Your company wants to migrate their 10-TB on-premises database export into Cloud Storage. You want to minimize the time it takes to complete this activity and the overall cost. The bandwidth between the on-premises environment and Google Cloud is 1 Gbps. You want to follow Google-recommended practices. What should you do?
Answer(s): B
B: Use the Transfer Appliance.Specifically designed for large (TB–PB) data migrations.Faster than any 1 Gbps network transfer.Lower operational cost.Resilient and recommended for 10 TB+ migrations.Google Cloud documentation recommends Transfer Appliance when:Network speed is too slowData is large (TB/PB scale)You want to minimize time and cost
You are working at a financial institution that stores mortgage loan approval documents on Cloud Storage. Any change to these approval documents must be uploaded as a separate approval file. You need to ensure that these documents cannot be deleted or overwritten for the next 5 years. What should you do?
Answer(s): A
Option A, creating a retention policy on the bucket for 5 years and then locking it, is the correct approach because it directly addresses the requirement of preventing deletion or overwriting of objects within a Cloud Storage bucket for a specified duration. Retention policies in Cloud Storage are designed for data immutability and compliance. When a retention policy is locked, it becomes permanent, and neither the policy nor the objects it covers can be deleted or modified before the policy's duration expires. This ensures adherence to the 5-year retention requirement, aligning with regulatory obligations common in financial institutions dealing with sensitive documents. Option B, applying a retention policy as an organizational constraint, sets a minimum duration for all buckets within the organization. While this prevents deletion, it doesn't guarantee a specific 5-year immutability window for this bucket, and allows a longer duration if applied at a bucket level. Option C, using a customer-managed key (CMK) for encryption, addresses encryption at rest, but does not prevent deletion or overwriting, meaning it does not satisfy immutability. Key rotation has no effect on the data's deletion or overwrite status. Finally, Option D, applying a project-level constraint, has the same weakness as Option B: it sets a minimum, not a specific duration, for all buckets in a project. Only option A utilizes a locked retention policy on the specific bucket. This policy type achieves the exact level of immutability required.Authoritative Links:Cloud Storage Retention Policies: https://cloud.google.com/storage/docs/retention-policies Locking Retention Policies: https://cloud.google.com/storage/docs/locking-retention-policies Organizational Constraints: https://cloud.google.com/resource-manager/docs/organization-policy/understanding-constraints
Your company has decided to make a major revision of their API in order to create better experiences for their developers. They need to keep the old version of the API available and deployable, while allowing new customers and testers to try out the new API. They want to keep the same SSL and DNS records in place to serve both APIs. What should they do?
Answer(s): D
The correct answer is D: Use separate backend pools for each API path behind the load balancer. This approach allows you to maintain both the old and new API versions simultaneously, under the same SSL and DNS records. By configuring a load balancer to route traffic based on the URL path, requests to the old API path will be directed to its corresponding backend pool, while requests to the new API path will be routed to the new API’s backend pool. This is achieved using path-based routing, a common technique in load balancing for managing different versions or functionalities of an application. Option A, while feasible, would require a different DNS record or SSL, which the requirements specifically avoid. Option B is not suitable because the goal is to support existing clients to the old API. Option C is inefficient as it puts a load on the old API. This ensures that existing clients using the old API are not disrupted and new clients or testers can easily access the new API without affecting the other.Authoritative Links:Google Cloud Load Balancing Overview: https://cloud.google.com/load-balancing/docs/load-balancing-overview URL Map Overview (for path-based routing): https://cloud.google.com/load-balancing/docs/url-map Backend Services and Backend Pools: https://cloud.google.com/load-balancing/docs/backend-service
You have a Compute Engine application that you want to autoscale when total memory usage exceeds 80%. You have installed the Cloud Monitoring agent and configured the autoscaling policy as follows:You observe that the application does not scale under high load. You want to resolve this. What should you do?
Answer(s): C
C: Change the filter to metric.label.state = ‘used’. The current filter is set up with multiple AND conditions, which means it's looking for a metric that simultaneously has all these states: 'used', 'buffered', 'cached', and 'slab'. This is logically impossible, as a memory location can't be in multiple states at once. Therefore, the filter will never match any metrics, and the autoscaling policy won't trigger.
Your company has a Google Cloud project that uses BigOuery for data warehousing. The VPN tunnel between the on-premises environment and Google Cloud is configured with Cloud VPN. Your security team wants to avoid data exfiltration by malicious insiders, compromised code, and accidental oversharing. What should you do?
The correct answer is B: Configure VPC Service Controls and configure Private Google Access for on-premises hosts. Here's a detailed justification:Data exfiltration prevention requires a multi-layered approach, focusing on both network-level security and resource-level access controls. VPC Service Controls (VPC SC) allows you to define a security perimeter around Google Cloud resources, like BigQuery, limiting data access to authorized networks and identities. This mitigates the risk of unauthorized access, even if an attacker gains credentials. VPC SC implements context-aware access, only allowing requests from within the defined perimeter. https://cloud.google.com/vpc-service-controls/docs/overviewSince the company's on-premises environment needs to access BigQuery, configuring Private Google Access for on-premises hosts is crucial. Private Google Access enables on-premises systems to communicate with Google Cloud services, including BigQuery, over a private network (e.g., the Cloud VPN tunnel), without traversing the public internet. This further reduces the attack surface and improves security. VPC SC and Private Google Access work in tandem to provide a comprehensive data exfiltration prevention solution.https://cloud.google.com/vpc/docs/private-access-optionsOption A, Private Service Connect, is mainly for privately accessing services hosted in other VPC networks, not necessarily for controlling data exfiltration from your own project by internal actors. Option C, manipulating service account roles, while a good practice, is insufficient. Restricting access to only one service account doesn't prevent an attacker who compromises that service account from exfiltrating data within the allowed roles. Option D, Private Google Access, only secures the network connection. It does not enforce context-aware access controls to prevent data exfiltration by authorized but malicious users or compromised code. Hence, option B provides a much more comprehensive solution for the given scenario. VPC SC prevents data egress by enforcing perimeters, and Private Google Access gives secure private connectivity to BigQuery from on-prem.
Post your Comments and Discuss Google Google Cloud Architect Professional exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Google Cloud Architect Professional content, but please register or login to continue.