Free Google Professional Cloud Architect Sample Questions

Correct answers: A, B — The capability is not part of the company's core competitive differentiation, so engineering effort is better spent on revenue-generating features.; A mature SaaS vendor already meets the required compliance certifications and integrates with the existing HR and finance systems out of the box.

• A. Expense reporting is a back-office capability that does not differentiate the company competitively, which is a classic signal to buy so engineering time goes toward features that move the business forward. This is one of the two factors that should tip the disposition decision toward buying.
• B. A vendor that already carries the needed compliance certifications and integrates with existing HR and finance systems removes both compliance risk and integration effort that a custom build would otherwise require. This directly supports buying over building and is the other deciding factor.
• C. Language familiarity with an API client library is a minor implementation convenience and does not address whether the capability is strategic or how much compliance and integration work a custom build would require. It is not a strong driver of the build-versus-buy decision.
• D. The availability of a managed database service lowers the operational cost of building, which would argue for building rather than buying. It does not, by itself, make the case that buying is the better disposition for this capability.
• E. Engineer comfort with Compute Engine reflects existing build capability rather than a reason to prefer a purchased solution. Team skill availability supports either disposition and is not decisive for choosing to buy.

Correct answers: A, B — Buffer incoming telemetry in a durable, replicated messaging service so data persists and can be reprocessed if a downstream consumer becomes unavailable.; Deploy the ingestion pipeline across multiple regions with automated failover, so vehicle telemetry keeps being accepted if one region has an outage.

• A. A durable, replicated messaging layer holds incoming telemetry safely even if a downstream processing component is temporarily unavailable, ensuring the data can still be consumed once processing resumes rather than being lost.
• B. Deploying ingestion across multiple regions with automated failover means the pipeline keeps accepting vehicle telemetry even if one region experiences an outage, which is exactly what prevents a regional failure from silently dropping data.
• C. A single-region pipeline that discards undelivered readings during an outage is the exact failure mode the continuity requirement is meant to prevent, since telemetry would be silently and permanently lost during any regional disruption.
• D. Keeping telemetry only in local server memory means any server restart or failure loses that data immediately, which provides no durability at all and directly conflicts with a business continuity requirement for a central data pipeline.
• E. Relying on manual field collection during an outage does not scale to hundreds of thousands of vehicles and introduces long delays before data becomes available again, which does not meet the pipeline's continuity needs.

Correct answer: A — Spot VMs, accepting that Compute Engine can reclaim capacity with a short shutdown notice in exchange for a steep discount off the on-demand price.

• A. Spot VMs offer the deepest discount off on-demand pricing in exchange for the possibility of preemption, and because this checkpointed batch job tolerates worker restarts, it can absorb that tradeoff to minimize cost.
• B. Sole-tenant nodes address hardware isolation and compliance requirements, not cost minimization, and they carry a premium rather than a discount, so they do not fit a job optimizing purely for lowest compute cost.
• C. Committed-use discounts require a one- or three-year commitment to steady capacity, which suits predictable always-on workloads rather than a nightly job that could instead exploit spare, interruptible capacity for a deeper discount.
• D. Paying full on-demand price for SLA coverage is unnecessary here because the job is fault-tolerant and not customer-facing, so the extra cost of guaranteed uptime does not buy anything the workload needs.

Correct answer: A — Introduce a new versioned API path for breaking changes, while still supporting the existing version until partners migrate.

• A. Introducing a new versioned path for breaking changes while keeping the existing version available lets partner integrations keep working against the version they built for, until they choose to migrate on their own schedule.
• B. Changing the existing response format in place without a version indicator breaks every partner integration built against the prior format the moment the change ships, with no way for them to keep working unchanged.
• C. Requiring partners to rebuild their integration for any format change, however small, creates unnecessary partner churn and does not reflect a practice for evolving an API in a compatible way.
• D. Removing the previous version immediately on release gives partners no migration window, which breaks their integrations rather than letting them keep working while the API evolves.

Correct answer: A — It automatically collects configuration and utilization data from on-premises servers and databases and uploads it to Migration Center for assessment.

• A. The Discovery Client is the on-premises component that automatically gathers configuration and utilization data from servers and databases and sends it to Migration Center, which is exactly the automated collection step needed before an accurate assessment can be produced. This removes the manual effort of building inventory spreadsheets by hand.
• B. Provisioning a landing zone with a folder and project hierarchy is a resource-hierarchy design activity, not something the Discovery Client performs. That work happens separately, typically before or in parallel with discovery, using organization and folder design guidance.
• C. Migration Center's discovery tooling collects assessment data; it does not perform the live data transfer of virtual machine disks into Compute Engine. Disk migration is handled by dedicated migration tooling once the assessment and planning phases are complete.
• D. Architectural diagrams and wave sequencing documents are outputs an architect produces using the assessment data, not something the discovery component generates automatically. The Discovery Client's role ends once it uploads the collected inventory data for analysis.

Correct answers: A, B, E — Dedicated Interconnect for high-bandwidth, low-latency private connectivity directly into the Google Cloud network, suitable for large-scale data transfer and long-term hybrid application traffic.; Cloud VPN as a lower-bandwidth, encrypted fallback path over the public internet, useful for redundancy or for workloads that do not need Interconnect-level throughput.; Network Connectivity Center to manage and centralize multiple hybrid connections, such as Interconnect and VPN, into a hub-and-spoke topology as connected sites grow in number.

• A. Dedicated Interconnect offers a private, dedicated, high-bandwidth path suitable for both the large data transfers involved in migration and the ongoing low-latency needs of applications that stay hybrid for the long term.
• B. Cloud VPN provides an encrypted path over the public internet that works well as a redundant path or for workloads that do not need Interconnect-level throughput, complementing a primary Interconnect connection.
• C. Sending all traffic over the public internet with no encryption at all ignores the security risk of exposing application data in transit, regardless of whether the traffic is described internally as business application traffic.
• D. A single unencrypted consumer-grade broadband link has neither the reliability nor the bandwidth guarantees needed for enterprise migration data volumes or ongoing hybrid application traffic, especially at multi-year, multi-wave scale.
• E. Network Connectivity Center centralizes multiple hybrid connections such as Interconnect and VPN into a manageable hub-and-spoke topology, which becomes increasingly valuable as the number of connected sites grows over a multi-year migration.

Correct answer: A — Run autoscaled instance groups or GKE clusters behind a global external Application Load Balancer in two regions per continent, backed by a multi-region Spanner instance for consistent writes.

• A. A global load balancer fanning out to instance groups or clusters in multiple regions removes any single region as a point of failure, and a multi-region Spanner instance keeps session data consistent even when one region drops out.
• B. Serving from a single region with CDN caching in front reduces latency for cacheable content but does nothing for a full regional outage, since the origin backend and its state still live in one place.
• C. Nightly replication to Cloud Storage means up to a day of session data could be lost, and manual rebuild from backups takes far longer than the near-continuous availability the studio needs during an active outage.
• D. Multi-zone redundancy inside a single region protects against a zone failure but not a regional failure, and a same-region Cloud SQL standby replica goes down along with the primary if the whole region fails.

Correct answer: A — Gemini Cloud Assist's natural-language design experience in Application Design Center, which lets the architect refine the architecture in conversation, then generate Terraform.

• A. Gemini Cloud Assist supports designing, configuring, and provisioning architectures through natural-language interaction in Application Design Center, including generating Terraform, kubectl manifests, or gcloud commands from the resulting design.
• B. A monitoring dashboard editor visualizes metrics from resources that already exist; it has no role in conversationally designing an architecture or generating its infrastructure code.
• C. A billing budget console tracks spend against a threshold and cannot design an architecture or produce Terraform for resources that do not exist yet.
• D. A delivery pipeline promotes a built artifact through deployment targets; it assumes the infrastructure and application already exist rather than helping design them from scratch.

Correct answer: A — Provision Hyperdisk volumes and configure IOPS and throughput as separate parameters from the disk capacity

• A. Hyperdisk decouples performance provisioning from capacity, letting an architect raise or lower IOPS and throughput independently of the volume size and without resizing the disk, which is exactly the tunable-performance requirement described.
• B. Persistent Disk performance, including pd-balanced, scales with the provisioned capacity, so the only way to raise IOPS or throughput is to increase the disk size, which contradicts the requirement to tune performance without resizing.
• C. Local SSD data does not survive a VM stop, suspend, or crash, so it cannot serve as durable storage for an OLTP database that must retain committed transactions, even though its raw IOPS is high.
• D. Snapshot schedules protect against data loss but do not change a persistent disk's IOPS or throughput ceiling, and pd-standard still ties its performance to the size of the provisioned volume.

Correct answers: A, B — Google manages node provisioning, upgrades, and repairs automatically, removing the need for the team to size or patch the underlying node pools; Billing is based on the CPU, memory, and storage that pods actually request rather than the capacity of statically sized node pools the team provisions

• A. Autopilot's defining characteristic is that Google operates node provisioning, upgrades, and repairs on the team's behalf, which is exactly the hands-off node management this team is asking for.
• B. Autopilot bills by the resources pods actually request rather than by the size of a fixed node pool, matching the team's requirement to pay only for what their workloads consume.
• C. Autopilot does not give users SSH access to nodes or allow privileged host-level customization such as custom kernel modules, since Google manages the node layer entirely, so this describes Standard mode's flexibility, not Autopilot's.
• D. Autopilot does not expose per-node machine type selection to the team; node shape is managed automatically based on workload requests, so this describes the manual control available in Standard mode, not Autopilot.
• E. Node-level credential rotation and certificate renewal are part of the node management Google performs automatically in Autopilot, so requiring the team to do this manually is not how Autopilot works.

Correct answer: A — Deploy the microservice on Cloud Run, since it runs the existing container image, can hold the in-memory cache across requests on a warm instance, and scales to zero when idle

• A. Cloud Run runs an existing container image directly, keeps an instance warm to serve subsequent requests so an in-memory cache persists between them, and scales instance count down to zero when there is no traffic, matching all three requirements.
• B. Cloud Functions is built around single-purpose functions rather than an existing multi-container image, and a cold start replaces the execution environment, so in-memory state is not reliably preserved the way this workload needs.
• C. App Engine standard environment runs applications in Google-managed language runtimes rather than arbitrary multi-container images, so the existing container would need to be repackaged rather than deployed as-is.
• D. A single always-on Compute Engine VM keeps running and billing continuously; it does not scale to zero, and Cloud Run is not the only Google Cloud compute option with scale-to-zero behavior, so this description is inaccurate on both points.

Correct answer: A — Target firewall rules using the service account attached to each instance, since changing an instance's service account requires an IAM permission that can be tightly restricted.

• A. Service accounts are access-controlled through IAM, so changing which service account an instance uses requires a permission that security can restrict, preventing an engineer from silently widening firewall scope by editing instance metadata.
• B. Network tags are plain instance metadata that most engineers can edit directly, so an attacker or careless engineer can add a permissive tag to an instance without any IAM approval, widening its effective access.
• C. Subnet-based targeting forces every workload in that subnet to share one access level, which does not scale for autoscaled groups with mixed roles and still lets an engineer move an instance into a broader subnet.
• D. Autoscaled instances are recreated with new external IPs and this design likely uses Cloud NAT or no external IPs at all, so IP-based rules would be unstable and would not solve the metadata-editing risk described.

Correct answers: A, B, C — Deploy Cloud IDS with a mirroring policy on the subnets carrying east-west traffic so a managed engine can inspect it for known attack signatures.; Wrap the BigQuery datasets in a VPC Service Controls perimeter so data cannot be exfiltrated to unauthorized networks even by a caller holding valid IAM permissions.; Enable VPC Flow Logs and firewall rule logging on the relevant networks so every accepted and denied connection is recorded for later audit review.

• A. Cloud IDS mirrors traffic on the targeted subnets to a managed detection engine that inspects it against known attack signatures, directly satisfying the requirement to add intrusion detection for east-west traffic between subnets.
• B. A VPC Service Controls perimeter around the BigQuery datasets blocks data movement to unauthorized networks even when the caller presents valid IAM credentials, which is exactly the exfiltration protection the scenario requires.
• C. Turning on VPC Flow Logs together with firewall rule logging records every accepted and denied connection through the network, giving the audit trail the security team needs to review later.
• D. Granting broad project-level Editor permissions removes the least-privilege access control the datasets need and increases exfiltration risk rather than preventing it, working against the stated security goal.
• E. Removing deny firewall rules eliminates network-level access control entirely and would let unwanted traffic reach the subnets unblocked, which weakens security instead of improving intrusion detection visibility.
• F. Sharing one service account credential among every analyst removes individual accountability and makes IAM-based access review impossible, undermining both the audit and least-privilege goals of the scenario.

Correct answer: A — Build a grounded search-and-chat agent with Vertex AI Search and Conversation, pointed at a data store built from the catalog and manuals.

• A. Vertex AI Search and Conversation is built for exactly this pattern: it ingests a data store such as the parts catalog and manuals, then serves a grounded chat interface that answers questions and cites the source passages.
• B. Syntax analysis parses grammatical structure such as parts of speech, and produces no ranked retrieval or chat interface, so it cannot power a question-answering experience on its own.
• C. Transcribing past call recordings only creates more raw audio-derived text; it does not deliver a grounded chat interface that answers new dealer questions against the catalog and manuals.
• D. Extracting raw text from scanned pages into a spreadsheet produces unstructured text a dealer would still have to search manually, with no chat interface, ranking, or citation of source pages.

Correct answers: A, B, C — Deploy the model behind a private endpoint reachable only from the application's VPC, rather than exposing a public endpoint to the internet.; Configure autoscaling with a minimum and maximum replica count sized to the application's expected traffic pattern and latency targets.; Enable model monitoring to detect prediction drift over time so the team is alerted before accuracy degrades unnoticed in production.

• A. A private endpoint scoped to the application's VPC keeps the deployed model reachable only from trusted network paths, which is standard practice for a production endpoint serving an internal application.
• B. Sizing autoscaling minimum and maximum replicas to expected traffic and latency targets lets the endpoint absorb load spikes while avoiding the cost of over-provisioned idle capacity, a core production deployment practice.
• C. Model monitoring for prediction drift catches gradual accuracy degradation as real-world input distributions shift away from the fine-tuning data, which a team would otherwise only discover from downstream complaints.
• D. Assuming an internal application is trusted by default and skipping authentication leaves the endpoint exposed to anything on the network path, which a production deployment should never assume is safe.
• E. A single fixed replica with no autoscaling leaves no headroom for traffic spikes and no resilience if that replica fails, which is a fragile choice for a production-facing endpoint.
• F. Skipping endpoint access logging removes the server-side record needed to diagnose failed requests or investigate anomalous traffic, which client-side application metrics alone cannot reconstruct.

Correct answers: A, B, C — Load structured customer transaction data into BigQuery and expose curated views so pipeline components can query it directly through the BigQuery connector.; Register the engineered churn features in Vertex AI Feature Store so both training pipeline steps and online serving can read consistent feature values.; Stage raw unstructured documents and images in Cloud Storage buckets organized by ingestion date so pipeline components can reference them as artifacts.

• A. Curated BigQuery views give pipeline components a governed, queryable interface to structured transaction data without each component needing to know the raw table layout.
• B. Registering features in Feature Store ensures training and online serving read the same computed values, which avoids the training-serving skew that comes from recomputing features in two separate places.
• C. Cloud Storage staged by ingestion date gives unstructured artifacts a predictable, referenceable location that pipeline components can read as inputs without depending on a database connector.
• D. This is a false constraint: Agent Platform Pipelines can read from BigQuery, Cloud Storage, Feature Store, and other connectors, so forcing every source into one relational schema throws away structure best suited to each data type.
• E. Deferring access control until after a pipeline run succeeds exposes sensitive data during the run itself; IAM and access boundaries should be configured before any pipeline reads the data, not retroactively.
• F. Requiring full human labeling before any staging, even for exploratory schema validation, blocks the team from simply inspecting a data source's structure and unnecessarily delays early integration work.

Correct answer: A — Use Cloud Run functions for the sporadic image-resizing step, and use AI Hypercomputer GPU resources orchestrated through Agent Platform Pipelines for the multi-day training run.

• A. Cloud Run functions fit a sporadic, short-lived task like image resizing because it only runs when invoked, while a multi-day GPU training run needs the sustained accelerator capacity that AI Hypercomputer, orchestrated by Agent Platform Pipelines, is built to provide.
• B. This reverses the fit: provisioning GPU capacity for a sporadic function wastes idle accelerator time, and Cloud Run functions are not designed to sustain a multi-day, resource-intensive training run.
• C. Cloud Run functions have a maximum execution time per invocation, so they cannot host a multi-day training run regardless of how the workload is structured.
• D. Keeping GPU capacity always on for a sporadic, short-lived function pays for idle accelerator time between invocations, which is the opposite of cost-effective for that workload.

Correct answer: A — Sign a Business Associate Agreement with Google Cloud and configure the workloads to use only HIPAA-covered products under that agreement.

• A. HIPAA requires a signed Business Associate Agreement between the covered entity and any vendor that processes protected health information, and Google Cloud only extends HIPAA eligibility to the specific products listed under that agreement, so this must be in place before any PHI touches the platform.
• B. A content delivery network improves latency for static assets but has no bearing on whether the organization has the legal and contractual coverage HIPAA requires for handling protected health information.
• C. Storage durability and region configuration are architectural choices that matter after HIPAA eligibility and contractual coverage are established; durability alone does not satisfy the regulatory prerequisite for processing PHI.
• D. Broad Owner-level access directly violates the least-privilege principle HIPAA compliance programs require and increases the risk of unauthorized disclosure rather than addressing the prerequisite for handling PHI at all.

Correct answers: A, B — Require firewall rule changes to pass through a change ticketing system that records the requester, approver, and justification.; Restrict the IAM roles that can modify VPC firewall rules to a small, named group of network security engineers only.

• A. A ticketing-based change management process that records who requested a change, who approved it, and why creates the auditable trail a PCI DSS assessor expects to see for controls protecting the cardholder-data environment.
• B. Limiting the IAM roles capable of modifying firewall rules to a small, named group directly enforces the requirement that only a defined set of engineers can approve changes to controls guarding cardholder data.
• C. The broad Editor role grants far more permissions than firewall management alone and is not scoped to a small, defined group, which works against the principle of least privilege the assessor is testing.
• D. Disabling logging removes the evidence trail needed to prove who made changes and when, which is the opposite of what a PCI DSS control review requires for the cardholder-data environment.
• E. A shared service account undermines individual accountability regardless of key rotation cadence, since a review cannot tie a specific change back to a specific engineer when credentials are shared.

Correct answer: A — Chrome Enterprise Premium, which applies context-aware access and data-loss-prevention scanning to browser sessions reaching SaaS apps.

• A. Chrome Enterprise Premium applies BeyondCorp-style context-aware access controls and real-time data-loss-prevention scanning directly in the browser, covering SaaS destinations that the organization does not host, not just Google Cloud applications.
• B. IAP is a reverse proxy that sits in front of applications the organization deploys behind a Google Cloud load balancer; it cannot be inserted in front of a third-party SaaS vendor's own infrastructure.
• C. VPC Service Controls protects Google Cloud API calls within a defined perimeter of Google Cloud projects; it has no mechanism to extend that perimeter to an external SaaS vendor's own services.
• D. Access levels are policy objects evaluated by services like IAP and VPC Service Controls; a browser does not automatically enforce them without an integration point such as Chrome Enterprise Premium.

Correct answer: D — Cloud Build's SLSA-compliant build provenance, which signs an attestation describing the source, steps, and inputs used.

• A. Object versioning preserves a history of files in a bucket but carries no cryptographic claim about which source commit or build steps produced any particular version.
• B. Vulnerability scanning identifies known CVEs in installed packages, which is useful for patch management but says nothing about whether the artifact was built by the expected pipeline from the expected source.
• C. Build logs record console output for debugging and review, but plain-text logs are not a signed, tamper-evident attestation that downstream consumers can cryptographically verify.
• D. SLSA-compliant build provenance from Cloud Build produces a signed, non-falsifiable record of the exact source commit, build steps, and inputs that produced the artifact, which is precisely the cryptographic proof of origin the architect needs.

Correct answer: A — On-premises purchases are capital expenditures depreciated over time, while committed use discounts convert cloud spend into predictable, recurring operating expenses.

• A. On-premises hardware purchases are capitalized and depreciated over their useful life, while committed use discounts are still consumption-based operating spend, just with a predictable, discounted recurring cost.
• B. Treating both options as capital expenditure ignores the fundamental accounting distinction between owned depreciable assets and ongoing operating spend, which materially affects budgeting and tax treatment.
• C. A multi-year committed use discount is still billed as recurring operating expense under standard cloud accounting, not capitalized like a physical asset purchase.
• D. How a purchase is funded internally does not determine its accounting classification; depreciable hardware purchases are capital expenditures regardless of which budget line pays for them.

Correct answer: A — Introduce automated pre-deployment checks and staged rollouts for changes above a defined risk threshold, leaving low-risk changes on the existing fast path.

• A. Adding automated checks and staged rollouts specifically for higher-risk changes strengthens oversight where it is needed while keeping the existing fast path for changes that carry little risk.
• B. Applying the same heavy manual review to every change regardless of risk slows down low-risk releases without necessarily preventing the kind of failure that caused the outage.
• C. An indefinite freeze with no interim guidance stalls all delivery and leaves teams without a clear path forward, which is a disproportionate response to one failed deployment.
• D. Removing review entirely and relying on self-certification removes exactly the safeguard whose absence likely contributed to the outage in the first place.

Correct answers: A, B, D — Schedule automated backups and export them to a multi-region Cloud Storage bucket so backups survive the loss of the primary region entirely.; Write and rehearse a documented runbook for promoting the replica to primary and repointing the application's database connection string.; Provision a cross-region read replica so a promotable, continuously updated copy of the order data exists outside the primary region.

• A. Automated backups exported to a multi-region bucket give the team a recovery path that is independent of the primary region's availability, protecting against a scenario where the region itself is lost.
• B. A rehearsed promotion runbook turns disaster recovery from a theoretical capability into a tested procedure, so the team can actually execute the failover within its recovery time objective when it matters.
• C. An application cache holds only a transient, incomplete view of recent activity and is not a durable or complete record of order history, so it cannot substitute for a database recovery strategy.
• D. A cross-region read replica keeps continuously replicated data outside the primary region, so it can be promoted to become the new primary if that region becomes unavailable.
• E. Point-in-time recovery protects against logical errors such as accidental deletes within the primary region, and disabling it removes a recovery capability the cross-region replica does not provide.
• F. A backup on a disk attached to the same instance is lost along with that instance during a regional outage, so it does not protect the order history against the failure the team is planning for.

Correct answer: B — Run automated load tests against a staging environment that mirrors production, driving traffic beyond the projected peak volume before release.

• A. Unit tests validate business logic in isolation and do not exercise the service under realistic concurrent load, so they cannot reveal whether the checkout path will hold up at peak volume.
• B. Driving simulated load up to and beyond the expected peak against a production-like staging environment surfaces capacity limits, such as database connection exhaustion or autoscaling delays, while there is still time to fix them before real customers hit the same limits.
• C. Support team impressions from routine interactions are not a substitute for measured load against realistic peak traffic volumes, since day-to-day usage does not resemble a holiday traffic surge.
• D. Reacting during the event itself means any capacity problem is discovered while real customers are trying to check out, which is exactly the outcome Cymbal Retail wants to avoid by testing ahead of time.

Correct answer: A — Configure a Cloud Deploy delivery pipeline with a canary deployment strategy and Cloud Monitoring-based verification so traffic shifts gradually and an unhealthy release rolls back automatically.

• A. Cloud Deploy's canary strategy shifts a configurable percentage of traffic to the new revision in stages and can be paired with automated verification against Cloud Monitoring metrics, triggering a rollback if error rate or latency thresholds are breached, without custom rollout logic.
• B. A default rolling update replaces pods based on readiness rather than shifting a controlled percentage of live traffic, and it has no built-in automated rollback tied to error-rate or latency thresholds, so a bad release can still reach most users.
• C. Standing up a parallel cluster and cutting DNS over manually is an all-or-nothing switch rather than a gradual, percentage-based traffic shift, and DNS changes propagate on their own timeline, which does not give the fine-grained control the team wants.
• D. Pushing a tagged image to Artifact Registry only makes the new version available to be deployed; it has no effect on live traffic routing and does nothing to gradually shift users or trigger a rollback.

Correct answer: A — An Apigee API management layer in front of the internal microservices, exposing a stable proxy interface to partners while decoupling it from internal implementation changes.

• A. An Apigee layer in front of the internal microservices gives partners a stable, versioned proxy interface while the underlying implementation can change freely behind it, and it provides a single place to apply consistent authentication and rate-limiting policy across every partner-facing endpoint.
• B. Giving partner systems direct network access to each internal microservice's private IP ties every partner integration to the current internal implementation and topology, so any internal refactor would directly break external partners.
• C. A single shared credential for every partner cannot distinguish which partner made a given call, which makes it impossible to apply per-partner rate limits or to revoke one partner's access without affecting all the others.
• D. A nightly data export replaces real-time API access with a stale batch file, which does not meet the goal of exposing live functionality as a versioned API and does nothing to enforce authentication or rate limiting per partner.

Correct answer: A — Infrastructure Manager, which runs your Terraform blueprint as a managed service, handling state storage, execution, previews, and audit logging.

• A. Infrastructure Manager takes an existing Terraform root module as a blueprint and runs it as a managed service, storing state, generating previews before apply, and logging every deployment action for audit purposes.
• B. Infrastructure Manager consumes standard Terraform configuration written in HashiCorp Configuration Language directly; it does not require rewriting configurations into a different syntax.
• C. Infrastructure Manager deploys whatever resources a Terraform blueprint defines, regardless of whether they were originally created through the console or an earlier `terraform apply`, as long as state is imported correctly.
• D. Infrastructure Manager actually executes the deployment and manages its state; cost estimation is not its core function, and it does far more than produce a price estimate.

Correct answer: A — The Cloud SDK is the installable package that bundles `gcloud`, `gsutil`, and `bq` together, along with the libraries and dependencies they share.

• A. The Cloud SDK installer bundles `gcloud`, `gsutil`, and `bq` along with their shared client libraries, giving a single installation path for all three command-line tools.
• B. All three tools are first-party Google-maintained components distributed together as part of the same SDK, not independent third-party projects with separate installers.
• C. `gsutil` and `bq` are included in the same Cloud SDK installation as `gcloud`, rather than requiring separate installs from unrelated repositories.
• D. The Cloud SDK remains the active distribution mechanism for these tools; `gcloud storage` is a newer command group for Cloud Storage operations within `gcloud`, not a replacement for the entire SDK or for `bq`.

Correct answer: A — Conduct a blameless postmortem that captures the incident timeline, root cause, and contributing factors, and track the resulting action items to completion.

• A. A blameless postmortem that records the timeline, root cause, and contributing factors, with tracked action items, is the operational excellence practice for turning an incident into concrete preventive work without singling out individuals.
• B. A private summary written by only the paged engineer and sent to a manager assigns the review to one individual and keeps the findings out of shared team knowledge, which undermines a blameless, organization-wide review.
• C. Reviewing only outages that cross a fixed duration threshold means shorter but still preventable incidents never get analyzed, so recurring risks in those shorter incidents go unaddressed.
• D. Delaying the review to a quarterly cadence separates the analysis from the incident by months, by which point details of the timeline and contributing factors are harder to reconstruct accurately.

Correct answers: A, B — Create an alerting policy on the Pub/Sub subscription's oldest unacknowledged message age that only fires once the age sustains above a threshold for several consecutive minutes, filtering out transient backlog spikes that clear on their own.; Define an SLO for the predictive-maintenance dashboards based on end-to-end data freshness, and configure a burn-rate alert that pages engineers only when the freshness SLI is trending toward breaching that SLO within the error budget window.

• A. Requiring the oldest unacknowledged message age to sustain above a threshold for several minutes before firing filters out normal, self-resolving backlog fluctuations while still catching a genuinely stuck subscription.
• B. An SLO on end-to-end data freshness with a burn-rate alert ties paging directly to whether the business-critical dashboards are actually at risk of going stale, which is the symptom that matters rather than an intermediate pipeline metric.
• C. Paging on any nonzero backlog treats every routine, momentary queuing event as an incident, which will page the team constantly for conditions that resolve on their own and is exactly the alert fatigue the team wants to avoid.
• D. Worker CPU utilization is only one stage of a multi-stage pipeline and does not by itself capture failures at the Pub/Sub ingestion point or the BigQuery write step, so it is an incomplete proxy for overall pipeline health.
• E. A once-daily manual check leaves the team blind to problems for up to a full day, which is too slow to catch an ingestion failure before the predictive-maintenance dashboards have already gone stale for customers.
• F. INFO-level logs represent normal operation, so paging on every such entry generates a continuous stream of unnecessary pages for expected activity rather than surfacing genuine anomalies.

Correct answers: A, C — Configure the production target in the delivery pipeline to require approval, so the rollout pauses until an authorized user approves it before deploying.; Grant the reviewing engineer an IAM role that includes the rollout-approval permission, since approval authority is controlled through IAM policy rather than target configuration alone.

• A. Marking the production target as requiring approval causes its rollout to pause in an awaiting-approval state until an authorized user approves or rejects it, which is exactly the sign-off gate the operations team wants. Cloud Deploy generates approval-related Pub/Sub notifications so the reviewer can be alerted when action is needed.
• B. A target without a required-approval setting advances automatically once the previous rollout succeeds, so leaving staging unconfigured this way lets it proceed without manual intervention. This matches the requirement that only production needs sign-off.
• C. Requiring approval on a target is not sufficient by itself; the specific engineer must also hold an IAM role or permission that grants rollout-approval rights, since Cloud Deploy authorizes the approve action through IAM. Configuring the target alone would leave no one able to actually approve the pending rollout.
• D. A canary strategy phases traffic percentages and can include verification jobs, but a 100% initial phase does not by itself create a manual, named-approver sign-off gate independent of IAM permissions. Pausing for verification is a different mechanism than the explicit approval workflow requested here.
• E. Cloud Audit Logs record who took which action against a resource for compliance and forensic review, but enabling logging does not insert an approval requirement into a rollout. A target must be explicitly configured to require approval for that gate to exist.

Correct answer: A — To identify the contributing factors and systemic gaps behind an incident and produce concrete follow-up actions, without assigning individual fault to the engineers involved.

• A. A blameless postmortem focuses on the systemic and process factors that allowed an incident to happen, producing action items that reduce the chance of recurrence, rather than pointing at an individual.
• B. Assigning individual fault is the opposite of the blameless approach; naming a specific engineer discourages honest reporting in future incidents and is not the postmortem's purpose.
• C. Financial cost accounting may sometimes accompany incident follow-up, but it is not the primary purpose of a postmortem, which is centered on understanding and preventing the technical and process failure.
• D. Postmortems are meant to be retained as institutional knowledge that informs future reliability work, not discarded once the immediate fix is in place.

Correct answer: A — Deploy a distributed load-testing cluster on GKE running an open-source tool such as Locust across many worker pods to generate concurrent simulated player traffic against staging, then tear the cluster down after the test.

• A. A distributed load-testing cluster on GKE can generate realistic concurrent traffic that mirrors expected player load, letting the SRE team observe Cloud Spanner and Memorystore behavior under stress and surface bottlenecks before launch. Running the worker pods temporarily on GKE and deleting them afterward keeps the exercise cost-controlled, which is exactly what the scenario asks for.
• B. Uptime checks confirm an endpoint is reachable and record baseline latency under whatever traffic is already occurring, but they do not generate the concurrent load needed to reveal how the system behaves at 500,000 concurrent players. Relying on them alone leaves capacity and bottleneck questions completely unanswered before launch.
• C. Raising Cloud Spanner processing units increases available compute capacity, but capacity alone does not prove the rest of the stack, including GKE autoscaling, Memorystore, and application logic, behaves correctly under realistic concurrent load. Sizing decisions without an actual load test amount to an untested assumption about launch readiness.
• D. Enabling Cloud CDN can reduce origin traffic for cacheable content, but a multiplayer game's real-time session and state APIs are largely non-cacheable, so a drop in origin requests says little about backend concurrency handling. This does not substitute for actually generating and measuring peak simulated load.

Correct answer: A — Configure a Cloud Deploy pipeline with a canary strategy that routes a small, configurable share of matchmaking traffic to the new version, monitors error and latency metrics, and promotes or rolls back automatically.

• A. A canary strategy exposes only a small, controllable slice of players to the new matchmaking version while metric-based automation watches error rate and latency, which limits the blast radius exactly as required. Because the pipeline can halt or reverse the rollout automatically once thresholds are crossed, recovery happens in minutes rather than waiting on a person to notice.
• B. Redirecting all traffic to the new cluster at once exposes every player to the new algorithm simultaneously, which is the opposite of limiting impact to a small fraction of players. Relying on manual redirection back to the original cluster also depends on someone noticing and acting quickly, which is slower than an automated canary rollback.
• C. Deploying directly to every player with no staged rollout means a flawed algorithm affects the entire player base immediately, with no way to limit exposure beforehand. There is also no automated mechanism described here to detect a problem or reverse it quickly.
• D. A player-controlled toggle depends on players opting in and reporting bugs themselves, which is slow, unpredictable, and does not guarantee only a small fraction of players are exposed at any given time. Waiting for bug reports is also far slower than automated metric-based detection and rollback.