You are architecting a new application feature for a healthcare provider based in Qatar. The feature needs to summarize sensitive patient notes that are submitted by clinicians. A critical requirement is that the content of these patient notes must never be processed outside of Qatar's borders. You want to use a powerful, pre-trained generative model for the summarization task while strictly adhering to the data residency constraint. What should you do?
Answer(s): B
In this scenario, you must balance the need for a powerful generative model with the strict data residency requirement of the healthcare industry in Qatar.Data Residency Compliance: To ensure patient data is never processed outside of Qatar, you must use a service that supports regional ML processing . Google Cloud's region in Doha ( me-central1 ) supports deploying models to Vertex AI Endpoints.Gemma via Model Garden: Gemma is Google’s family of lightweight, open-source generative models. Because you can download and deploy Gemma yourself using Vertex AI Model Garden , you have complete control over where the compute happens. By selecting a Gemma model and deploying it to a Vertex AI Endpoint in the me-central1 (Doha) region, all inference and data processing stay strictly within the local regional boundary.Powerful Summarization: Gemma is built on the same research and technology as the Gemini models, making it highly capable of complex NLP tasks like summarization, while being small enough to be deployed on private infrastructure.Why the other options are incorrect:Option A is incorrect because the Gemini API (as a managed service) often uses a global pool of resources. While VPC Service Controls protect the network perimeter, they do not inherently guarantee that the underlying ML processing occurs within a specific country's borders unless a regional endpoint is explicitly supported and selected for that specific service.Option B vs. Gemini API: As of now, many specialized Generative AI managed services (like the core Gemini API) process data in larger "multi-regions" (like the US or EU). Using Gemma on a regional endpoint is the most reliable way to guarantee local processing in a specific country like Qatar.Option C is incorrect because the Cloud Natural Language API is designed for entity recognition, sentiment analysis, and syntax, but it does not have a native "summarization" feature comparable to generative LLMs.Option D is incorrect because training a custom model from scratch is extremely time-consuming, expensive, and unnecessary. Using a pre-trained model like Gemma provides a "powerful" starting point that only requires deployment (or minor fine-tuning) to meet the requirement.
You are migrating a critical on-premises inventory management application to Google Cloud. The application is a monolith with a traditional relational database, and the immediate business goal is a rapid data center exit. The monolith is exposing an API to other business critical applications. The long-term vision is to modernize the application into globally distributed, cloud-native services to support the company’s expansion. You need to design the initial cloud architecture to ensure that future modernization causes the least possible disruption to other applications that depend on inventory data. The future modernization might require the API to change structure. What should you do?
Decoupling and Abstraction: An API Management platform like Apigee acts as a layer of abstraction between the dependent applications and the backend monolith. This decouples the frontend (consumers) from the backend (the inventory application).Future-proofing: The key requirement is to ensure future modernization causes minimal disruption. Apigee allows you to manage the API lifecycle, meaning you can change the underlying backend services (e.g., as you break the monolith into microservices) while maintaining a consistent, versioned API interface for consumers.Managing API Changes: When the monolith is modernized, the native API is likely to change. Apigee can manage these changes, potentially by offering multiple API versions simultaneously or by transforming requests/responses to ensure backward compatibility for older clients.Controlled Access: It provides a centralized point for managing access, security (authentication/authorization), traffic management, and monitoring for all incoming API requests.
Your organization uses separate Google Cloud projects for shared services, development, testing, and production. •The shared services project hosts your private CI/CD runners and a central Artifact Registry •The development, testing, and production projects host the GKE clusters where applications are deployed. You need to design an architecture that allows the CI/CD runners to connect to the GKE clusters and the clusters to pull images from Artifact Registry, all using private IP addresses. However, direct network traffic between the development, testing, and production environments must be strictly prohibited. What should you do?
Answer(s): A
VPC Separation for Isolation: Creating a separate Virtual Private Cloud (VPC) for each environment (development, testing, production) ensures strict network isolation. This inherently prevents direct network traffic between the different environments, satisfying a key requirement of the prompt .Centralized Shared Services: The shared services VPC hosts common resources like the CI/CD runners and Artifact Registry.VPC Network Peering for Controlled Connectivity: VPC Network Peering allows private IP communication between the distinct VPCs (e.g., development VPC can peer with the shared services VPC). This enables the runners to access GKE clusters and the clusters to pull images from the Artifact Registry using private IP addresses.Controlled Access: Firewall rules can be implemented within each environment's VPC to explicitly permit only necessary traffic from the shared services VPC's ranges (e.g., allowing port 22/SSH for runners to connect to nodes, and the necessary API/image pull traffic].
You are designing the network architecture for a public-facing, containerized web application deployed on Cloud Run. All incoming traffic must be inspected by a Cloud Armor web application firewall (WAF) before reaching the application You plan to use an Application Load Balancer, which will have the Cloud Armor policy attached. You must ensure that all public requests pass through the load balancer and any attempt to access the Cloud Run service directly through its default *.run.app URL is blocked. What should you do?
Answer(s): C
C: Set the Cloud Run ingress to Allow internal traffic and Cloud Load Balancing, and use a serverless NEG backend on the load balancer.You need to force all traffic through the Application Load Balancer, where Cloud Armor is attached. The secure design is:Configure Cloud Run ingress = “internal and Cloud Load Balancing”This blocks direct access via the default *.run.app URL from the public internet.Only requests coming through Google Cloud Load Balancing are allowed.Use a Serverless NEGThe load balancer connects to Cloud Run through the serverless Network Endpoint Group.Cloud Armor policies inspect traffic before it reaches Cloud Run.
To improve governance and security, your organization has structured the Google Cloud environment using folders for different business units. Each business unit folder has subfolders for development, staging, and production environments, which must comply with internal security controls: •Production workloads must be protected from direct internet ingress by default unless explicitly tagged. •The application must be accessible to customers over HTTPS. You need to design a scalable and enforceable model that blocks internet ingress traffic to the production folders while selectively allowing direct HTTPS traffic to the necessary virtual machines. You must also ensure that individual project teams cannot overwrite these controls once they are implemented for all current and future production projects. What should you do?
At each production folder, apply a hierarchical firewall policy to deny all ingress except for HTTPS to tagged VMs.Detailed ReasoningTo meet the requirements of enforcement, scalability, and prevention of project-level overrides, hierarchical firewall policies are the designated tool:Hierarchical Enforcement: Hierarchical firewall policies are applied at the folder or organization level. Rules defined at a folder level are evaluated before any project-level VPC firewall rules. This ensures that project teams cannot overwrite these controls with their own local rules.Targeting and Selectivity: By applying the policy at each production folder (rather than the organization root as in Option C), you can specifically target production environments without unintentionally impacting development or staging folders.
Post your Comments and Discuss Google Google Cloud Architect Professional exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Google Cloud Architect Professional content, but please register or login to continue.