Managing and provisioning a solution infrastructure
Free Google Cloud Certified - Professional Cloud Architect practice — 6 questions on Managing and provisioning a solution infrastructure, with explanations. No sign-up. Full 12-question mixed test →
A company uses Shared VPC with a host project 'net-host' and two service projects, 'team-a-svc' and 'team-b-svc'. Team A's project admins need to create and manage firewall rules that apply only to instances tagged 'team-a-web' in the Shared VPC network, without being able to view or modify firewall rules that affect Team B's resources. Which approach BEST meets this requirement?
In Shared VPC, firewall rules always live in the host project, so any admin who manages them needs a role granted on the host project. Compute Security Admin grants firewall rule management, and an IAM condition can scope that grant to resources matching a specific tag, letting Team A manage only its own rules without touching Team B's.
An organization has three VPC networks: vpc-finance, vpc-hr, and vpc-shared-services. vpc-finance is peered with vpc-shared-services, and vpc-hr is also peered with vpc-shared-services. A new requirement states that instances in vpc-finance must reach internal load balancers in vpc-hr using internal IP addresses, and the organization expects to add several more department VPCs with similar cross-communication needs in the near future. Which solution BEST meets these requirements with minimal ongoing management overhead?
Shared VPC or Network Connectivity Center's hub-and-spoke model centralizes connectivity so that as new departments are added, they simply attach to the shared network or hub, avoiding a growing full mesh of point-to-point connections and reducing long-term operational overhead.
A batch-processing workload runs on Compute Engine instances that have no external IP addresses. The instances must read objects from Cloud Storage and must also download base container images from Docker Hub on the public internet during startup. Which configuration is required to satisfy both requirements?
Private Google Access lets instances without external IPs reach Google APIs (like Cloud Storage) over Google's internal network path without consuming Cloud NAT resources, while Cloud NAT is required separately to allow outbound connections to non-Google internet destinations like Docker Hub. Both are needed together to satisfy the full requirement.
A platform team already manages all Kubernetes workloads through GitOps: manifests are stored in a Git repository and reconciled onto GKE clusters by a continuous delivery operator. They now want to provision GCP resources, such as Cloud SQL instances and Cloud Storage buckets, using the same GitOps workflow and the same kubectl-based tooling, with the resources' state visible through the Kubernetes API alongside their application objects. Which tool should they use to provision the GCP resources?
Config Connector exposes GCP resources as Kubernetes Custom Resources, letting teams manage Cloud SQL instances, Cloud Storage buckets, and other GCP services with kubectl and standard Kubernetes-native GitOps tooling, with state tracked in the Kubernetes API alongside application manifests.
A team uses Cloud Build to build container images and wants a fully managed continuous delivery pipeline that automatically deploys new releases to a staging GKE cluster, then requires an explicit manual approval before that same release is promoted to the production GKE cluster. Which approach implements this promotion workflow with a built-in approval gate?
Cloud Deploy is the managed continuous delivery service for GKE (and other runtimes) that models a pipeline of progressive targets and natively supports requiring manual approval before a release is promoted to a given target, such as production, which is exactly the described gate.
A company requires a hybrid connection between its on-premises data center and its VPC network with these requirements: 10 Gbps aggregate throughput, traffic that never traverses the public internet, and a 99.99% availability SLA. Which configuration BEST meets these requirements?
Google's documented Interconnect SLA tiers require two or more Dedicated Interconnect connections located in at least two different metropolitan (Interconnect) locations, along with redundant Cloud Routers, to qualify for the 99.99% availability SLA, while keeping traffic entirely off the public internet.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
undefined $34.99 with code A5F51EAB51242FE60905 — valid through Sep 23.
Get my $34.99 deal →