Google Professional Cloud Architect Practice Exams
Last updated on Oct 22,2026- Exam Code: Professional Cloud Architect
- Exam Name: Google Certified Professional – Cloud Architect (GCP)
- Certification Provider: Google
- Latest update: Oct 22,2026
Your web application uses Google Kubernetes Engine to manage several workloads. One workload requires a consistent set of hostnames even after pod scaling and relaunches.
Which feature of Kubernetes should you use to accomplish this?
- A . StatefulSets
- B . Role-based access control
- C . Container environment variables
- D . Persistent Volumes
A
Explanation:
https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/
You are working with a data warehousing team that performs data analysis. The team needs to process data from external partners, but the data contains personally identifiable information (PlI). You need to process and store the data without storing any of the Pll dat a.
What should you do?
- A . Create a Dataflow pipeline to retrieve the data from the external sources. As part of the pipeline use the Cloud Data Loss Prevention (Cloud DLP) API to remove any Pll data Store the result in BigQuery
- B . Create a Dataflow pipeline to retrieve the data from the external sources. As part of the pipeline store all non-PII data in BigQuery and store all Pll data in a Cloud Storage bucket that has a retention policy set.
- C . Ask the external partners to upload an data on Cloud Storage Configure Bucket Lock for the bucket Create a Dataflow pipeline to read the data from the bucket As part of the pipeline, use the Cloud Data Loss Prevention (Cloud DIP) API to remove any Pll data Store the result in BigQuery
- D . Ask the external partners to import ail data in your BigQuery dataset Create a dataflow pipeline to copy the data into a new table As part of the Dataflow bucket skip all data in columns that have Pll data
A
Explanation:
Create a Dataflow pipeline to retrieve the data from the external sources, he did not specify the way he is going to create it, it might be a pub/sub or external table or whatever.
Your company places a high value on being responsive and meeting customer needs quickly. Their primary business objectives are release speed and agility. You want to reduce the chance of security errors being accidentally introduced.
Which two actions can you take? Choose 2 answers
- A . Ensure every code check-in is peer reviewed by a security SME.
- B . Use source code security analyzers as part of the CI/CD pipeline.
- C . Ensure you have stubs to unit test all interfaces between components.
- D . Enable code signing and a trusted binary repository integrated with your CI/CD pipeline.
- E . Run a vulnerability security scanner as part of your continuous-integration /continuous-delivery (CI/CD) pipeline.
BE
Explanation:
https://docs.microsoft.com/en-us/vsts/articles/security-validation-cicd-pipeline?view=vsts
Your customer is moving their corporate applications to Google Cloud Platform. The security team wants detailed visibility of all projects in the organization. You provision the Google Cloud Resource Manager and set up yourself as the org admin.
What Google Cloud Identity and Access Management (Cloud IAM) roles should you give to the security team’?
- A . Org viewer, project owner
- B . Org viewer, project viewer
- C . Org admin, project browser
- D . Project owner, network admin
B
Explanation:
https://cloud.google.com/iam/docs/using-iam-securely
Your company wants you to build a highly reliable web application with a few public APIs as the backend. You don’t expect a lot of user traffic, but traffic could spike occasionally. You want to leverage Cloud Load Balancing, and the solution must be cost-effective for users.
What should you do?
- A . Store static content such as HTML and images in Cloud CDN. Host the APIs on App Engine and store the user data in Cloud SQL.
- B . Store static content such as HTML and images in a Cloud Storage bucket. Host the APIs on a zonal Google Kubernetes Engine cluster with worker nodes in multiple zones, and save the user data in Cloud Spanner.
- C . Store static content such as HTML and images in Cloud CDN. Use Cloud Run to host the APIs and save the user data in Cloud SQL.
- D . Store static content such as HTML and images in a Cloud Storage bucket. Use Cloud Functions to host the APIs and save the user data in Firestore.
D
Explanation:
https://cloud.google.com/load-balancing/docs/https/setting-up-https-serverless#gcloud:-cloud-functions
https://cloud.google.com/blog/products/networking/better-load-balancing-for-app-engine-cloud-run-and-functions
You have an outage in your Compute Engine managed instance group: all instance keep restarting after 5 seconds. You have a health check configured, but autoscaling is disabled. Your colleague, who is a Linux expert, offered to look into the issue. You need to make sure that he can access the VMs.
What should you do?
- A . Grant your colleague the IAM role of project Viewer
- B . Perform a rolling restart on the instance group
- C . Disable the health check for the instance group. Add his SSH key to the project-wide SSH keys
- D . Disable autoscaling for the instance group. Add his SSH key to the project-wide SSH Keys
C
Explanation:
https://cloud.google.com/compute/docs/instance-groups/autohealing-instances-in-migs
Health checks used for autohealing should be conservative so they don’t preemptively delete and recreate your instances. When an autohealer health check is too aggressive, the autohealer might mistake busy instances for failed instances and unnecessarily restart them, reducing availability
Your customer wants to do resilience testing of their authentication layer. This consists of a regional managed instance group serving a public REST API that reads from and writes to a Cloud SQL instance.
What should you do?
- A . Engage with a security company to run web scrapes that look your users’ authentication data om malicious websites and notify you if any if found.
- B . Deploy intrusion detection software to your virtual machines to detect and log unauthorized access.
- C . Schedule a disaster simulation exercise during which you can shut off all VMs in a zone to see how your application behaves.
- D . Configure a red replica for your Cloud SQL instance in a different zone than the master, and then manually trigger a failover while monitoring KPIs for our REST API.
You have developed an application using Cloud ML Engine that recognizes famous paintings from uploaded images. You want to test the application and allow specific people to upload images for the next 24 hours. Not all users have a Google Account.
How should you have users upload images?
- A . Have users upload the images to Cloud Storage. Protect the bucket with a password that expires after 24 hours.
- B . Have users upload the images to Cloud Storage using a signed URL that expires after 24 hours.
- C . Create an App Engine web application where users can upload images. Configure App Engine to disable the application after 24 hours. Authenticate users via Cloud Identity.
- D . Create an App Engine web application where users can upload images for the next 24 hours.
Authenticate users via Cloud Identity.
A
Explanation:
https://cloud.google.com/blog/products/storage-data-transfer/uploading-images-directly-to-cloud-storage-by-using-signed-url
You have developed an application using Cloud ML Engine that recognizes famous paintings from uploaded images. You want to test the application and allow specific people to upload images for the next 24 hours. Not all users have a Google Account.
How should you have users upload images?
- A . Have users upload the images to Cloud Storage. Protect the bucket with a password that expires after 24 hours.
- B . Have users upload the images to Cloud Storage using a signed URL that expires after 24 hours.
- C . Create an App Engine web application where users can upload images. Configure App Engine to disable the application after 24 hours. Authenticate users via Cloud Identity.
- D . Create an App Engine web application where users can upload images for the next 24 hours.
Authenticate users via Cloud Identity.
A
Explanation:
https://cloud.google.com/blog/products/storage-data-transfer/uploading-images-directly-to-cloud-storage-by-using-signed-url
As part of implementing their disaster recovery plan, your company is trying to replicate their production MySQL database from their private data center to their GCP project using a Google Cloud VPN connection.
They are experiencing latency issues and a small amount of packet loss that is disrupting the replication.
What should they do?
- A . Configure their replication to use UDP.
- B . Configure a Google Cloud Dedicated Interconnect.
- C . Restore their database daily using Google Cloud SQL.
- D . Add additional VPN connections and load balance them.
- E . Send the replicated transaction to Google Cloud Pub/Sub.