Google Professional Cloud Architect Practice Exams
Last updated on Oct 23,2026- Exam Code: Professional Cloud Architect
- Exam Name: Google Certified Professional – Cloud Architect (GCP)
- Certification Provider: Google
- Latest update: Oct 23,2026
You have been asked to select the storage system for the click-data of your company’s large portfolio of websites. This data is streamed in from a custom website analytics package at a typical rate of 6,000 clicks per minute, with bursts of up to 8,500 clicks per second. It must been stored for future analysis by your data science and user experience teams.
Which storage infrastructure should you choose?
- A . Google Cloud SQL
- B . Google Cloud Bigtable
- C . Google Cloud Storage
- D . Google cloud Datastore
C
Explanation:
https://cloud.google.com/bigquery/docs/loading-data-cloud-storage
A recent audit that a new network was created in Your GCP project. In this network, a GCE instance has an SSH port open the world. You want to discover this network’s origin.
What should you do?
- A . Search for Create VM entry in the Stackdriver alerting console.
- B . Navigate to the Activity page in the Home section. Set category to Data Access and search for Create VM entry.
- C . In the logging section of the console, specify GCE Network as the logging section. Search for the Create Insert entry.
- D . Connect to the GCE instance using project SSH Keys. Identify previous logins in system logs, and match these with the project owners list.
C
Explanation:
Incorrect Answers:
A: To use the Stackdriver alerting console we must first set up alerting policies.
B: Data access logs only contain read-only operations.
Audit logs help you determine who did what, where, and when.
Cloud Audit Logging returns two types of logs:
– Admin activity logs
– Data access logs: Contains log entries for operations that perform read-only operations do not modify any data, such as get, list, and aggregated list methods.
A recent audit that a new network was created in Your GCP project. In this network, a GCE instance has an SSH port open the world. You want to discover this network’s origin.
What should you do?
- A . Search for Create VM entry in the Stackdriver alerting console.
- B . Navigate to the Activity page in the Home section. Set category to Data Access and search for Create VM entry.
- C . In the logging section of the console, specify GCE Network as the logging section. Search for the Create Insert entry.
- D . Connect to the GCE instance using project SSH Keys. Identify previous logins in system logs, and match these with the project owners list.
C
Explanation:
Incorrect Answers:
A: To use the Stackdriver alerting console we must first set up alerting policies.
B: Data access logs only contain read-only operations.
Audit logs help you determine who did what, where, and when.
Cloud Audit Logging returns two types of logs:
– Admin activity logs
– Data access logs: Contains log entries for operations that perform read-only operations do not modify any data, such as get, list, and aggregated list methods.
Your company captures all web traffic data in Google Analytics 260 and stores it in BigQuery. Each country has its own dataset. Each dataset has multiple tables. You want analysts from each country to be able to see and query only the data for their respective countries.
How should you configure the access rights?
- A . Create a group per country. Add analysts to their respective country-groups. Create a single group ‘all_analysts’, and add all country-groups as members. Grant the ‘all-analysis’ group the IAM role of BigQuery jobUser. Share the appropriate dataset with view access with each respective analyst country-group.
- B . Create a group per country. Add analysts to their respective country-groups. Create a single group ‘all_analysts’, and add all country-groups as members. Grant the ‘all-analysis’ group the IAM role of BigQuery jobUser. Share the appropriate tables with view access with each respective analyst countrygroup.
- C . Create a group per country. Add analysts to their respective country-groups. Create a single group ‘all_analysts’, and add all country-groups as members. Grant the ‘all-analysis’ group the IAM role of BigQuery dataViewer. Share the appropriate dataset with view access with each respective analyst country-group.
- D . Create a group per country. Add analysts to their respective country-groups. Create a single group ‘all_analysts’, and add all country-groups as members. Grant the ‘all-analysis’ group the IAM role of BigQuery dataViewer. Share the appropriate table with view access with each respective analyst countrygroup.
For this question, refer to the TerramEarth case study
Your development team has created a structured API to retrieve vehicle data. They want to allow third parties to develop tools for dealerships that use this vehicle event data. You want to support delegated authorization against this data.
What should you do?
- A . Build or leverage an OAuth-compatible access control system.
- B . Build SAML 2.0 SSO compatibility into your authentication system.
- C . Restrict data access based on the source IP address of the partner systems.
- D . Create secondary credentials for each dealer that can be given to the trusted third party.
A
Explanation:
https://cloud.google.com/appengine/docs/flexible/go/authorizing-apps https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#delegate_application_authorization_with_oauth2
Delegate application authorization with OAuth2
Cloud Platform APIs support OAuth 2.0, and scopes provide granular authorization over the methods that are supported. Cloud Platform supports both service-account and user-account OAuth, also called three-legged OAuth.
Reference: https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#delegate_application_authorization_with_oauth2 https://cloud.google.com/appengine/docs/flexible/go/authorizing-apps
Your company wants to start using Google Cloud resources but wants to retain their on-premises Active Directory domain controller for identity management.
What should you do?
- A . Use the Admin Directory API to authenticate against the Active Directory domain controller.
- B . Use Google Cloud Directory Sync to synchronize Active Directory usernames with cloud identities and
configure SAML SSO. - C . Use Cloud Identity-Aware Proxy configured to use the on-premises Active Directory domain controller as an identity provider.
- D . Use Compute Engine to create an Active Directory (AD) domain controller that is a replica of the onpremises AD domain controller using Google Cloud Directory Sync.
B
Explanation:
https://cloud.google.com/solutions/federating-gcp-with-active-directory-introduction#implementing_federation
During a high traffic portion of the day, one of your relational databases crashes, but the replica is never promoted to a master. You want to avoid this in the future.
What should you do?
- A . Use a different database.
- B . Choose larger instances for your database.
- C . Create snapshots of your database more regularly.
- D . Implement routinely scheduled failovers of your databases.
D
Explanation:
https://cloud.google.com/solutions/dr-scenarios-planning-guide
For this question, refer to the Mountkirk Games case study.
Mountkirk Games wants to set up a continuous delivery pipeline. Their architecture includes many small services that they want to be able to update and roll back quickly.
Mountkirk Games has the following requirements:
• Services are deployed redundantly across multiple regions in the US and Europe.
• Only frontend services are exposed on the public internet.
• They can provide a single frontend IP for their fleet of services.
• Deployment artifacts are immutable.
Which set of products should they use?
- A . Google Cloud Storage, Google Cloud Dataflow, Google Compute Engine
- B . Google Cloud Storage, Google App Engine, Google Network Load Balancer
- C . Google Kubernetes Registry, Google Container Engine, Google HTTP(S) Load Balancer
- D . Google Cloud Functions, Google Cloud Pub/Sub, Google Cloud Deployment Manager
For this question, refer to the Mountkirk Games case study.
Mountkirk Games wants to set up a continuous delivery pipeline. Their architecture includes many small services that they want to be able to update and roll back quickly.
Mountkirk Games has the following requirements:
• Services are deployed redundantly across multiple regions in the US and Europe.
• Only frontend services are exposed on the public internet.
• They can provide a single frontend IP for their fleet of services.
• Deployment artifacts are immutable.
Which set of products should they use?
- A . Google Cloud Storage, Google Cloud Dataflow, Google Compute Engine
- B . Google Cloud Storage, Google App Engine, Google Network Load Balancer
- C . Google Kubernetes Registry, Google Container Engine, Google HTTP(S) Load Balancer
- D . Google Cloud Functions, Google Cloud Pub/Sub, Google Cloud Deployment Manager
For this question, refer to the Mountkirk Games case study.
Mountkirk Games wants to set up a continuous delivery pipeline. Their architecture includes many small services that they want to be able to update and roll back quickly.
Mountkirk Games has the following requirements:
• Services are deployed redundantly across multiple regions in the US and Europe.
• Only frontend services are exposed on the public internet.
• They can provide a single frontend IP for their fleet of services.
• Deployment artifacts are immutable.
Which set of products should they use?
- A . Google Cloud Storage, Google Cloud Dataflow, Google Compute Engine
- B . Google Cloud Storage, Google App Engine, Google Network Load Balancer
- C . Google Kubernetes Registry, Google Container Engine, Google HTTP(S) Load Balancer
- D . Google Cloud Functions, Google Cloud Pub/Sub, Google Cloud Deployment Manager