GCP Professional Cloud Architect Practice Questions: Case Study Walkthroughs

These questions are designed to mirror the difficulty, ambiguity, and scenario-based nature of the Google Cloud Professional Cloud Architect exam. Focus on understanding why the correct answer is right and, more importantly, why the distractors are wrong, as this is key to passing.

Question 1

Your company is migrating a legacy monolithic application to Google Cloud. The application has a stateful session layer and uses a relational database. You need to refactor the application to run on Google Kubernetes Engine (GKE) with minimal code changes. You must ensure that the new architecture is highly available and can handle sudden spikes in traffic without manual intervention. What should you do? If this interests you, GCP Professional Cloud Architect Difficulty: Why Case Studies Are the Real Boss goes into more detail.

• A. Deploy the application as a single Deployment with a replica count of 3, use a ClusterIP Service, and configure a HorizontalPodAutoscaler.
• B. Deploy the application as a Deployment with a replica count of 3, use a LoadBalancer Service, and configure a HorizontalPodAutoscaler based on CPU utilization.
• C. Deploy the application as a StatefulSet with a replica count of 3, use a Headless Service, and configure a PodDisruptionBudget.
• D. Deploy the application as a StatefulSet with a replica count of 3, use a LoadBalancer Service, and configure a HorizontalPodAutoscaler based on custom metrics.

Answer: D

Explanation: The application is stateful, so a StatefulSet is required to maintain stable network identities and persistent storage for the session layer. A LoadBalancer Service distributes traffic to the pods, and the HorizontalPodAutoscaler (HPA) provides automatic scaling based on load. Option B is wrong because Deployments are for stateless applications. Option C is wrong because a Headless Service does not provide a stable external IP for load balancing, and a PodDisruptionBudget does not handle traffic spikes.

Question 2

Your organization has a strict security policy requiring that all Compute Engine VMs have the "shielded VM" feature enabled. You need to ensure that any VM created in the organization, either by users or by service accounts, automatically complies with this policy. What should you do?

• A. Use Organization Policy to define a constraint that requires compute.instances.shieldedVm to be true.
• B. Use a Shared VPC and attach a firewall rule that only allows traffic to shielded VMs.
• C. Create a custom image with Shielded VM settings baked in and document that all users must use it.
• D. Use Cloud Asset Inventory to run a daily report and manually remediate any non-compliant VMs.

Answer: A

Explanation: Organization Policy allows you to set constraints at the organization, folder, or project level. The compute.instances.shieldedVm constraint is a boolean constraint that can be set to true to require all new VMs to be shielded, enforcing it at the API level. Options B, C, and D are incorrect because they are either reactive, require manual adherence, or do not enforce the policy at creation time.

Question 3

You are designing a data ingestion pipeline for a global IoT platform. Devices send millions of small, time-stamped messages every minute. You need to buffer this data for a few minutes before processing it in batches with Cloud Dataflow. You want to minimize cost and operational overhead. Which service should you use for the buffering layer?

• A. Cloud Pub/Sub
• B. Cloud Bigtable
• C. Cloud Storage
• D. Cloud SQL

Answer: A

Explanation: Cloud Pub/Sub is a scalable, managed message queue designed for high-throughput ingestion of event data. It allows Dataflow to pull data in batches and acts as a buffer to decouple producers from consumers. Cloud Bigtable and Cloud Storage are databases, not message queues, and would require more overhead to manage the buffering logic. Cloud SQL is not designed for this scale of streaming data.

Question 4

You are migrating a critical application to Compute Engine. You need to ensure that the application can recover from a zonal failure with an RTO of less than 15 minutes and an RPO of zero. The application writes data to a persistent disk. What is the most cost-effective way to meet these requirements?

• A. Use a regional persistent disk and keep a snapshot taken every hour.
• B. Use a standard persistent disk and replicate the VM to another zone using a custom script.
• C. Use a regional persistent disk and configure the application to run on a managed instance group in a different zone.
• D. Use a standard persistent disk and enable asynchronous replication to a disk in another zone.

Answer: C If you're preparing for this exam, GCP Professional Cloud Architect Passing Score: What to Aim For is essential reading.

Explanation: A regional persistent disk provides synchronous replication of data across two zones, giving an RPO of zero. A managed instance group (MIG) with a health check can automatically detect the zonal failure and recreate the VM in the other zone, meeting the RTO requirement. Option A has an RPO of up to an hour. Option B is a manual process that is slow and error-prone. Option D is not a native feature of standard persistent disks.

Question 5

Your company is building a microservices application on Google Kubernetes Engine (GKE). You need to enforce strict network policies so that services can only communicate with specific other services. For example, the frontend service can only talk to the backend service, and the backend service can only talk to the database service. How should you configure the network?

• A. Use GKE Network Policy (Calico) with ingress and egress rules based on pod labels.
• B. Create separate VPCs for each service and use VPC peering.
• C. Use a single VPC and create a firewall rule for each service's port.
• D. Use Istio service mesh with a VirtualService for each service.

Answer: A

Explanation: GKE Network Policy provides Kubernetes-native network security, allowing you to define fine-grained ingress and egress rules based on pod labels and namespaces. This is the standard way to implement micro-segmentation in GKE. Option B is too complex and doesn't scale. Option C is incorrect because firewall rules in a VPC are IP-based, not label-based, and are not the right tool for pod-level security. Option D (Istio) is for traffic management and security (like mTLS), but Network Policy is the core mechanism for enforcing L3/L4 access control.

Question 6

Your company has a VPC with a subnet in us-central1. You have a Cloud Function in us-central1 that needs to access a Cloud SQL instance in the same region. You want to connect to Cloud SQL privately using an internal IP address, without exposing the database to the public internet. What must you do?

• A. Create a Cloud SQL instance with a public IP and configure a firewall rule to allow traffic from the Cloud Function's IP.
• B. Create a Cloud SQL instance with a private IP and configure the VPC connector for the Cloud Function to use the same VPC.
• C. Create a Cloud SQL instance with a private IP and use Cloud VPN to connect the Cloud Function to the VPC.
• D. Create a Cloud SQL instance with a private IP and enable Cloud SQL Auth Proxy on the Cloud Function.

Answer: B

Explanation: To access a private IP Cloud SQL instance, your resource must be in the same VPC. A Cloud Function needs a Serverless VPC Connector to access resources in a VPC. This allows the function to communicate with the Cloud SQL instance over the private network. Option A exposes the database to the public internet. Option C uses VPN which is unnecessary for resources in the same region. Option D (Cloud SQL Auth Proxy) is used for connecting from external resources or when you don't want to manage IP addresses, but it still requires network connectivity to the instance's IP.

Question 7

You are designing a multi-region disaster recovery strategy for a web application. You are using Cloud SQL for PostgreSQL for your primary database in us-central1. You need to ensure that you can fail over to a secondary region in the event of a regional outage. What is the simplest and most reliable approach?

• A. Use Cloud SQL's built-in cross-region replica feature to create a read replica in europe-west1, and promote it during a disaster.
• B. Export the Cloud SQL database to Cloud Storage on a nightly basis and import it into a new instance in the other region.
• C. Use Cloud SQL's built-in high availability (HA) configuration to create a standby instance in a different zone within us-central1.
• D. Set up a continuous data migration pipeline using Dataflow to copy changes to a Cloud SQL instance in another region.

Answer: A

Explanation: Cloud SQL supports cross-region replication for PostgreSQL, allowing you to create a read replica in a different region. In a disaster, you can promote this replica to a primary instance, providing a reliable and relatively simple DR mechanism. Option B has an RPO of up to 24 hours and a complex recovery process. Option C only protects against a zonal failure, not a regional one. Option D is overly complex and bespoke compared to the native replication feature. This topic pairs well with GCP Professional Cloud Architect 12-Week Study Plan.

Question 8

Your team is using Cloud Build to build a Docker image from a source repository. The build process needs to access a private artifact repository in Artifact Registry. You want to ensure that the build can authenticate to the registry without embedding credentials in the source code or build config. What is the recommended approach?

• A. Use a Cloud Build trigger and specify the credentials in the substitutions field.
• B. Store the service account key in Secret Manager and access it during the build step.
• C. Configure the Cloud Build service account with the Artifact Registry Writer role, and use docker login with gcloud auth configure-docker in the build step.
• D. Use a custom build step that runs gcloud auth login with a user account.

Answer: C

Explanation: Cloud Build uses a service account to run builds. By granting that service account the appropriate IAM role (e.g., roles/artifactregistry.writer) on the repository, the build can automatically authenticate to Artifact Registry. The standard gcloud auth configure-docker command in the build step uses the service account's credentials. Options A and B are insecure and involve storing secrets in plain text or requiring complex setup. Option D is not possible in a non-interactive build environment.

Question 9

You need to design a solution for storing and querying a large dataset of time-series data from millions of sensors. Each data point has a timestamp, a sensor ID, and a value. You need to support queries like "Get the average value for sensor X over the last hour." You also need to retain the data for 5 years. What is the most cost-effective and performant solution?

• A. Store the data in Cloud Bigtable with a row key of sensorID#timestamp.
• B. Store the data in Cloud Storage as a CSV file and query it with BigQuery.
• C. Store the data in Cloud Spanner with a primary key of sensorID, timestamp.
• D. Store the data in BigQuery with a partitioning column on timestamp and a clustering column on sensorID.

Answer: D

Explanation: BigQuery is ideal for analytical queries on massive datasets. Partitioning by timestamp allows for efficient time-range queries and reduces costs by only scanning relevant partitions, while clustering by sensorID further optimizes queries filtering on a specific sensor. BigQuery's storage is cost-effective for long-term retention. Option A (Bigtable) is good for high-throughput writes, but is less efficient for analytical aggregation queries. Option B is poor for performance. Option C (Spanner) is a transactional database, not designed for this type of analytical workload and is more expensive.

Question 10

Your company has a global user base and serves a static website (HTML, CSS, JS) and a REST API from Google Cloud. You want to reduce latency for users and protect the backend from DDoS attacks. You also want to route traffic to the API based on URL paths (e.g., /api/* to the backend, everything else to the static site). Which two Google Cloud products should you use together?

• A. Cloud CDN and Cloud Storage.
• B. Cloud Load Balancing and Cloud Armor.
• C. Cloud DNS and Cloud NAT.
• D. Cloud Load Balancing and Cloud CDN.

Answer: B

Explanation: The requirement specifies URL-based routing, which is a feature of Cloud Load Balancing (specifically the URL map). The requirement also mentions DDoS protection, which is a feature of Cloud Armor. Therefore, you need Cloud Load Balancing (with URL maps) to route traffic and Cloud Armor to provide DDoS protection and WAF capabilities. Cloud CDN alone (Option A) does not provide URL routing to an API backend. Option D is missing Cloud Armor. Option C is not relevant to these requirements. --- These questions cover key domains, but remember that the real exam is heavily scenario-based and will require you to synthesize multiple concepts. Make sure you understand the "why" behind each answer, and practice designing complete architectures that combine networking, compute, storage, and IAM. Good luck with your preparation!

To make that preparation manageable, a free Google Cloud Professional Cloud Architect study plan can give you a schedule that fits your time.

Nothing replaces hands-on practice — sit Google Cloud Professional Cloud Architect exam simulations and review every answer explanation.

A free Google Cloud Professional Cloud Architect readiness check can help you identify your weakest topic before the real exam.