Google Cloud Professional Cloud Architect Practice Exam

What the Google Cloud Professional Cloud Architect exam covers

• Designing and Planning a Cloud Solution Architecture175 questions
• Managing and Provisioning a Cloud Solution Infrastructure156 questions
• Designing for Security and Compliance158 questions
• Analyzing and Optimizing Technical and Business Processes121 questions
• Managing Implementation89 questions
• Ensuring Solution and Operations Excellence128 questions

Free Google Cloud Professional Cloud Architect practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 827.

1. Question 1Designing and Planning a Cloud Solution Architecture

   A global payments platform must serve users on several continents from a single relational schema, keep externally consistent ACID transactions across regions, and scale writes horizontally beyond one machine as volume grows. Cloud SQL's single-writer ceiling is a concern. Which Google Cloud database fits best?

   • ABigtable
   • BCloud SQL with cross-region read replicas
   • CFirestore in Datastore mode
   • DCloud Spanner (multi-region)Correct
   ✓ Correct answer: D

   Cloud Spanner shards relational data across nodes with TrueTime-backed synchronous replication, giving externally consistent ACID SQL transactions while scaling writes horizontally across regions in a multi-region instance. Cloud SQL has a single primary write node and is regional, so it cannot scale writes globally.

   Why the other options are wrong

   • ABigtable is a NoSQL wide-column store without a relational schema, SQL joins, or multi-row ACID transactions, so it cannot back a relational payments ledger.
   • BCloud SQL read replicas scale reads only; writes stay on a single regional primary, so it cannot scale writes horizontally or span continents with strong consistency.
   • CFirestore in Datastore mode is a document and entity store without a fixed relational schema or SQL joins, so it does not meet the relational, strongly consistent requirement.
2. Question 2Ensuring Solution and Operations Excellence

   An e-commerce site must absorb predictable flash-sale traffic spikes without latency degradation or running excess capacity beforehand. Which approach best balances performance and cost?

   • ARely only on reactive CPU-target autoscaling, adding instances after the spike traffic arrives
   • BPredictive autoscaling that pre-provisions capacity ahead of forecast demand, scaling down afterwardCorrect
   • CPre-warm by scheduling a fixed over-provisioned instance count for the entire sale day in advance
   • DFront the site with Cloud CDN alone and leave the backend fleet fixed at its baseline size
   ✓ Correct answer: B

   Compute Engine managed instance group predictive autoscaling reads historical load and adds VMs minutes before forecast demand, so capacity is already warm when the sale starts and scales in afterward. Reactive CPU-target scaling only responds after load arrives, causing latency until new VMs boot.

   Why the other options are wrong

   • AReactive CPU-target autoscaling responds only after the spike is already underway, so new VMs are still booting during the critical first minutes, allowing the latency degradation the scenario forbids.
   • CScheduling a fixed over-provisioned count for the whole sale day keeps excess VMs running during low-traffic hours, which is exactly the pre-provisioned idle cost the requirement rules out.
   • DCloud CDN caches static assets but cannot serve dynamic cart and checkout traffic; leaving the backend fixed at baseline means it is overwhelmed once the sale spike arrives.
3. Question 3Designing for Security and Compliance

   You configure CMEK for a Cloud Storage bucket. What happens if the Cloud KMS key is later disabled or destroyed?

   • AGoogle automatically re-encrypts the affected objects with a Google-managed key so access continues
   • BObjects encrypted with that key become inaccessible until the key is re-enabled (and are unrecoverable if destroyed)Correct
   • CThe affected objects are silently deleted from the bucket in order to free up storage space
   • DNothing changes at all, because CMEK keys are only stored as metadata alongside the objects
   ✓ Correct answer: B

   Objects encrypted with that key become inaccessible until the key is re-enabled (and are unrecoverable if destroyed) is correct.

   Why the other options are wrong

   • AGoogle does not fall back to a Google-managed key for CMEK-encrypted objects; without the customer key they cannot be decrypted.
   • CDisabling or destroying the key does not delete the objects; it makes them undecryptable rather than removing them.
   • DCMEK keys actually encrypt the data encryption keys, so disabling or destroying them directly blocks access to the objects.
4. Question 4Analyzing and Optimizing Technical and Business Processes

   A monthly BigQuery bill spiked sharply. Investigation shows analysts run 'SELECT *' against a 40 TB unpartitioned table for dashboards that only need the last 7 days. Which change most directly reduces query cost?

   • AAdd a Cloud Armor security policy in front of BigQuery to filter the analysts' expensive queries before they run
   • BMove the dataset into a multi-region Cloud Storage bucket so the same queries scan fewer bytes and cost less
   • CPartition the table by date and have queries select only needed columns and the recent partitionsCorrect
   • DSwitch the underlying BigQuery table storage to the Coldline class so scanning historical data becomes cheaper
   ✓ Correct answer: C

   Partition the table by date and have queries select only needed columns and the recent partitions is correct.

   Why the other options are wrong

   • ACloud Armor is a web application firewall for HTTP(S) traffic and cannot sit in front of BigQuery or reduce bytes scanned per query.
   • BBigQuery on-demand cost is driven by bytes scanned, not by moving data to a Cloud Storage bucket, which does not change query pricing.
   • DBigQuery does not use Coldline storage for query tables, and cost is based on bytes scanned, so a storage class switch would not reduce it.
5. Question 5Designing and Planning a Cloud Solution ArchitectureSelect all that apply

   An architect is balancing the cost and performance pillars while designing a multi-tier web platform that must stay responsive under variable load without over-provisioning. Which TWO design choices align with both pillars simultaneously? (Choose TWO)

   • AAdd a managed cache such as Memorystore in front of expensive database queries to cut latency and reduce database loadCorrect
   • BPermanently provision the managed instance group at forecast peak capacity so guaranteed headroom is always available
   • CUse a managed instance group with autoscaling so capacity tracks actual demandCorrect
   • DStore all media in a single regional Cloud Storage bucket and serve it directly from that origin to users worldwide
   ✓ Correct answer: A, C

   Fronting expensive database queries with Memorystore cuts read latency on cache hits and lowers database load, serving both cost and performance. An autoscaling managed instance group tracks demand so capacity rises under load and falls when idle, avoiding permanent over-provisioning - satisfying both pillars at once.

   Why the other options are wrong

   • BPermanently provisioning the group at peak capacity guarantees headroom but wastes money on idle resources during low traffic, defeating the cost pillar.
   • DServing all media from a single regional bucket to a global audience adds latency for distant users and concentrates egress in one region, hurting performance with no cost gain.
6. Question 6Managing and Provisioning a Cloud Solution Infrastructure

   A security team must inspect and block malicious north-south and east-west traffic inside a VPC at Layer 7 using a Google-managed threat-detection engine, without deploying third-party appliances. Which Google Cloud capability should you provision?

   • ACloud Next Generation Firewall (Cloud NGFW) Enterprise with the intrusion prevention serviceCorrect
   • BStandard VPC firewall rules that allow or deny traffic based only on protocol, ports, and IP ranges
   • CCloud Armor security policies attached to the backend service of an external Application Load Balancer
   • DHierarchical firewall policies applied at the organization node to broadly govern allowed network flows
   ✓ Correct answer: A

   Cloud Next Generation Firewall (Cloud NGFW) Enterprise with the intrusion prevention service (IPS) provides Layer 7 deep packet inspection using a Google-managed threat signature engine (powered by Palo Alto Networks) to detect and block known malware, exploits, and command-and-control traffic for both inbound/outbound (north-south) and inter-VM (east-west) traffic within a VPC - without requiring deployment or management of third-party virtual appliances.

   Why the other options are wrong

   • BBasic VPC firewall rules match on ports and IP ranges only and perform no Layer 7 inspection or threat detection of malicious payloads.
   • CCloud Armor protects internet-facing load balancer backends at the edge and does not inspect east-west traffic inside the VPC.
   • DHierarchical firewall policies enforce allow/deny rules across the hierarchy but include no managed intrusion-prevention engine.
7. Question 7Designing for Security and Compliance

   A multinational must guarantee that resources for its EU subsidiary are only ever created in EU regions to satisfy data residency rules, even if an engineer mistakenly selects a US region. Which mechanism enforces this preventively?

   • AIAM Conditions that restrict resource creation to users whose identities are based in EU member countries
   • BOrganization Policy constraint constraints/gcp.resourceLocations limited to EU value groups, applied to the EU folderCorrect
   • CA billing budget alert that fires whenever spend appears against resources in any non-EU Google Cloud region
   • DCloud Audit Logs reviewed regularly to detect and flag any resources that were created outside the EU regions
   ✓ Correct answer: B

   The constraints/gcp.resourceLocations Organization Policy constraint restricts which regions and multi-regions are allowed for resource creation. Google provides predefined value groups such as 'in:eu-locations' that cover all current and future EU regions. When this constraint is applied to the EU subsidiary's folder, any attempt to create a resource in a non-EU region - including accidental selections by engineers - is denied by the policy before the API call succeeds, providing a preventive data residency control.

   Why the other options are wrong

   • AIAM Conditions gate who can act based on identity attributes, not where resources may be created, so a user could still pick a US region.
   • CA budget alert only notifies after spend occurs and does not preventively block resource creation in a US region.
   • DAudit logs detect out-of-region resources after the fact but do not prevent an engineer from creating them in the first place.
8. Question 8Analyzing and Optimizing Technical and Business Processes

   A team wants to ensure that performance does not regress between releases. Which testing practice in the CI/CD pipeline most directly catches performance regressions before production?

   • AAutomated load and performance tests in a staging environment that fail the pipeline when latency or throughput crosses defined thresholdsCorrect
   • BRelying on production users to report back through support channels whenever the application starts to feel noticeably slow
   • CRunning only the existing unit tests, assuming they already exercise every code path and cover performance adequately
   • DManually timing a single request in the developer's browser just before each release to estimate performance changes
   ✓ Correct answer: A

   Embedding automated load and performance tests directly in the CI/CD pipeline, with explicit pass/fail thresholds for latency and throughput, creates an objective gate that blocks a release the moment a regression is introduced. Running these tests against a staging environment that mirrors production load characteristics gives statistically meaningful signal before any user is affected.

   Why the other options are wrong

   • BUser reports arrive only after the regression is already in production, so they cannot catch it beforehand.
   • CUnit tests verify correctness of code paths, not latency or throughput, so they do not detect performance regressions.
   • DTiming one request by hand is not statistically meaningful and cannot reliably detect regressions before production.
9. Question 9Managing Implementation

   A team wants the gcloud CLI in a CI/CD pipeline to use a specific service account identity non-interactively, without leaving an exported JSON key on disk. Which approach best follows current best practices?

   • AUse Workload Identity Federation so the CI provider's token is exchanged for short-lived Google Cloud credentials, then run gcloud with that identityCorrect
   • BRun gcloud auth activate-service-account with a long-lived exported JSON key stored as a masked CI secret variable that is rotated manually every quarter
   • CLet the pipeline use the CI runner's own default service account with broad cloud-platform scope instead of the intended one
   • DRun gcloud auth application-default login once and commit the generated user credential file for later pipeline runs to reuse
   ✓ Correct answer: A

   Workload Identity Federation lets an external CI provider exchange its native OIDC token for short-lived Google Cloud credentials, so gcloud authenticates as a specific service account with no JSON key ever created or stored on disk. This removes the risk of long-lived key rotation and leakage through CI logs or repo history.

   Why the other options are wrong

   • BStoring an exported JSON key as a CI secret still materializes a long-lived key that can leak through logs or history, exactly what the requirement forbids.
   • CThe CI runner's default service account is a different, often over-privileged identity; it does not run the job as the specific intended service account.
   • Dgcloud auth application-default login is interactive and yields user credentials, not the service account identity, and committing that file leaks long-lived credentials.
10. Question 10Managing and Provisioning a Cloud Solution Infrastructure

    You provision Compute Engine persistent disks for a fleet of production VMs and must guarantee automated, application-consistent point-in-time backups retained for 14 days, created with minimal operational overhead and the lowest possible performance impact. What is the BEST approach?

    • AAttach a resource policy that defines a snapshot schedule with the desired frequency, retention, and storage location to each diskCorrect
    • BWrite a cron job on each VM that runs gcloud compute disks snapshot and manually deletes snapshots older than 14 days
    • CCreate a custom machine image of each VM nightly and store the images in a dedicated project
    • DEnable disk cloning, which keeps a continuously updated independent copy of every disk
    ✓ Correct answer: A

    Snapshot schedules are implemented as resource policies that you attach to one or more persistent disks; they automatically create incremental snapshots on a defined cadence, apply a retention window (auto-deleting old snapshots), and let you choose a regional or multi-regional storage location. Snapshots are incremental and taken without detaching the disk, minimizing performance impact, and for application consistency you can use the guest-flush option or VSS on Windows. This is the lowest-overhead, native, fully managed backup mechanism for persistent disks. Hand-rolled cron jobs reinvent retention logic and are error-prone, while machine images and clones are heavier and not designed as a rolling backup retention solution.

    Why the other options are wrong

    • BA per-VM cron script reimplements scheduling and retention manually, is brittle and operationally costly, and is the opposite of the minimal-overhead managed solution requested.
    • CCustom machine images capture the whole VM configuration, are heavier and slower to manage for routine rolling backups, and lack a built-in 14-day retention policy.
    • DDisk clones create an independent full copy at a point in time; they are not a scheduled, retention-managed backup mechanism and do not continuously update.

Who this Google Cloud Professional Cloud Architect practice exam is for

This practice set is for anyone preparing for the Google Cloud Professional Cloud Architect exam at the advanced level - from first-time candidates building a foundation to experienced Google practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this Google Cloud Professional Cloud Architect practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real Google Cloud Professional Cloud Architect exam.

Related Google resources

• Google Cloud Professional Cloud Architect study guideKey concepts
• Google practice examsAll Google
• Certification pathWhere this fits
• GCP Associate Cloud Engineer vs Cloud ArchitectComparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• Google Cloud Professional Cloud Database Engineer practice examRelated
• Google Cloud Professional Cloud Developer practice examRelated
• Google Cloud Professional Cloud DevOps Engineer practice examRelated

Google Cloud Professional Cloud Architect practice exam FAQ