Your company is running its application workloads on Compute Engine. The applications have been deployed in production, acceptance, and development environments. The production environment is business-critical and is used 24/7, while the acceptance and development environments are only critical during office hours. Your CFO has asked you to optimize these environments to achieve cost savings during idle times. What should you do?
Answer(s): B
The most cost-effective approach for optimizing non-production environments during idle times is to stop them completely when not needed, as suggested by option B. Cloud Scheduler provides a managed, reliable way to trigger actions at specific times, perfectly suited for automating start and stop operations. Cloud Functions, being serverless and event-driven, are ideal for executing the necessary commands to manage Compute Engine instances. By stopping the development and acceptance environments during non-office hours, you eliminate all associated compute costs. Option A, while seemingly providing resource reduction, still incurs costs as the instances remain running, even with smaller machine types. Option C, autoscaling, is useful for scaling resources based on demand, but it won't eliminate costs during true periods of no usage. Option D, using preemptible VMs, might reduce cost, however, it isn't appropriate for environments with requirements for consistency and availability, even if they are not 24/7. Stopping instances guarantees the greatest cost savings during off hours. Cloud Scheduler and Cloud Functions work together seamlessly for time-based automation, making them the preferred method. This combination enables cost savings without requiring a complex setup. Stopping instances is more efficient than reducing their size for cost optimization during complete downtime. Option B directly addresses the CFO's requirement to optimize costs during idle times effectively.Supporting Links:Cloud Scheduler: https://cloud.google.com/scheduler Cloud Functions: https://cloud.google.com/functions Compute Engine Instance Life Cycle: https://cloud.google.com/compute/docs/instances/instance-lifecycle
You are moving an application that uses MySQL from on-premises to Google Cloud. The application will run on Compute Engine and will use Cloud SQL. You want to cut over to the Compute Engine deployment of the application with minimal downtime and no data loss to your customers. You want to migrate the application with minimal modification. You also need to determine the cutover strategy. What should you do?
Answer(s): C
Option C is the most appropriate strategy for migrating the application to Google Cloud with minimal downtime and data loss, using Cloud SQL. Here's why:The core principle is to establish database replication before switching over the application. Option C achieves this by first setting up a VPN for secure connectivity between the Compute Engine app and the on-premises MySQL server. It then deploys the application in Compute Engine, initially configured to read and write to the on-premises database. This maintains application functionality while migration is set up. Subsequently, Cloud SQL replication is configured from the on-premises server to a Cloud SQL replica, creating a live copy of the data. Once the replication is synchronized, the Compute Engine application is briefly stopped, and the Cloud SQL replica is promoted to a standalone instance, making it the new primary database. Finally, the application is restarted, now configured to use the Cloud SQL instance. This approach guarantees data consistency by leveraging database replication and reduces downtime by switching over only once the Cloud SQL instance is up-to-date. This avoids large data transfers at cutover, unlike options A, B, and D that use a one-time dump and import, introducing potentially long periods of data unavailability or complex application code changes.Option A is problematic because it requires application code changes to write to two databases, which complicates the cutover and increases risk. Option B introduces unnecessary complexities with proxies and still relies on a one-time data import. Option D is problematic because it starts with a downtime event as the on-prem application must be stopped before any migration takes place.Authoritative links for further research:Cloud SQL Replication: https://cloud.google.com/sql/docs/mysql/replication Cloud SQL Overview: https://cloud.google.com/sql/docs Database Migration Strategies: https://cloud.google.com/architecture/database-migration-to-cloud-overview Cloud VPN: https://cloud.google.com/vpn/docs
Your organization has decided to restrict the use of external IP addresses on instances to only approved instances. You want to enforce this requirement across all of your Virtual Private Clouds (VPCs). What should you do?
Answer(s): D
The correct answer is D . An Organization Policy with a constraints/compute.vmExternalIpAccess constraint provides centralized control over the use of external IP addresses on Compute Engine instances across your entire organization. This approach aligns with the requirement to enforce restrictions across all VPCs. By using the allowedValues list, you can explicitly specify which instances, identified by their resource names or tags, are permitted to have external IPs, thus limiting access to only approved resources. This is a much more flexible and scalable approach than solutions that involve managing VPC routes or NAT. Option A is not feasible because it would impact instances needing internet access that are not deemed 'approved', plus removing the default route can impact internal network traffic as well. Option B, creating a new VPC, only addresses the requirement on a limited basis instead of across all VPCs. Option C, while restricting IP addresses, it is an additional solution and doesn't explicitly address the requirement.Here's a breakdown:Organization Policies: Provide a way to enforce organization-wide configurations and restrictions on Google Cloud resources. They're hierarchical and inherited, allowing centralized management. constraints/compute.vmExternalIpAccess : This specific constraint allows you to control whether instances can have external IP addresses. allowedValues List: This list within the constraint specifies which resources (instances) are allowed to have external IPs.Why other options are less suitable:A: Removing the default route would break internet connectivity for all instances, not just the ones needing restriction. B: Creating a new VPC and subnet is an overly complex solution that doesn't enforce the policy across all VPCs. C: Cloud NAT hides instances behind a single external IP, but it does not provide explicit control to allow external access on specific instances.Authoritative Links:Organization Policy Constraints: https://cloud.google.com/resource-manager/docs/organization-policy/constraints-list compute.vmExternalIpAccess Constraint: https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints/constraints-compute#compute.vmExternalIpAccess
Your company uses the Firewall Insights feature in the Google Network Intelligence Center. You have several firewall rules applied to Compute Engine instances. You need to evaluate the efficiency of the applied firewall ruleset. When you bring up the Firewall Insights page in the Google Cloud Console, you notice that there are no log rows to display. What should you do to troubleshoot the issue?
The correct answer is B. Enable Firewall Rules Logging for the firewall rules you want to monitor. Here's why:Firewall Insights in the Google Network Intelligence Center relies on logs generated by the firewall rules themselves. If no log rows are displayed, it indicates that logging is not enabled for the relevant firewall rules. Firewall Insights doesn't automatically capture traffic data for all rules; it specifically uses the logging data generated when Firewall Rule Logging is explicitly turned on. VPC flow logs (Option A) capture network traffic flow metadata, not detailed firewall rule actions, and they do not directly feed into Firewall Insights. While the compute.networkAdmin IAM role (Option C) is necessary to manage firewall rules, it does not control the logging behavior of those rules. Checking logs via the Google Cloud SDK (Option D) might show log entries if they exist, but it will not fix the underlying problem of logging not being enabled. The fix is to configure each firewall rule of interest to generate logs when they are triggered. Once enabled, these logs are then ingested by the Firewall Insights tool, making the data visible in the Google Cloud Console. This is a deliberate design to minimize logging costs and optimize performance by only recording information that is needed for analysis.For more detailed information, refer to the official Google Cloud documentation on Firewall Insights: https://cloud.google.com/network-intelligence-center/docs/firewall-insights/overview and Firewall Rule Logging: https://cloud.google.com/vpc/docs/firewall-rules-logging .
Your company has sensitive data in Cloud Storage buckets. Data analysts have Identity Access Management (IAM) permissions to read the buckets. You want to prevent data analysts from retrieving the data in the buckets from outside the office network. What should you do?
Answer(s): A
Option A is the correct solution because it leverages VPC Service Controls (VPC SC) and access levels to enforce network-based access restrictions on Cloud Storage data. VPC SC establishes a security perimeter around Google Cloud resources, preventing data exfiltration to unauthorized networks. By creating a perimeter encompassing the projects housing the Cloud Storage buckets, access is inherently limited to within that perimeter. Then, by using an access level specifying the office network's CIDR range, only requests originating from that network are allowed. This ensures that even if data analysts have IAM read permissions, their access is restricted to requests originating from inside the office, effectively blocking external data retrieval. VPC SC provides a robust, centralized way to implement these policies, and the access level integration adds granular control over network origin. This approach is superior because it doesn't require complex modifications to IAM permissions (as in C) or rely on instance-level firewall rules (as in B), which may not adequately protect against all egress attempts. Option D is intended for connecting on-premises networks to Google Cloud, which is not needed here, since we only want to limit access based on network of origin.Authoritative Links:VPC Service Controls: https://cloud.google.com/vpc-service-controls Access Levels: https://cloud.google.com/access-context-manager/docs/access-levels
Post your Comments and Discuss Google Google Cloud Architect Professional exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Google Cloud Architect Professional content, but please register or login to continue.