2024 Professional-Cloud-Architect dumps review - Professional Quiz Study Materials
Professional-Cloud-Architect Test Prep Training Practice Exam Questions Practice Tests
NEW QUESTION # 10
You are designing a large distributed application with 30 microservices. Each of your distributed microservices needs to connect to a database back-end. You want to store the credentials securely.
Where should you store the credentials?
- A. In a config file that has restricted access through ACLs
- B. In a secret management system
- C. In the source code
- D. In an environment variable
Answer: B
Explanation:
Explanation/Reference: https://cloud.google.com/kms/docs/secret-management
NEW QUESTION # 11
Your organization has a 3-tier web application deployed in the same network on Google Cloud Platform.
Each tier (web, API, and database) scales independently of the others. Network traffic should flow through the web to the API tier and then on to the database tier. Traffic should not flow between the web and the database tier.
How should you configure the network?
- A. Add tags to each tier and set up firewall rules to allow the desired traffic flow
- B. Set up software based firewalls on individual VMs
- C. Add each tier to a different subnetwork
- D. Add tags to each tier and set up routes to allow the desired traffic flow
Answer: A
Explanation:
Google Cloud Platform(GCP) enforces firewall rules through rules and tags. GCP rules and tags can be defined once and used across all regions.
Reference: https://cloud.google.com/docs/compare/openstack/
https://aws.amazon.com/it/blogs/aws/building-three-tier-architectures-with-security-groups/
NEW QUESTION # 12
Your customer is moving an existing corporate application to Google Cloud Platform from an on- premises data center. The business owners require minimal user disruption. There are strict security team requirements for storing passwords.
What authentication strategy should they use?
- A. Federate authentication via SAML 2.0 to the existing Identity Provider.
- B. Provision users in Google using the Google Cloud Directory Sync tool.
- C. Ask users to set their Google password to match their corporate password.
- D. Use G Suite Password Sync to replicate passwords into Google.
Answer: B
Explanation:
Provision users to Google's directory
The global Directory is available to both Cloud Platform and G Suite resources and can be provisioned by a number of means. Provisioned users can take advantage of rich authentication features including single sign-on (SSO), OAuth, and two-factor verification.
You can provision users automatically using one of the following tools and services:
Google Cloud Directory Sync (GCDS)
Google Admin SDK
A third-party connector
GCDS is a connector that can provision users and groups on your behalf for both Cloud Platform and G Suite. Using GCDS, you can automate the addition, modification, and deletion of users, groups, and non-employee contacts. You can synchronize the data from your LDAP directory server to your Cloud Platform domain by using LDAP queries. This synchronization is one-way:
the data in your LDAP directory server is never modified.
References: https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#authentication-and-identity
NEW QUESTION # 13
Your customer runs a web service used by e-commerce sites to offer product recommendations to users. The company has begun experimenting with a machine learning model on Google Cloud Platform to improve the quality of results.
What should the customer do to improve their model's results over time?
- A. Build a roadmap to move the machine learning model training from Cloud GPUs to Cloud TPUs, which offer better results.
- B. Monitor Compute Engine announcements for availability of newer CPU architectures, and deploy the model to them as soon as they are available for additional performance.
- C. Export Cloud Machine Learning Engine performance metrics from Stackdriver to BigQuery, to be used to analyze the efficiency of the model.
- D. Save a history of recommendations and results of the recommendations in BigQuery, to be used as training data.
Answer: D
Explanation:
Reference:
https://cloud.google.com/solutions/building-a-serverless-ml-model
NEW QUESTION # 14
For this question, refer to the TerramEarth case study. You are asked to design a new architecture for the ingestion of the data of the 200,000 vehicles that are connected to a cellular network. You want to follow Google-recommended practices.
Considering the technical requirements, which components should you use for the ingestion of the data?
- A. Compute Engine with project-wide SSH keys
- B. Compute Engine with specific SSH keys
- C. Google Kubernetes Engine with an SSL Ingress
- D. Cloud IoT Core with public/private key pairs
Answer: C
Explanation:
Explanation
https://cloud.google.com/solutions/iot-overview
https://cloud.google.com/iot/quotas
NEW QUESTION # 15
Your company has decided to build a backup replica of their on-premises user authentication PostgreSQL database on Google Cloud Platform. The database is 4 TB, and large updates are frequent. Replication requires private address space communication. Which networking approach should you use?
- A. A Google Compute Engine instance with a VPN server installed connected to the data center network
- B. Google Cloud Dedicated Interconnect
- C. A NAT and TLS translation gateway installed on-premises
- D. Google Cloud VPN connected to the data center network
Answer: B
Explanation:
https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations Google Cloud Dedicated Interconnect provides direct physical connections and RFC 1918 communication between your on-premises network and Google's network. Dedicated Interconnect enables you to transfer large amounts of data between networks, which can be more cost effective than purchasing additional bandwidth over the public Internet or using VPN tunnels.
Benefits:
Traffic between your on-premises network and your VPC network doesn't traverse the public Internet.
Traffic traverses a dedicated connection with fewer hops, meaning there are less points of failure where traffic might get dropped or disrupted.
Your VPC network's internal (RFC 1918) IP addresses are directly accessible from your on-premises network. You don't need to use a NAT device or VPN tunnel to reach internal IP addresses. Currently, you can only reach internal IP addresses over a dedicated connection. To reach Google external IP addresses, you must use a separate connection.
You can scale your connection to Google based on your needs. Connection capacity is delivered over one or more 10 Gbps Ethernet connections, with a maximum of eight connections (80 Gbps total per interconnect).
The cost of egress traffic from your VPC network to your on-premises network is reduced. A dedicated connection is generally the least expensive method if you have a high-volume of traffic to and from Google's network.
References: https://cloud.google.com/interconnect/docs/details/dedicated
NEW QUESTION # 16
Your organization requires that metrics from all applications be retained for 5 years for future analysis in possible legal proceedings.
Which approach should you use?
- A. Configure Stackdriver Monitoring for all Projects, and export to Google Cloud Storage
- B. Grant the security team access to the logs in each Project
- C. Configure Stackdriver Monitoring for all Projects, and export to BigQuery
- D. Configure Stackdriver Monitoring for all Projects with the default retention policies
Answer: C
Explanation:
Explanation/Reference:
Explanation:
Stackdriver Logging provides you with the ability to filter, search, and view logs from your cloud and open source application services. Allows you to define metrics based on log contents that are incorporated into dashboards and alerts. Enables you to export logs to BigQuery, Google Cloud Storage, and Pub/Sub.
Reference: https://cloud.google.com/stackdriver/
NEW QUESTION # 17
Your company is migrating its on-premises data center into the cloud. As part of the migration, you want to integrate Kubernetes Engine for workload orchestration. Parts of your architecture must also be PCI DSScompliant.
Which of the following is most accurate?
- A. App Engine is the only compute platform on GCP that is certified for PCI DSS hosting.
- B. Kubernetes Engine and GCP provide the tools you need to build a PCI DSS-compliant environment.
- C. All Google Cloud services are usable because Google Cloud Platform is certified PCI-compliant.
- D. Kubernetes Engine cannot be used under PCI DSS because it is considered shared hosting.
Answer: C
Explanation:
Reference:
https://cloud.google.com/security/compliance/pci-dss
NEW QUESTION # 18
You want to optimize the performance of an accurate, real-time, weather-charting application. The data comes from 50,000 sensors sending 10 readings a second, in the format of a timestamp and sensor reading. Where should you store the data?
- A. Google Cloud Bigtable
- B. Google Cloud Storage
- C. Google BigQuery
- D. Google Cloud SQL
Answer: A
Explanation:
It is time-series data, So Big Table.
https://cloud.google.com/bigtable/docs/schema-design-time-series
Google Cloud Bigtable is a scalable, fully-managed NoSQL wide-column database that is suitable for both real-time access and analytics workloads.
Good for:
Low-latency read/write access
High-throughput analytics
Native time series support
Common workloads:
IoT, finance, adtech
Personalization, recommendations
Monitoring
Geospatial datasets
Graphs
NEW QUESTION # 19
You want to make a copy of a production Linux virtual machine in the US-Central region. You want to manage and replace the copy easily if there are changes on the production virtual machine. You will deploy the copy as a new instance in a different project in the US-East region.
What steps must you take?
- A. Use the Linux dd and netcat commands to copy and stream the root disk contents to a new virtual machine instance in the US-East region.
- B. Create a snapshot of the root disk, create an image file in Google Cloud Storage from the snapshot, and create a new virtual machine instance in the US-East region using the image file the root disk.
- C. Create a snapshot of the root disk and select the snapshot as the root disk when you create a new virtual machine instance in the US-East region.
- D. Create an image file from the root disk with Linux dd command, create a new virtual machine instance in the US-East region
Answer: B
Explanation:
Explanation/Reference:
NEW QUESTION # 20
One of your primary business objectives is being able to trust the data stored in your application. You want to log all changes to the application data. How can you design your logging system to verify authenticity of your logs?
- A. Write the log concurrently in the cloud and on premises.
- B. Digitally sign each timestamp and log entry and store the signature.
- C. Create a JSON dump of each log entry and store it in Google Cloud Storage.
- D. Use a SQL database and limit who can modify the log table.
Answer: C
Explanation:
Explanation
https://cloud.google.com/storage/docs/access-logs
Write a log entry. If the log does not exist, it is created. You can specify a severity for the log entry, and you can write a structured log entry by specifying --payload-type=json and writing your message as a JSON string:
gcloud logging write LOG STRING
gcloud logging write LOG JSON-STRING --payload-type=json
References: https://cloud.google.com/logging/docs/reference/tools/gcloud-logging
NEW QUESTION # 21
Your company acquired a healthcare startup and must retain its customers' medical information for up to 4 more years, depending on when it was created. Your corporate policy is to securely retain this data, and then delete it as soon as regulations allow.
Which approach should you take?
- A. Store the data in Google Drive and manually delete records as they expire.
- B. Store the data in Cloud Storage and run a nightly batch script that deletes all expired data.
- C. Store the data in Cloud Storage and use lifecycle management to delete files when they expire.
- D. Anonymize the data using the Cloud Data Loss Prevention API and store it indefinitely.
Answer: C
NEW QUESTION # 22
Your company plans to migrate a multi-petabyte data set to the cloud. The data set must be available
24hrs a day. Your business analysts have experience only with using a SQL interface.
How should you store the data to optimize it for ease of analysis?
- A. Put flat files into Google Cloud Storage
- B. Load data into Google BigQuery
- C. Stream data into Google Cloud Datastore
- D. Insert data into Google Cloud SQL
Answer: B
Explanation:
Explanation/Reference:
Explanation:
BigQuery is Google's serverless, highly scalable, low cost enterprise data warehouse designed to make all your data analysts productive. Because there is no infrastructure to manage, you can focus on analyzing data to find meaningful insights using familiar SQL and you don't need a database administrator.
BigQuery enables you to analyze all your data by creating a logical data warehouse over managed, columnar storage as well as data from object storage, and spreadsheets.
References: https://cloud.google.com/bigquery/
NEW QUESTION # 23
The Dress4Win security team has disabled external SSH access into production virtual machines (VMs) on Google Cloud Platform (GCP).
The operations team needs to remotely manage the VMs, build and push Docker containers, and manage Google Cloud Storage objects.
What can they do?
- A. Configure a VPN connection to GCP to allow SSH access to the cloud VMs.
- B. Have the development team build an API service that allows the operations team to execute specific remote procedure calls to accomplish their tasks.
- C. Develop a new access request process that grants temporary SSH access to cloud VMs when an operations engineer needs to perform a task.
- D. Grant the operations engineer access to use Google Cloud Shell.
Answer: A
NEW QUESTION # 24
You are implementing the infrastructure for a web service on Google Cloud. The web service needs to receive and store the data from 500,000 requests per second. The data will be queried later in real time, based on exact matches of a known set of attributes. There will be periods where the web service will not receive any requests. The business wants to keep costs low. Which web service platform and database should you use for the application?
- A. Cloud Run and BigQuery
- B. A Compute Engine autoscaling managed instance group and BigQuery
- C. Cloud Run and Cloud Bigtable
- D. A Compute Engine autoscaling managed instance group and Cloud Bigtable
Answer: C
Explanation:
https://cloud.google.com/run/docs/about-instance-autoscaling
https://cloud.google.com/blog/topics/developers-practitioners/bigtable-vs-bigquery-whats-difference
NEW QUESTION # 25
For this question, refer to the EHR Healthcare case study. You are responsible for designing the Google Cloud network architecture for Google Kubernetes Engine. You want to follow Google best practices. Considering the EHR Healthcare business and technical requirements, what should you do to reduce the attack surface?
- A. Use a private cluster with a public endpoint with master authorized networks configured.
- B. Use a private cluster with a private endpoint with master authorized networks configured.
- C. Use a public cluster with master authorized networks enabled and firewall rules.
- D. Use a public cluster with firewall rules and Virtual Private Cloud (VPC) routes.
Answer: B
Explanation:
https://cloud.google.com/kubernetes-engine/docs/concepts/private-cluster-concept#overview
NEW QUESTION # 26
You need to deploy a stateful workload on Google Cloud. The workload can scale horizontally, but each instance needs to read and write to the same POSIX filesystem. At high load, the stateful workload needs to support up to 100 MB/s of writes. What should you do?
- A. Create a Cloud Storage bucket and mount it in each instance using gcsfuse.
- B. Use a regional persistent disk for each instance.
- C. Use a persistent disk for each instance.
- D. Create a Cloud Filestore instance and mount it in each instance.
Answer: D
Explanation:
Explanation
https://cloud.google.com/storage/docs/gcs-fuse#notes
Cloud Filestore: Cloud Filestore is a scalable and highly available shared file service fully managed by Google. Cloud Filestore provides persistent storage ideal for shared workloads. It is best suited for enterprise applications requiring persistent, durable, shared storage which is accessed by NFS or requires a POSIX compliant file system.
Reference: https://cloud.google.com/storage/docs/gcs-fuse
NEW QUESTION # 27
......
Exam Questions Answers Braindumps Professional-Cloud-Architect Exam Dumps PDF Questions: https://www.practicetorrent.com/Professional-Cloud-Architect-practice-exam-torrent.html
Professional-Cloud-Architect Exam Dumps, Professional-Cloud-Architect Practice Test Questions: https://drive.google.com/open?id=1WVWoiMt4-VzUcon-kgbFRVmyvHrs4M9x