Question 1

An enterprise is in search of a solution for its application. The solution will handle the load in case of a failure of the entire zone. In your opinion, from the following options, which solution is better? (Choose 2)

Options :

A : Overprovision your regional managed instance group by at least 50% (for three zones)

B : Spread your managed instance group over two zones and overprovision by 100% (for two zones)

C : Do not select the "Multizone" option when creating your managed instance group

D : Create a regional unmanaged instance group and spread your instances across multiple zones

Answer: A,B

Question 2

As a cloud architect, you are managing a project that consists of a single Virtual Private Cloud (VPC) and a single subnetwork located in the us-west1 region. Within this subnetwork, there is a Compute Engine instance hosting an application. Now, your development team intends to deploy a new instance within the same project, but in the europe-central2 region. They require access to the application and wish to adhere to Google's best practices. As a cloud architect, what guidance should you provide in this situation?

Options :

A : They should create a subnetwork in the same VPC, in europe-central2 region. Than, use Cloud VPN to connect these two subnetworks, and finally create a new instance in the new subnetwork and use the first instance-s private address as the endpoint.

B : They should create a VPC and a subnetwork in europe-central2 region. Than, expose the application with an internal load balancer, and finally create a new instance in the new subnetwork and use the load balancer-s address as the endpoint.

C : They should create a VPC and a subnetwork in europe-central2 region. Than, peer the 2 VPCs, and finally create a new instance in the new subnetwork and use the first instance-s private address as the endpoint.

D : They should create a subnetwork in the same VPC, in europe-central2 region. Than, create a new instance in the new subnetwork and use the first instance-s private address as the endpoint.

Answer: D

Question 3

In your role as a cloud architect, you are tasked with designing a large distributed application comprising 20 microservices. Each of these microservices must connect to the database backend. Your objective is to ensure the secure storage of credentials for these connections. What is the recommended storage location for the credentials?

Options :

A : In a config file that has restricted access through ACLs

B : In an environment variable

C : In a secret management system

D : In the source code

Answer: C

Question 4

Your organization has stored sensitive data in a Cloud Storage bucket. For regulatory reasons, your company must be able to rotate the encryption key used to encrypt the data in the bucket. The data will be processed in Dataproc. You want to follow Google-recommended practices for security. What should you do?

Options :

A : Create a key with Cloud Key Management Service (KMS). Encrypt the data using the encrypt method of Cloud KMS.

B : Create a key with Cloud Key Management Service (KMS). Set the encryption key on the bucket to the Cloud KMS key.

C : Generate a GPG key pair. Encrypt the data using the GPG key. Upload the encrypted data to the bucket.

D : Generate an AES-256 encryption key. Encrypt the data in the bucket using the customer-supplied encryption keys feature.

Answer: D

Question 5

Refer to the Mountkirk Games case study for this question: https://services.google.com/fh/files/blogs/master_case_study_mountkirk_games.pdfAs a cloud architect, your task is to deploy Virtual Private Cloud (VPC) Service Controls for Mountkirk Games. The objective is to allow developers to utilize Cloud Shell while ensuring they do not have unrestricted access to managed services. It is crucial to find a balance between these conflicting goals while considering the business requirements of Mountkirk Games. What steps should you take in this scenario?

Options :

A : You should use VPC Service Controls for the entire platform.

B : You should create a service perimeter around only the projects that handle sensitive data, and do not grant your developers access to it.

C : You should include all developers in an access level associated with the service perimeter, and allow them to use Cloud Shell.

D : You should prioritize VPC Service Controls implementation over Cloud Shell usage for the entire platform.

Answer: B

Free Professional-Cloud-Architect Mock Exam – Practice Online Confidently

Buying Options: