8 Google Professional Cloud Architect Practice Questions That Mirror the Real Exam
Here are 8 multiple-choice questions designed to mirror the style, difficulty, and domain coverage of the Google Professional Cloud Architect exam. Each question tests your ability to apply architectural principles to real-world scenarios, focusing on trade-offs and Google Cloud best practices.
Intro: These questions cover key domains including hybrid networking, data processing, high availability, security, and migration planning. Read each scenario carefully, as the "best" answer often depends on specific constraints like cost, latency, or compliance. You can explore this further in GCP Professional Cloud Architect Difficulty: Why Case Studies Are the Real Boss.
Question 1
Your company is migrating a legacy on-premises application to Google Cloud. The application requires a static IP address and low-latency access to on-premises resources, but you cannot configure a Cloud VPN tunnel due to firewall restrictions in the on-premises data center. Which networking solution should you use to connect the environments?
A. Dedicated Interconnect
B. Partner Interconnect
C. Cloud VPN with dynamic routing
D. VPC Network Peering
Answer: A
Explanation: Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google's network, bypassing the public internet and not requiring a VPN tunnel. Partner Interconnect is used when you cannot meet Google in a colocation facility. Cloud VPN requires firewall changes to establish the tunnel, and VPC Peering does not support on-premises connectivity.
Question 2
You are designing a data processing pipeline that ingests millions of small JSON files from a third-party API into Cloud Storage. You need to transform the data and load it into BigQuery for analysis. The pipeline should be serverless and minimize operational overhead. Which service should you use to orchestrate the transformation and loading steps?
A. Cloud Dataflow with a Pub/Sub trigger
B. Cloud Composer with a Cloud Function
C. Cloud Functions with an Eventarc trigger
D. Cloud Run with a Pub/Sub subscription
Answer: C
Explanation: Cloud Functions triggered by Eventarc (specifically Cloud Storage events) provides a simple, serverless, and event-driven way to process each file as it lands. Dataflow is better for large-scale, stateful streaming or batch processing, not for small per-file transformations. Cloud Composer adds unnecessary orchestration overhead for a simple two-step pipeline. Cloud Run is suitable but requires a running service, whereas Cloud Functions is the classic lightweight, event-driven choice for this scenario.
Question 3
Your organization requires that all Compute Engine instances in a project be launched with a specific set of labels and a custom boot disk. You need to enforce this policy centrally without requiring developers to manually configure each instance. Which two features should you combine to achieve this?
A. Organization Policy and Cloud Deployment Manager
B. Instance Templates and Managed Instance Groups
C. Service Account and IAM Roles
D. Cloud Asset Inventory and Cloud Audit Logs For background on this area, read 10 Google Associate Cloud Engineer Practice Questions That Mirror the Real Exam.
Answer: B
Explanation: An Instance Template defines the machine type, boot disk, and labels for an instance. By requiring developers to use Managed Instance Groups (MIGs) based on a pre-approved template, you enforce the configuration. Organization Policy cannot set instance-level properties like labels or disks. Service Accounts and IAM control permissions, not instance configuration.
Question 4
You are migrating a stateful application to Google Kubernetes Engine (GKE). The application currently runs on a single VM and stores its state in a local MySQL database. You want to minimize changes to the application code while ensuring high availability. What is the most suitable migration strategy?
A. Refactor the application into microservices and deploy each with a Deployment.
B. Containerize the application and MySQL, and run MySQL in a StatefulSet with persistent volumes.
C. Use GKE with a StatefulSet for the application and a Cloud SQL instance for the database.
D. Lift-and-shift the VM to Compute Engine and use a regional persistent disk.
Answer: C
Explanation: This is the most modern approach, minimizing code changes while offloading the database management to a fully managed, highly available service (Cloud SQL). Running MySQL yourself in a StatefulSet (Option B) still requires you to manage failover and backups. Option A is a large refactoring effort. Option D does not provide high availability for the VM itself.
Question 5
Your company is deploying a global web application on Google Cloud. Users in Europe and Asia should be served by the nearest regional backend. You need to ensure that traffic is routed to the correct region based on the user's origin, and that failover occurs if an entire regional backend becomes unhealthy. Which load balancing configuration should you use?
A. Global external Application Load Balancer with URL maps
B. Global external Application Load Balancer with backend services and a health check
C. Regional internal TCP Proxy Load Balancer
D. Global external Application Load Balancer with a backend service configured for global external backend
Answer: B
Explanation: A Global external Application Load Balancer (ALB) is the correct choice for global traffic. By configuring multiple backend services (one per region) and attaching health checks, the ALB automatically routes users to the nearest healthy backend. URL maps are for routing based on path, not geography. An internal load balancer is for private traffic.
Question 6
Your security team requires that all data stored in Cloud Storage buckets be encrypted with a customer-managed key (CMEK) that is rotated every 30 days. You need to design a solution that automates the key rotation. What should you do?
A. Use Cloud KMS to create a key, and use Cloud Scheduler to call the cryptoKeys.rotate API every 30 days.
B. Use a Cloud Function that is triggered by a Pub/Sub topic to rotate the key. We recommend pairing this with How Hard Is Google Professional Cloud Architect, Really? An Honest Difficulty Rating.
C. Use Cloud KMS with a key rotation period set to 30 days.
D. Use Cloud HSM to generate a new key and manually update the bucket's IAM policy.
Answer: C
Explanation: Cloud KMS natively supports automatic key rotation. You can specify a rotation period (e.g., 30 days) when creating the key, and Cloud KMS will automatically generate a new primary version. Options A and B are unnecessary manual automation steps. Option D is incorrect; you don't update IAM to rotate keys.
Question 7
You are designing a disaster recovery plan for a critical application. The primary environment is in us-central1. The application uses Cloud Spanner. You need to ensure that the application can failover to a secondary region with zero downtime and no data loss. What is the correct configuration?
A. Export the Spanner database nightly and import it into a new instance in us-east1.
B. Configure a regional Cloud Spanner instance with 3 nodes.
C. Configure a multi-region Cloud Spanner instance configuration.
D. Use Cloud SQL for PostgreSQL with cross-region replication.
Answer: C
Explanation: Cloud Spanner's multi-region configurations are specifically designed for global, strongly consistent reads and writes with automatic failover. They provide synchronous replication across regions, ensuring zero data loss and near-zero downtime. Nightly exports (A) are for disaster recovery, not failover, and will incur data loss. A regional instance (B) is for high availability within one region, not across regions. Cloud SQL for PostgreSQL (D) offers asynchronous replication, which can lose data.
Question 8
Your organization is subject to strict compliance regulations that require you to maintain immutable audit logs for at least 7 years. Which two logging configurations should you implement to meet this requirement?
A. Enable Data Access audit logs and store them in Cloud Storage with a retention policy.
B. Route logs to BigQuery and set a table expiration of 7 years.
C. Enable VPC Flow Logs and export them to Cloud Pub/Sub.
D. Store logs in Cloud Logging and rely on the default 30-day retention.
Answer: A
Explanation: To ensure immutability, you must store logs in Cloud Storage with a bucket retention policy, which prevents deletion or modification. Enabling Data Access audit logs ensures you capture the required access data. BigQuery (B) does not offer immutable retention policies. VPC Flow Logs (C) are for network traffic, not all audit logs. The default 30-day retention (D) is far too short for compliance.
Closing: These questions represent the analytical depth required for the certification. Focus not just on knowing the services, but on understanding the architectural trade-offs between them (e.g., managed vs. unmanaged, regional vs. global, synchronous vs. asynchronous). Good luck with your preparation!
To build a week-by-week schedule that fits the time you have left, use the free Google Cloud Professional Cloud Architect study plan.
Simulate the full exam experience with Google Cloud Professional Cloud Architect practice exam questions that replicate the question format and timing.
If you are unsure which topics need more work, the free Google Cloud Professional Cloud Architect readiness check gives a quick check of your weak topics along with explanations.