Free GCP-CLOUD-ARCHITECT Practice Test

The Google-recommended practice for managing configuration and policy across a multi-cloud Kubernetes environment (GKE and EKS) is to use the components of GKE Enterprise. Config Sync enables GitOps-style configuration management, automatically synchronizing cluster configurations from a central Git repository to ensure consistency. Policy Controller, a managed service based on OPA Gatekeeper, allows for the creation and enforcement of centralized policies across all connected clusters. This combination provides a robust, declarative, and consistent approach to multi-cluster governance.

A. This option involves developing a custom controller, which is not a managed, Google-recommended practice and adds significant development and maintenance overhead.
B. Relying on a custom script for security policy enforcement is not a scalable or reliable solution compared to a dedicated policy engine like Policy Controller.
D. While FluxCD and Kyverno are valid open-source tools, Config Sync and Policy Controller are the specific, integrated, and managed solutions recommended by Google for this use case.

1. Google Cloud Documentation, "Config Sync overview". This document states, "Config Sync lets you use a common configuration for all your clusters... You can also use Config Sync with Anthos clusters on AWS [EKS]."

2. Google Cloud Documentation, "Policy Controller overview". This document explains that Policy Controller "enforces programmable policies for your clusters" and is "based on the open source Open Policy Agent (OPA) Gatekeeper project."

3. Google Cloud Solutions, "Modern CI/CD with GKE Enterprise". This guide details how Config Sync and Policy Controller are integral parts of a secure software supply chain, providing "centralized configuration" and "enforceable policies" for multi-cluster environments.

The question asks how to enable autoscaling on a running Google Kubernetes Engine (GKE) cluster. The gcloud container clusters update command is used to modify the configuration of an existing cluster. The --enable-autoscaling flag, along with --min-nodes and --max-nodes, specifically configures the cluster autoscaler on the specified running cluster, allowing it to automatically add or remove nodes based on workload demands.

A. The resize command manually sets a fixed number of nodes; it does not enable automatic scaling based on load.
B. Adding tags to Compute Engine instances is not the correct mechanism for configuring GKE cluster autoscaling, which is a cluster-level setting.
D. The create command builds a new cluster. This would require a disruptive application migration rather than updating the existing, running cluster.

1. Google Cloud Documentation. gcloud container clusters update. The command reference explicitly shows the --enable-autoscaling, --min-nodes, and --max-nodes flags for modifying an existing cluster.

2. Google Cloud Documentation. Autoscaling a cluster. Section: "Enabling cluster autoscaling". It states, "You can enable autoscaling on an existing cluster by using the gcloud command-line tool or the Google Cloud console." and provides the gcloud container clusters update command as the example.

Cloud Logging automatically collects certain logs, including Admin Activity audit logs, which track administrative changes and other actions. However, for logs generated within a virtual machine's operating system, such as system logs (e.g., syslog, Windows Event Log) or application logs, the Cloud Logging agent must be installed on that VM. The agent streams these logs from the VM to the Cloud Logging API, centralizing them with other project logs. This combination provides comprehensive log coverage.

A. VM system logs are not collected automatically; they require the installation of the Cloud Logging agent on each VM.
C. Using a custom syslogd instance is a non-standard, manual approach that lacks the integration and features of the native Cloud Logging service.
D. The Logging agent only collects logs from the specific instance it is installed on, not from the entire project or other services.

1. Google Cloud Documentation, "Overview of Cloud Audit Logs". It states, "Cloud Audit Logs maintains three audit logs for each Cloud project...: Admin Activity, Data Access, and System Event." These are collected by default.

2. Google Cloud Documentation, "About the Logging agent". It specifies, "You can use the Logging agent to send logs from your own applications and from third-party applications to Cloud Logging... The agent is pre-installed on some Compute Engine VM images." This confirms the agent is needed for VM-specific logs.

3. Google Cloud Documentation, "Default logs". This page lists which logs are collected by default and which require the agent. It explicitly mentions syslog as a log collected by the agent.

The primary issue is high latency for static content for users in Europe and Asia, caused by the distance to the us-central1 backend. Enabling Cloud CDN (C) caches static assets at Google's globally distributed edge locations, serving content from a point-of-presence near the user. Deploying the frontend to regional managed instance groups (D) in Europe and Asia and using a global load balancer also moves the application closer to the users. Both solutions effectively reduce round-trip time and latency for static content delivery to a global audience.

A. Cloud SQL read replicas would improve database read performance for dynamic content, not the slow-loading static content identified in the problem.
B. A regional Network Load Balancer operates at Layer 4 and is confined to a single region; it cannot provide global routing or content caching.

1. Google Cloud Documentation, "Cloud CDN > Docs > Overview". It states, "Cloud CDN (Content Delivery Network) uses Google's global edge network to serve content closer to users, which accelerates your websites and applications."

2. Google Cloud Documentation, "Load Balancing > Docs > Load Balancer types > Choosing a load balancer". This document highlights that the Global External HTTP(S) Load Balancer is "for global web applications" and supports Cloud CDN.

3. Google Cloud Documentation, "Compute Engine > Docs > Instance groups > Creating groups of managed instances". Deploying MIGs in multiple regions is a standard pattern for reducing latency for global users.

Google Cloud Managed Service for Prometheus is a fully managed, multi-cloud, cross-project solution that is built on the same globally scalable infrastructure as other Google services. It is designed to be a drop-in replacement for standard Prometheus, supporting PromQL for queries and alerts. This addresses the need for a low-maintenance, highly scalable, enterprise-grade solution that integrates seamlessly with existing Prometheus workflows. It allows developers to continue using their familiar tools while offloading the operational burden of managing and scaling the monitoring infrastructure.

A. Deploying a Prometheus operator is a self-managed approach, which contradicts the requirement for a low-maintenance, cloud-based enterprise solution.
B. Building a custom SaaS solution is a significant engineering effort, which is the opposite of a low-maintenance, ready-to-use solution.
D. While Cloud Monitoring provides a single pane of glass, Managed Service for Prometheus is the specific service designed for native Prometheus compatibility and PromQL support.

1. Google Cloud. (n.d.). Google Cloud Managed Service for Prometheus. Google Cloud Documentation. Retrieved from https://cloud.google.com/stackdriver/docs/managed-prometheus. (This page states, "Google Cloud Managed Service for Prometheus is Google Cloud's fully managed multi-cloud, cross-project solution for Prometheus metrics... You can use PromQL to query the data... without having to manually manage and operate Prometheus at scale.")

2. Google Cloud. (n.d.). About Google Cloud Managed Service for Prometheus. Google Cloud Documentation. Retrieved from https://cloud.google.com/stackdriver/docs/managed-prometheus/overview. (The overview highlights that it "lets you monitor and alert on your workloads, using Prometheus, without having to manually manage and operate Prometheus at scale.")

To create a fully auditable and traceable link between a production deployment and its source code, the deployed artifact must have a unique, immutable identifier that corresponds to the code version. Using the source code commit hash (e.g., a Git SHA) as the container image tag is a standard industry best practice. The commit hash is a unique fingerprint of the code at a specific point in time. This creates an unambiguous, machine-readable link from the running container back to the exact source code commit that produced it, fulfilling the auditability requirement.

A. A date and time stamp is not unique; multiple commits could occur within the same second, and it's not a direct link to the code's state.
B. Comments are manual, prone to human error, and not easily parsed by automated auditing tools, making them an unreliable linking mechanism.
D. The :latest tag is mutable and should not be used in production. It can be repointed to different images, which breaks traceability and makes deployments unpredictable.

1. Google Cloud Documentation, "Cloud Build," "Best practices for building containers," Section: "Tagging images." It advises, "Tag your images with more than just the latest tag... Consider using a tagging scheme, for example... Git commit SHA."

2. Google Cloud Architecture Center, "CI/CD for hybrid and multi-cloud workloads," Section: "Build and test." The article emphasizes creating immutable artifacts and states, "A common practice is to tag the container image with the commit ID of the source code."

3. DevOps on Google Cloud, "Continuous integration," Section: "Artifacts." The documentation highlights the importance of versioning build artifacts and suggests using the commit SHA as a version identifier for traceability.

The Google-recommended practice for real-time log monitoring and response is an event-driven architecture using a log sink. You configure a sink in Cloud Logging with a specific filter to match anomaly events (e.g., firewall modifications). This sink exports matching log entries in real-time to a Pub/Sub topic. A Cloud Function is then configured with a Pub/Sub trigger, causing it to execute immediately whenever a relevant log is published to the topic. This provides the fastest possible reaction time, allowing for immediate alerting or automated remediation, which directly satisfies the requirement to "react quickly."

A: A cron job is a polling mechanism. It introduces inherent delays (up to the polling interval) and is less efficient than an event-driven push model for real-time needs. B: Exporting to BigQuery is ideal for batch analysis and forensics, not real-time alerting. There are delays in data ingestion and querying, making it too slow for immediate response. D: Exporting logs to Cloud Storage is a batch process, where logs are collected and written to files periodically. This latency makes it unsuitable for rapid, real-time event detection.

1. Google Cloud Documentation, "Scenarios for exporting logs," Section: "Real-time security and access monitoring". This section explicitly recommends exporting logs to Pub/Sub to be consumed by another application, such as Cloud Functions, for real-time analysis. (https://cloud.google.com/logging/docs/export/configureexportv2#scenarios)

2. Google Cloud Architecture Center, "Real-time log analysis for security and access analytics". This reference architecture details the pattern of using Cloud Logging -> Log Sink -> Pub/Sub -> Cloud Functions for real-time alerting and analysis. (https://cloud.google.com/architecture/real-time-log-analysis-for-security-and-access-analytics)

3. Google Cloud Documentation, "Overview of log routing and storage," Section: "Sinks". Sinks control how Cloud Logging routes logs. You can use sinks to route some or all of your logs to supported destinations, including Pub/Sub topics. (https://cloud.google.com/logging/docs/routing/overview#sinks)

Google Cloud Migration Center is the purpose-built, recommended tool for this scenario. It is designed to accelerate the migration planning phase by discovering on-premises assets (including compute and SAP workloads), assessing their configuration and utilization, and generating a detailed Total Cost of Ownership (TCO) report. This report provides a comprehensive cost estimate for running those specific workloads on Google Cloud, incorporating right-sizing recommendations. This aligns perfectly with the need to quickly create a cost estimate based on the current environment using a Google-recommended practice.

A. Cloud Asset Inventory is used to discover and analyze resources that are already running in Google Cloud, not on-premises.
B. Engaging a partner is a valid but typically more time-consuming and in-depth process than what is needed for a quick initial estimate.
C. The pricing calculator requires manual data entry of estimated resources; it does not gather data from the current environment to inform the estimate.

1. Google Cloud Migration Center Documentation, "Migration Center overview." The documentation states, "Migration Center is a unified migration platform that helps you accelerate your end-to-end cloud journey... It allows you to discover your on-premises infrastructure, perform automated assessments... and calculate the total cost of ownership (TCO)."

2. Google Cloud Blog, "Accelerate your cloud migration with the new Google Cloud Migration Center," (2022). This article introduces Migration Center as the primary starting point for planning a migration and understanding costs.

3. Google Cloud Solutions, "SAP on Google Cloud," Section: "Plan and assess." This section recommends using assessment tools like Migration Center to plan the migration of SAP workloads and estimate costs.

Using time-partitioned tables is the Google-recommended best practice for managing time-series data like logs. By partitioning the table by day and setting the partition expiration to 45 days, BigQuery will automatically and efficiently delete partitions older than the specified limit. This approach optimizes storage costs and query performance because it avoids costly Data Manipulation Language (DML) operations that would require scanning the table to delete old rows. It is a more manageable and cost-effective solution than manual scripting or whole-table expiration.

A. Configuring table expiration would delete the entire table after 45 days, not just the old records, resulting in complete data loss.
C. BigQuery does not have a default behavior to automatically prune data; data retention must be explicitly configured by the user.
D. Using a script with DML statements (DELETE) to remove old records is expensive, as it requires a full table scan and incurs query costs.

1. Google Cloud Documentation, "Introduction to partitioned tables," Section: "Partition expiration." It states, "Setting a partition expiration is a cost-effective way to manage storage."

2. Google Cloud Documentation, "Managing partitioned tables," Section: "Updating a partition expiration time." This guide provides instructions on how to set partitionexpirationdays.

3. Google Cloud Documentation, "BigQuery best practices: cost control," Section: "Use table expiration or partitioned tables to prune old data." This section explicitly recommends partition expiration over DML for deleting old data.

The stack trace with java.lang.SecurityException: SHA1 digest error indicates that one or more JAR files are signed but the embedded signature/digest is invalid (often corrupted during packaging). Re-signing the JARs (or removing the invalid signatures) and redeploying resolves the SHA-1 digest mismatch so App Engine can verify the archive at class-load time.

A. Recompiling a single class with MD5 does not correct manifest-signature mismatches across the whole JAR.
C. The problem is signature verification, not missing libraries; uploading additional JARs will not fix an invalid digest.

1. Oracle

“JAR File Specification – Signing and Verification”

Section 4.2

explains SHA-1 digest verification errors.

2. Google Cloud

“App Engine Standard for Java – Troubleshooting deployment errors”

paragraph “java.lang.SecurityException: SHA1 digest error”

recommends re-signing or removing signatures.