Question 1

You have an application that will run on Compute Engine. You need to design an architecture that takes into account a disaster recovery plan that requires your application to fail over to another region in case of a regional outage. What should you do?

Options :

A : A. Deploy the application on two Compute Engine instances in the same project but in a different region. Use the first instance to serve traffic, and use the HTTP load balancing service to fail over to the standby instance in case of a disaster.

B : Deploy the application on a Compute Engine instance. Use the instance to serve traffic, and use the HTTP load balancing service to fail over to an instance on your premises in case of a disaster.

C : Deploy the application on two Compute Engine instance groups, each in the same project but in a different region. Use the first instance group to serve traffic, and use the HTTP load balancing service to fail over to the standby instance group in case of a disaster.

D : Deploy the application on two Compute Engine instance groups, each in a separate project and a different region. Use the first instance group to serve traffic, and use the HTTP load balancing service to fail over to the standby instance group in case of a disaster.

Answer: C

Question 2

You can use the internal IP address, but not the external IP adddress, to SSH an instance from another instance in the same VPC. What is one possible reason?

Options :

A : The receiving instance has an ephemeral address instead of a reserved address

B : The external IP address is disabled

C : The outgoing instance does not have the correct permission granted to its service account

D : The firewall rule to allow SSH is restricted to the internal VPC

Answer: D

Question 3

A digital media company lately shifted its infrastructure from On-Site to Google Cloud. There are multiple instances that are under the Global HTTPS load balancer. DDoS attacks were reported a few days ago for applications and infrastructure. Now they are searching for a service that could provide a DDoS protection mechanism. Which service should they use for this purpose?

Options :

A : IAM policies

B : Cloud Identity Aware Proxy

C : GCP firewalls

D : Cloud Armor

Answer: D

Question 4

Refer to the EHR Healthcare case study for this question: https://services.google.com/fh/files/blogs/master_case_study_ehr_healthcare.pdfThe sales employees of EHR work remotely and travel to various locations for their job. These employees require access to web-based sales tools located in the EHR data center. EHR has made the decision to retire their existing Virtual Private Network (VPN) infrastructure, necessitating the migration of the web-based sales tools to a BeyondCorp access model. Each sales employee possesses a Google Workspace account, which they utilize for single sign-on (SSO) purposes. What should you do?

Options :

A : You should create an Identity-Aware Proxy (IAP) connector that points to the sales tool application.

B : You should deploy an external HTTP(S) load balancer and create a custom Cloud Armor policy for the sales tool application.

C : You should create a Google group for the sales tool application, and upgrade that group to a security group.

D : For every sales employee who needs access to the sales tool application, you should give their Google Workspace user account the predefined AppEngine Viewer role.

Answer: A

Question 5

You are working with Cloud Shell and need to install a custom utility in a few weeks. Where can the file be stored so that it is in the default execution path and remains persistent across sessions?

Options :

A : ~/bin

B : Cloud Storage

C : /google/scripts

D : /usr/local/bin

Answer: A

Free Professional-Cloud-Architect Mock Exam – Practice Online Confidently

Buying Options: