You are using a GitHub repository for your application’s source code. You want to set up an efficient and secure continuous deployment process to automatically build and deploy the application to Cloud Run whenever a pull request is merged. What should you do?
Answer(s): D
D: Connect your repository using the Cloud Build GitHub app. Create a trigger in Cloud Build. Once a pull request is merged, trigger Cloud Build to build and deploy the application to Cloud Run. Efficient Integration: Using the native Cloud Build GitHub App is Google's recommended practice for connecting GitHub repositories. It provides secure, OAuth-based access without requiring you to manage webhook secrets or long-lived authentication keys manually.
You are deploying a highly confidential data processing workload on Google Cloud. Your company’s compliance framework mandates that cryptographic keys used for encrypting data at rest must be generated and stored exclusively within a validated Hardware Security Module (HSM). You want to use a fully integrated Google Cloud managed service to handle the lifecycle and usage of these keys. What should you do?
Answer(s): C
JustificationOption C – Create a new key in Cloud KMS with the HSM protection levelCloud KMS can generate keys that are stored and used only inside Google-managed FIPS-140-2 Level 3 HSMs. The key lifecycle (creation, rotation, destruction) is fully automated and auditable through Cloud KMS APIs. No on-premises hardware or network connectivity is required, satisfying the “fully integrated Google Cloud managed service” requirement. Data encrypted with such keys never leaves Google’s HSM boundary, meeting the compliance mandate for exclusive HSM generation and storage.Why the other options are unsuitableA: Customer-Supplied Encryption Keys (CSEK) – The key material must be supplied at each encryption request; it is not stored in a Google-managed HSM and therefore does not meet the “generated and stored exclusively within a validated HSM” rule. B. Import with SOFTWARE protection – Importing key material into Cloud KMS with software protection stores the key in software, not in an HSM, violating the HSM-only storage requirement. D. Cloud External Key Manager (Cloud EKM) – Cloud EKM is designed to connect Cloud KMS to an external HSM that you operate. While it can use an on-premises HSM, the key is still managed externally; the question explicitly asks for a fully integrated Google Cloud managed service that handles lifecycle and usage, which is provided by native Cloud KMS HSM-protected keys.Conclusion Creating a Cloud KMS key with the HSM protection level (Option C) directly satisfies the compliance constraints by leveraging Google-managed HSMs for key generation, storage, and lifecycle management without external dependencies.
Cloud KMS Key Protections: https://cloud.google.com/kms/docs/keys/key-protections Cloud KMS HSM-backed keys: https://cloud.google.com/kms/docs/keys/create-use#hsm_protected_keys
Your ecommerce platform uses a regional Cloud SQL for PostgreSQL database to store critical order information. The business requests a recovery time objective (RTO) of less than 10 minutes and a recovery point objective (RPO) of 2 minutes to ensure business continuity in the event of a full regional outage. You need to design a disaster recovery strategy for the Cloud SQL database that meets the business's strict RTO and RPO requirements. Your design must avoid operational complexity. What should you do?
Why option C is the optimal choiceMeets the strict RTO/RPO targets – A cross-region read replica can be promoted in seconds to a few minutes, easily satisfying an RTO < 10 min, while the replication stream guarantees that at most a few seconds of data are lost, comfortably within a 2-minute RPO. Minimal operational overhead – The replica is managed automatically by Cloud SQL; once created you only need to monitor health and, in a disaster, issue a promotion command. No manual backup restores, network-level DR drills, or custom scripts are required. Native integration with Cloud SQL HA – Promotion of a read replica is a built-in, supported operation that preserves the same instance configuration (instance type, storage size, networking) and eliminates the need to provision a separate VM or external service.Why the other options are less suitableOption A – Hourly backups to Cloud Storage provide a recovery point that can be up to 60 minutes old, violating the 2-minute RPO. Restoring and launching a new instance also adds minutes to the RTO, and the process is more error-prone. Option B – Database Migration Service (DMS) can replicate data, but it introduces extra components, licensing considerations, and configuration complexity. While it can achieve low RPO, the operational burden of managing DMS pipelines and ensuring seamless cut-over is higher than simply promoting a replica. Option D – Enabling high-availability (HA) within the same region protects against instance-level failures but does not survive a full-region outage; the standby remains in the same zone/region, so it cannot meet the regional-disaster requirement.Conclusion – Deploying a cross-region read replica and promoting it on demand delivers the required RTO/RPO with the simplest, most maintainable architecture for a Google Cloud SQL disaster-recovery design.
Cloud SQL read replicas: https://cloud.google.com/sql/docs/postgres/replication/replication-management Promoting a read replica to a primary instance: https://cloud.google.com/sql/docs/postgres/replication/promote-replica
You are designing a central, automated infrastructure deployment process for your organization using Terraform and Cloud Build. The security team prohibits the use of long-lived, static service account keys in any CI/CD pipeline. Additionally, while developers can propose infrastructure changes for peer review, they must not have permissions to directly apply changes in the production project. You need to design a secure and automated workflow for applying Terraform changes that meets the security team's requirements and ensures proper governance. What should you do?
Answer(s): B
Why option B is the correct choiceLeast-privilege execution – Cloud Build runs the Terraform plan step using a service-account that is impersonated by the author of the pull request. This gives each change only the permissions it needs, eliminating long-lived static keys. Governance through approval – The pipeline automatically performs terraform plan on every PR, but the subsequent terraform apply step is gated behind a manual approval checkpoint. Only an authorized reviewer can trigger the apply, satisfying the requirement that developers cannot directly apply changes to production. Auditability – All plan outputs are stored in Cloud Build logs, providing a traceable review trail before any state is changed. No static credentials in the pipeline – By using service-account impersonation , the build authenticates with short-lived tokens derived from the developer’s identity, removing the need to store JSON keys in Secret Manager or elsewhere.Why the other options are unsuitableOption A – Runs terraform apply automatically on merge without any manual approval, violating the security rule that changes must not be applied without explicit permission. It also still relies on a static service-account key unless impersonation is explicitly configured, which is not mentioned. Option C – While it avoids automated applies, it requires a developer to run terraform apply from a workstation. This introduces manual, non-repeatable steps, breaks the fully automated CI/CD flow, and makes audit logging harder to enforce consistently. Option D – Stores a privileged JSON key in Secret Manager and fetches it at runtime. Although it avoids long-lived keys on disk, the key is still a static credential that must be managed, rotated, and protected. It does not address the need for peer-review-driven governance and still exposes a credential to the build environment.Implementation sketch for option B1. Create a delegated service account for each developer (or a shared “terraform-apply” SA) with the minimal IAM permissions required for the target project. 2. In Cloud Build, configure a service-account impersonation trigger that runs the plan step using the PR author’s identity. 3. Store the Terraform configuration in a version-controlled repo; Cloud Build checks out the code on each PR. 4. After a successful plan, pause the pipeline and present a manual approval step to designated reviewers. 5. Upon approval, the pipeline proceeds to an apply step that again uses impersonated credentials, ensuring the apply runs with the same least-privilege context.
Cloud Build documentation on service-account impersonation: https://cloud.google.com/build/docs/run-builds-on-github#impersonating_service_accounts Terraform integration with Cloud Build best practices: https://cloud.google.com/terraform/docs/setup#using_cloud_buildThis justification follows the style expected for Google Professional Cloud Architect exam review: concise, technically precise, and focused on security, governance, and automation.
You need to build a continuous delivery pipeline for a containerized application in Google Cloud. You want to run all your tests in the pipeline to improve your application’s quality. What should you do?
Answer(s): A
Why option A is the optimal designSequential, gated testing stages – Option A enforces a clear gate-keeping flow: unit tests → container build → integration/acceptance tests in a test environment → production deployment with smoke testing. This guarantees that only code that passes each quality gate proceeds forward, minimizing the risk of broken releases. Full use of Cloud Build triggers – The pipeline leverages Cloud Build’s native event-driven triggers to start the workflow automatically on every push to the central repository, ensuring continuous integration without manual intervention. Production-ready smoke testing – Deploying to production only after all higher-level tests succeed, followed by smoke tests, provides an additional safety net that validates the health of the new version in the live environment before it is exposed to users. Container-centric workflow – Building the container early and pushing it to a central registry (e.g., Artifact Registry) decouples the build from the runtime environment, enabling reproducible deployments across test and production stages.Why the other options are less suitableOption B – Places the unit-test step after the container build, which adds unnecessary compute cost and introduces a race condition: if the build fails, the test step still consumes resources. Moreover, it lacks a dedicated smoke-test stage before production, reducing confidence in the final release. Option C – Starts testing in a local developer environment, which cannot be reliably automated or scaled in Cloud Build. Relying on local test results before invoking Cloud Build breaks the continuous-delivery model and introduces variability across developers’ machines. Option D – Requires developers to run unit tests locally before committing, which is a manual gate that can be bypassed. While it adds an early quality check, it does not provide the automated, auditable pipeline needed for a robust CI/CD flow on GCP, and it omits explicit smoke testing in production.Conclusion Option A delivers a fully automated, gate-controlled, and test-rich continuous delivery pipeline that aligns with Google Cloud best practices for containerized applications.
Cloud Build documentation: https://cloud.google.com/build/docs Deploying containers with Cloud Build: https://cloud.google.com/build/docs/deploying-containers
Post your Comments and Discuss Google Google Cloud Architect Professional exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the Google Cloud Architect Professional content, but please register or login to continue.