Free Google Associate Data Practitioner Sample Questions

Correct answer: C — Validity

• A. Incorrect. Completeness refers to the extent to which all required data is present and focuses on missing values or coverage. It does not evaluate conformance to specific rules or formats.
• B. Incorrect. Uniqueness checks for duplicate records or values to ensure each entity is represented only once. It does not address whether data conforms to business rules, formats, or constraints.
• C. Correct. Validity refers to the degree to which data conforms to predefined rules, expected formats (such as email syntax), and constraints (such as value ranges or referential integrity).
• D. Incorrect. Timeliness measures whether data is available when needed and represents the most recent state. It is concerned with freshness and latency rather than rule or format conformance.

Correct answer: B — Dataplex Auto Data Quality

• A. Cloud Data Fusion is a fully managed, cloud-native data integration service (ETL/ELT) for building and managing data pipelines. While it includes data profiling and some quality plugins, it is not primarily designed for defining and automating cross-table data quality rules using YAML and generating standardized quality scores.
• B. Dataplex Auto Data Quality is specifically designed to automate data quality checks for BigQuery and Cloud Storage. It allows users to define rules using YAML, execute those rules automatically at scale, generate data quality scores (metrics), and integrate with alerting systems when quality thresholds are not met.
• C. Dataflow is a managed service for executing Apache Beam pipelines for stream and batch data processing. While you could custom-code data quality logic within a Dataflow pipeline, it is not a purpose-built service for managed YAML-based data quality rule orchestration and scoring.
• D. Cloud Monitoring is used for infrastructure and application observability, logging, and metrics. While it can receive alerts from other services (like Dataplex), it does not have the built-in capability to introspect BigQuery tables and perform data-level quality checks based on YAML rules.

Correct answers: A, C, E — Accuracy; Consistency; Timeliness

• A. Accuracy is a core dimension of data quality that refers to the degree to which data correctly represents the real-world values or events it is intended to model, ensuring it is free from errors.
• B. Elasticity is a systems and cloud computing concept referring to the ability to scale resources up or down based on workload; it is not a dimension used to measure data quality.
• C. Consistency is a widely recognized data quality dimension that ensures data is uniform and non-contradictory across different systems, records, or time periods.
• D. Latency describes the time delay involved in data transmission or processing. While it impacts data availability, it is categorized as a system performance metric rather than a standard data quality dimension.
• E. Timeliness measures whether the data is sufficiently up-to-date and available at the moment it is needed for operational decision-making or analysis.
• F. Concurrency refers to the ability of a database or system to handle multiple operations or users simultaneously. It is a performance and architectural concern, not a data quality dimension.

Correct answer: B — Use a manifest file containing the list of specific files to transfer.

• A. Incorrect. Creating 10,000 separate transfer jobs would be operationally expensive, generate immense management overhead, and is not a scalable approach for selective transfers.
• B. Correct. A manifest file (provided as a TSV) allows you to specify the exact file paths to be transferred. This is the most efficient method when you have a specific list of files, as it avoids scanning millions of unnecessary files and allows the selection to be handled in a single transfer job.
• C. Incorrect. Prefix filters are designed to include or exclude groups of files based on common path patterns. Configuring 10,000 individual prefix rules would be impractical, difficult to maintain, and less efficient than using a manifest.
• D. Incorrect. Transferring the entire dataset and deleting unwanted files later is highly inefficient. It wastes significant network bandwidth, time, and storage costs, especially when only a tiny fraction of the data (10,000 out of millions) is actually needed.

Correct answer: C — Spanner

• A. Cloud SQL is a managed relational database service (MySQL, PostgreSQL, SQL Server). While it supports high availability within a region and cross-region read replicas, it is not designed to provide multi-continent strong consistency and horizontal global scalability required for a distributed ledger application.
• B. AlloyDB is a high-performance, PostgreSQL-compatible database optimized for demanding relational workloads. However, it is primarily regional in focus for its storage layer and does not offer the same native, multi-continent strong consistency and global scalability as Spanner.
• C. Cloud Spanner is Google Cloud’s globally distributed relational database. It is unique in providing strong consistency, relational semantics (SQL), and high availability across multiple regions and continents using TrueTime. It is the ideal choice for mission-critical applications like global financial ledgers.
• D. Bigtable is a high-performance, scalable NoSQL database designed for large analytical and operational workloads. It lacks relational semantics and the specific ACID transaction guarantees across global scales required for a financial ledger application.

Correct answer: B — Use the BigQuery Python Client Library to stream data using the Storage Write API.

• A. Incorrect. Writing events to a local CSV file and using a cron job with 'bq load' is a batch-oriented approach. This introduces significant latency and is not suitable for real-time streaming requirements.
• B. Correct. The BigQuery Storage Write API is the modern, high-performance method for streaming data into BigQuery. Using the BigQuery Python Client Library allows your application to ingest real-time events directly with low latency and high throughput.
• C. Incorrect. Storage Transfer Service is designed for transferring large volumes of data between cloud storage providers or from on-premises systems to Google Cloud Storage. It is not built for streaming events directly from application code to BigQuery.
• D. Incorrect. Database Migration Service (DMS) is intended for migrating existing relational databases (like MySQL or PostgreSQL) to managed services like Cloud SQL or AlloyDB. It is not an event-streaming ingestion tool.

Correct answer: A — Standard Storage

• A. Standard Storage is the most cost-effective choice for data that is stored for less than 30 days. Unlike other classes, it has no minimum storage duration and no retrieval fees. Since the logs are processed and deleted within 24 hours, you only pay for the storage used during that specific window.
• B. Nearline Storage is intended for data accessed less than once a month and has a minimum storage duration of 30 days. If data is deleted within 24 hours, you are still charged for the full 30 days, and you would also incur data retrieval fees when Dataflow reads the files.
• C. Coldline Storage is designed for data accessed less than once a quarter and has a minimum storage duration of 90 days. Deleting data after only 24 hours would result in significant early deletion charges (paying for 90 days) and high retrieval costs.
• D. Archive Storage is meant for long-term preservation (accessed less than once a year) and carries a 365-day minimum storage duration. It has the highest retrieval costs and the most expensive early deletion penalties, making it entirely unsuitable for a transient landing bucket.

Correct answers: A, B — The JSON_EXTRACT or dot notation to access the array.; The UNNEST function to flatten the array into rows.

• A. To process an array stored within a JSON data type, you must first access or extract that specific array. In BigQuery, this is accomplished using dot notation (e.g., `json_col.array_field`) or the `JSON_QUERY` / `JSON_EXTRACT_ARRAY` functions.
• B. The UNNEST function is the standard BigQuery SQL mechanism used to flatten arrays. It takes an array and returns a table with one row for each element in the array, allowing you to perform joins or individual analysis on the elements.
• C. FLATTEN_JSON is not a valid function in BigQuery SQL. To achieve this result, developers must combine extraction methods with the UNNEST function.
• D. The PIVOT operator is used to rotate data from a state of rows to columns (summarization), not to expand nested arrays into rows.
• E. ARRAY_AGG is an aggregation function that does the opposite of flattening; it collects multiple row values and combines them into a single array.

Correct answer: B — Set up a Schedule on the dashboard to deliver a PDF format via email.

• A. Incorrect. Looker Alerts are designed to notify users when data values cross a specific threshold or change in a defined way (condition-based). They are not intended for the recurring, time-based delivery of static dashboard files.
• B. Correct. Looker's built-in scheduling feature allows users to configure recurring deliveries. You can specify the delivery format (PDF), the frequency (weekly), the specific day and time (Monday at 8:00 AM), and the destination (email).
• C. Incorrect. While a custom script could theoretically work, it is unnecessarily complex and involves manual intervention or external automation. Looker provides native features that handle this requirement much more efficiently.
• D. Incorrect. Using the Looker API to rebuild a dashboard inside an email template is an over-engineered solution that does not leverage Looker's standard scheduling and delivery capabilities.

Correct answer: A — measure: total_revenue { type: sum sql: ${order_amount} ;; }

• A. Correct. In LookML, a measure with `type: sum` is the standard and most efficient way to calculate total revenue from a numeric column. The `sql` parameter correctly references the underlying field `${order_amount}`, and Looker handles the aggregation logic automatically.
• B. Incorrect. A dimension is used for row-level attributes or categorizations, not for aggregated metrics. Additionally, `type: sum` is not a valid type for a LookML dimension.
• C. Incorrect. While this syntax might appear to work in specific SQL dialects, it is not the standard LookML pattern. Using `type: number` with a manual `sum()` function in the `sql` parameter can interfere with Looker's ability to handle symmetric aggregates and complex joins correctly.
• D. Incorrect. The `type: count` parameter is used to count the number of rows or non-null values. To calculate the total dollar amount (revenue), `type: sum` must be used instead.

Correct answers: A, B, C — CSV; Excel Spreadsheet (XLSX); JSON

• A. CSV (Comma Separated Values) is a standard, natively supported format in Looker for downloading dashboard tile data. It is a highly portable flat-file format that is easily imported into spreadsheet tools like Excel for offline analysis.
• B. Excel Spreadsheet (XLSX) is a native download format in Looker. It allows users to export data into a format directly compatible with Microsoft Excel, often preserving some basic structure and making it convenient for business users.
• C. JSON (JavaScript Object Notation) is natively available as a download format for Looker tiles. While it is more commonly used for programmatic data interchange, it is a valid option for extracting the underlying data of a visualization.
• D. XML is not a standard native download format offered for dashboard tiles in Looker. Looker focuses on more modern and common data formats like CSV, Excel, and JSON.
• E. Microsoft Access Database (.accdb) is a proprietary database format and is not supported as a native download option for Looker dashboard tiles.

Correct answer: B — Built-in IAM integration for BigQuery access

• A. While VPC Service Controls can provide a security perimeter for Google Cloud services, it is a broad security feature and not a specific functional benefit of the BigQuery-Jupyter notebook integration itself.
• B. Managed Jupyter environments on Google Cloud (such as Vertex AI Workbench) offer built-in Identity and Access Management (IAM) integration. This allows users to securely access BigQuery datasets, tables, and jobs using their existing cloud permissions without the need to manually manage service account keys or separate credentials.
• C. Access to BigQuery via Jupyter notebooks in Google Cloud is managed through IAM roles and Cloud authentication. There is no requirement for users to manage local SSH keys to interact with the managed notebook instance or the BigQuery service.
• D. Jupyter notebooks are designed specifically to use Python and its vast ecosystem of libraries (such as pandas, NumPy, and the BigQuery client library) for data analysis, which is a major advantage of the integration.
• E. BigQuery is a cloud-based data warehouse. Data is queried directly from cloud-hosted tables using SQL. While users can load CSV files into BigQuery, their use is entirely optional and not a mandatory part of the notebook workflow.

Correct answer: B — APPROX_QUANTILES(order_value, 2)[OFFSET(1)]

• A. Incorrect. While PERCENTILE_CONT is a valid analytic function in BigQuery for calculating percentiles, it requires two arguments: the value expression and the percentile (e.g., PERCENTILE_CONT(order_value, 0.5)). The syntax provided here is missing the value argument, making it incorrect.
• B. Correct. In BigQuery, APPROX_QUANTILES(expression, number) divides data into the specified number of buckets and returns an array of boundaries. For 2 buckets, it returns an array containing the minimum, the 50th percentile (median), and the maximum. Accessing [OFFSET(1)] retrieves the middle value, which is the approximate median. This is a common and efficient method for handling large datasets.
• C. Incorrect. BigQuery does not have a built-in aggregate function named MEDIAN(). To find the median, users must use PERCENTILE_CONT, PERCENTILE_DISC, or APPROX_QUANTILES.
• D. Incorrect. NTILE(2) is a window function that divides the result set into two buckets and assigns a bucket number (1 or 2) to each row based on the ordering. It does not return the statistical median value of the data.

Correct answer: B — SAFE_CAST

• A. CAST_OR_NULL is not a valid or standard BigQuery function for handling conversion failures. BigQuery handles these scenarios using the 'SAFE.' prefix methodology.
• B. SAFE_CAST is the correct BigQuery function that attempts a type conversion and returns NULL if the conversion fails. This is essential for maintaining query stability when processing inconsistent or dirty data.
• C. TRY_CAST is used in other SQL dialects like SQL Server (T-SQL), but it is not a recognized function in BigQuery. The BigQuery equivalent for this behavior is SAFE_CAST.
• D. COALESCE is used to return the first non-NULL value in a list of expressions. While it can be used to provide a default value if a SAFE_CAST fails and returns NULL, it does not perform type conversion itself.

Correct answer: A — Use the TRANSFORM clause inside the CREATE MODEL statement.

• A. Correct. The TRANSFORM clause in BigQuery ML allows you to define feature preprocessing logic (like scaling or mathematical transformations) directly within the CREATE MODEL statement. These transformations are stored as part of the model and are automatically applied during ML.PREDICT, ML.EVALUATE, and ML.EXPLAIN_PREDICT, ensuring consistent feature engineering without manual intervention.
• B. Incorrect. While a view can centralize transformation logic, it is external to the model object. Using a view would still require the user to ensure the prediction data is passed through that specific view, rather than being an automatic feature of the model itself.
• C. Incorrect. ML.FEATURE_ENGINEER is not a valid BigQuery ML function. The standard mechanism for persisting transformations within the model lifecycle is the TRANSFORM clause.
• D. Incorrect. Manually applying the transformation in the SELECT statement during ML.PREDICT requires you to duplicate and maintain the logic in every prediction query, which is error-prone and fails the requirement of automatic application.

Correct answer: A — ML.CONFUSION_MATRIX

• A. Correct. ML.CONFUSION_MATRIX is the specific BigQuery ML function that returns the confusion matrix for classification models, providing the exact counts of true positives (TP), true negatives (TN), false positives (FP), and false negatives (FN).
• B. Incorrect. ML.EVALUATE returns aggregate metrics such as precision, recall, accuracy, and F1-score. While these are derived from the confusion matrix, this function does not provide the raw counts of TP, TN, FP, and FN directly.
• C. Incorrect. ML.ROC_CURVE provides the receiver operating characteristic (ROC) curve data points, focusing on the trade-offs between true positive rates and false positive rates at different thresholds, rather than providing the static classification counts.
• D. Incorrect. ML.FEATURE_INFO provides metadata and statistics about the input features used to train the model, such as minimum, maximum, and category counts, rather than performance evaluation metrics.

Correct answers: A, B — Very low loss (high accuracy) on the training dataset.; High loss (low accuracy) on the evaluation/validation dataset.

• A. Correct. Very low loss or high accuracy on the training dataset indicates the model has learned the training data extremely well, potentially including noise and outliers, which is a key component of overfitting.
• B. Correct. High loss or low accuracy on the evaluation/validation dataset shows that the model fails to generalize to unseen data. When paired with high training performance, this is the definitive indicator of overfitting.
• C. Incorrect. High loss on the training dataset is a sign of underfitting, where the model is too simple to capture the underlying patterns in the data.
• D. Incorrect. Very low loss on the evaluation/validation dataset indicates that the model generalizes well to new data, which is the goal of machine learning and the opposite of overfitting.
• E. Incorrect. Training time is influenced by factors like model complexity, data size, and hardware; it is not a direct metric used to identify overfitting.

Correct answers: A, B — Data freshness; System latency

• A. Correct. Data freshness is a key metric in streaming Dataflow jobs that indicates how far the pipeline's output is behind real-time. It represents the 'age' of the data and helps identify if the pipeline is keeping up with incoming events.
• B. Correct. System latency measures the current duration that an item spends being processed within the pipeline or the age of the oldest work item. This directly answers the requirement to know how long it takes to process an item.
• C. Incorrect. BigQuery slot utilization is a resource metric specific to BigQuery query execution and does not provide information about the performance or lag of a Dataflow streaming pipeline.
• D. Incorrect. Cloud Storage bucket size measures storage capacity usage in GCS. It is unrelated to the processing speed or real-time lag of a Dataflow job.
• E. Incorrect. Dataproc cluster memory is a metric for monitoring the resources of a Hadoop/Spark cluster in Cloud Dataproc. It is not relevant to Dataflow monitoring.

Correct answer: B — Set the trigger_rule parameter for the tasks appropriately (e.g., all_success, all_done).

• A. Incorrect. Eventarc is used for event-driven integrations across Google Cloud services. Airflow manages its own internal task dependencies and does not require external event routing between tasks within a single DAG.
• B. Correct. Airflow uses the `trigger_rule` parameter to control task execution based on the outcome of upstream tasks. The default `all_success` rule ensures a task only runs if predecessors succeed, while the `all_done` rule is ideal for cleanup tasks that must execute regardless of success or failure.
• C. Incorrect. Splitting tasks into separate DAGs and coordinating them via Cloud Scheduler adds unnecessary complexity and overhead. Airflow is designed to handle these specific execution conditions natively within a single DAG.
• D. Incorrect. Cloud Logging is intended for observability, monitoring, and troubleshooting. It is not a mechanism for defining task dependencies or triggering conditional logic within an Airflow workflow.

Correct answer: C — Unix cron format

• A. XML is a markup language used for data storage and transmission. It is not used for defining timing logic or execution schedules in Cloud Scheduler.
• B. While JSON is common for configuration and API payloads, it is not the format used to define the timing string in Cloud Scheduler. Cloud Scheduler uses a specialized syntax for its schedule.
• C. Unix cron format is the industry-standard format adopted by Cloud Scheduler to define when jobs run. A cron-style expression specifies timing details using five fields: minute, hour, day of month, month, and day of week.
• D. YAML is a human-readable data serialization format often used for configuration files, but the specific execution schedule within a Cloud Scheduler job is defined using cron syntax.

Correct answer: A — Use Dataproc Workflow Templates to create an ephemeral cluster.

• A. Dataproc Workflow Templates allow you to define a workload and manage ephemeral clusters that are automatically provisioned when the job starts and deleted when it finishes. This approach is the standard best practice for optimizing costs in scheduled batch processing as it ensures you only pay for compute resources during the actual job execution.
• B. A long-running Dataproc cluster remains active even between jobs, leading to unnecessary costs for master and worker nodes during idle periods. While auto-scaling helps adjust capacity during execution, it does not solve the requirement of deleting the entire compute resource immediately upon job completion.
• C. While BigQuery is a serverless and cost-effective data warehouse, migrating an existing 5 TB Spark job to BigQuery SQL would require a complete rewrite of the processing logic. The requirement is specifically about optimizing the resource lifecycle for a Spark-based workload.
• D. Cloud Data Fusion is a visual data integration tool, but using it with a static execution environment means the resources are pre-provisioned and not automatically deleted. This fails to meet the goal of on-demand provisioning and immediate teardown for cost efficiency.

Correct answer: B — Cloud Workflows

• A. Cloud Composer is a managed Apache Airflow service used for complex workflows and scheduled tasks. It is not considered lightweight, involves more operational overhead, and does not scale to zero because it requires a persistent environment (GKE nodes).
• B. Cloud Workflows is the ideal serverless orchestration tool for connecting APIs, Cloud Functions, and other Google Cloud services. It is highly available, provides pay-per-use pricing that scales to zero when idle, and is specifically designed for lightweight, event-driven HTTP orchestration.
• C. Cloud Data Fusion is a fully managed, cloud-native data integration service with a graphical interface. It is designed for building complex ETL/ELT data pipelines rather than orchestrating simple, lightweight serverless function calls and API requests.
• D. Dataproc is a managed service for running Apache Spark and Hadoop clusters for big data processing. It is not an orchestration tool for serverless workflows and does not meet the requirement to scale to zero automatically.

Correct answer: B — Dataflow is a fully serverless service, while standard Dataproc requires you to provision and manage cluster infrastructure.

• A. Incorrect. The underlying technologies are reversed here: Cloud Dataflow is built on the Apache Beam model, while Cloud Dataproc is a managed service for the Apache Hadoop and Spark ecosystem.
• B. Correct. Cloud Dataflow is a fully serverless (NoOps) service where Google automatically provisions, manages, and scales the underlying compute resources. In contrast, standard Cloud Dataproc requires users to explicitly provision and manage the lifecycle of clusters (VMs) to run jobs.
• C. Incorrect. Both Cloud Dataflow and Cloud Dataproc are capable of processing both batch and streaming data workloads.
• D. Incorrect. Cloud Dataflow primarily uses the Apache Beam SDK (supporting Java, Python, and Go) and offers Dataflow SQL. Cloud Dataproc supports a wide range of big-data tools and languages, including Java, Scala, Python, and SQL via Hive or Spark SQL.

Correct answer: B — The subscriber creates a linked dataset in their own BigQuery project that points to your shared dataset.

• A. Incorrect. Analytics Hub is designed to share data products in a governed, BigQuery-native way rather than through file-based exports like CSVs. This allows for live, real-time access rather than static delivery.
• B. Correct. In Analytics Hub, a subscriber accesses shared data by creating a linked dataset in their own BigQuery project. This linked dataset acts as a pointer to the publisher's shared data product, allowing the subscriber to query it securely and directly from their own environment.
• C. Incorrect. Access is managed via Analytics Hub and IAM permissions, allowing the subscriber to use their own project and identity. They do not need to log into the publisher's project or use guest accounts.
• D. Incorrect. While the data remains in the publisher's storage, the compute resources (slots) used to query the data are provided by the subscriber's project. Consequently, the subscriber is billed for their own query processing costs.

Correct answer: B — Use Policy Tags to implement column-level access control on the PII column.

• A. Row-level access policies (RLAP) are used to restrict access to specific rows based on user identity or attributes (e.g., region or department), but they do not hide specific columns. Analysts would still be able to see the PII column for any row they are permitted to access.
• B. Policy Tags enable column-level security in BigQuery. By tagging the sensitive PII column and restricting access to that specific tag, analysts can continue to query the table and see non-sensitive columns while being blocked from viewing or selecting the sensitive PII data.
• C. While isolating sensitive data into a separate dataset is a possible architectural choice, it introduces unnecessary complexity and management overhead compared to native column-level security. It is not considered the best approach for simple field-level restriction within an existing table.
• D. Customer-Managed Encryption Keys (CMEK) are designed to protect data at rest and give organizations control over key rotation and management. They do not provide granular field-level access control for users who have permission to run queries on the table.

Correct answer: C — Use Analytics Hub to create a data exchange and invite the suppliers as subscribers.

• A. Manually creating and managing 50 IAM users across different organizations is not scalable and lacks centralized governance for data exchanges. It makes tracking usage and managing permissions for external entities cumbersome compared to purpose-built solutions.
• B. Exporting data to Cloud Storage is a batch-oriented approach and does not provide real-time access. It creates significant operational overhead, results in 50 duplicated copies of data, and does not allow for centralized query tracking or use of supplier-side compute resources.
• C. Analytics Hub is the recommended Google Cloud solution for securely sharing BigQuery data across organizational boundaries. It allows you to create a centralized data exchange where you can manage subscriptions, track usage, and provide real-time data access. Crucially, it enables subscribers to query the shared data using their own BigQuery compute (slots) and projects.
• D. Emailing CSV extracts is manual, insecure, and not suitable for real-time data sharing or large-scale distribution. It does not support centralized governance, real-time querying, or the ability for suppliers to use their own compute resources for data analysis.

Correct answers: A, B — Store the data in a Cloud Storage bucket using the Archive storage class.; Enable Object Retention Lock on the Cloud Storage bucket.

• A. Cloud Storage Archive is the lowest-cost storage class provided by Google Cloud, specifically designed for long-term retention of data that is accessed less than once a year. This satisfies the requirement for the lowest possible cost.
• B. Object Retention Lock (part of the Bucket Lock feature) enforces WORM (Write Once Read Many) behavior. Once a retention policy is locked, it prevents the deletion or modification of objects by any user, including administrators, for the specified duration, fulfilling the compliance requirement.
• C. BigQuery storage is more expensive than Cloud Storage Archive. Furthermore, table expiration controls when a table is automatically deleted but does not prevent a user with appropriate permissions from deleting the table or modifying the data before that time.
• D. Autoclass automatically moves objects to different storage classes based on access patterns. While it can help manage costs, it does not provide the WORM immutability required for regulatory compliance.
• E. Standard storage is the most expensive class and is intended for frequently accessed data. A 'Delete' lifecycle rule merely automates deletion at the end of a period; it does not prevent manual deletion or modification during that period.

Correct answer: A — Create a lifecycle rule with the action 'Delete', and conditions 'Age' = 30 and 'MatchesSuffix' = '.log'.

• A. Correct. Google Cloud Storage lifecycle management allows you to define rules that trigger actions like 'Delete' based on specific conditions. The 'Age' condition specifies the number of days since object creation, and 'MatchesSuffix' allows you to target objects by their extension (e.g., '.log'). This is the most efficient, automated, and cost-effective method to manage object lifecycles.
• B. Incorrect. 'MatchesPrefix' evaluates the beginning of the object's name, which is typically used for targeting specific folders or naming schemes. Since '.log' is the file extension (the suffix), this condition would not correctly isolate the log files for deletion.
• C. Incorrect. Manually downloading, deleting, and re-uploading files is highly inefficient, time-consuming, and incurs unnecessary egress and ingress costs. Cloud Storage lifecycle management is the native, automated tool designed specifically for this use case.
• D. Incorrect. Autoclass is a feature designed to automatically transition objects between storage classes (e.g., Standard to Coldline) based on access patterns to optimize costs. It does not provide functionality to delete specific objects based on file extensions or age.

Correct answers: A, B — Set the dataset's default table expiration to 7 days.; Set the specific table's partition expiration to 3 days.

• A. Correct. Setting the dataset's default table expiration ensures that any new table created in the dataset will automatically be deleted after the specified duration (7 days). This provides a default lifecycle policy for the entire dataset.
• B. Correct. For partitioned tables, BigQuery allows you to set a partition expiration time. Setting this to 3 days on the specific table ensures that each individual partition is deleted 3 days after the partition's date, meeting the requirement for granular data management.
• C. Incorrect. BigQuery dataset-level settings primarily manage default table expiration. Partition expiration is a property configured at the table level for partitioned tables, not a dataset-wide default for partitions.
• D. Incorrect. Setting the table expiration to 3 days would delete the entire table (metadata and all data) after 3 days. The requirement specifies that individual partitions should expire after 3 days, not the whole table.
• E. Incorrect. Using a scheduled query to delete a dataset is not a standard lifecycle management practice. BigQuery's built-in expiration settings are the native, automated, and recommended method for managing table and partition lifecycles.

Correct answer: B — Use CMEK and configure the Cloud KMS key with a rotation period of 90 days.

• A. CSEK (Customer-Supplied Encryption Keys) requires you to manage and provide encryption keys yourself for every operation. Using a cron job on an on-premises server creates significant operational overhead, increases the risk of manual error, and is not a native or highly reliable way to enforce rotation in Google Cloud.
• B. CMEK (Customer-Managed Encryption Keys) via Cloud KMS is the recommended solution for this scenario. Cloud KMS allows you to define an automatic rotation schedule (e.g., every 90 days), which ensures compliance while minimizing manual intervention and operational burden.
• C. GMEK (Google-Managed Encryption Keys) are the default encryption keys handled by Google. While Google rotates these keys internally, customers cannot configure, control, or verify the rotation interval to meet specific regulatory mandates like a strict 90-day window.
• D. Cloud EKM (External Key Manager) delegates key management to a third-party system outside of Google Cloud. This is typically used for specific sovereignty requirements and introduces additional network complexity and management overhead rather than simplifying the rotation process.

Correct answer: B — Cloud HSM (Hardware Security Module)

• A. Cloud EKM (External Key Manager) allows you to manage encryption keys in an external key management system outside of Google Cloud. While those external systems may be compliant, it does not specifically provide Google-managed hardware security modules certified for FIPS 140-2 Level 3 for keys hosted within Google Cloud.
• B. Cloud HSM is a cloud-hosted Hardware Security Module service that integrates with Cloud KMS. It allows you to host encryption keys and perform cryptographic operations in FIPS 140-2 Level 3 validated hardware modules. This is the correct choice when you need hardware-backed protection at that specific certification level while managing keys within the Google Cloud ecosystem.
• C. Customer-Supplied Encryption Keys (CSEK) allow you to provide your own key material for use with services like Compute Engine or Cloud Storage. However, this method shifts key management and storage responsibilities entirely to the user and does not utilize Cloud KMS hardware-backed modules to satisfy FIPS 140-2 Level 3 requirements.
• D. Secret Manager is designed to store and manage sensitive application data such as API keys, passwords, and certificates. It is not intended to provide hardware-backed cryptographic key management for disk or bucket encryption, nor does it meet the FIPS 140-2 Level 3 hardware requirement for key generation.

Correct answer: B — Disable the KMS key version used to encrypt the dataset.

• A. Destroying the KMS key version makes the encrypted data permanently unrecoverable. This is a destructive action that violates the requirement to avoid permanent data deletion.
• B. Disabling the KMS key version is the best immediate response. It prevents BigQuery from using the key to decrypt the data, effectively blocking all access to the dataset. Unlike destruction, disabling a key is reversible, allowing you to re-enable access once the security investigation is resolved.
• C. Deleting the BigQuery dataset is an extreme measure that involves potential data loss and high operational overhead for restoration. Disabling the encryption key is a more efficient and targeted way to control access without moving or deleting the underlying data.
• D. Changing the rotation schedule creates new key versions for future data but does not revoke access to the current key version used to encrypt existing data. It is a preventative maintenance task rather than an incident response tool for blocking access.

Correct answer: C — Dual-region buckets allow you to select a specific pair of regions for replication, while multi-region buckets replicate data across a large, predefined geographic area.

• A. Incorrect. Multi-region buckets do not replicate data globally across all regions; they replicate data across a large, predefined geographic area (e.g., the US, EU, or Asia). Dual-region buckets do not replicate within a single region; they replicate data across two specific regions.
• B. Incorrect. Both multi-region and dual-region buckets (and even single-region buckets) are designed for the same level of data durability (99.999999999%). The difference between them is related to availability and geographic redundancy, not the durability SLA.
• C. Correct. Dual-region buckets allow users to specify exactly which two regions will host the data (e.g., us-east1 and us-west1), which is useful for compliance and low-latency access. Multi-region buckets replicate data across a broader, predefined geographic area like 'US' or 'EU'.
• D. Incorrect. While it is true that Turbo Replication is a feature unique to dual-region buckets, multi-region buckets definitely support replication—it is their primary function to replicate data across several regions within a large geography.

Correct answer: A — Use the Cloud Storage Soft Delete feature to restore the objects, assuming the retention period has not expired.

• A. Correct. Cloud Storage Soft Delete is a built-in feature designed to protect against accidental or malicious deletion. It retains deleted objects for a configurable retention period (defaulting to 7 days), during which they can be restored to the bucket.
• B. Incorrect. Google Cloud does not provide a service for customers to retrieve data from internal system backups or tape archives. Recovery is the customer's responsibility using features like Soft Delete, Object Versioning, or external backup solutions.
• C. Incorrect. While re-uploading from an on-premises server is a possible action if a backup exists, it is a manual workaround rather than a native Google Cloud Storage recovery feature. The question typically seeks the platform-native solution, which is Soft Delete.
• D. Incorrect. Object Lifecycle Management is used to automate the management of objects, such as moving them to colder storage classes or deleting them after a certain age. It does not have the capability to undo or reverse a deletion once it has been executed.

Correct answer: B — Export the database to a SQL dump file and store it in a Cloud Storage Archive class bucket.

• A. While on-demand backups in Cloud SQL do not expire automatically like scheduled backups, they are not the most cost-effective or standard method for multi-year (7-year) regulatory archival. Storing backups within the Cloud SQL service is generally more expensive than using specialized storage classes.
• B. Exporting the database to a SQL dump file and storing it in Cloud Storage Archive class is the recommended best practice for long-term retention. Archive storage is specifically designed for data accessed less than once a year, offering the lowest cost for long-term archival compliance.
• C. Read replicas are designed for read scalability and high availability, not for long-term archival. Stopping an instance to 'freeze' data is not a viable disaster recovery strategy and does not scale for a 7-year retention period.
• D. Point-in-Time Recovery (PITR) uses write-ahead logs (WAL) to allow recovery to a specific second, but it is intended for short-term recovery windows (typically up to 7 days). It is technically impossible and cost-prohibitive to maintain PITR logs for 7 years.