Question bank
Professional Cloud Architect
43 Professional Cloud Architect questions with the correct answer and a written explanation, organised across 6 exam domains.
- 43 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Analyzing and optimizing technical and business processes
8 questions in this domain
- Question 1Single Choice
What is the primary purpose of analyzing technical processes when designing an enterprise cloud architecture?
- AIdentifying optimization opportunitiesCorrect answer
- BIncreasing infrastructure costs
- CReducing system redundancy
- DEliminating all documentation
Why this is the answer
Analyzing technical processes helps identify inefficiencies and optimization opportunities, enabling better cost, performance, and reliability outcomes.
- Question 2Multiple Select
Which activities are part of optimizing business processes on Google Cloud? Select all that apply.
- AAutomating manual workflowsCorrect answer
- BRight-sizing cloud resourcesCorrect answer
- CIncreasing manual approvals
- DIgnoring customer metrics
Why this is the answer
Automating workflows and right-sizing resources improve efficiency and reduce waste, while manual approvals and ignoring metrics hinder optimization.
- Question 3Interactive
Given the following command, what does it help you analyze during resource optimization in Google Cloud?
- ADiscover running instances for potential right-sizingCorrect answer
- BReview IAM policy bindings
- CCreate new virtual machines
- DMonitor network firewall rules
Why this is the answer
The command lists running compute instances, supporting analysis of resource usage and opportunities for right-sizing or cleanup.
- Question 4Single Choice
Which Google Cloud service provides recommendations for reducing cost and improving performance of cloud resources?
- ARecommenderCorrect answer
- BCloud Scheduler
- CCloud Debugger
- DCloud Armor
Why this is the answer
Recommender analyzes usage patterns and provides actionable recommendations to optimize cost, performance, and reliability in Google Cloud.
- Question 5Multiple Select
Which key metrics should be monitored when optimizing a technical process in Google Cloud? Select all that apply.
- ACPU utilizationCorrect answer
- BMemory usageCorrect answer
- CNetwork latencyCorrect answer
- DGit star count
Why this is the answer
CPU, memory, and network latency directly affect process performance, while unrelated repository metrics do not support optimization decisions.
- Question 6Interactive
Given the following command, what type of recommendations can you retrieve from the Google Cloud Recommender service?
- AVM machine type right-sizing recommendationsCorrect answer
- BFirewall rule recommendations
- CCloud IAM role recommendations
- DCloud storage lifecycle recommendations
Why this is the answer
This command uses the MachineTypeRecommender to list recommendations for changing VM machine types based on historical utilization.
- Question 7Single Choice
What is the first step that should be taken in a continuous business optimization process?
- ADefine business objectivesCorrect answer
- BDeploy final solution
- CRemove monitoring
- DPurchase new hardware
Why this is the answer
Defining business objectives establishes clear goals before measuring baselines, analyzing data, or implementing improvements in a process.
- Question 8Multiple Select
Which benefits does automation bring to business process optimization in the cloud? Select all that apply.
- AReduced manual errorsCorrect answer
- BFaster executionCorrect answer
- CImproved consistencyCorrect answer
- DIncreased operational cost
Why this is the answer
Automation reduces errors, accelerates execution, and improves consistency; it typically lowers costs rather than increasing them.
Designing and planning a cloud solution architecture
10 questions in this domain
- Question 9Single Choice
In Google Cloud, what is the scope of a Virtual Private Cloud (VPC) network?
- AGlobalCorrect answer
- BRegional
- CZonal
- DMulti-regional but limited to one continent
Why this is the answer
A VPC network is a global resource that spans all regions. Its subnets, firewall rules, and routes can be used across the Google Cloud global network.
- Question 10Multiple Select
Which two statements are true about managed instance groups (MIGs) in Google Cloud?
- AMIGs can automatically heal unhealthy instances.Correct answer
- BMIGs provide autoscaling based on load metrics.Correct answer
- CMIGs can only contain instances in different projects.
- DMIGs require manual replacement of failed instances.
Why this is the answer
Managed instance groups support autoscaling and automatic healing so failed instances are recreated without manual intervention. Group instances are normally in the same project.
- Question 11Interactive
Review the provided Terraform code block and identify the Google Cloud resource being created.
- ACloud Storage bucketCorrect answer
- BCompute Engine instance
- CKubernetes cluster
- DCloud SQL instance
Why this is the answer
The Terraform block declares resource \"google_storage_bucket\", so it creates a Cloud Storage bucket.
- Question 12Single Choice
Which Google Cloud service enables declarative provisioning of infrastructure through YAML and Python templates?
- ACloud Deployment ManagerCorrect answer
- BCloud Functions
- CCloud Run
- DApp Engine
Why this is the answer
Cloud Deployment Manager is Google Cloud's infrastructure deployment tool, using YAML, Python, or Jinja2 templates.
- Question 13Multiple Select
Which two factors should have the greatest influence on region selection for a highly available Google Cloud architecture?
- ADeploying across multiple zones or regions to avoid correlated failure.Correct answer
- BUsing regions that meet data residency or compliance requirements.Correct answer
- CChoosing the cheapest region without considering latency or resilience.
- DPlacing all resources in one zone to reduce complexity.
Why this is the answer
A highly available regional plan should minimize correlated failure and honor data residency or compliance constraints. A single zone increases risk.
- Question 14Interactive
In the provided Kubernetes manifest, which type of workload resource is declared?
- ADeploymentCorrect answer
- BService
- CConfigMap
- DNamespace
Why this is the answer
The manifest has apiVersion apps/v1 and kind Deployment, so it defines a Deployment managing a set of replicated Pods.
- Question 15Single Choice
Which statement best describes global external HTTPS load balancing in Google Cloud?
- AIt uses a single anycast IPv4 or IPv6 address to distribute traffic globally.Correct answer
- BIt is limited to a single region and zone.
- CIt requires one load balancer per backend service.
- DIt can only balance traffic between Cloud Run services.
Why this is the answer
Global external HTTP(S) load balancing uses a single global anycast IP address and forwards traffic to the nearest available backend across regions.
- Question 16Multiple Select
Which three aspects are essential when designing reliable cloud architectures?
- ADesign for failure by assuming components will fail.Correct answer
- BUse managed services to reduce operational overhead.Correct answer
- CImplement automated recovery and health checking.Correct answer
- DAvoid all redundancy to control costs.
Why this is the answer
Reliable architectures include failure-tolerant design, managed services, health checks, automated failover, and recovery to meet availability goals.
- Question 17Interactive
The gcloud command in the code block is used to create which Google Cloud resource?
- AA Compute Engine virtual machine instanceCorrect answer
- BA Cloud Storage bucket
- CA Kubernetes Engine cluster
- DA Cloud SQL database instance
Why this is the answer
The command uses \"gcloud compute instances create\", which provisions a Compute Engine virtual machine instance.
- Question 18Single Choice
What is the root resource in the Google Cloud resource hierarchy?
- AOrganizationCorrect answer
- BProject
- CFolder
- DBilling account
Why this is the answer
In the Google Cloud resource hierarchy, the organization node is the root, followed by folders, then projects, and then resources.
Designing for security and compliance
8 questions in this domain
- Question 19Single Choice
Which Google Cloud service is used to define and enforce fine-grained access control on resources?
- ACloud Identity and Access Management (Cloud IAM)Correct answer
- BCloud Audit Logs
- CCloud Key Management Service (Cloud KMS)
- DVirtual Private Cloud (VPC) Service Controls
Why this is the answer
Cloud IAM authorizes who can act on specific Google Cloud resources. It defines members, roles, and policies to enforce access control.
- Question 20Multiple Select
Which items are core components of an IAM policy? (Select all that apply.)
- AMembersCorrect answer
- BRolesCorrect answer
- CIAM bindingsCorrect answer
- DBilling accounts
Why this is the answer
An IAM policy is composed of bindings that attach one or more members to a role. Billing accounts are not part of the IAM policy structure.
- Question 21Interactive
Refer to the IAM policy in the code block. Which role is granted to sara@example.com?
- Aroles/storage.objectViewerCorrect answer
- Broles/storage.objectAdmin
- Croles/iam.serviceAccountUser
- Droles/viewer
Why this is the answer
The IAM policy binds user:sara@example.com to roles/storage.objectViewer, granting read-only access to Cloud Storage objects.
- Question 22Single Choice
Which Google Cloud service records user activity such as resource changes, access attempts, and administrative actions?
- ACloud Audit LogsCorrect answer
- BCloud Monitoring
- CCloud Profiler
- DCloud Trace
Why this is the answer
Cloud Audit Logs record administrative activity, data access, and system events to help answer who did what, where, and when.
- Question 23Multiple Select
Which of the following are valid types of Cloud Audit Logs? (Select all that apply.)
- AAdmin ActivityCorrect answer
- BData AccessCorrect answer
- CSystem EventCorrect answer
- DAccess Transparency
Why this is the answer
Cloud Audit Logs categories include Admin Activity, Data Access, System Event, and Policy Denied. Access Transparency is a separate feature that logs actions taken by Google staff.
- Question 24Interactive
Review the organization policy in the code block. What does this constraint enforce?
- ADisabling the creation of service account keysCorrect answer
- BEnabling the creation of service account keys
- CRequiring multi-factor authentication
- DRestricting Cloud Storage bucket locations
Why this is the answer
The organization policy constraint iam.disableServiceAccountKeyCreation, when enforced, prevents the creation of service account keys.
- Question 25Single Choice
Which Cloud KMS option lets customers create and manage the keys that Google Cloud uses to encrypt data?
- ACustomer-Managed Encryption Keys (CMEK)Correct answer
- BCustomer-Supplied Encryption Keys (CSEK)
- CGoogle-managed encryption keys
- DDefault encryption keys
Why this is the answer
CMEK lets customers control and manage their own encryption keys through Cloud KMS, while CSEK uses customer-supplied keys that are not managed in Cloud KMS.
- Question 26Multiple Select
Which practices enhance the security of Google Cloud resources? (Select all that apply.)
- AApply the principle of least privilege to IAM rolesCorrect answer
- BUse service accounts instead of user credentials for applicationsCorrect answer
- CEnable Cloud Audit Logs to monitor activityCorrect answer
- DShare admin credentials across the team
Why this is the answer
Least privilege, service account usage, and audit logging are key security best practices. Sharing admin credentials increases the risk of unauthorized access.
Ensuring solution and operations reliability
5 questions in this domain
- Question 27Single Choice
Which Google Cloud service is used to visualize performance metrics and set up custom monitoring dashboards?
- ACloud MonitoringCorrect answer
- BCloud Logging
- CCloud Trace
- DCloud Profiler
Why this is the answer
Cloud Monitoring is the Google Cloud service for metrics, uptime checks, and dashboards; Cloud Logging stores logs, Cloud Trace analyzes latency, and Cloud Profiler analyzes performance.
- Question 28Multiple Select
Which three services are part of Google Cloud's operations suite commonly used for application reliability?
- ACloud MonitoringCorrect answer
- BCloud LoggingCorrect answer
- CCloud TraceCorrect answer
- DCloud Storage
Why this is the answer
Cloud Monitoring, Cloud Logging, and Cloud Trace are central Google Cloud operations tools. Cloud Storage is object storage, not an observability service.
- Question 29Interactive
Review the gcloud command in the code block. What is the primary purpose of this command?
- AIt reads recent ERROR or higher severity log entries from Compute Engine instances.Correct answer
- BIt creates a Cloud Logging sink for Compute Engine ERROR logs.
- CIt creates an alerting policy for all Compute Engine ERROR logs.
- DIt deletes log entries with severity ERROR from Compute Engine instances.
Why this is the answer
The command uses gcloud logging read to retrieve log entries filtered by resource type and minimum severity.
- Question 30Single Choice
What is a service level objective (SLO) in the context of cloud service reliability?
- AA target value or range of values for a service level indicatorCorrect answer
- BA legal agreement that specifies penalties for downtime
- CA log-based metric that counts all user requests
- DA postmortem document used after a production incident
Why this is the answer
An SLO is the target level for an SLI, for example 99.9% availability. It is not a legal contract, log metric, or postmortem.
- Question 31Multiple Select
Which operational practices help to ensure the reliability of a production service running on Google Cloud?
- AImplementing redundancy across zones and regionsCorrect answer
- BAutomating rollbacks and progressive rolloutsCorrect answer
- CRegularly testing backup and restore proceduresCorrect answer
- DDisabling monitoring to reduce operational overhead
Why this is the answer
Redundancy, automated rollbacks, and restore testing improve resilience; disabling monitoring removes visibility and harms reliability.
Managing and provisioning cloud solution infrastructure
7 questions in this domain
- Question 32Single Choice
What is the primary role of a Virtual Private Cloud (VPC) in Google Cloud?
- AIt provides isolated networking resourcesCorrect answer
- BIt stores unstructured object data
- CIt executes code in response to events
- DIt manages user identities and access
Why this is the answer
A VPC provides isolated networking resources, such as subnets, routes, and firewalls, for Google Cloud resources.
- Question 33Multiple Select
Which of the following are Google Cloud compute services?
- ACloud Storage
- BCompute EngineCorrect answer
- CCloud RunCorrect answer
- DCloud SQL
Why this is the answer
Compute Engine and Cloud Run are compute services. Cloud Storage is object storage and Cloud SQL is a managed database service.
- Question 34Interactive
What resource is declared in the provided Terraform configuration?
- AA VPC networkCorrect answer
- BA firewall rule
- CA Cloud Router
- DA subnetwork
Why this is the answer
The configuration uses google_compute_network, which declares a VPC network resource with automatic subnetwork creation disabled. This means subnets must be created separately.
- Question 35Single Choice
What is a service account used for in Google Cloud?
- ATo provide a secure identity for applications and servicesCorrect answer
- BTo store secrets and encryption keys
- CTo create and manage virtual machines
- DTo assign static IP addresses to resources
Why this is the answer
A service account provides an identity that applications and services use to authenticate and access Google Cloud resources.
- Question 36Multiple Select
Which of the following can be used to manage Google Cloud infrastructure as code?
- ACloud Deployment ManagerCorrect answer
- BTerraformCorrect answer
- CCloud Console
- DCloud Shell
Why this is the answer
Cloud Deployment Manager and Terraform allow you to define and provision Google Cloud resources as code. Console and Shell are interfaces, not infrastructure-as-code tools.
- Question 37Interactive
What is the effect of the command shown below?
- ACreates a VPC network with custom subnetsCorrect answer
- BCreates a VPC network with automatic subnets
- CCreates a firewall rule
- DCreates a Compute Engine instance
Why this is the answer
The gcloud command creates a VPC network named example-vpc with --subnet-mode=custom, so subnets are not automatically created.
- Question 38Single Choice
Which statement best describes the Google Cloud resource hierarchy?
- AOrganization -> Folders -> Projects -> ResourcesCorrect answer
- BProjects -> Folders -> Organization -> Resources
- CFolders -> Organization -> Projects -> Resources
- DOrganization -> Projects -> Resources -> Folders
Why this is the answer
Google Cloud resources are organized in a hierarchy as Organization, Folders, Projects, and then resources within projects.
Managing implementation
5 questions in this domain
- Question 39Single Choice
Which Google Cloud service provisions resources from declarative YAML configuration files and is a native Infrastructure-as-Code option?
- ACloud Deployment ManagerCorrect answer
- BCloud Build
- CKubernetes Engine
- DApp Engine
Why this is the answer
Cloud Deployment Manager is Google Cloud’s native Infrastructure-as-Code service, which creates resources from YAML declarative configuration files.
- Question 40Multiple Select
What are valid benefits of using Cloud Deployment Manager to manage implementation? Select two.
- ADeployments can be repeated in multiple projectsCorrect answer
- BResources can be updated by editing the configurationCorrect answer
- CThe service replaces IAM policies automatically
- DIt runs inside every GKE node
Why this is the answer
Deployment Manager provides repeatable, declarative deployments and supports update operations; it does not automatically replace IAM policies nor run in GKE nodes.
- Question 41Interactive
The provided Deployment manifest specifies an update strategy. What is the name of this upgrade method?
- ARollingUpdateCorrect answer
- BRecreate
- CBlue/green
- DCanary
Why this is the answer
The `strategy` field with `type: RollingUpdate` instructs Kubernetes to replace pods incrementally with minimal downtime.
- Question 42Single Choice
Which command sends the local source tree to Cloud Build using an existing build config file?
- Agcloud builds submit --config cloudbuild.yaml .Correct answer
- Bgcloud app deploy cloudbuild.yaml
- Ckubectl apply -f cloudbuild.yaml
- Dgsutil cp cloudbuild.yaml gs://bucket
Why this is the answer
`gcloud builds submit --config cloudbuild.yaml` uploads source code and the build configuration to Cloud Build for execution.
- Question 43Multiple Select
Which two practices reduce the risk of changing an application deployed on Google Kubernetes Engine?
- ADirect all traffic to the new version immediately
- BUse readiness probes to ensure pods are readyCorrect answer
- CRoll out new versions gradually with a canary releaseCorrect answer
- DDelete the old Deployment before creating the new one
Why this is the answer
Gradual canary rollouts and readiness probes detect problems before the entire workload is affected, lowering change risk.
Frequently asked questions
Everything about the Professional Cloud Architect question bank and how to use it.