70 questions / 10 random questions
Random questions, instant feedback, and review for missed questions.
An operator needs read-only access to one bucket. What is the appropriate IAM approach?
Answer: Grant a reader role at the needed scope
Grant only the needed permissions at the needed scope. Broad basic roles or public access are not substitutes.
A user still has access after a project grant is removed, while a parent folder grants access. What should you check?
Answer: Check inherited grants from ancestors
Ancestor allow grants are inherited. Inspect effective access rather than only direct project bindings.
How can external CI access Google Cloud without storing a long-lived service account key?
Answer: Use Workload Identity Federation for CI
Federate a trusted external identity for short-lived access. Restrict issuer, workload conditions, and IAM privileges.
Which statement correctly describes Google Cloud VPC and subnet scope?
Answer: VPCs are global while subnets are regional
A VPC is global and its subnets are regional. One VPC can contain subnets in multiple regions.
What is Public NAT appropriate for when VMs without external IPs need internet updates?
Answer: Provide outbound connectivity and return traffic
Public NAT supports outbound connections without external VM IPs, not arbitrary unsolicited inbound access. Check routes and firewall rules too.
Which service runs a containerized HTTP API without requiring you to operate a Kubernetes cluster?
Answer: Use Cloud Run
Cloud Run provides managed application execution. Configure authentication, limits, and downstream connectivity.
Which Cloud Run resource fits a nightly container task that aggregates files and exits?
Answer: Execute it as a Cloud Run job
Jobs execute tasks to completion. Add scheduling and design for safe retries.
Which service stores images and backup files as objects in buckets?
Answer: Use Cloud Storage
Cloud Storage is object storage. Choose location, access controls, and retention for the workload.
Which is a basic managed database candidate for an existing PostgreSQL business application?
Answer: Cloud SQL for PostgreSQL
Cloud SQL offers managed relational databases including PostgreSQL. Plan connectivity, permissions, availability, and recovery.
Which service is suited to SQL analytics over a large sales-history warehouse?
Answer: Use BigQuery
BigQuery supports analytics workloads. Distinguish warehouse scans from transactional row updates and manage access and scanned data.
Which service decouples order intake and processing through topics and subscriptions?
Answer: Use Pub/Sub here
Pub/Sub decouples publishers and subscribers. Design acknowledgements, redelivery, failure handling, and idempotent processing.
Where should an application store API keys with versioning and access controls rather than in source code?
Answer: Store them in Secret Manager
Secret Manager versions secret values and controls access through IAM. Limit access and plan rotation.
What should be configured in Cloud Monitoring to notify on-call staff when API error rate exceeds a threshold?
Answer: An alerting policy with conditions and channels
Configure alert conditions and notification channels, then test delivery and response procedures. Dashboards alone do not notify responders.
What happens at the threshold of an alerts-only Cloud Billing budget?
Answer: It alerts; it does not guarantee spending stops
Alerts-only budgets report spending. Design separate supported controls and operations if enforcement is required.
Which Google Cloud service stores CI-built container images for runtimes to pull?
Answer: Artifact Registry
Artifact Registry stores images and packages. Separate push and pull privileges and identify released versions.
Which GKE mode reduces node-management work while retaining Kubernetes?
Answer: Use GKE Autopilot
Autopilot manages much of the infrastructure. Users still design workloads, permissions, resource requests, and compatibility.
Which Compute Engine feature manages templated VM fleets with autohealing and scaling?
Answer: Use a managed instance group
MIGs manage VMs from templates. Configure health checks, autoscaling, and placement for the workload.
How should uploaded images persist beyond a Cloud Run instance's lifetime?
Answer: Persist it externally, for example in Cloud Storage
Writable local instance storage is not durable. Persist important data externally and verify successful writes and permissions.
Which statement correctly relates IAM principals, roles, and resources?
Answer: Grant a role to a principal on a resource
A principal is an identity, a role groups permissions, and a resource is the target.
What is a basic design for separating development and production access and blast radius?
Answer: Design separate projects and access for environments
Separate projects and design IAM, connectivity, data, and deployment access. Project separation alone does not remove shared connections or inherited grants.
A new Cloud Run version should first serve only part of production traffic. Which approach supports a gradual rollout?
Answer: Configure traffic percentages for old and new revisions
Cloud Run can split traffic by revision. Start with a small share, observe errors and latency, and increase it when healthy. Check database compatibility before relying on rollback.
Cloud SQL for PostgreSQL runs in one zone. Which configuration enables automatic failover within the same region after a zonal failure?
Answer: Use HA with a standby instance in another zone
Regional HA uses a standby in another zone to support automatic failover. Applications must handle interrupted connections and reconnect during a failover.
An incorrect DELETE was committed in Cloud SQL for PostgreSQL. PITR is enabled and the preceding timestamp is recoverable. Which recovery approach is appropriate?
Answer: Restore to a new instance at the earlier time and validate it
PITR restores a selected time to a new instance. Validate the recovered data before deciding how to copy it back or switch connections, and account for legitimate writes made after that time.
A Pub/Sub consumer using standard delivery stops after inserting an order but before acknowledging the message. How should it prevent a duplicate insert on redelivery?
Answer: Enforce order ID uniqueness in the database during processing
Standard delivery can repeat messages. Use a business identifier such as an order ID with database uniqueness and consistent duplicate handling. Acknowledge after successful processing and recognize already completed work on redelivery.
Several workers update the same Cloud Storage object. An overwrite should fail if another worker changed it since it was read. Which approach is appropriate?
Answer: Require the generation read earlier to match on the write
Use the previously read generation in ifGenerationMatch. A mismatch fails with HTTP 412. Reload the current content and resolve the conflict rather than blindly overwriting it.
A private Cloud Storage file will be shared briefly with a partner using a signed URL. Which handling is appropriate?
Answer: Keep expiry short because anyone holding the URL can use it
A signed URL grants its holder the specified action for a limited time. It does not automatically verify the intended recipient or enforce single use. Limit scope and expiry and prevent disclosure.
A BigQuery sales table is partitioned by a date column. How should a query aggregate only last month's data while pruning the scan?
Answer: Filter the partitioning date column to last month's date range
A suitable filter on the partitioning column allows partition pruning. Use a range such as the start of the month through, but excluding, the next month and check scan estimates or execution statistics.
IAM permissions were changed in a production project. Which logs should be checked first to identify the actor and time?
Answer: Inspect Admin Activity entries in Cloud Audit Logs
Admin Activity audit logs record administrative changes such as IAM permission updates. Inspect the resource, method, authenticated principal, and timestamp, then correlate with deployment and approval records.
A VM with no external IP or NAT must reach Cloud Storage. DNS, routes, and firewall rules meet the requirements. Which subnet feature should be enabled?
Answer: Enable Private Google Access on the subnet
Private Google Access enables VMs without external IP addresses to reach supported Google APIs and services. It is configured per subnet. Connectivity does not grant data access; IAM authorization is still required.
Cloud Tasks invokes an HTTP handler. Which queue settings should be tuned to constrain dispatch rate and concurrent requests so the handler is not overloaded?
Answer: Configure queue dispatch rate and concurrent dispatch limits
Queue rate and concurrency limits help control handler load. Account for bursts and retries when sizing them. Handlers should also tolerate repeated execution safely.
Cloud Run service A calls IAM-protected service B over a working network path. Which authentication and permission setup is appropriate?
Answer: Grant A invoker access and send an ID token intended for B
Grant A's service account Cloud Run Invoker on B. Send a Google-signed ID token with B's service URL or an accepted custom audience. Both authorization and authentication are required.
Two applications in one GKE cluster use different buckets. How should access be separated per application without distributing long-lived keys?
Answer: Use GKE identity federation and grant each workload scoped access
Workload Identity Federation for GKE supports IAM access scoped to workload identities associated with Kubernetes service accounts. Grant only the required bucket operations rather than relying on broad node identity access or long-lived keys.
A web application sits behind an external Application Load Balancer. Which option inspects incoming HTTP attacks such as SQL injection?
Answer: Apply Cloud Armor web application firewall rules
Cloud Armor WAF rules inspect HTTP requests through supported load balancers. Check attachment and rule behavior, including false positives. Application defenses such as parameterized queries remain necessary.
Teams in one organization have separate application projects. Which design centralizes networking while allowing teams to use approved subnets?
Answer: Use Shared VPC from a centrally managed host project
Shared VPC places shared networking in a host project while eligible resources remain in service projects. Scope subnet-use permissions and separate network administration from application administration.
Last month's logs are stored in Cloud Logging. A sink to Cloud Storage was created today. What should be considered when also copying the older logs?
Answer: Check a separate copying mechanism for the stored older logs
Sinks do not retroactively route entries received before creation. Use a separate mechanism such as copying stored log-bucket data to Cloud Storage, checking the time range, retained data, and destination access.
Temporary Cloud Storage objects should be deleted automatically after 30 days. No exact deletion time is required. Which approach fits?
Answer: Configure lifecycle deletion based on the object's age
Object Lifecycle Management supports age-based deletion. Actions are asynchronous rather than guaranteed at the exact threshold. Check retention policies, holds, and soft delete behavior too.
A Cloud Run service receives a secret as an environment variable. Instances of the same revision must use the same secret version. Which configuration fits?
Answer: Pin the secret reference to a specific numbered version
Secret environment variables are resolved at instance startup. Pin a numbered version for consistency across startup times, then validate a revision referencing the new version before rollout.
BigQuery uses on-demand pricing. A query should be rejected before execution if its estimated billable bytes exceed a limit. Which setting should be used?
Answer: Set the maximum bytes billed limit on the query job
Maximum bytes billed limits billable bytes for a query. If its pre-execution estimate exceeds the limit, the query fails without a charge. It is not an overall monthly spending cap.
A restartable nightly batch runs on Spot VMs. Which design reduces lost progress if a VM is interrupted?
Answer: Periodically persist progress externally and record a restart point
Spot VMs can be reclaimed. Periodically save checkpoints to durable external storage and resume from them. Do not depend solely on shutdown notice, and handle replayed work safely.
A Firestore transaction function calls an external email API. Conflicts cause duplicate notifications. Which redesign is appropriate?
Answer: Record notification intent in the database and send with deduplication
Firestore may rerun a transaction function after conflicts. External email is not rolled back. Record notification intent transactionally, then use a separate sender with stable identifiers and supported idempotency controls.
A symmetric Cloud KMS key was rotated. What is true of data the application previously encrypted with that key?
Answer: Existing ciphertext is not automatically re-encrypted
Rotation creates a new key version but does not automatically re-encrypt existing data. Previously encrypted data still depends on its original version. Check dependencies, including backups, before destroying old versions.
Confidential data is stored in Cloud Storage. In addition to IAM, which option controls data movement across a perimeter around supported Google Cloud services?
Answer: Configure a service perimeter with VPC Service Controls
VPC Service Controls provides perimeter controls for supported services, including cross-perimeter access and data movement. It complements IAM. Review supported services, ingress, egress, and exceptions.
An organization policy now restricts resource locations. What happens to existing resources outside the allowed locations?
Answer: Review existing resources and plan any required migration separately
The location constraint restricts creation of supported resources; it does not discover or remediate existing violations automatically. Check service coverage and separately inventory and migrate existing deployments.
Cloud SQL hits its connection limit after Cloud Run scales out. Each instance has its own connection pool. Which design should be reviewed?
Answer: Budget total connections from instance counts and per-instance pools
Per-instance pools multiply as the service scales. Budget connections across instances and other clients, leave operational headroom, and tune pool sizes and scaling. Configure bounded waits and retry delays.
A Cloud Run application initializes slowly. Which probe setup avoids premature restarts during initialization while detecting unrecoverable hangs afterward?
Answer: Wait for initialization with startup probes and detect hangs with liveness probes
Startup probes defer liveness checks until initialization succeeds. Use liveness to detect unrecoverable instance failures. Avoid treating every temporary dependency failure as a restart condition.
Repeatedly failing Pub/Sub messages are forwarded to a dead-letter topic. What is true of the configured maximum delivery attempts?
Answer: The count is approximate and forwarding permissions must be configured
The attempt limit is approximate and forwarding is best effort. Configure the Pub/Sub service agent's required publishing and subscription permissions, plus dead-letter consumption, monitoring, and controlled reprocessing.
An operator needs SSH access to a Compute Engine VM with no external IP. Which configuration appropriately uses IAP?
Answer: Configure an IAP tunnel, required roles, and firewall access
IAP TCP forwarding permits SSH without a VM external IP. Configure tunnel authorization, firewall access from IAP to SSH, and VM login permissions such as OS Login. Tunnel authorization does not replace OS authentication.
Personal account pages behind Cloud CDN contain user-specific content. Which design prevents sharing those responses across users?
Answer: Exclude personal pages from shared caching with suitable configuration
Exclude personalized responses from shared caching. Use a mode that respects private/no-store or bypass CDN for those routes. FORCE_CACHE_ALL overrides origin directives, so headers alone are insufficient in that mode.
Another department should query aggregate results from a BigQuery customer table without personal details or direct source-table access. Which approach fits?
Answer: Share an authorized view returning only the required aggregates
An authorized view can expose query results without direct source-data access. Control its SQL and who may modify it, and assess whether the aggregates themselves could reveal individuals.
A Cloud Scheduler job should start at the same UTC time each day. Which configuration avoids daylight-saving clock gaps and repeated times?
Answer: Set the schedule time zone to UTC and specify the desired time
Scheduler evaluates schedules in the configured time zone. UTC avoids daylight-saving gaps and repeated wall-clock times, but does not eliminate delivery delays or duplicate execution from retries.
A Dataflow pipeline counts device actions in five-minute windows based on when they occurred. Records can arrive out of order. Which design fits?
Answer: Window by event time and define how late records affect results
Use event-time windows for occurrence-based aggregation. Watermarks estimate progress, not a guarantee that no later data will arrive. Define allowed lateness, triggers, and how downstream results are updated.
A business database needs multi-region deployment, SQL transactions with strong consistency, and horizontal scaling. Which service is a candidate?
Answer: Configure a distributed database using Spanner
Spanner combines horizontal scaling and strongly consistent transactions, with multi-region configurations available. Evaluate topology, latency, cost, schema, and queries; it is not necessarily a drop-in migration.
Cloud Build validates external pull requests. Production secrets are needed only during deployment. Which permission design is appropriate?
Answer: Separate validation and deployment identities; restrict secrets to deployment
Build steps use their execution identity's permissions. Separate untrusted validation from production deployment identities and triggers. Restrict secrets to the necessary stage and protect production configuration from untrusted changes.
Old Artifact Registry images should be cleaned up automatically, but production rollback versions must remain. How should cleanup be introduced?
Answer: Define delete and keep policies, then inspect the dry-run candidates
Define keep policies for rollback artifacts alongside delete policies. Artifacts matching both are kept. Inspect dry-run results before enabling deletion and verify that needed releases remain protected.
A Cloud DNS private zone for example.com is authorized for a VPC. Only the public zone has a www record. What does the VPC's standard resolver return for www.example.com?
Answer: Return NXDOMAIN because the matching private zone lacks the record
When the matching authorized private zone is selected, an absent record yields NXDOMAIN, not public fallback. Plan required internal records and avoid unintentionally shadowing existing names with overly broad private zones.
A Cloud SQL for PostgreSQL primary region fails. An asynchronously replicated cross-region read replica will be promoted. What must the recovery plan consider?
Answer: Assess unreplicated data loss and plan application connection switching
Asynchronous replication can leave recent committed writes unreplicated. Evaluate lag and acceptable loss, then switch application connections after promotion. Keep a single authoritative writer when the old primary returns.
A Cloud Storage bucket uses both IAM and object ACLs. How should access control be consolidated into IAM?
Answer: Review ACL dependencies, migrate required grants to IAM, and enable uniform access
Uniform bucket-level access disables ACLs and makes IAM the access-control mechanism. Migrate required ACL-only grants first and check applications that perform ACL operations.
Many event documents are written to Firestore. Which document ID design avoids concentrated writes caused by sequential IDs?
Answer: Use scattered document IDs such as Firestore auto-generated IDs
High-rate writes to sequential document IDs can create hotspots. Scatter IDs, for example with auto-generated IDs. Separately assess sequential indexed fields and single-document contention; ID changes alone do not guarantee performance.
Cloud Monitoring shows an SLO error-budget burn rate above one. If that measured rate persists, which interpretation is correct?
Answer: The error budget is being consumed faster than the sustainable rate
Burn rate normalizes error-budget consumption. If a rate above one persists across a compliance period, the SLO will be missed. A brief spike alone does not establish period-wide failure; choose alert windows and thresholds together.
Several Cloud Run APIs must run in sequence with result-based branching, tracked state, and retries. Which service can orchestrate the overall process?
Answer: Define API calls and branching steps using Workflows
Workflows orchestrates service calls, branches, waits, and retries. Configure permissions and retry conditions. It does not turn multiple APIs into one database transaction; design idempotency and compensation where needed.
After Cloud Run concurrency was increased, results from different users became mixed. Per-request working data is stored in global variables. Which redesign is appropriate?
Answer: Isolate per-request data and verify safe concurrent execution
Concurrent requests within one instance can overwrite shared mutable state. Isolate request-specific state and synchronize truly shared resources. Concurrency of one can be a mitigation, but review state management in the code.
A local PC cannot connect to a private-IP-only Cloud SQL instance even with Cloud SQL Auth Proxy running. What should be checked first?
Answer: Whether the proxy host has a network path to the database
The Auth Proxy secures connections but does not create a network path. Its host must be able to reach the private address. Also verify API enablement, IAM permissions, and database authentication.
A large file is uploaded to Cloud Storage over an unreliable connection. How can it resume after interruption without always restarting from byte zero?
Answer: Use a resumable upload and continue after checking persisted bytes
Resumable uploads maintain an upload session. After interruption, check the persisted range before continuing. Treat the session URI as a credential and keep it out of public logs and unintended sharing.
Pub/Sub publishes order updates, with each order's messages published in one region. Which setup enables ordered delivery per order?
Answer: Use the order ID as ordering key and enable subscription ordering
Use a shared ordering key for related messages and enable subscription ordering. Ordering follows service receipt order, not inferred business-event chronology. Consumers must still handle redelivery safely.
A GKE application has a PodDisruptionBudget. Does this guarantee its minimum Pod count remains available during a sudden node failure?
Answer: It constrains voluntary evictions but cannot prevent sudden failures
PDBs primarily constrain voluntary disruptions through the Eviction API. They cannot prevent hardware failures. Design replicas, placement, and spare capacity, and check how the selected GKE upgrade strategy handles disruption budgets.
A Google Cloud API call fails with a permission error. How should you investigate the IAM decision without granting unnecessary access?
Answer: Identify the actual caller, resource, and permission and troubleshoot the decision
Policy Troubleshooter evaluates IAM access for a principal, resource, and permission. Verify the caller actually used, not just the intended account. Rejections from controls outside IAM require separate investigation.
A BigQuery table is clustered by region, then customer ID, but most queries filter only customer ID. Which change should be evaluated to reduce data scanned?
Answer: Evaluate putting customer ID first using representative queries
Clustering column order affects block pruning. Leading-column filters generally align better with the layout, so evaluate column order against representative workloads. Result ordering with ORDER BY is a separate concern.
A Cloud Billing export row contains multiple credits. After UNNEST, summing cost duplicates the charge. Which aggregation avoids this error?
Answer: Aggregate credits per original row and add each cost only once
Expanding credits repeats the original cost on each resulting row. Sum credit amounts within each original row, use zero for an empty array, and add cost once. Equal costs on distinct billing rows are still separate charges.
A database on Compute Engine is writing across several disks. What approach supports an application-consistent backup for recovery?
Answer: Coordinate database quiescing and capture all required disks consistently
Disk snapshots alone do not automatically guarantee application consistency. Follow supported database backup procedures, coordinating quiescing or flushing as appropriate. Verify multi-disk coordination and test recovery.
Cloud Trace shows downstream service calls as separate traces. What should be checked to follow the end-to-end request?
Answer: Whether trace context is propagated and child spans are created
Propagate the trace ID and parent context across service calls, for example through traceparent over HTTP. Check both outgoing and incoming instrumentation. Exporting spans separately does not automatically reconstruct missing parent relationships.