Your employer is a financial services company that recently acquired a popular fintech startup. The startup's core application is a monolithic Python application running on a managed instance group of Compute Engine virtual machines with a single, large PostgreSQL database. Your development team struggles with slow deployment cycles, and the monolithic design of the startup's core application makes it difficult to integrate new. ML-powered fraud detection models. You need a long-term strategy that improves developer agility and positions the company to leverage Google Cloud's advanced data and AI capabilities for future innovations. What should you do?
Answer(s): C
Why option C is the optimal choicePhased, event-driven migration – It breaks the monolith into logical services incrementally, allowing the team to ship value early while reducing risk. Pub/Sub for asynchronous communication – Enables loose coupling between newly created services (e.g., fraud-model inference, user-session handling) and the legacy codebase, smoothing the transition from a single-process deployment to a distributed architecture. Vertex AI endpoints for ML models – Provides a managed, scalable serving layer for the fraud-detection models, guaranteeing low-latency predictions and automatic scaling without having to operate dedicated inference servers. Alignment with long-term strategy – By moving toward a microservices footprint on Google-managed platforms (GKE or Cloud Run), the organization gains developer agility, independent CI/CD pipelines, and the ability to adopt additional Google AI services (e.g., AutoML, Feature Store) as new use-cases emerge.Why the other options are less suitableOption A – Deploying a Vertex AI endpoint and exposing a REST API is a good step for the ML model, but it does not address the underlying monolithic architecture or the need for asynchronous integration. The application would still be tightly coupled, limiting developer velocity. Option B – Containerizing the monolith and moving it to GKE improves deployment speed, yet the core remains a single, large service. It does not introduce the decoupling or event-driven patterns required for future feature isolation and does not leverage Google’s AI platform for the fraud models. Option D – Migrating PostgreSQL to Cloud SQL and replicating to BigQuery is valuable for analytics, but training and serving fraud models directly inside BigQuery is not designed for low-latency, real-time inference required by a fraud-detection workflow. It also sidesteps the need for a service-oriented architecture that supports independent scaling of the application tier.
Vertex AI Endpoints: https://cloud.google.com/vertex-ai/docs/endpoints/create-endpoint Pub/Sub Quickstart: https://cloud.google.com/pubsub/docs/quickstart
You are deploying a new three-tier application to Compute Engine instances within a single Virtual Private Cloud (VPC). The architecture is segmented into three subnets: a web tier subnet, an application tier subnet, and a database tier subnet. •The web tier must only receive traffic from an external load balancer. •The application tier must only receive traffic from the web tier. •The database tier must only receive traffic from the application tier. You need to enforce strict traffic flow control and want to follow Google-recommended practices. What should you do?
Why option C is the best choiceGranular, tier-aware enforcement – By assigning a unique network tag (or a dedicated service account ) to each tier, you can write firewall rules that explicitly allow traffic only from the upstream tier. This matches the required flow: external → web, web → application, application → database, and blocks any other source. Google-recommended practice – Google advises using service-account-based firewall rules (or network tags) to enforce least-privilege connectivity in multi-tier VPC designs. This approach scales cleanly and avoids reliance on broad CIDR blocks or external services. No external dependencies – Unlike option A, which introduces Cloud NAT and Cloud Armor, option C uses native VPC firewall features only, keeping the architecture simple and reducing operational overhead. Predictable rule ordering – Tags and service accounts are evaluated consistently, making it easier to audit and troubleshoot traffic flow.Why the other options are less suitableOption A – Cloud NAT is intended for outbound internet access, not for controlling east-west traffic between subnets. Cloud Armor policies would require additional complexity and do not integrate natively with VPC subnet segmentation; they are better suited for DDoS protection and external HTTP(S) traffic filtering. Option B – A single firewall rule allowing all ports between the three CIDR ranges defeats the strict “only-from-upstream-tier” requirement. It also bypasses the principle of least privilege and makes future rule management harder. Option D – VPC Network Peering is used to connect different VPCs , not to enforce traffic policies within the same VPC. Peering does not provide any security controls; it merely extends routing. Traffic filtering still needs to be implemented separately, offering no advantage over native firewall rules.Implementation sketch for option C1. Create three service accounts: web-sa , app-sa , db-sa .2. Attach each service account to the corresponding VM instances in the tiers. 3. Add a unique network tag (e.g., web-tag , app-tag , db-tag ) to each tier’s instances.4. Define firewall rules:Allow ingress on the application tier from instances that have the web-tag (or from web-sa ).Allow ingress on the database tier from instances that have the app-tag (or from app-sa ).(Optional) Allow ingress on the web tier from the external load balancer’s IP range. 5. Ensure firewall rule priority is higher than any deny-all rule and that the rules are scoped to the appropriate subnet CIDR blocks.
Firewall rules with service accounts – https://cloud.google.com/vpc/docs/firewalls#firewall_rules_with_service_accounts Network tags and firewall rule targeting – https://cloud.google.com/vpc/docs/firewalls#targeting_firewall_rulesThese documents provide the official guidance on using service accounts and network tags to enforce precise traffic flow within a single VPC, aligning with the recommended architecture for the described three-tier deployment.
You are launching a data fabric service on Google Cloud in ten weeks and need to transfer 2 petabytes of historical data from your on-premises data center to Google Cloud. You want to securely transfer the data with low latency. What should you do?
Answer(s): B
JustificationOption B – Request Transfer Appliances is the optimal choice.Google Transfer Appliances (e.g., Transfer Appliance, Data Transfer Appliance) can ingest up to several petabytes in a single shipment, handling the 2 PB volume without saturating the existing WAN. The appliance performs encrypted, checksum-verified copying on-site, then ships the physical device to Google Cloud where the data is automatically ingested into Cloud Storage, meeting the low-latency and security requirements. This method bypasses the limitations of bandwidth-constrained VPN or interconnect solutions, which would require months to move 2 PB at realistic rates.Option A – 1 Gbps VPN + Storage Transfer ServiceA 1 Gbps VPN can transfer roughly 300 TB per month; moving 2 PB would take > 6 months, far exceeding the 10-week deadline. Storage Transfer Service works only with Google-to-Google or on-premises endpoints that support its API; it does not address the physical bandwidth bottleneck.Option C – 1 Gbps Direct Interconnect + Storage Transfer ServiceEven with Direct Interconnect, a 1 Gbps link provides the same bandwidth ceiling as the VPN, leading to the same multi-month transfer time. Direct Interconnect does not solve the latency/throughput issue for a multi-petabyte migration within weeks.Option D – Portable DisksWhile physically feasible, shipping thousands of disks introduces logistical complexity, risk of data loss, and additional validation steps. Google’s Transfer Appliance provides a managed, secure, and verifiable solution that eliminates manual handling of numerous drives.Therefore, requesting Google Cloud Transfer Appliances (Option B) delivers the required throughput, security, and timing for a 2 PB migration within the 10-week window.
Transfer Appliance Overview: https://cloud.google.com/transfer-appliance/docs/overview Importing Data with Transfer Appliance: https://cloud.google.com/transfer-appliance/docs/importing-data
You are designing the storage configuration for a critical Cloud Storage bucket. This bucket will store trade confirmation documents for a financial services company. These documents are immutable and serve as a legal record. Your design must meet two primary data protection requirements: •The system must allow for the rapid recovery of any document that is accidentally deleted or maliciously overwritten. •Once a document is written, it must be impossible for anyone, including administrators, to delete or modify it for seven years. What should you do?
Answer(s): D
Why option D is the optimal designImmutable retention – Enabling Bucket Lock together with a 7-year retention policy guarantees that, once an object is written, it cannot be overwritten or deleted by any principal (including administrators) for the full retention period. This satisfies the legal-record requirement of “impossible to delete or modify for seven years.” Rapid recovery – Object Versioning keeps every previous version of an object. If a document is accidentally deleted or overwritten, the prior version can be restored instantly, providing the rapid-recovery capability required. Combined guarantee – The combination of versioning (for recoverability) and bucket lock + retention (for write-once-read-many immutability) directly addresses both protection requirements in a single, native Cloud Storage feature set.Why the other options are insufficientOption A – Restricting the service account to storage.objectCreator prevents accidental overwrites but does not stop an administrator from deleting or modifying existing objects, nor does it provide any retention guarantee. Option B – Replicating to an archive bucket via Transfer Service offers geographic redundancy but does not enforce immutability or retention; the source bucket remains fully mutable, so the legal-record protection is missing. Option C – A lifecycle rule only controls when objects can be deleted after a certain age; it does not prevent deletion or modification before the retention window, nor does it protect against overwrites. It also lacks versioning for quick restoration.Implementation steps (summary)1. Enable Object Versioning on the bucket.2. Apply a Bucket Lock configuration and set a 7-year retention policy at the bucket level. 3. Verify that the IAM policy grants only the necessary write permissions to the application’s service account; all other principals retain only read access.
Cloud Storage Object Versioning: https://cloud.google.com/storage/docs/versioning Bucket Lock and Retention Policies: https://cloud.google.com/storage/docs/bucket-lock
Your company has hired an external auditing firm to perform a compliance audit. Your company’s governance policy requires that external auditors be managed in a single Google Group that is granted temporary, read-only access to a Cloud Storage bucket named audit-evidence-bucket. Access must be traceable to the individual auditor's identity and be active only for the duration of the audit engagement, which runs the entire month of October. You need a secure access control strategy that avoids administrative overhead and complies with your company's governance policy. What should you do?
Answer(s): A
Why option A is the optimal solutionSingle, auditable identity – The external auditors are managed through one Google Group, so all access can be traced back to that group and ultimately to each individual auditor’s corporate identity. Temporary, read-only access – By attaching the roles/storage.objectViewer role to the group, auditors receive only the permissions required to read evidence objects. Automatic time-bounding – An IAM condition can enforce that the binding is effective only from 2025-10-01 through 2025-11-01. When the condition expires, the group’s effective policy reverts, eliminating any manual revocation step. Zero ongoing administrative overhead – No scheduled jobs, Cloud Run functions, or external identity providers need to be maintained; the condition is evaluated by the IAM service at each request. Compliance-ready – The approach satisfies the governance policy (single group, read-only, time-limited) while keeping the control surface simple and auditable.Why the other options are less suitableOption B (Signed URLs) – Generating signed URLs for every object is impractical at scale, does not enforce a group-level permission model, and cannot guarantee that each auditor’s identity is traceable through IAM logs. It also requires per-object management and does not automatically expire for the whole bucket. Option C (Scheduler + Cloud Run) – This introduces additional moving parts (scheduler, Cloud Run, custom code) that must be deployed, monitored, and secured. It adds operational complexity and a larger attack surface, whereas the same outcome can be achieved directly in IAM with a condition. Option D (Workforce Identity Federation) – Mapping external auditors to a Google Group via federation is possible, but it requires setting up an external identity provider, configuring federation, and managing session durations. For a short-term, single-bucket use case, this over-engineers the solution and does not inherently provide the same built-in time-bound enforcement that an IAM condition offers.
IAM Conditions – Time-based restrictions : https://cloud.google.com/iam/docs/conditions Granting roles to Google Groups : https://cloud.google.com/iam/docs/granting-roles-to-groupsThese documents detail how to bind a role to a Google Group and how to apply an IAM condition that limits access to a specific date range, supporting the recommended approach.
Post your Comments and Discuss Google Google Cloud Architect Professional exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Google Cloud Architect Professional content, but please register or login to continue.