Google Professional Cloud Architect Practice Exams
Last updated on Oct 22,2026- Exam Code: Professional Cloud Architect
- Exam Name: Google Certified Professional – Cloud Architect (GCP)
- Certification Provider: Google
- Latest update: Oct 22,2026
You are configuring the cloud network architecture for a newly created project m Google Cloud that will host applications in Compote Engine Compute Engine virtual machine instances will be created in two different subnets (sub-a and sub-b) within a single region
• Instances in sub-a win have public IP addresses
• Instances in sub-b will have only private IP addresses
To download updated packages, instances must connect to a public repository outside the boundaries of Google Cloud You need to allow sub-b to access the external repository.
What should you do?
- A . Enable Private Google Access on sub-b
- B . Configure Cloud NAT and select sub b m the NAT mapping section
- C . Configure a bastion host instance in sub a to connect to instances in sub-b
- D . Enable Identity Aware Proxy for TCP forwarding for instances in sub-b
For this question, refer to the TerramEarth case study.
TerramEarth’s 20 million vehicles are scattered around the world. Based on the vehicle’s location its telemetry data is stored in a Google Cloud Storage (GCS) regional bucket (US. Europe, or Asia). The CTO has asked you to run a report on the raw telemetry data to determine why vehicles are breaking down after 100 K miles. You want to run this job on all the data.
What is the most cost-effective way to run this job?
- A . Move all the data into 1 zone, then launch a Cloud Dataproc cluster to run the job.
- B . Move all the data into 1 region, then launch a Google Cloud Dataproc cluster to run the job.
- C . Launch a cluster in each region to preprocess and compress the raw data, then move the data into a multi region bucket and use a Dataproc cluster to finish the job.
- D . Launch a cluster in each region to preprocess and compress the raw data, then move the data into a region bucket and use a Cloud Dataproc cluster to finish the jo
D
Explanation:
Storageguarantees 2 replicates which are geo diverse (100 miles apart) which can get better remote latency and availability.
More importantly, is that multiregional heavily leverages Edge caching and CDNs to provide the content to the end users.
All this redundancy and caching means that Multiregional comes with overhead to sync and ensure consistency between geo-diverse areas. As such, it’s much better for write-once-read-many scenarios. This means frequently accessed (e.g. “hot” objects) around the world, such as website content, streaming videos, gaming or mobile applications.
Reference: https://medium.com/google-cloud/google-cloud-storage-what-bucket-class-for-the-best-performance-5c847ac8f9f2
For this question, refer to the TerramEarth case study.
TerramEarth’s 20 million vehicles are scattered around the world. Based on the vehicle’s location its telemetry data is stored in a Google Cloud Storage (GCS) regional bucket (US. Europe, or Asia). The CTO has asked you to run a report on the raw telemetry data to determine why vehicles are breaking down after 100 K miles. You want to run this job on all the data.
What is the most cost-effective way to run this job?
- A . Move all the data into 1 zone, then launch a Cloud Dataproc cluster to run the job.
- B . Move all the data into 1 region, then launch a Google Cloud Dataproc cluster to run the job.
- C . Launch a cluster in each region to preprocess and compress the raw data, then move the data into a multi region bucket and use a Dataproc cluster to finish the job.
- D . Launch a cluster in each region to preprocess and compress the raw data, then move the data into a region bucket and use a Cloud Dataproc cluster to finish the jo
D
Explanation:
Storageguarantees 2 replicates which are geo diverse (100 miles apart) which can get better remote latency and availability.
More importantly, is that multiregional heavily leverages Edge caching and CDNs to provide the content to the end users.
All this redundancy and caching means that Multiregional comes with overhead to sync and ensure consistency between geo-diverse areas. As such, it’s much better for write-once-read-many scenarios. This means frequently accessed (e.g. “hot” objects) around the world, such as website content, streaming videos, gaming or mobile applications.
Reference: https://medium.com/google-cloud/google-cloud-storage-what-bucket-class-for-the-best-performance-5c847ac8f9f2
Your development team has installed a new Linux kernel module on the batch servers in Google Compute Engine (GCE) virtual machines (VMs) to speed up the nightly batch process. Two days after the installation, 50% of web application deployed in the same
nightly batch run. You want to collect details on the failure to pass back to the development team.
Which three actions should you take? Choose 3 answers
- A . Use Stackdriver Logging to search for the module log entries.
- B . Read the debug GCE Activity log using the API or Cloud Console.
- C . Use gcloud or Cloud Console to connect to the serial console and observe the logs.
- D . Identify whether a live migration event of the failed server occurred, using in the activity log.
- E . Adjust the Google Stackdriver timeline to match the failure time, and observe the batch server metrics.
- F . Export a debug VM into an image, and run the image on a local server where kernel log messages will be displayed on the native screen.
ACE
Explanation:
https://www.flexera.com/blog/cloud/2013/12/google-compute-engine-live-migration-passes-the-test/
"With live migration, the virtual machines are moved without any downtime or noticeable service degradation"
Your development team has installed a new Linux kernel module on the batch servers in Google Compute Engine (GCE) virtual machines (VMs) to speed up the nightly batch process. Two days after the installation, 50% of web application deployed in the same
nightly batch run. You want to collect details on the failure to pass back to the development team.
Which three actions should you take? Choose 3 answers
- A . Use Stackdriver Logging to search for the module log entries.
- B . Read the debug GCE Activity log using the API or Cloud Console.
- C . Use gcloud or Cloud Console to connect to the serial console and observe the logs.
- D . Identify whether a live migration event of the failed server occurred, using in the activity log.
- E . Adjust the Google Stackdriver timeline to match the failure time, and observe the batch server metrics.
- F . Export a debug VM into an image, and run the image on a local server where kernel log messages will be displayed on the native screen.
ACE
Explanation:
https://www.flexera.com/blog/cloud/2013/12/google-compute-engine-live-migration-passes-the-test/
"With live migration, the virtual machines are moved without any downtime or noticeable service degradation"
You are responsible for the Google Cloud environment in your company Multiple departments need access to their own projects and the members within each department will have the same project responsibilities You want to structure your Google Cloud environment for minimal maintenance and maximum overview of 1AM permissions as each department’s projects start and end You want to follow Google-recommended practices.
What should you do?
- A . Create a Google Group per department and add all department members to their respective groups Create a folder per department and grant the respective group the required 1AM permissions at the folder level Add the projects under the respective folders
- B . Grant all department members the required 1AM permissions for their respective projects
- C . Create a Google Group per department and add all department members to their respective groups Grant each group the required I AM permissions for their respective projects
- D . Create a folder per department and grant the respective members of the department the required 1AM permissions at the folder level. Structure all projects for each department under the respective folders
A
Explanation:
This option follows the Google-recommended practices for structuring a Google Cloud environment for minimal maintenance and maximum overview of IAM permissions. By creating a Google Group per department and adding all department members to their respective groups, you can simplify user management and avoid granting IAM permissions to individual users. By creating a folder per department and granting the respective group the required IAM permissions at the folder level, you can enforce consistent policies across all projects within each department and avoid granting IAM permissions at the project level. By adding the projects under the respective folders, you can organize your resources hierarchically and leverage inheritance of IAM policies from folders to projects. The other options are not optimal for this scenario, because they either require granting IAM permissions to individual users (B, C), or do not use Google Groups to manage users (D).
Reference:
https://cloud.google.com/architecture/framework/system-design https://cloud.google.com/architecture/identity/best-practices-for-planning https://cloud.google.com/resource-manager/docs/creating-managing-folders
TerramEarth has about 1 petabyte (PB) of vehicle testing data in a private data center. You want to move the data to Cloud Storage for your machine learning team. Currently, a 1-Gbps interconnect link is available for you. The machine learning team wants to start using the data in a month.
What should you do?
- A . Request Transfer Appliances from Google Cloud, export the data to appliances, and return the appliances to Google Cloud.
- B . Configure the Storage Transfer service from Google Cloud to send the data from your data center to Cloud Storage
- C . Make sure there are no other users consuming the 1 Gbps link, and use multi-thread transfer to upload the data to Cloud Storage.
- D . Export files to an encrypted USB device, send the device to Google Cloud, and request an import of the data to Cloud Storage
One of your primary business objectives is being able to trust the data stored in your application. You want to log all changes to the application data.
How can you design your logging system to verify authenticity of your logs?
- A . Write the log concurrently in the cloud and on premises.
- B . Use a SQL database and limit who can modify the log table.
- C . Digitally sign each timestamp and log entry and store the signature.
- D . Create a JSON dump of each log entry and store it in Google Cloud Storage.
C
Explanation:
https://cloud.google.com/storage/docs/access-logs
Reference: https://cloud.google.com/logging/docs/reference/tools/gcloud-logging
One of your primary business objectives is being able to trust the data stored in your application. You want to log all changes to the application data.
How can you design your logging system to verify authenticity of your logs?
- A . Write the log concurrently in the cloud and on premises.
- B . Use a SQL database and limit who can modify the log table.
- C . Digitally sign each timestamp and log entry and store the signature.
- D . Create a JSON dump of each log entry and store it in Google Cloud Storage.
C
Explanation:
https://cloud.google.com/storage/docs/access-logs
Reference: https://cloud.google.com/logging/docs/reference/tools/gcloud-logging
One of your primary business objectives is being able to trust the data stored in your application. You want to log all changes to the application data.
How can you design your logging system to verify authenticity of your logs?
- A . Write the log concurrently in the cloud and on premises.
- B . Use a SQL database and limit who can modify the log table.
- C . Digitally sign each timestamp and log entry and store the signature.
- D . Create a JSON dump of each log entry and store it in Google Cloud Storage.
C
Explanation:
https://cloud.google.com/storage/docs/access-logs
Reference: https://cloud.google.com/logging/docs/reference/tools/gcloud-logging