Professional Cloud Architect · Sample questions

Professional Cloud Architect sample questions with answers and explanations

10 real questions from the CertifyDeck Professional Cloud Architect bank, spread across the domains of the official Google Cloud Certified Professional Cloud Architect skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.

1. Question 1Domain: Managing and provisioning a cloud solution infrastructureEasy

   Your team runs a file-processing application on Compute Engine VMs with Hyperdisk Balanced data disks. You must back up the disks every day, keep each backup for 14 days, and have older backups removed automatically, following Google-recommended practices with minimal custom tooling. What should you do?

   • A.Write a cron job on each VM that runs gcloud compute disks snapshot every night and deletes snapshots older than 14 days.
   • B.Convert the data disks to Hyperdisk Balanced High Availability so that each disk is replicated to a second zone.
   • C.Create a snapshot schedule with a daily schedule and --max-retention-days 14, and attach it to the data disks.
   • D.Copy the data files to a Cloud Storage bucket every night with gcloud storage rsync and enable Autoclass.
   Show answer and explanation

   Correct answer: C. Create a snapshot schedule with a daily schedule and --max-retention-days 14, and attach it to the data disks.

   Explanation

   Snapshot schedules are the recommended way to back up Persistent Disk and Hyperdisk volumes regularly and automatically, and the --max-retention-days value sets how long each snapshot is kept before it is deleted. A cron job per VM is custom tooling to maintain. Synchronous replication to a second zone protects against a zonal outage but copies deletions and corruption, so it isn't a backup, and Autoclass changes storage classes without deleting old copies.

   Official references

   • Create schedules for disk snapshots
2. Question 2Domain: Managing and provisioning a cloud solution infrastructureEasy

   Your company ingests clickstream events from Pub/Sub and also reprocesses historical files from Cloud Storage, and it wants one programming model for both streaming and batch. Volumes fluctuate during the day. The data team does not want to provision, scale or delete worker VMs, and every record must be processed exactly once before it lands in BigQuery. Which service should you provision?

   • A.Cloud Run functions triggered by each Pub/Sub message, plus a scheduled job that replays the historical files.
   • B.A Compute Engine managed instance group that runs custom consumer code and autoscales on Pub/Sub backlog.
   • C.A long-running Managed Service for Apache Spark cluster with Spark Structured Streaming jobs and an autoscaling policy.
   • D.Dataflow pipelines built with the Apache Beam SDK, using the same pipeline code for streaming and batch.
   Show answer and explanation

   Correct answer: D. Dataflow pipelines built with the Apache Beam SDK, using the same pipeline code for streaming and batch.

   Explanation

   Dataflow is fully managed: it allocates worker VMs for each job, autoscales them, deletes them when the job ends, uses the same Apache Beam programming model for batch and streaming, and provides exactly-once processing of every record by default. A Managed Service for Apache Spark cluster and a managed instance group both leave you provisioning and operating the compute. Per-message functions plus a separate replay job means two programming models and no built-in exactly-once guarantee.

   Official references

   • Dataflow overview
3. Question 3Domain: Analyzing and optimizing technical and business processesEasy

   Your company's assessment found that application developers and infrastructure operators both lack Google Cloud experience, and each group needs different skills. The training budget is limited, and engineers must be able to experiment without touching production. What should you recommend?

   • A.Postpone training until after the migration, and let the engineers learn by operating the migrated workloads in production.
   • B.Assign role-based learning paths to developers and operators separately, and give engineers free trial or sandbox environments to practice in.
   • C.Hire a system integrator to run the migration end to end, so that internal teams do not need to acquire Google Cloud skills.
   • D.Send all engineers to the same multi-day classroom course on infrastructure operations, and let them practice afterwards in the production project under supervision.
   Show answer and explanation

   Correct answer: B. Assign role-based learning paths to developers and operators separately, and give engineers free trial or sandbox environments to practice in.

   Explanation

   Google's assessment guidance recommends training engineers according to their role, for example separate paths for workload developers and infrastructure operators, and says a free environment for testing and learning is critical. A single infrastructure course ignores the developers' needs, and practicing in production breaks the requirement to stay away from it. Outsourcing the migration leaves the internal teams without the skills to run the workloads afterwards.

   Official references

   • Migrate to Google Cloud: Assess and discover your workloads
4. Question 4Domain: Analyzing and optimizing technical and business processesMedium

   Your company's executives are undecided about moving a CPU-bound pricing workload to Google Cloud. Engineers claim that Compute Engine can scale out much faster than the current environment during demand peaks, but leadership wants evidence before committing budget. What should you recommend to support the decision?

   • A.Ask the Google Cloud account team for published benchmarks of similar workloads and present them as the decision criteria to leadership.
   • B.Run a proof of concept with a defined scope, expected outputs and measurable business impact, such as the time needed to add peak capacity.
   • C.Rehost the whole workload immediately and compare production behavior during the next peak, rolling back if the results are worse.
   • D.Buy a three-year committed use discount for the expected capacity, so that the cost side of the business case is fixed before the decision is made.
   Show answer and explanation

   Correct answer: B. Run a proof of concept with a defined scope, expected outputs and measurable business impact, such as the time needed to add peak capacity.

   Explanation

   Google recommends experiments and proofs of concept with a precise scope, expected outputs and measurable business impact to validate assumptions and demonstrate value to business leaders, for example measuring how quickly a zone can provide the cores a peak needs. Generic benchmarks do not validate this workload. Committing spend or rehosting in production before the decision reverses the order and adds risk.

   Official references

   • Migrate to Google Cloud: Assess and discover your workloads
5. Question 5Domain: Designing and planning a cloud solution architectureMedium

   Your company serves a latency-sensitive trading dashboard from a single Google Cloud region to users on several continents. Users far from the region report slow and inconsistent response times. The business prioritizes network performance over network cost, and regulations do not allow the backend to move to other regions. What should you recommend for the load balancer's external IP address?

   • A.Use Standard Tier with a regional external Application Load Balancer so that traffic stays on the region's network.
   • B.Use a Standard Tier address and apply a spread placement policy to the backend VMs to reduce response variability.
   • C.Use Premium Tier so that user traffic enters and leaves Google's network at the point of presence closest to each user.
   • D.Use Standard Tier so that traffic reaches users through the peering, ISP or transit networks closest to the region.
   Show answer and explanation

   Correct answer: C. Use Premium Tier so that user traffic enters and leaves Google's network at the point of presence closest to each user.

   Explanation

   With Premium Tier, traffic from internet users enters Google's high-performance network at the point of presence closest to them and leaves it at the point of presence closest to its destination, which minimizes hops on the public internet; Google recommends it to optimize for performance and for users in many locations worldwide. Standard Tier is the option for optimizing cost because it relies on peering, ISP or transit networks for most of the path, so every Standard Tier choice keeps the long public-internet path that causes the problem, and VM placement does not change that path.

   Official references

   • Network Service Tiers overview
6. Question 6Domain: Designing and planning a cloud solution architectureMedium

   Your organization is migrating an industrial monitoring platform that stores several petabytes of sensor readings. The application code uses the Apache HBase API, writes millions of readings per second, and reads them by device identifier and time with single-digit millisecond latency. You want a managed service and as few code changes as possible. Which database should you choose?

   • A.Bigtable, with a row key that combines the device identifier and a timestamp.
   • B.BigQuery, with tables partitioned by ingestion time and clustered by device.
   • C.Cloud SQL for PostgreSQL, with a table partitioned by device and indexed by time.
   • D.Spanner, with an interleaved table that stores the readings under each device.
   Show answer and explanation

   Correct answer: A. Bigtable, with a row key that combines the device identifier and a timestamp.

   Explanation

   Bigtable stores very large amounts of single-keyed data with high read and write throughput at low latency, suits time-series data, and offers a supported extension to the Apache HBase library, so the HBase code needs few changes. Spanner can scale but is a relational database without HBase API compatibility, so the code would need rewriting. Cloud SQL does not fit the petabyte write throughput, and BigQuery is an analytics warehouse rather than a low-latency serving store.

   Official references

   • Bigtable overview
7. Question 7Domain: Managing implementationMedium

   Your developers test a Python service locally against the Pub/Sub emulator. Their setup script runs gcloud pubsub topics create before the tests, but the topics never appear in the emulator and the service publishes to the real project. Tests must stay fully local and the setup must create the topics they need. What should you do?

   • A.Create the topics in the Google Cloud console in a test project and point the service at that project.
   • B.Set PUBSUB_EMULATOR_HOST with gcloud beta emulators pubsub env-init and create topics with the client library.
   • C.Grant the developers the Pub/Sub Admin role on the emulator project so that topic creation succeeds locally.
   • D.Add --project with a fictitious project ID to the gcloud pubsub topics create command so that it targets the emulator.
   Show answer and explanation

   Correct answer: B. Set PUBSUB_EMULATOR_HOST with gcloud beta emulators pubsub env-init and create topics with the client library.

   Explanation

   The Pub/Sub emulator works only with applications built on the Cloud Client Libraries and does not support the Google Cloud console or gcloud pubsub commands; the client libraries use the emulator when PUBSUB_EMULATOR_HOST is set, which env-init does. Granting IAM roles does not help because the emulator does not support IAM operations, and a console-created test project breaks the requirement to stay local.

   Official references

   • Testing apps locally with the emulator (Pub/Sub)
8. Question 8Domain: Ensuring solution and operations excellenceMedium

   Your company runs a public web application on GKE. The security team wants automated scanning for common web vulnerabilities such as cross-site scripting and outdated libraries before each release. The application owner warns that production reliability must not be put at risk by the scans, and the auditors expect the scans to be part of a broader security testing process. What should you recommend?

   • A.Run Web Security Scanner custom scans against a publicly reachable staging deployment before each release, and keep manual security reviews in the process.
   • B.Rely on the weekly Web Security Scanner managed scans of production, because they replace manual security reviews and penetration tests for web apps.
   • C.Enable Artifact Registry automatic scanning of the application images, because it detects cross-site scripting in the deployed application.
   • D.Attach a Cloud Armor security policy to the load balancer, because its preconfigured rules confirm that the application has no web vulnerabilities.
   Show answer and explanation

   Correct answer: A. Run Web Security Scanner custom scans against a publicly reachable staging deployment before each release, and keep manual security reviews in the process.

   Explanation

   Web Security Scanner custom scans report findings such as cross-site scripting and outdated libraries, but the scanner can adversely affect the reliability of some applications, may not suit production, and does not replace a manual security review. Managed scans run weekly against public production endpoints and, like any scan, do not replace manual reviews. Artifact Analysis scans image packages rather than exercising the running web app, and Cloud Armor filters traffic but does not test for vulnerabilities.

   Official references

   • Overview of Web Security Scanner
9. Question 9Domain: Designing for security and complianceEasy

   A data science team builds Python applications on popular open source libraries such as Pandas and Scikit-learn. Auditors now ask the company to obtain these open source packages from a trusted supplier, with an SBOM, vulnerability information and signed, verifiable provenance for each package, while keeping the developers' workflow almost unchanged. What should you recommend?

   • A.Generate SLSA build provenance in Cloud Build for the team's own applications and store it in Artifact Registry next to each image.
   • B.Enforce Binary Authorization on the clusters that run the applications so that only attested container images can be deployed.
   • C.Use Assured Open Source Software to obtain the curated packages that Google builds and secures, with their SBOMs and provenance.
   • D.Create a remote repository in Artifact Registry that caches PyPI so that every package is downloaded through Google Cloud.
   Show answer and explanation

   Correct answer: C. Use Assured Open Source Software to obtain the curated packages that Google builds and secures, with their SBOMs and provenance.

   Explanation

   Assured OSS provides open source packages that Google builds and secures, from a known supplier, with SBOMs in industry formats, VEX vulnerability information and signed, tamper-evident provenance, covering popular Python packages including Pandas and Scikit-learn. Cloud Build provenance describes the company's own builds, not third-party packages, and a remote repository caches whatever the public index serves without adding SBOMs or provenance.

   Official references

   • Overview of Assured Open Source Software
   • Generate and validate build provenance
10. Question 10Domain: Designing for security and complianceEasy

    Your company is onboarding Google Cloud as a strategic vendor. Before production workloads are approved, the vendor risk team must review an independent auditor's report on Google Cloud's controls for security, availability, and confidentiality. They want to obtain it on demand, without opening a negotiation with Google. What should you recommend?

    • A.Enable Access Transparency logs and share them with the vendor risk team as proof of Google's control effectiveness.
    • B.Open a Cloud Customer Care case that asks Google to run a SOC 2 audit of your organization's Google Cloud projects.
    • C.Export the Security Command Center findings for your projects and present them as the SOC 2 evidence for Google Cloud.
    • D.Download the Google Cloud SOC 2 report from Compliance Reports Manager and share it under your agreement's terms.
    Show answer and explanation

    Correct answer: D. Download the Google Cloud SOC 2 report from Compliance Reports Manager and share it under your agreement's terms.

    Explanation

    Google Cloud's SOC 2 reports are produced by an independent third party, evaluate controls relevant to the Trust Services Criteria, and are available on demand through Compliance Reports Manager, with confidential material shared under the customer agreement. Security Command Center findings describe the configuration of your own resources, not Google's controls, and Access Transparency logs record individual Google personnel accesses rather than an attested control assessment. Google does not audit a customer's projects through a support case.

    Official references

    • SOC 2 compliance (Google Cloud)
    • Compliance Reports Manager