Your company places a high value on being responsive and meeting customer needs quickly. Their primary business objectives are release speed and agility. You want to reduce the chance of security errors being accidentally introduced. Which two actions can you take? (Choose two.)
Answer(s): B,E
The correct answer is B and E . The company values release speed and agility while also aiming to reduce security errors. Option B, using source code security analyzers in the CI/CD pipeline, addresses this by automatically scanning code for vulnerabilities early in the development process. This prevents errors from progressing further, aligning with agility as issues are caught sooner. Option E, running vulnerability security scans in the CI/CD pipeline, ensures that built artifacts are checked for known security weaknesses before deployment. This automated process helps maintain a balance between rapid release cycles and proactive security. Option A, requiring peer review by a security SME for every check-in, can be a bottleneck and doesn't align with the objective of agility. Option C, unit testing interfaces, is essential for software quality but not specifically geared toward security. Option D, code signing and a trusted repository, adds security but it does not proactively identify and prevent vulnerabilities during development phase. Instead, it is focused on verifying the integrity of the deployed binary. Therefore, the automated and proactive approaches of options B and E, integrated within the CI/CD pipeline, are the most suitable for achieving both rapid delivery and robust security.Supporting Links:CI/CD Pipeline: https://cloud.google.com/devops/capabilities/ci-cd DevSecOps: https://cloud.google.com/devops/capabilities/devsecops Static Application Security Testing (SAST): https://owasp.org/www-project-top-ten/ (refer to the guidance on automated security testing) Dynamic Application Security Testing (DAST): https://owasp.org/www-project-top-ten/ (refer to the guidance on automated security testing)
You want to enable your running Google Kubernetes Engine cluster to scale as demand for your application changes. What should you do?
Answer(s): C
The correct answer is C because it directly addresses enabling autoscaling on an existing Kubernetes Engine cluster, fulfilling the question's requirement. Option A, while resizing the cluster, doesn't enable autoscaling; it simply changes the static node count. Option B suggests tagging instances, which is insufficient for enabling autoscaling as it doesn't configure the cluster to react dynamically to workload demands. Option D proposes creating a new cluster with autoscaling enabled which is unnecessary and disruptive, considering the question is about an existing running cluster. The gcloud alpha container clusters update command with the--enable-autoscaling flag, along with specifying minimum and maximum node counts, directly configures the cluster to automatically adjust the number of nodes based on resource utilization, ensuring the application scales effectively with varying demands. This leverages Kubernetes' Horizontal Pod Autoscaler (HPA) in conjunction with the cluster autoscaler, enabling dynamic resource management. Option C is the most efficient and least disruptive way to achieve the goal.Further Research:Google Cloud Documentation on Cluster Autoscaler: https://cloud.google.com/kubernetes-engine/docs/how-to/autoscaling/cluster-autoscaler Google Cloud Documentation on gcloud container clusters update :https://cloud.google.com/sdk/gcloud/reference/container/clusters/update Kubernetes Documentation on Horizontal Pod Autoscaler: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/
Your marketing department wants to send out a promotional email campaign. The development team wants to minimize direct operation management. They project a wide range of possible customer responses, from 100 to 500,000 click-through per day. The link leads to a simple website that explains the promotion and collects user information and preferences. Which infrastructure should you recommend? (Choose two.)
Answer(s): A,C
Here's a detailed justification for choosing options A and C, and why option B and D are less suitable for the scenario:Justification for Option A: Google App Engine and Cloud DatastoreApp Engine is a fully managed, serverless platform. This aligns perfectly with the development team's desire to minimize operational management, as it handles scaling, patching, and infrastructure maintenance automatically. The provided scenario describes a highly variable load from 100 to 500,000 click-throughs per day. App Engine's auto-scaling capabilities can seamlessly handle this fluctuating demand. Google Cloud Datastore is a highly scalable NoSQL database service, ideal for storing user data generated from the website. Its schemaless nature allows for flexible data models and efficient scaling, which is especially important given the potentially large and fluctuating number of user interactions. This combination offers a hands-off experience, allowing the development team to concentrate on application logic rather than infrastructure.Justification for Option C: Managed Instance Group and Cloud BigtableManaged Instance Groups (MIGs) offer automatic scaling of compute resources based on demand, addressing the variable load effectively. MIGs distribute the website traffic across multiple virtual machine instances for higher availability and fault tolerance. Google Cloud Bigtable, a scalable NoSQL database, is an ideal choice for handling the potentially large volumes of data generated by the website, particularly if there's a need for fast reads and writes across many user records. It is a good option for scaling reads/writes, and therefore a good choice. The combination provides a robust solution with good autoscaling capabilities.Why Option B is Less Suitable: Google Kubernetes Engine (GKE) and Persistent DiskWhile GKE provides great flexibility, it also requires more operational overhead than App Engine. Managing a Kubernetes cluster includes tasks like node management, cluster upgrades, and scaling configurations, which does not align with the requirement for minimizing direct operational management. Persistent disk isn't a scalable data storage solution like Bigtable, thus limiting the performance and scalability needed for potentially millions of user interactions per day.Why Option D is Less Suitable: Single Compute Engine VM and Cloud SQLA single Compute Engine VM creates a single point of failure, which is undesirable in a production setting that needs to handle varied loads. The single VM also limits the scale of what can be done with the website. Cloud SQL is suitable for relational data, but is less ideal for the scale and rapid data writes of 500,000 users in a single day. Therefore, it is not a preferred database for this specific scenario.In summary:Options A and C provide solutions that emphasize minimizing operational management and high scalability, perfectly aligning with the project requirements. Option B introduces more operational complexity, and Option D creates a single point of failure, which are both less suitable.Authoritative Links:Google App Engine: https://cloud.google.com/appengine Google Cloud Datastore: https://cloud.google.com/datastore Google Managed Instance Groups: https://cloud.google.com/compute/docs/instance-groups Google Cloud Bigtable: https://cloud.google.com/bigtable
Your company just finished a rapid lift and shift to Google Compute Engine for your compute needs. You have another 9 months to design and deploy a more cloud-native solution. Specifically, you want a system that is no-ops and auto-scaling. Which two compute products should you choose? (Choose two.)
Answer(s): B,C
The question focuses on selecting compute products that offer no-ops and auto-scaling capabilities for a cloud-native solution after a lift-and-shift to Compute Engine.Option B, Google Kubernetes Engine (GKE) with containers , is a strong choice because GKE is a managed Kubernetes service. Kubernetes automates the deployment, scaling, and management of containerized applications, significantly reducing operational overhead (no-ops). Its inherent auto-scaling features adjust resources based on demand, ensuring applications remain performant without manual intervention. https://cloud.google.com/kubernetes-engineOption C, Google App Engine Standard Environment , also aligns with the requirements. It is a fully managed, serverless platform where Google handles infrastructure management, resulting in minimal operational effort. App Engine automatically scales based on application traffic, ensuring high availability and resource efficiency without manual configuration. https://cloud.google.com/appengineTherefore, options B and C fulfill both no-ops and auto-scaling criteria, making them the correct choices.Option A, Compute Engine with containers, does not inherently offer no-ops. Although containers aid in application portability, users are still responsible for managing the underlying infrastructure, scaling, and orchestration.Option D, Compute Engine with custom instance types, focuses on customization rather than automation and scaling. It doesn't address the no-ops requirement.Option E, Compute Engine with managed instance groups (MIGs), provides auto-scaling but does not eliminate the management overhead associated with the infrastructure, and hence it does not offer the no-ops experience required in the question.
One of your primary business objectives is being able to trust the data stored in your application. You want to log all changes to the application data. How can you design your logging system to verify authenticity of your logs?
The correct answer is C. Digitally sign each timestamp and log entry and store the signature. This approach provides a verifiable way to ensure the authenticity and integrity of logs. Digital signatures use cryptographic hashing and asymmetric encryption. When a log entry is generated, its hash is computed, then encrypted with the private key of the logging system. The signature, along with the original log entry and timestamp, is stored. This allows anyone with access to the corresponding public key to verify the signature, confirming that the log wasn't tampered with and originated from the expected source. Options A, B, and D don't offer the same level of authenticity verification. Concurrent logging (A) only provides redundancy, not proof of origin. Limiting database access (B) helps control modification but doesn't guarantee data wasn't altered by authorized users. JSON dumps (D) can be changed without detection. Digital signatures, as in option C, ensure non-repudiation and protect against both unauthorized tampering and accidental modifications by providing a cryptographic record that is difficult to forge.Supporting concepts and authoritative links:Digital Signatures: For an in-depth understanding of digital signatures, refer to resources explaining Public Key Infrastructure (PKI) and the process of signing and verifying data. https://en.wikipedia.org/wiki/Digital_signature Cryptography: A general understanding of cryptography is helpful, especially hashing functions, asymmetric encryption, and the role of public and private keys. https://www.cloudflare.com/learning/ssl/what-is-public-key-cryptography/ Immutable Logging: Understanding the concept of immutability in logging helps understand why digitally signing is important. https://www.techtarget.com/searchsecurity/definition/immutable-logging
Post your Comments and Discuss Google Google Cloud Architect Professional exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Google Cloud Architect Professional content, but please register or login to continue.