Google Professional Cloud Architect Practice Exams
Last updated on Oct 22,2026- Exam Code: Professional Cloud Architect
- Exam Name: Google Certified Professional – Cloud Architect (GCP)
- Certification Provider: Google
- Latest update: Oct 22,2026
For this question, refer to the Dress4Win case study.
Which of the compute services should be migrated as Cis and would still be an optimized architecture for performance in the cloud?
- A . Web applications deployed using App Engine standard environment
- B . RabbitMQ deployed using an unmanaged instance group
- C . Hadoop/Spark deployed using Cloud Dataproc Regional in High Availability mode
- D . Jenkins, monitoring, bastion hosts, security scanners services deployed on custom machine types
Configure a VPN tunnel between vpc-a and vpc-b with the help of OpenVPN
A news teed web service has the following code running on Google App Engine. During peak load, users report that they can see news articles they already viewed.
What is the most likely cause of this problem?
- A . The session variable is local to just a single instance.
- B . The session variable is being overwritten in Cloud Datastore.
- C . The URL of the API needs to be modified to prevent caching.
- D . The HTTP Expires header needs to be set to -1 to stop caching.
A
Explanation:
https://stackoverflow.com/questions/3164280/google-app-engine-cache-list-in-session-variable?rq=1
A news teed web service has the following code running on Google App Engine. During peak load, users report that they can see news articles they already viewed.
What is the most likely cause of this problem?
- A . The session variable is local to just a single instance.
- B . The session variable is being overwritten in Cloud Datastore.
- C . The URL of the API needs to be modified to prevent caching.
- D . The HTTP Expires header needs to be set to -1 to stop caching.
A
Explanation:
https://stackoverflow.com/questions/3164280/google-app-engine-cache-list-in-session-variable?rq=1
You team needs to create a Google Kubernetes Engine (GKE) cluster to host a newly built application that requires access to third-party services on the internet. Your company does not allow any Compute Engine instance to have a public IP address on Google Cloud. You need to create a deployment strategy that adheres to these guidelines.
What should you do?
- A . Create a Compute Engine instance, and install a NAT Proxy on the instance. Configure all workloads on GKE to pass through this proxy to access third-party services on the Internet
- B . Configure the GKE cluster as a private cluster, and configure Cloud NAT Gateway for the cluster subnet
- C . Configure the GKE cluster as a route-based cluster. Configure Private Google Access on the Virtual Private Cloud (VPC)
- D . Configure the GKE cluster as a private cluster. Configure Private Google Access on the Virtual Private Cloud (VPC)
B
Explanation:
A Cloud NAT gateway can perform NAT for nodes and Pods in a private cluster, which is a type of VPC-native cluster. The Cloud NAT gateway must be configured to apply to at least the following subnet IP address ranges for the subnet that your cluster uses:
Subnet primary IP address range (used by nodes)
Subnet secondary IP address range used for Pods in the cluster Subnet secondary IP address range used for Services in the cluster
The simplest way to provide NAT for an entire private cluster is to configure a Cloud NAT gateway to apply to all of the cluster’s subnet’s IP address ranges. https://cloud.google.com/nat/docs/overview
You are deploying an application to Google Cloud. The application is part of a system. The application in Google Cloud must communicate over a private network with applications in a non-Google Cloud environment.
The expected average throughput is 200 kbps. The business requires:
• 99.99% system availability
• cost optimization
You need to design the connectivity between the locations to meet the business requirements.
What should you provision?
- A . A Classic Cloud VPN gateway connected with one tunnel to an on-premises VPN gateway.
- B . A Classic Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway.
- C . An HA Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway.
- D . Two HA Cloud VPN gateways connected to two on-premises VPN gateways. Configure each HA Cloud
VPN gateway to have two tunnels, each connected to different on-premises VPN gateways.
C
Explanation:
https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies#configurations_that_support_9999_availability
You are designing a large distributed application with 30 microservices. Each of your distributed microservices needs to connect to a database back-end. You want to store the credentials securely.
Where should you store the credentials?
- A . In the source code
- B . In an environment variable
- C . In a secret management system
- D . In a config file that has restricted access through ACLs
C
Explanation:
https://cloud.google.com/docs/authentication/production#providing_credentials_to_your_applicati on
You have deployed an application on Anthos clusters (formerly Anthos GKE). According to the SRE practices at your company you need to be alerted if the request latency is above a certain threshold for a specified amount of time.
What should you do?
- A . Enable the Cloud Trace API on your project and use Cloud Monitoring Alerts to send an alert based on the Cloud Trace metrics
- B . Configure Anthos Config Management on your cluster and create a yaml file that defines the SLO and alerting policy you want to deploy in your cluster
- C . Use Cloud Profiler to follow up the request latency. Create a custom metric in Cloud Monitoring based on the results of Cloud Profiler, and create an Alerting Policy in case this metric exceeds the threshold
- D . Install Anthos Service Mesh on your cluster. Use the Google Cloud Console to define a Service Level Objective (SLO)
D
Explanation:
https://cloud.google.com/service-mesh/docs/overview
https://cloud.google.com/service-mesh/docs/observability/slo-overview
Your company creates rendering software which users can download from the company website. Your company has customers all over the world. You want to minimize latency for all your customers. You
want to follow Google-recommended practices.
How should you store the files?
- A . Save the files in a Multi-Regional Cloud Storage bucket.
- B . Save the files in a Regional Cloud Storage bucket, one bucket per zone of the region.
- C . Save the files in multiple Regional Cloud Storage buckets, one bucket per zone per region.
- D . Save the files in multiple Multi-Regional Cloud Storage buckets, one bucket per multi-region.
A
Explanation:
https://cloud.google.com/storage/docs/locations#location-mr
Your web application has several VM instances running within a VPC. You want to restrict communications between instances to only the paths and ports you authorize, but you don’t want to rely on static IP addresses or subnets because the app can autoscale.
How should you restrict communications?
- A . Use separate VPCs to restrict traffic
- B . Use firewall rules based on network tags attached to the compute instances
- C . Use Cloud DNS and only allow connections from authorized hostnames
- D . Use service accounts and configure the web application particular service accounts to have access