Google Cloud Professional Cloud Architect Practice Exam

What the Google Cloud Professional Cloud Architect exam covers

• Designing and Planning a Cloud Solution Architecture170 questions
• Managing and Provisioning a Cloud Solution Infrastructure151 questions
• Designing for Security and Compliance153 questions
• Analyzing and Optimizing Technical and Business Processes117 questions
• Managing Implementation86 questions
• Ensuring Solution and Operations Excellence125 questions

Free Google Cloud Professional Cloud Architect sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 802.

1. Question 1Designing and Planning a Cloud Solution Architecture

   An application needs a relational database with global horizontal scale and strong consistency. Which Google Cloud service fits?

   • ABigtable
   • BFirestore
   • CCloud SQL
   • DCloud SpannerCorrect
   ✓ Correct answer: D

   Spanner is global relational database with ACID properties.

   Why the other options are wrong

   • ABigtable is incorrect because Lacks relational schema..
   • BFirestore is incorrect because Not suitable for this scenario..
   • CCloud SQL is incorrect because Regional only, not global..
2. Question 2Designing and Planning a Cloud Solution Architecture

   An application serves users only in one country and needs the lowest cost while keeping HA. Which storage/region strategy is most appropriate for its Cloud Storage data?

   • AUse Archive class for the primary serving data
   • BUse a regional bucket close to the users rather than a multi-region bucketCorrect
   • CAlways use a dual-region or multi-region bucket regardless of audience
   • DStore the data only on a single VM local SSD
   ✓ Correct answer: B

   Use a regional bucket close to the users rather than a multi-region bucket is correct.

   Why the other options are wrong

   • AUse Archive class for the primary serving data is incorrect because Not suitable for this scenario..
   • CAlways use a dual-region or multi-region bucket regardless of audience is incorrect because Not suitable for this scenario..
   • DStore the data only on a single VM local SSD is incorrect because Not suitable for this scenario..
3. Question 3Designing for Security and Compliance

   A deny IAM policy and an allow policy both apply to a principal for the same permission. Which wins?

   • AThe deny policy takes precedence and the action is blocked, regardless of any allow grantCorrect
   • BThe two policies cancel each other out and access silently defaults to the Owner role
   • CThe allow grant always overrides the deny policy for that same permission on the principal
   • DWhichever of the two policies was created or modified most recently is the one that wins
   ✓ Correct answer: A

   The deny policy takes precedence and the action is blocked, regardless of any allow grant is correct.

   Why the other options are wrong

   • BConflicting policies do not cancel to Owner; IAM deny policies are evaluated first and simply block the action.
   • CAn allow grant never overrides a matching deny, because deny is evaluated before allow and takes precedence.
   • DIAM evaluation is not based on creation time; a deny always wins regardless of when the policies were made.
4. Question 4Ensuring Solution and Operations Excellence

   A regional managed instance group behind a global external HTTP(S) Load Balancer keeps marking healthy VMs as unhealthy, causing them to be recreated in a loop. Logs show the health check probes time out, though the app responds fine on the VM. What is the most likely cause?

   • ACloud DNS holds a stale record for the backend, so the load balancer resolves the wrong address for the health check
   • BThe instances use Spot provisioning, so Compute Engine preempts them faster than the health check can mark them healthy
   • CA firewall rule does not allow the load balancer/health-check probe source ranges (130.211.0.0/22 and 35.191.0.0/16) to reach the instancesCorrect
   • DThe MIG autoscaler minimum is set too low, so the group keeps scaling in the instances before probes can complete
   ✓ Correct answer: C

   A firewall rule does not allow the load balancer/health-check probe source ranges (130.211.0.0/22 and 35.191.0.0/16) to reach the instances is correct.

   Why the other options are wrong

   • AThe load balancer probes instances by IP, not by DNS, so a stale Cloud DNS record would not cause health-check probes to time out.
   • BSpot preemption would show preemption events, not probe timeouts on a responsive app; provisioning model does not block probe traffic.
   • DA low autoscaler minimum affects instance count, not probe reachability; the app responds locally, so the probes are simply not arriving.
5. Question 5Designing and Planning a Cloud Solution Architecture

   A company requires a backup and recovery design for Compute Engine boot and data disks that supports point-in-time restore, low storage cost, and automated scheduling without writing custom scripts. Which Google Cloud design choice best meets these requirements?

   • AAttach a snapshot schedule (resource policy) to the disks so incremental snapshots are taken and retained automaticallyCorrect
   • BManually copy each disk's contents to a Cloud Storage bucket every night using a cron job running on the VM itself
   • CCreate a single full machine image once at setup and never refresh it, relying on that one image for all future recovery
   • DRely on regional persistent disks alone to provide point-in-time recovery of the boot and data disks after any failure
   ✓ Correct answer: A

   Compute Engine snapshot schedules (resource policies) let you define automated snapshot windows and retention rules that apply directly to persistent disks. Snapshots are incremental after the first full snapshot, so ongoing storage cost is low. Because snapshots are stored in Cloud Storage, they support point-in-time restore without any custom scripting or cron jobs - satisfying all three stated requirements.

   Why the other options are wrong

   • BA custom cron-based copy job is exactly the manual scripting the requirement wants to avoid and lacks incremental efficiency.
   • CA one-time machine image quickly becomes stale and provides no point-in-time restore for ongoing data changes.
   • DRegional persistent disks provide zonal redundancy, not point-in-time restore, so they cannot recover from data corruption at an earlier time.
6. Question 6Designing and Planning a Cloud Solution Architecture

   An architect must estimate cost as part of the migration business case. Migration Center has produced utilization data showing many on-premises VMs are heavily over-provisioned. How should the cost plan use this data to maximize savings when sizing Compute Engine targets?

   • ARight-size the Compute Engine targets to actual observed utilization rather than replicating the over-provisioned on-premises specificationsCorrect
   • BSize the cloud VMs to the on-premises peak utilization observed in the data so headroom is preserved for the busiest moments
   • CPurchase 3-year committed use discounts for the current over-provisioned specs first, then resize the machines downward afterward
   • DLift and shift each VM to the closest matching machine type, then rely on live migration to shrink them automatically over time
   ✓ Correct answer: A

   Migration Center collects CPU, memory, and disk utilization telemetry from on-premises VMs and uses it to generate right-sized Compute Engine recommendations. When on-premises VMs are heavily over-provisioned - a common pattern where capacity is reserved for peak loads that rarely occur - adopting the recommended smaller machine types directly translates to lower hourly costs. Right-sizing is one of the fastest paths to realizing cloud cost savings during migration and forms an important part of the business case.

   Why the other options are wrong

   • BSizing to peak rather than typical observed utilization carries most of the over-provisioning into the cloud and forfeits the savings the utilization data reveals.
   • CCommitting to discounts on the over-provisioned specs locks in the wasted capacity for years; you should right-size first and then apply commitments to the smaller footprint.
   • DLive migration relocates a running VM during host maintenance and never changes its machine type, so it cannot shrink an oversized instance automatically.
7. Question 7Designing for Security and Compliance

   A company must guarantee that no project anywhere in the organization can use a service account key downloaded as a JSON file, to eliminate long-lived credentials. Which control enforces this preventively across the whole org?

   • APeriodically scan projects with Security Command Center and delete any keys found
   • BApply the Organization Policy constraint constraints/iam.disableServiceAccountKeyCreation at the organization nodeCorrect
   • CGrant developers only roles/iam.serviceAccountUser so they cannot create keys
   • DSet a short rotation period on all existing service account keys
   ✓ Correct answer: B

   The Organization Policy constraint constraints/iam.disableServiceAccountKeyCreation is a boolean constraint that, when enforced at the organization node, prevents the creation of downloadable JSON or P12 key files for any service account in any project under that org. Because it is a preventive policy constraint evaluated before the action is taken, it is not bypassable by any user regardless of their IAM role, providing the strongest preventive control against long-lived credential creation.

   Why the other options are wrong

   • APeriodically scanning with Security Command Center is a detective control - it finds keys that already exist and have been in use, but keys created between scans represent a window of exposure that the question's 'preventively' requirement rules out.
   • CGranting developers only roles/iam.serviceAccountUser limits which service accounts they can act as but does not restrict their ability to create or manage service account keys - the roles/iam.serviceAccountKeyAdmin role and others still permit key creation.
   • DSetting a short rotation period on existing keys reduces the lifetime of credentials but does not prevent new keys from being created in the future, which fails the goal of guaranteeing that no JSON key can ever exist.
8. Question 8Analyzing and Optimizing Technical and Business Processes

   A microservice intermittently returns errors only in production. The team has no consistent way to reproduce the issue. Which troubleshooting best practice should they apply first to systematically isolate the cause?

   • AForm a hypothesis from observed telemetry (logs, metrics, traces), then test one variable at a time to confirm or eliminate itCorrect
   • BChange several configuration values simultaneously and watch to see whether the intermittent errors happen to stop
   • CRedeploy the entire platform from scratch in the hope that clearing any hidden state resolves the errors
   • DWait to see whether the intermittent errors eventually disappear on their own before starting any investigation
   ✓ Correct answer: A

   Systematic troubleshooting begins with gathering evidence from observability data - logs, metrics, and distributed traces - to generate a testable hypothesis about the cause. By then changing one variable at a time and observing whether the error rate changes, the team can confirm or rule out each hypothesis in isolation. Changing multiple things simultaneously makes it impossible to determine which change had which effect, extending the investigation.

   Why the other options are wrong

   • BChanging many variables at once makes it impossible to attribute any change in behavior to a specific cause, so it does not isolate the issue.
   • CA full redeploy may temporarily mask the problem but destroys the evidence needed to identify the actual cause.
   • DWaiting passively neither isolates the cause nor prevents recurrence and wastes the telemetry available for diagnosis.
9. Question 9Managing Implementation

   A team uses Cloud Code in VS Code to develop a Kubernetes app for GKE. They want to iterate locally with automatic rebuild and redeploy on every code save against a remote cluster. Which underlying tool does Cloud Code orchestrate for this continuous development loop?

   • ASkaffold, which Cloud Code uses to build, push, and deploy on file changesCorrect
   • Bterraform apply triggered on each save
   • Cgcloud builds submit run on a cron schedule
   • Dkubectl rollout restart issued manually by the developer
   ✓ Correct answer: A

   Cloud Code's inner development loop is powered by skaffold, an open-source tool that watches source files for changes, automatically rebuilds the container image, pushes it to a registry, and redeploys it to the target GKE cluster - all triggered on each save without any manual steps from the developer.

   Why the other options are wrong

   • Bterraform apply provisions or modifies infrastructure from declarative configuration files; it does not watch application source code and trigger container builds on save.
   • Cgcloud builds submit submits a build job to Cloud Build and must be invoked explicitly; it does not run on a schedule or respond to source file changes.
   • Dkubectl rollout restart is a manual command that recycles existing pods using the already-deployed image; it does not rebuild the container or pick up new source code changes.
10. Question 10Designing and Planning a Cloud Solution ArchitectureSelect all that apply

    A finance team is building the cost model for a steady-state production workload on Compute Engine that runs 24x7 for at least three years on a predictable fleet of N2 VMs, plus a separate fault-tolerant batch tier that runs sporadically. Which TWO purchasing decisions MINIMIZE cost while matching each workload's characteristics? (Choose TWO)

    • APurchase committed use discounts (CUDs) for the steady-state 24x7 N2 fleetCorrect
    • BRun the fault-tolerant batch tier on Spot VMs to capture the deepest discountsCorrect
    • CRun the steady-state fleet entirely on Spot VMs to maximize savings
    • DBuy committed use discounts for the sporadic batch tier to lock in capacity
    ✓ Correct answer: A, B

    Committed use discounts give the largest savings for predictable, sustained usage because you commit to a steady amount of vCPU/memory for one or three years, which exactly describes a 24x7 fleet that will run for at least three years. Spot VMs offer the deepest per-VM discounts but can be preempted at any time, making them ideal for fault-tolerant, restartable batch jobs that run sporadically. Matching pricing model to workload behavior is a core cost-optimization design skill. Putting steady-state production on Spot risks frequent preemption, and committing to sporadic batch wastes a commitment you cannot keep utilized.

    Why the other options are wrong

    • CSpot VMs can be preempted with little notice, which is unacceptable for a steady-state 24x7 production fleet that must stay available.
    • DCUDs require sustained, predictable usage to be cost-effective; a sporadic batch tier would leave the commitment underutilized, increasing effective cost.

Related Google resources

• Google Cloud Professional Cloud Architect study guideKey concepts
• Google practice examsAll Google
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Google Cloud Professional Cloud Security Engineer practice examRelated
• Google Cloud Professional Cloud Network Engineer practice examRelated
• Associate Google Workspace Administrator practice examRelated

Google Cloud Professional Cloud Architect practice exam FAQ