gsutil for massive migrations because scripting lacks centralized monitoring, managed retries, and built-in checksum validation.

Correct answer: C. Store the key in Secret Manager and expose it to the Cloud Run service as an environment variable or mounted volume.

Secret Manager natively integrates with Cloud Run to securely inject versioned secrets at runtime. Plain text environment variables fail the requirement because they are visible in the console to anyone with Viewer access, lacking proper encryption and versioning.

Correct answer: C. Configure an Object Lifecycle Management policy to downgrade storage classes based on age (Standard -> Nearline -> Coldline -> Archive).

Object Lifecycle Management automatically transitions objects to cheaper storage classes based on age, optimizing costs natively. Writing custom Cloud Functions to move files manually introduces unnecessary execution costs and operational complexity compared to the built-in feature.

Correct answer: A. Use the Database Migration Service (DMS) for a continuous migration.

Database Migration Service handles minimal-downtime database migrations by performing an initial dump followed by continuous replication. Using mysqldump requires taking the source offline, resulting in hours of unacceptable downtime during the transfer.

Correct answer: D. Use Firestore.

Firestore provides mobile client SDKs with built-in offline persistence that automatically synchronize local data changes once network connectivity is restored. Memorystore and Spanner are strictly server-side backends, lacking native device-level offline capabilities.

Correct answer: B. Deploy the microservices to Google Kubernetes Engine (GKE) Standard clusters.

GKE Standard grants full administrative access to cluster nodes, enabling the installation of required security agents via DaemonSets. App Engine and Cloud Run completely abstract the underlying infrastructure, preventing you from installing custom compliance tools on the host.

Correct answer: A. Deploy a Cross-region Internal Application Load Balancer.

A Cross-region Internal Application Load Balancer provides a single private IP and instant Layer 7 failover across multiple regions. Using DNS geolocation policies with separate regional load balancers is slower, relying on DNS TTLs rather than instant routing.

Correct answer: C. Grant the service account roles/cloudsql.client.

The Cloud SQL Client role provides the specific permission needed by the Auth Proxy to establish database connections. Granting Editor or Admin violates the least privilege principle because those roles allow unauthorized modifications to the infrastructure.

Correct answer: A. Create an ingress allow rule on the App Tier targeting the App Service Account, filtering source by the Web Service Account.

Filtering firewall rules by service account tightly couples network access to IAM identities, dynamically adapting to autoscaling without managing IP addresses. Network tags are less secure because users with basic instance permissions could potentially modify them to bypass restrictions.

Correct answer: D. Configure HA VPN between AWS and Google Cloud.

HA VPN provides a secure, highly available, and software-only connection between cloud environments without the need for physical hardware. Cross-Cloud Interconnect or Dedicated Interconnect require physical infrastructure, which violates the prompt's budget and time constraints.

Correct answer: D. Provision a Dedicated Interconnect (10 Gbps circuit) now, and add a second circuit later.

Dedicated Interconnect provides a physical 10 Gbps link that meets the immediate bandwidth requirements and can be scaled by adding circuits. HA VPN relies on the public internet, introducing latency and jitter that would cause video frame drops.

Correct answer: C. Use Bigtable.

Bigtable is a wide-column NoSQL database engineered for high-throughput operational workloads with single-digit millisecond latency. Firestore has strict throughput limits, and Cloud SQL scales vertically, making them unsuitable for massive IoT ingestion.

Correct answer: D. Go to IAM & Admin > Audit Logs and enable "Data Access" logs for Cloud Storage and Cloud SQL.

Data Access audit logs capture operations that read configuration or data, such as storage object views or SQL queries. Admin Activity logs are enabled by default but only capture administrative changes, not user data reads.

Correct answer: D. Deploy the Web tier to a Regional Managed Instance Group (MIG) with an External Application Load Balancer.

A Regional Managed Instance Group distributes VMs across multiple zones, ensuring high availability during zonal failures. An External Application Load Balancer intelligently routes traffic and works with the group to handle variable customer demand.

Correct answer: D. Configure a VPC Service Controls (VPC-SC) perimeter around the project and restrict data egress.

VPC Service Controls define a security perimeter that blocks data exfiltration even if users have valid IAM permissions. Cloud DLP scans for sensitive text but cannot block API calls used to copy data to external projects.

Correct answer: B. Deploy the API to Cloud Run.

Cloud Run automatically scales containers from zero to thousands of instances and charges only for exact compute time. GKE Autopilot and Compute Engine require baseline resources, meaning you pay a constant cost even when traffic drops to zero.

Correct answer: B. Use Dataflow with Streaming Engine enabled.

Dataflow with Streaming Engine is the correct choice because it provides a fully managed Apache Beam environment optimized for sub-second latency, advanced windowing, and watermarking. Dataproc is a weaker distractor because managing cluster scaling for wildly fluctuating traffic is slower and more complex.

Correct answer: D. Enable Index Advisor to automatically analyze queries and recommend missing indexes

Index Advisor is correct because it is the native Cloud SQL feature that analyzes query performance and provides automated CREATE INDEX commands. For the exam, remember that Cloud SQL database flags tune configurations, whereas Index Advisor specifically recommends missing indexes.

Correct answer: C. Configure an Organization Policy with the gcp.resourceLocations constraint restricted to US locations.

The gcp.resourceLocations organization policy is correct because it acts as a preventative guardrail that blocks resource creation outside of allowed regions. VPC Service Controls is a distractor because it secures data exfiltration rather than restricting physical infrastructure deployment.

Correct answer: D. The principal retains full BigQuery admin access on the project, because IAM allow policies are additive — a more restrictive grant at the child level cannot remove permissions inherited from a parent.

The principal retains admin access because Google Cloud IAM allow policies are additive across the resource hierarchy, meaning child-level grants cannot remove parent permissions. To revoke inherited access, you must use an IAM deny policy instead of adding a more restrictive role.

Correct answer: C. Configure the Terraform scripts to provision Spot VMs (Preemptible) for these environments.

Provisioning Spot VMs is correct because it provides deep discounts for ephemeral, fault-tolerant compute resources with minimal Terraform code changes. Committed Use Discounts fail here because they require long-term commitments unsuitable for short-lived environments.

Correct answer: A. Grant the user roles/run.developer and roles/iam.serviceAccountUser.

The roles/run.developer and roles/iam.serviceAccountUser combination is correct because it allows deployment and service account impersonation without granting IAM modification rights. The run.admin role is a strong distractor because it incorrectly includes permission to modify service IAM policies.

Correct answer: A. Use the Recommender API (Active Assist).

The Recommender API is correct because Active Assist uses machine learning to analyze historical usage and generate actionable rightsizing recommendations. Cloud Monitoring is a distractor because it only displays raw metrics without providing automated optimization advice.

Correct answer: D. Use Cloud Batch to run the job on Spot VMs.

Cloud Batch with Spot VMs is correct because it is a managed service that automatically handles retries for interrupted, fault-tolerant batch workloads at massive discounts. Cloud Run jobs is a weaker distractor because it lacks deep infrastructure discounting like Spot VMs.

Correct answer: A. Deploy the model to Cloud Run services with GPU allocation.

Cloud Run services with GPU allocation is correct because it provides a fully managed serverless platform that natively supports GPUs and autoscaling. GKE is a strong distractor but fails the requirement because managing node pools violates the strict infrastructure abstraction constraint.

Correct answer: C. Configure Identity-Aware Proxy (IAP) for TCP forwarding and grant users the roles/iap.tunnelResourceAccessor role.

Identity-Aware Proxy for TCP forwarding wraps SSH connections in HTTPS, tunneling traffic directly to internal IPs without requiring public IPs. A bastion host is a strong distractor, but it directly violates the strict security policy by requiring a public IP address to function.

Correct answer: C. Use Private Service Connect (PSC) to create an endpoint for the SaaS provider.

Private Service Connect maps a specific service from another VPC to an internal IP address without requiring full network peering. VPC Network Peering is a strong distractor, but it connects entire networks and fails due to overlapping IP range restrictions.

Correct answer: D. Grant the contractor roles/bigquery.dataViewer on the dataset with an IAM Condition request.time < timestamp("2025-XX-XXT00:00:00Z").

Attaching a temporal IAM Condition using the request.time attribute automatically revokes access precisely at the specified timestamp. A resource.name condition is the strongest distractor, but it only restricts resource scope and fails to expire access after the two-week period.

Correct answer: C. Create a firewall rule allowing tcp:8080, targeting the Backend Service Account, with a Source Filter of the Frontend Service Account.

Using service accounts for target and source filters provides strict, identity-based micro-segmentation that remains secure during IP changes. Network tags are the strongest distractor, but they are legacy strings easily modified by users, making them less secure.

Correct answer: C. Deploy the application to Google Compute Engine (GCE) instances using a Managed Instance Group (MIG).

Compute Engine with a Managed Instance Group supports specific OS kernels and local state for a direct infrastructure lift-and-shift. GKE is the strongest distractor, but containerizing a stateful monolith requires extensive code changes and violates the deadline.

Correct answer: D. Migrate to AlloyDB for PostgreSQL.

AlloyDB for PostgreSQL maintains full compatibility while using a columnar engine to accelerate analytics without impacting transactional performance. Cloud SQL is the strongest distractor, but it lacks specialized analytical acceleration and suffers from bottlenecks.

Correct answer: D. Migrate to Cloud Spanner (Enterprise Edition).

Cloud Spanner is the correct choice because it provides global horizontal scalability while maintaining strict ACID compliance through external consistency. For the exam, remember that Cloud SQL fails this requirement because it only scales vertically and relies on eventually consistent read replicas globally.

Correct answer: B. Autopilot automatically sets default CPU and memory requests based on pre-configured values

GKE Autopilot automatically applies pre-configured default resource requests to pods when they are not explicitly defined in the deployment manifest. A practical exam tip is that Autopilot tailors its infrastructure to your exact needs by strictly enforcing resource requests on all deployed workloads.

Correct answer: B. Deploy the worker application to a GKE Standard cluster using a Horizontal Pod Autoscaler (HPA) with Pub/Sub metrics.

GKE Standard is ideal for long-running batch tasks, allowing workers to pull messages and process them for up to fifty minutes without platform timeouts. Cloud Functions and App Engine are optimized for short-lived requests, making them vulnerable to timeout failures.

Correct answer: B. Customer-Managed Encryption Keys (CMEK). · D. Uniform Bucket-Level Access.

Customer-Managed Encryption Keys allow you to control encryption keys via Cloud KMS for compliance. Uniform Bucket-Level Access disables legacy ACLs and enforces IAM policies uniformly across the bucket to prevent accidental data exposure.

Correct answer: B. Provision Google Cloud NetApp Volumes and create an SMB share integrated with Active Directory.

Google Cloud NetApp Volumes natively supports the SMB protocol required for Windows network drives and native ACLs. Filestore uses NFS, which lacks native Windows UNC path support and standard Windows permission management.

Correct answer: C. Use BigQuery.

BigQuery is the correct choice because it is a fully managed, serverless enterprise data warehouse that scales automatically to handle petabytes of data using standard SQL. For the exam, remember that Dataproc requires cluster management, while Cloud SQL and AlloyDB face strict storage limits or transactional bottlenecks.

Correct answer: C. Use a Global External Application Load Balancer and enable Cloud CDN.

A Global External Application Load Balancer combined with Cloud CDN terminates SSL at the edge and caches static assets for worldwide users. A regional load balancer is a strong distractor, but it introduces high latency for global users by operating in a single region.

Correct answer: D. You must explicitly enable "Data Access" audit logs for the Cloud SQL API.

Data Access audit logs capture user queries and must be explicitly enabled because they are disabled by default. Admin Activity logs are the strongest distractor, but they only capture control-plane changes, meaning SQL queries remain completely invisible.

Correct answer: A. Grant the developer roles/iam.serviceAccountTokenCreator and use gcloud auth impersonate-service-account.

Granting the token creator role allows developers to impersonate the service account using short-lived access tokens via the gcloud CLI. Downloading a JSON key is the strongest distractor, but it violates security best practices by creating risky permanent credentials.

Correct answer: D. Grant roles/container.clusterViewer to the team at the Organization level.

The container.clusterViewer role is granted because it specifically provides read-only access to Kubernetes API objects like pods and deployments. Note that container.viewer might also be a defensible choice for broad read-only access, which makes this question slightly ambiguous when selecting the single best fit.

Correct answer: A. Use Gemini Cloud Assist and ask, Why can't VM A connect to IP X.X.X.X?" to trigger a network troubleshooting investigation."

Gemini Cloud Assist is context-aware and integrated directly into the console to analyze live configurations. The Recommender API focuses on cost and security insights, not interactive troubleshooting or root cause analysis.

Correct answer: C. Configure a Budget Alert connected to a Pub/Sub topic, which triggers a Cloud Run Function to stop the instances.

Routing budget alerts through Pub/Sub to trigger a Cloud Function is the standard programmatic pattern for automated cost control. Google Cloud lacks a native hard spending cap, so you must deploy this serverless architecture. Email alerts alone require slow, manual human intervention.

Correct answer: G. Create an A record for example.com pointing to 203.0.113.50, a CNAME record for www.example.com pointing to example.com, and MX records pointing to Google's mail servers

An A record maps the apex domain to an IPv4 address, while a CNAME aliases the www subdomain to that apex. MX records are strictly required to route email to the proper mail servers. Remember that CNAME records cannot point directly to IP addresses.

Correct answer: D. gcloud services enable compute.googleapis.com

The command gcloud services enable compute.googleapis.com activates the Compute Engine API for your project. Remember that API management lives under the gcloud services group, not under the individual compute command groups.

Correct answer: A. Grant User A the Compute OS Login role (roles/compute.osLogin) on the specific finance-vm-01 instance.

Granting the Compute OS Login role at the instance level restricts access to that specific VM without granting sudo privileges. Project-level grants violate the principle of least privilege, and metadata keys are ignored entirely when OS Login is enabled.

Correct answer: A. Increase the resources.requests.cpu value in the Pod manifest.

Increasing the CPU request in your Pod manifest provisions guaranteed baseline compute for your workloads in Autopilot. You cannot manually configure node pools in Autopilot mode, as Google automatically manages the infrastructure based strictly on your resource requests.

Correct answer: C. Create a push subscription with the Cloud Run service URL as the endpoint.

A push subscription automatically delivers messages to your Cloud Run service URL over HTTPS, providing a true event-driven architecture. Pull subscriptions require active polling, which directly violates the requirement and adds unnecessary complexity and compute costs.

Correct answer: A. Set a CORS configuration on the bucket allowing GET requests from https://myapp.example.com

Setting a CORS configuration on the bucket explicitly allows the browser to fetch cross-origin resources securely. Making objects public via IAM only handles authorization, but browsers will still strictly block the requests without the proper CORS headers.

Correct answer: D. Configure the service with Minimum instances set to 1.

Setting the minimum instances to one ensures Cloud Run keeps a container continuously running, bypassing the cold start entirely. While pinging the service with a scheduler is a common workaround, it is a hack compared to the native min-instances feature.

Correct answer: B. Cause: the new project has zero default GPU quota and the request exceeds it. Post-creation step: manually install NVIDIA drivers, since standard public images do not pre-install them.

New Google Cloud projects start with a default GPU quota of zero, so the API immediately rejects the request until you request and are granted quota. Standard Debian images do not include NVIDIA drivers, so you must manually install them after the VM boots.

Correct answer: D. Create a "Europe" Folder. Move the European projects into this Folder and apply the Organization Policy to the Folder.

Applying the policy to a folder ensures all projects inside automatically inherit it, covering future European projects. Organization policies cannot be attached to labels or billing accounts, making folders the correct hierarchical grouping mechanism.

Correct answer: D. Create a Private Cluster with private nodes (–enable-private-nodes) and public control plane endpoint enabled. Configure Master Authorized Networks to whitelist the CI/CD provider's IP range.

Private clusters keep nodes isolated with internal IPs, while enabling the public endpoint lets external pipelines reach the control plane. Configuring Master Authorized Networks restricts this public access strictly to your CI/CD provider's approved IP ranges.

Correct answer: D. Use direct resource access for Cloud Storage and service account impersonation for the legacy API.

Direct resource access is recommended for supported APIs like Cloud Storage because it provides a cleaner audit trail. For unsupported legacy APIs, you must fall back to service account impersonation to exchange the federated token for an acceptable credential.

Correct answer: B. Grant the developer the Service Account Token Creator (roles/iam.serviceAccountTokenCreator) role on the specific Service Account.

Granting the Service Account Token Creator role allows the developer to impersonate the account using short-lived credentials. The Service Account User role is incorrect because it only allows attaching the account to compute resources, not CLI impersonation.

Correct answer: A. kubectl apply -f deployment.yaml

The apply command manages resources declaratively, letting you update configurations by simply rerunning the same command on the file. Imperative commands like create will throw an error if the resource already exists, breaking your update workflow.

Correct answer: D. Firestore (Native mode), because it supports document-based data with real-time and offline capabilities.

Firestore in Native mode is purpose-built for mobile and web applications requiring flexible JSON documents and real-time synchronization. Cloud SQL lacks built-in offline caching, and Bigtable is meant for massive analytical throughput, not mobile client syncing.

Correct answer: A. Create a Patch Deployment and configure it with a recurring schedule for Saturday at 2:00 AM.

Patch Deployments are the correct component because they support recurring schedules and executing pre-patch scripts automatically. A Patch Job is only a one-time execution, so it cannot handle the required weekly schedule.

Correct answer: B. Create a new BigQuery dataset, then use the bq load command with schema autodetection enabled to load the data into a new table.

Creating a dataset is required first because BigQuery tables must reside inside datasets. Using the load command with autodetect minimizes manual schema configuration by automatically inferring column types from the CSV header.

Correct answer: A. Create a Log Router sink that exports Admin Activity audit logs to a BigQuery dataset.

Exporting audit logs to BigQuery provides the SQL interface needed for complex joins and long-term retention required for compliance. Cloud Storage is great for cheap archival but lacks native analytical querying capabilities.

Correct answer: B. Use Storage Transfer Service for on-premises data.

Storage Transfer Service provides a fully managed solution for large on-premises migrations, handling retries and checksum validation automatically. Command-line tools require writing custom scripts and maintaining compute resources for the duration.

Correct answer: A. Create a Cloud Billing budget and configure an 80% threshold rule with email notifications enabled.

Cloud Billing budgets with threshold rules are the native way to trigger email alerts when spending reaches a specific percentage. Logging and Monitoring track operational events and uptime, not cumulative spending thresholds.

Correct answer: A. Create a dual-region bucket in NAM4 (us-central1 + us-east1) with turbo replication enabled

Turbo replication on a dual-region bucket guarantees an SLA-backed fifteen-minute recovery point objective across regions. Default replication on either multi-region or dual-region buckets only provides a twelve-hour RPO, failing the compliance requirement.

Correct answer: B. Use the "Backup for GKE" feature to create a plan that backs up both config and Persistent Volume Claims (PVCs) to a multi-region bucket.

Backup for GKE captures both application manifests and persistent volume claims in a consistent, managed backup suitable for cross-region restore. Manual disk snapshots lack configuration consistency, and regional disks only protect against zonal failures.

Correct answer: C. Cloud Workstations, which provides managed, container-defined developer environments running inside your VPC with administrator-controlled configurations applied consistently across all developers.

Cloud Workstations provides managed, container-defined developer environments that run inside your VPC and support pre-approved configurations. Cloud Shell lacks persistent workspaces, and Compute Engine VMs lack centralized administrative control.

Correct answer: C. Use the IAM Recommender to view the "Role recommendations" for the project.

The IAM Recommender automatically analyzes historical permission usage to suggest replacing broad primitive roles with narrower predefined roles. Policy Analyzer only shows current policy bindings without evaluating actual usage over time.

Correct answer: D. Use Cloud Asset Inventory to export the resource metadata to Cloud Storage, specifying the snapshotTime as 10 days ago.

Cloud Asset Inventory supports time travel, allowing you to export and view the exact resource metadata from a specific historical timestamp. Cloud Logging only records individual change events, not the complete state of all resources at a given time.

Correct answer: A. Create Spot VMs within a Managed Instance Group (MIG). Configure the application to handle potential preemptions by saving checkpoints.

Spot VMs provide the deepest discounts for fault-tolerant batch workloads, and a Managed Instance Group automatically replaces preempted instances. Remember that Automatic Restart is strictly incompatible with Spot and Preemptible VMs, so relying on a group is necessary.

Correct answer: B. Configure the Backend Service with "Rate" balancing mode and "Maximum RPS" of 50. Set the autoscaler to target a utilization percentage of that capacity.

To scale based on specific requests per second, you configure the Backend Service with a maximum RPS limit, then the autoscaler targets a percentage of that capacity. Simply guessing a utilization percentage fails because the backend needs to know the instance limit.

Correct answer: C. Create a Cloud Build Private Pool peered to your VPC.

Creating a Cloud Build private worker pool peered to your VPC provides the necessary network route to your on-premises repository. Modifying IAM roles will not solve this because authorization does not establish network connectivity.

Correct answer: A. Use a Dataflow Flex Template.

Dataflow Flex Templates package your pipeline within a custom Docker container, allowing you to include specialized dependencies. Classic Templates are restricted to a fixed runtime environment and cannot load custom system-level dependencies.

Correct answer: B. Regional Persistent Disk (pd-balanced or pd-ssd) configured with synchronous replication.

Regional Persistent Disks synchronously replicate data across two zones, achieving an RPO of zero for zonal failover. Local SSDs are ephemeral and snapshot schedules cannot provide immediate recovery without some data loss.

Correct answer: B. Deploy applications using Knative serving on GKE. It provides serverless abstractions on top of Kubernetes with automatic scaling, traffic management, and revision control while running on your own GKE cluster with full portability.

Deploying with Knative serving on GKE delivers serverless abstractions like scale-to-zero on your own cluster. Fully managed Cloud Run is incorrect here because it abstracts away your cluster control and prevents on-premises deployment.

Correct answer: C. Grant the Artifact Registry Reader (roles/artifactregistry.reader) role to the GKE Node Service Account on the app-repo repository.

Granting the Artifact Registry Reader role to the GKE Node Service Account provides the exact permissions needed to pull private images. The Storage Object Viewer role is an outdated legacy approach from the Container Registry era.

Correct answer: B. Enable Query Insights to monitor database load and identify resource-intensive queries

Cloud SQL Query Insights is the native tool that automatically captures query latency and resource consumption without custom code. Relying on Cloud Logging exports to BigQuery requires extensive manual configuration that Query Insights handles natively.

Correct answer: A. Cloud Run configured with the default autoscaling settings.

Cloud Run automatically scales to zero, ensuring you only pay when code executes. Compute Engine MIGs and App Engine Flexible require baseline instances, incurring costs even without traffic.

Correct answer: A. Recreate the table as a partitioned table based on a timestamp column, and ensure queries filter on the partition column.

Partitioning a table by timestamp limits data scanned to specific partitions, reducing costs and improving speed. Clustering alone does not reduce query costs since the entire table is still processed.

Correct answer: A. No. Rotating the key does not re-encrypt existing objects. Objects written before the rotation are still protected by the previous key version, which must remain enabled until those objects are re-encrypted or deleted.

Rotating a Cloud KMS key creates a new primary version but does not re-encrypt existing objects. Older objects remain tied to their original version, so disabling it prematurely makes them inaccessible.

Correct answer: D. Create an Eventarc trigger for Cloud Storage events and configure it to invoke the Cloud Run service.

Eventarc provides native event routing to Cloud Run, abstracting away underlying infrastructure. Manually configuring Pub/Sub requires writing custom integration logic and managing separate resources.

Correct answer: D. Deploy the new revision with the "Serve this revision immediately" setting disabled. In the "Manage Traffic" tab, assign 5% of traffic to the new revision and 95% to the existing revision.

Cloud Run supports native traffic splitting between revisions for canary deployments. Deploy the new revision without serving traffic, then manually adjust percentages in the console.

Correct answer: D. Hyperdisk Extreme

Hyperdisk Extreme provisions IOPS and capacity independently, avoiding disk over-provisioning. Local SSDs are ephemeral, causing data loss on instance stop, making them unsuitable for durable databases.

Correct answer: C. Create a Snapshot Schedule resource with a daily frequency and a 14-day retention policy. Attach this schedule to the Persistent Disk.

Snapshot schedules provide the native, fully managed way to automate persistent disk backups with retention rules. Creating custom Cloud Functions or cron jobs violates the requirement to avoid custom scripts, and Cloud Storage lifecycle rules don't apply to block storage.

Correct answer: C. Enable OS Login on the project and enforce 2-Step Verification in Google Workspace.

Enabling OS Login ties SSH access directly to Google Workspace identities, enforcing two-step verification and providing immediate revocation. Managing static keys via startup scripts lacks real-time synchronization, creating severe security gaps when employees leave the company.

Correct answer: C. Install and configure Google Cloud Directory Sync (GCDS) on a server within your on-premises network.

Installing Google Cloud Directory Sync on an on-premises server securely automates user and group synchronization from Active Directory. SAML only handles authentication, not full lifecycle management, and manual CSV uploads fail to meet the automated synchronization requirement.

Correct answer: C. Use the gcloud compute instance-groups managed set-instance-template command to set the new template, then start a Rolling Update.

Setting a new instance template and initiating a rolling update applies changes with minimal disruption. Instance templates are immutable, so editing them is impossible, and deleting the entire group causes a complete service outage.

Correct answer: C. Enable private IP for the Cloud SQL instance so it can be accessed via the VPC's internal network, and configure VPC Private Services Access if needed.

Enabling a private IP address routes traffic internally through your VPC without exposing the database to the internet. Authorized networks fail because private GKE pods lack predictable public IPs, and the Auth Proxy still requires underlying network connectivity to function.

Correct answer: A. Deploy AlloyDB for PostgreSQL. It provides a built-in columnar engine for HTAP workloads, separates compute and storage for independent scaling, and delivers 4x faster transactions with up to 100x faster analytics compared to standard PostgreSQL.

AlloyDB is the designated solution for hybrid transactional and analytical workloads, offering the requested four times transactional and one hundred times analytical speed improvements. Cloud SQL read replicas cannot match this performance because they lack a columnar engine.

Correct answer: D. Deploy a shared Gateway resource in an infrastructure namespace with HTTPRoute resources in each team's namespace

Using a shared Gateway resource separates infrastructure management from application routing, allowing teams to attach independent HTTPRoutes. Traditional Ingress relies on vendor-specific annotations for advanced traffic splitting and requires consolidating routing rules.

Correct answer: B. Update the deployment manifest to increase the resources.limits.memory to at least 600 MiB.

Increasing the memory limit resolves the Out of Memory crash while still preventing the container from consuming unlimited node resources. Remember that Kubernetes uses requests for scheduling, but enforces hard shutdowns based strictly on the configured limits.

Correct answer: C. Grant the developer the roles/appengine.appAdmin role on the project, and grant roles/iam.serviceAccountUser on the App Engine service account.

The App Engine App Admin role allows deploying versions and configuring traffic, but it must be paired with Service Account User for deployments. Note that the wording asks for a single predefined role, yet correctly deploying requires granting an additional role.

Correct answer: B. Permissions in a Custom Role might stop working if the underlying API features are deprecated or if the permissions are renamed by Google.

Permissions in custom roles might break if Google deprecates or renames the underlying APIs. Unlike predefined roles that Google maintains automatically, you must manually update custom roles when permissions change.

Correct answer: C. Deploy the application using Helm charts. Helm provides package management for Kubernetes with templated manifests, versioned releases, customizable values files, and built-in rollback capabilities.

Helm packages Kubernetes applications into versioned charts with templated manifests and rollback support. Plain kubectl lacks built-in lifecycle management, making rollbacks error-prone.

Correct answer: C. Create a user-managed Service Account with the required IAM roles. Assign this Service Account to the Compute Engine instance during creation or while stopped.

Attaching a dedicated service account to the VM provides temporary tokens via the metadata server, eliminating long-lived keys. The default service account violates least privilege due to broad permissions.

Correct answer: C. Application Design Center, which lets platform teams create and share Terraform-backed application templates on a visual canvas so developers can deploy governed applications from pre-approved designs.

Application Design Center is the correct service because it provides a visual canvas for creating shareable Terraform-backed templates. Standard Terraform requires writing code manually, which directly violates the requirement to provide pre-approved designs for developers.

Correct answer: C. Run gcloud auth configure-docker us-east1-docker.pkg.dev.

The correct command explicitly passes the registry's hostname to the credential helper. On the exam, remember that omitting the hostname only configures the legacy Container Registry, while passing the specific domain connects your Docker client to Artifact Registry.

Correct answer: A. Standard Tier

Memorystore for Redis Standard Tier provides high availability through automatic cross-zone replication and failover. Basic Tier offers no replication, meaning a node failure results in complete cache loss.

Correct answer: D. Create a Regional Managed Instance Group (MIG) in us-central1 and select "Multiple zones" for the target distribution.

A regional Managed Instance Group distributes instances across multiple zones within a region, providing the high availability and single logical management required here. Zonal groups fail entirely if their specific zone goes down, making them incorrect for strict resilience requirements.

Correct answer: C. On the Organization resource, remove the Project Creator role (roles/resourcemanager.projectCreator) from the domain-wide principal and grant it to the cloud-admins group.

To restrict project creation, you must modify IAM roles on the organization node by removing default domain-wide access and granting the role to specific administrators. The organization policy constraint mentioned in another option does not exist for this purpose.

Correct answer: A. Create a new Google Cloud project called monitoring-hub. Configure a Metrics Scope on monitoring-hub and add prod-app, staging-app, and dev-app as monitored projects. Grant the SRE team the Monitoring Viewer role on monitoring-hub. All dashboards and alerts created in monitoring-hub will automatically query metrics from all three projects.

A Metrics Scope allows you to view metrics from multiple projects simultaneously within a single host project. Networking controls like VPC peering handle private connectivity and are completely separate from cloud monitoring data aggregation.

Correct answer: D. Use the Google Cloud Pricing Calculator to model the resources and generate a shareable estimate URL.

The Google Cloud Pricing Calculator models costs for proposed architectures and provides a shareable link before deployment. Provisioning actual resources to estimate pricing wastes money, while migration tools target on-premises lift-and-shift scenarios.

Correct answer: B. Create an Alert Policy. Select the metric compute.googleapis.com/instance/cpu/utilization. Set the condition to "is above 90%" for a duration of 5 minutes.

The compute dot googleapis dot com slash instance slash utilization metric reflects CPU usage from the hypervisor without requiring an agent. The agent-based metric violates the no-agent rule, while uptime checks only test external reachability.

Correct answer: C. Enable Secure Boot in the Shielded VM options.

Secure Boot halts the boot process entirely if it detects unsigned drivers or unauthorized boot components. Integrity monitoring and virtual TPM modules measure and report system state but do not actively block the system from booting.

Correct answer: A. Create a Private managed zone with the DNS name corp.internal.. In the zone details, select the prod-vpc network as a visible network.

A private managed zone restricts DNS resolution to authorized VPC networks, hiding your internal records from the internet. Public zones expose records globally, while peering zones only forward queries to another VPC.

Correct answer: A. europe-west3 (Frankfurt) to satisfy the data residency laws and latency requirements.

Legal compliance laws like GDPR act as hard constraints, forcing you to choose specific geographical regions for data residency. Ignoring strict data sovereignty rules to save money or improve sustainability in another country violates legal requirements.

Correct answer: C. Configure an Organization Policy on the folder with the constraint "Define allowed external IPs for VM instances" (constraints/compute.vmExternalIpAccess) and set the policy to Deny All.

Setting the compute external IP access organization policy to deny all prevents instances from acquiring public addresses, overriding IAM permissions. Firewall rules block traffic but still allow the public IP assignment you must prevent.

Correct answer: A. Run the equivalent gcloud compute networks peerings create command in project-b to peer vpc-b with vpc-a.

VPC peering requires creating matching configurations on both networks because Google Cloud uses a decentralized model without an accept request. The status remains inactive until the reciprocal peering connection is created in the second project.

Correct answer: D. Stop the instance. Edit the configuration to set the Access Scopes to "Allow full access to all Cloud APIs". Restart the instance.

Setting access scopes to allow full access to all Cloud APIs resolves the token restriction while strictly relying on IAM roles to enforce least privilege. Granular per-API scopes are considered legacy because they add operational overhead and limit IAM effectiveness.

Correct answer: D. Create a Hierarchical Firewall Policy containing a deny rule for tcp:21. Associate the policy with the Finance folder.

Associating a hierarchical firewall policy containing a deny rule enforces centralized security at the folder level. Standard VPC firewall rules are ineffective here because project owners can easily override or delete them.

Correct answer: C. gcloud projects create dev-app-2024 –folder=123456789012

The gcloud projects create command accepts the project ID as a positional argument and uses the folder flag to set the parent. Remember that gcloud commands generally require the resource ID positionally rather than using flags, making the first option invalid.

Correct answer: A. Create a Cloud NAT gateway and a Cloud Router in the same region as the instance.

Cloud NAT provides outbound internet access for private instances without exposing them to inbound connections. Private Google Access only connects your VPC to Google APIs, not the public internet, making it a frequent distractor for patching scenarios.

Correct answer: C. In Project A, grant the Pub/Sub Subscriber role (roles/pubsub.subscriber) to the Project B service account on the analytics-events topic.

Granting the Pub/Sub Subscriber role on the topic in the producer project provides the exact permission needed to attach a cross-project subscription. This adheres to least privilege, whereas granting project-level editor roles would be overly permissive.

Correct answer: A. Grant the Compute Instance Admin role with an IAM Condition that includes an expiration timestamp. After March 15, 2026, the role binding still exists in the IAM policy but the condition evaluates to false, preventing any access.

IAM Conditions allow you to bind a role with a time limit, automatically denying access once the specified timestamp passes. For temporary contractor access, rely on this native expiration feature rather than custom Cloud Scheduler jobs or manual revocation.

Correct answer: C. Grant the IAP-secured Tunnel User role (roles/iap.tunnelResourceAccessor) to the group.

Using the console SSH button for private instances routes traffic through Identity-Aware Proxy, which requires the IAP-secured Tunnel User role. Compute Instance Admin allows VM management but lacks the specific permission to establish the IAP tunnel.

Correct answer: D. Navigate to VPC Network > IP addresses. Click Reserve internal static IP address, specify 10.128.0.55, and select this reserved address when creating the instance.

Reserving a static internal IP address decouples the IP from the VM lifecycle, ensuring it remains available even if the instance is deleted. Custom ephemeral IPs are released upon deletion, making them unsuitable for persistent legacy configurations.

Correct answer: A. Use Cloud Trace to view the distributed traces. Select a trace for the "Place Order" request and analyze the waterfall view.

Cloud Trace captures distributed request flows across microservices and displays them in a waterfall view to pinpoint latency bottlenecks. Cloud Monitoring shows aggregate metrics, whereas tracing is required to analyze the individual hops of a single request.

Correct answer: A. Create a Custom mode VPC. Manually define subnets with non-overlapping IP ranges in the specific regions you need.

A custom mode VPC prevents automatic subnet creation, giving you exact control over CIDR ranges to safely avoid overlapping your on-premises network. Auto mode VPCs automatically use 10.128.0.0/9, which risks immediate conflicts, and firewall rules never fix routing issues caused by overlapping IPs.

Correct answer: B. Navigate to Active Assist (Recommender) in the Google Cloud Console.

Active Assist uses machine learning to automatically identify idle resources and provide actionable recommendations to reduce waste. While budgets alert you to high-level spending increases, they do not automatically identify the specific idle virtual machines or unused IP addresses.

Correct answer: A. Create an ingress allow rule for traffic from the source range 35.235.240.0/20 on TCP port 22.

Creating an ingress allow rule from the 35.235.240.0/20 CIDR block permits traffic specifically from the Identity-Aware Proxy to your private instance. Opening port 22 directly to the internet fails because private VMs lack external IPs and bypasses IAP security.

Correct answer: C. Grant Sam the Compute Network User role on the us-central1 subnet in the net-host project.

Granting the Compute Network User role on the specific subnet allows Sam to deploy virtual machines while adhering to least privilege. Granting broader project-level access would unnecessarily permit deployments in other regions.

Correct answer: A. Provision four 10 Gbps Dedicated Interconnect connections across two separate metropolitan areas (2 per metro).

Provisioning four 10 Gbps Dedicated Interconnect connections across two metropolitan areas guarantees the 99.99% uptime SLA and ensures private connectivity. Two connections in a single city only provide a 99.9% SLA.

Correct answer: C. Install the Ops Agent on each instance.

Installing the Ops Agent on your instances enables the collection of guest-level metrics like memory and disk utilization. For the exam, remember that Compute Engine only provides hypervisor-level metrics like CPU and network by default.

Correct answer: C. Navigate to APIs & Services > Dashboard, locate the Compute Engine API, and view the "Errors" and "Traffic" graphs.

The APIs and Services Dashboard provides near real-time traffic, latency, and error rates for enabled APIs. Quotas only track allocation limits, not specific HTTP response codes like 5xx server errors.

Correct answer: B. View the Personalized Service Health dashboard in the Google Cloud Console. It automatically filters and displays incidents relevant to your projects, showing impacted products, regions, and incident status.

The Personalized Service Health dashboard automatically filters global Google Cloud incidents to show only those relevant to your active projects. The public status dashboard lacks this filtering, which often causes unnecessary alert fatigue.

Correct answer: C. Apply constraints/gcp.restrictNonCmekServices listing Cloud Storage, and apply constraints/gcp.restrictCmekCryptoKeyProjects listing the kms-central project.

You must apply both organization policy constraints to the folder to enforce your requirements. The restrictNonCmekServices constraint forces CMEK usage, while the restrictCmekCryptoKeyProjects constraint limits those keys to the designated project.

Correct answer: B. Create two named Configurations using gcloud config configurations create. Set the specific project and region properties for each, then switch using gcloud config configurations activate.

Creating and activating named configurations allows you to instantly switch grouped settings like project, region, and zone. Running interactive setup wizards or exporting individual environment variables is inefficient for frequent context switching.

Correct answer: C. Package your application manifests into a Helm chart and use helm install to deploy it to the cluster.

Packaging manifests into a Helm chart allows you to version, install, and upgrade complex applications as a single release. While applying raw files works, it lacks native package management features like dependency tracking and simple rollbacks.

Correct answer: B. Google Cloud Managed Lustre, a fully managed parallel file system with sub-millisecond latency and TB/s-scale throughput, purpose-built for HPC and AI workloads requiring concurrent multi-node access.

Managed Lustre is the correct choice because it is a fully managed parallel file system specifically built for high-performance computing workloads requiring massive concurrent access. For the exam, remember that standard Filestore handles general NFS workloads, while Managed Lustre targets sub-millisecond HPC throughput.

Correct answer: A. Configure a Budget in the Billing section. Set the amount to $5,000 and define threshold rules for 50%, 90%, and 100%.

Configuring a budget with specified threshold rules correctly tracks spend and sends email alerts without disrupting your resources. A key exam cue is that Google Cloud budgets are purely for monitoring and alerting, as there is no native feature to automatically cap billing or shut down resources.

Correct answer: D. Run the command bq query –dry_run [QUERY_STRING].

Using the dry run flag with the BigQuery command-line tool returns the exact byte count a query will process without actually executing it or incurring costs. Remember that pricing calculators estimate general monthly costs, but they cannot parse a specific SQL statement to predict its exact scan size.

Correct answer: A. Use the Clone feature to create a new instance from the source instance, specifying a Point-in-time of 14:29 UTC.

Creating a clone with a specific point-in-time timestamp allows you to recover the lost table while keeping the production database online and unaffected. On the exam, remember that standard automated backups overwrite the existing instance and cause downtime, whereas cloning preserves the original instance.

Correct answer: D. Cloud Spanner with a multi-region instance configuration.

Cloud Spanner with a multi-region configuration provides the required global strong consistency, relational SQL interface, and a 99.999 percent availability service level agreement. Cloud SQL lacks horizontal scalability, while Bigtable and Firestore are NoSQL solutions that do not offer external consistency.

Correct answer: B. Edit the subnet details in the Google Cloud Console and change the IP range to 10.1.0.0/23.

Expanding the primary IP range of an existing subnet is the non-disruptive method to increase available addresses without recreating resources. Secondary ranges are strictly for alias IPs like Kubernetes pods, so they cannot expand the primary address pool needed for standard virtual machines.

Correct answer: C. Create a Google Group for the developers. Grant the role to the group email address. Add the developers' accounts to the group.

Creating a Google Group and granting it the IAM role is the recommended practice, allowing you to manage access simply by adjusting group membership. Assigning roles to individual users creates massive policy bloat, and granting access to the entire domain violates the principle of least privilege.

Correct answer: C. Create a script named .customize_environment in your $HOME directory and add the installation commands there.

The customize environment script in your home directory is the designated mechanism for installing system-wide packages that need to run once when Cloud Shell starts. Placing the command in your bash profile runs it inefficiently on every new terminal tab instead of just once per virtual machine boot.

Correct answer: C. Create a Workload Identity Pool and an AWS Provider in Google Cloud. Grant the Workload Identity User role to the AWS IAM role ARN on the Google Service Account.

Creating a Workload Identity Pool establishes the necessary trust to let AWS identities exchange their credentials for short-lived Google Cloud access tokens. Long-lived service account keys are a security risk, and Workload Identity Federation is the modern, keyless best practice for cross-cloud authentication.

Correct answer: D. Use the Cloud Monitoring API client library in your application to define a custom metric and write the gauge values periodically.

Using the Cloud Monitoring API to write a custom gauge metric is correct because a gauge represents values that fluctuate up and down over time. A counter metric only increases, making it unsuitable for tracking a dynamic queue depth.

Correct answer: D. Enable Firewall Rule Logging on the individual firewall rules.

Enabling Firewall Rule Logging on the individual rules is correct because the console uses this specific feature to populate the hit count and last used metrics. VPC Flow Logs sample network traffic at the subnet level but do not populate firewall columns.

Correct answer: A. You provision a TPU VM directly via Compute Engine, GKE, or Gemini Enterprise Agent Platform, where the TPU chips and the host VM are a single integrated unit. You cannot attach a TPU to an existing arbitrary VM.

Cloud TPU VMs are provisioned as an integrated unit of host hardware and TPU chips, completely unlike attaching a GPU to an existing N1 VM. For the exam, remember that network-attached TPU nodes are legacy architecture; modern TPU usage relies entirely on the unified TPU VM model.

Correct answer: B. Configure a Regional External Passthrough Network Load Balancer in each region. Use Cloud DNS with a Geolocation routing policy to direct traffic.

Deploying regional passthrough network load balancers with a Cloud DNS geolocation policy correctly handles global UDP routing. Google Cloud lacks a global load balancer supporting raw UDP traffic, and proxy or application load balancers only handle TCP or HTTP protocols.

Correct answer: A. Install and configure Config Connector on your GKE cluster.

Config Connector is a Kubernetes add-on that lets you manage Google Cloud resources using standard declarative YAML manifests. Terraform is incorrect because it uses HashiCorp Configuration Language rather than Kubernetes-native configuration files.

Correct answer: D. Google Cloud NetApp Volumes. It supports both NFS and SMB/CIFS protocols, provides enterprise data management features like snapshots and replication, and offers three performance tiers (Standard, Premium, Extreme) with built-in data efficiency.

Google Cloud NetApp Volumes is the correct choice because it natively supports SMB and CIFS protocols required for Windows workloads. Filestore only supports NFS, making it incompatible with native Microsoft application requirements.

Correct answer: C. Configure a Budget of $100 with forecast-based thresholds enabled. Connect it to a Pub/Sub topic and deploy a Cloud Run Function triggered by the topic that sends notifications to your team's Slack channel when forecasted spend exceeds 100%.

Configuring a budget with a forecasted spend threshold and a Pub/Sub topic provides proactive alerts before exceeding your limit. Cloud Monitoring does not expose billing forecast metrics, so you must use the native budget programmatic notifications.

Correct answer: B. Create specific Service Accounts for the frontend and backend pools. Create a firewall rule allowing traffic where the Source Service Account is the frontend SA and the Target Service Account is the backend SA.

Using specific service accounts in your firewall rules securely ties network access to virtual machine identity, preventing users with basic instance admin rights from altering tags to bypass controls. Network tags are less secure because anyone who can edit an instance can modify them.

Correct answer: C. Add an attribute condition to the workload identity pool provider that checks the repository_owner_id claim against your organisation's numeric ID.

Adding an attribute condition to the pool provider is correct because it validates specific claims within the incoming token to restrict access. Modifying the issuer URL fails because GitHub uses a single, global issuer endpoint for all organizations.

Correct answer: D. Upgrade the log bucket containing the Cloud SQL audit logs to use Log Analytics. Once upgraded, you can write SQL queries directly in the Log Analytics page to query log views and aggregate data without additional BigQuery costs for storage or ingestion.

Upgrading a log bucket to use Log Analytics enables native SQL queries directly within Cloud Logging without requiring BigQuery exports. While Log Analytics is heavily marketed, exporting to BigQuery remains a valid, common architectural choice for complex queries.

Correct answer: D. The Fabric FAST (Foundational Architecture Solution for Terraform) repository.

Fabric FAST provides a turnkey, open-source Terraform blueprint to bootstrap a production-ready landing zone aligned with enterprise best practices. Deployment Manager is Google's deprecated infrastructure-as-code service and is not recommended for new landing zones.

Correct answer: D. Enable Database Center and view the Fleet Health dashboard.

Database Center provides a unified dashboard to proactively identify fleet-wide operational risks like missing backups. Cloud Monitoring tracks performance metrics, whereas this tool specifically evaluates configuration health and optimization.