Ten questions at a time, drawn from 100. Every answer is explained. Nothing is saved and no account is needed.
An organization wants to deploy an application that scales automatically based on incoming web traffic and requires no server management. Which GCP service category is most appropriate?
Practice quiz for Google Cloud (GCP). Scores are not saved.
An organization wants to deploy an application that scales automatically based on incoming web traffic and requires no server management. Which GCP service category is most appropriate?
Answer: Cloud Run. Cloud Run is a serverless platform that abstracts away infrastructure. Compute Engine requires manual management of VMs, GKE manages complex container orchestration, and Persistent Disk is a storage component, not a compute execution environment.
From lesson: GCP Overview and Service Categories
Which GCP storage service is best suited for hosting static website content that needs to be accessed globally with low latency?
Answer: Cloud Storage. Cloud Storage buckets can be configured for global access and are optimized for static assets. Cloud SQL and Cloud Spanner are database services, and Filestore is for high-performance file sharing, none of which are designed for static web hosting.
From lesson: GCP Overview and Service Categories
You need to migrate an on-premises relational database that requires high availability and automated backups without managing the database engine version. What should you use?
Answer: Cloud SQL. Cloud SQL is a fully managed relational database service. Compute Engine requires you to manage the database engine, Cloud Storage is for objects, and Dataproc is for big data processing, not transactional database hosting.
From lesson: GCP Overview and Service Categories
Why would a company choose a Virtual Private Cloud (VPC) over a public-facing configuration for their internal application servers?
Answer: To provide a private, isolated network environment for security and resource grouping. VPCs provide logical isolation for resources. VPCs do not affect internet speed, replace the need for IAM, or interact with database schema generation, which is a database layer task.
From lesson: GCP Overview and Service Categories
In the context of GCP resource hierarchy, what is the primary purpose of a 'Project'?
Answer: To act as the foundation for creating resources, enabling APIs, and managing billing. Projects are the base level for resource management and billing. They do not define physical locations, replace compute resources, or serve as identity providers (which are handled by Cloud Identity/IAM).
From lesson: GCP Overview and Service Categories
An application running on a Compute Engine instance needs to read files from a Cloud Storage bucket. What is the most secure way to grant this access?
Answer: Create a service account, assign the 'Storage Object Viewer' role to it, and attach it to the instance.. Attaching a custom service account is correct because it uses Workload Identity. Storing keys is insecure. Granting the default service account broad access violates least privilege. Making the bucket public is a security vulnerability.
From lesson: IAM β Identity and Access Management
A developer needs the ability to start and stop Compute Engine instances but should not be able to delete them. How should this be handled?
Answer: Create a custom role containing only 'compute.instances.start' and 'compute.instances.stop' permissions.. Custom roles are the only way to satisfy the specific constraint of allowing stop/start without deletion. Compute Admin and Owner include delete permissions. Viewer only allows reading, not performing actions.
From lesson: IAM β Identity and Access Management
Which statement best describes the hierarchy of IAM policy inheritance in Google Cloud?
Answer: Policies at the Organization, Folder, and Project levels are additive.. IAM policies are additive; an identity receives the union of all permissions granted at the Organization, Folder, Project, and Resource levels. They do not override each other, and they are not restricted to just the project level.
From lesson: IAM β Identity and Access Management
Your team needs to allow an external auditor read-only access to a specific project for one week. What is the best practice?
Answer: Grant the auditor the 'Viewer' role at the project level and remove it after a week.. Granting the 'Viewer' role provides necessary read-only access. Sharing service accounts is a security breach. Owner is excessive and violates least privilege, and folder-level access is too broad.
From lesson: IAM β Identity and Access Management
What happens if a user is granted the 'Storage Object Admin' role on a bucket and the 'Viewer' role on the project containing that bucket?
Answer: The user has the combined permissions of both roles.. IAM permissions are additive. The user receives all permissions from both roles. There is no conflict or override mechanism; the result is the union of all granted rights.
From lesson: IAM β Identity and Access Management
A team needs to host a static website on GCS. Which configuration is required for the bucket to serve the site content correctly?
Answer: Both enable website hosting and grant public read access to the objects.. To host a website, you must both configure the bucket for website hosting (to handle index/error pages) AND grant public read access to the objects, as buckets are private by default. Just enabling the property is insufficient without IAM/ACL permissions.
From lesson: Cloud Storage (GCS) β Buckets and Objects
You have a requirement to move data that hasn't been accessed in 90 days to a cheaper storage tier automatically. How do you implement this?
Answer: Use Object Lifecycle Management policies to transition storage classes based on age.. Object Lifecycle Management is the native, serverless way to transition objects between classes. Options 1, 3, and 4 are inefficient, manual, or incur unnecessary compute costs compared to the built-in policy engine.
From lesson: Cloud Storage (GCS) β Buckets and Objects
What is the primary difference between a bucket's 'Uniform' vs 'Fine-grained' access control?
Answer: Uniform control disables ACLs, relying entirely on IAM; Fine-grained allows individual object ACLs.. Uniform bucket-level access disables legacy ACLs, simplifying management through IAM. Fine-grained allows for more complex, older-style ACLs on individual objects. The others are incorrect as they conflate performance or scope with the access control mechanism.
From lesson: Cloud Storage (GCS) β Buckets and Objects
Your application uploads sensitive files that must be encrypted at rest, but your security team requires you to use your own encryption keys. What should you do?
Answer: Use Customer-Managed Encryption Keys (CMEK) via Cloud Key Management Service.. CMEK allows you to control the keys used to encrypt GCS data within GCP. While local encryption is possible, it creates overhead for data processing. Bucket Lock relates to retention, not encryption. External storage is not a standard GCS encryption feature.
From lesson: Cloud Storage (GCS) β Buckets and Objects
You accidentally deleted a critical object from a bucket. What is the most effective way to recover it?
Answer: Use the 'Restore' feature if Object Versioning was enabled on the bucket.. Object Versioning keeps versions of objects when deleted or overwritten. Without it, GCS does not have a 'Trash' folder or a support-level restore for individual objects. Audit logs provide metadata about the deletion, not the content of the file itself.
From lesson: Cloud Storage (GCS) β Buckets and Objects
An application on Compute Engine experiences inconsistent traffic. You want to ensure the Managed Instance Group (MIG) scales based on the number of requests per second rather than CPU usage. What should you do?
Answer: Create an autoscaling policy based on a custom metric via Cloud Monitoring. Custom metrics via Cloud Monitoring are the correct way to handle application-specific scaling triggers like requests per second. CPU utilization (option 2) is often a poor proxy for request volume. Predictive autoscaling (option 1) forecasts demand but doesn't solve for specific metric triggers. Manual resizing (option 3) defeats the purpose of the autoscaler.
From lesson: Compute Engine β VMs and Autoscaling
Your Managed Instance Group is scaling up and down too frequently. Which configuration change would most effectively reduce this 'flapping' behavior?
Answer: Increase the cooldown period. The cooldown period forces the MIG to wait before taking further action, allowing newly created instances time to stabilize. Decreasing the max count (option 1) limits capacity, not stability. Preemptible VMs (option 2) actually increase volatility. Disk I/O (option 3) is unrelated to the flapping issue.
From lesson: Compute Engine β VMs and Autoscaling
What is the primary benefit of using a Managed Instance Group (MIG) over an Unmanaged Instance Group for production workloads?
Answer: MIGs automatically replace instances that crash or become unhealthy. MIGs provide self-healing, ensuring instances stay running and healthy automatically. Option 1 is incorrect because MIGs require uniform templates. Option 2 is incorrect as unmanaged groups can also use static IPs. Option 3 is incorrect as both group types integrate with load balancers equally.
From lesson: Compute Engine β VMs and Autoscaling
When performing a rolling update on a MIG to change the machine image, how can you ensure that you don't lose all capacity simultaneously?
Answer: Set the max surge and max unavailable values in the update policy. The update policy's 'max surge' and 'max unavailable' parameters control how many instances are created or taken down at once. Disabling health checks (option 1) risks downtime. Manual deletion (option 2) is inefficient. Cooldown (option 3) does not manage concurrent instance updates.
From lesson: Compute Engine β VMs and Autoscaling
You have a batch processing application that can be interrupted and resumed later. Which VM configuration provides the most cost-effective solution?
Answer: Spot VMs. Spot VMs are designed specifically for fault-tolerant, interruptible workloads at a significant discount. Sole-tenant nodes (option 1) and Reserved instances (option 2) are generally more expensive and geared toward predictable workloads. E2 instances (option 3) are standard VMs and lack the cost benefits of Spot.
From lesson: Compute Engine β VMs and Autoscaling
An application requires an environment where HTTP requests can trigger logic, but you need full control over the runtime environment, including custom binaries. Which service should you choose?
Answer: Cloud Run. Cloud Run is container-based, allowing for custom binaries and dependencies. Cloud Functions limits the runtime environment to specific supported languages. App Engine is a PaaS, and Cloud SQL is a database service.
From lesson: Cloud Run and Cloud Functions
You have a function that processes file uploads from Cloud Storage. The function sometimes takes 15 minutes to complete. What is a potential issue?
Answer: Cloud Functions has a maximum timeout of 9 minutes.. Cloud Functions (2nd gen) has a hard timeout limit of 60 minutes, but 1st gen is limited to 9 minutes. The other options are incorrect because Cloud Functions handle storage events well, and timeout is a service limit, not a deployment size limit.
From lesson: Cloud Run and Cloud Functions
How does Cloud Run scale to zero?
Answer: It removes all running container instances when there are no incoming requests.. Cloud Run scales to zero by shutting down all container instances when no traffic is present, saving costs. It does not keep warm instances, nor does it switch to Cloud Functions.
From lesson: Cloud Run and Cloud Functions
Which mechanism provides the most secure way to authenticate a Cloud Run service that is internal-only?
Answer: Using IAM service-to-service authentication via Identity Tokens.. Using Identity Tokens via IAM is the standard, secure way for Google Cloud services to communicate. API keys are less secure, and public ingress is unnecessary for internal services.
From lesson: Cloud Run and Cloud Functions
What is a primary advantage of using Cloud Functions over Cloud Run for simple event-driven tasks?
Answer: Cloud Functions requires zero configuration regarding containers or images.. Cloud Functions is a Function-as-a-Service (FaaS) model that abstracts away the container layer entirely, unlike Cloud Run which requires container management. The other options are incorrect as Cloud Run is often more cost-effective for high volume and supports more complex configurations.
From lesson: Cloud Run and Cloud Functions
Why is BigQuery's columnar storage format advantageous for analytical queries compared to row-based storage?
Answer: It enables the query engine to read only the specific columns needed, reducing I/O.. Columnar storage allows BigQuery to read only the columns relevant to the query, minimizing data scanned, which is the primary cost driver. Row-based storage (Option A) is for OLTP. Option C is false as data is regional by default. Option D is incorrect because BigQuery does not use traditional indexes.
From lesson: BigQuery β Architecture and Basics
A data analyst is running a query over a massive table that spans several years of data. Which optimization technique will most directly reduce the cost of queries filtered by a specific time range?
Answer: Partitioning the table by the timestamp column.. Partitioning divides the table into segments (e.g., daily), allowing BigQuery to prune partitions that don't match the query filter, thus reducing bytes scanned. Clustering (Option A) improves performance but is less effective than partitioning for time-range filtering. Option B is for pre-computing results, and Option D refers to storage cost, not query cost.
From lesson: BigQuery β Architecture and Basics
How does the separation of compute and storage in BigQuery impact its scalability?
Answer: It allows users to scale compute resources independently of the volume of data stored.. BigQuery's architecture decouples storage (managed by Colossus) from compute (Dremel), allowing users to scale compute power based on query complexity without migrating data. Option B describes older warehouse models. Option C is false because performance scales with compute slots. Option D is false because the platform handles scaling automatically.
From lesson: BigQuery β Architecture and Basics
When is it most appropriate to use Clustering in BigQuery?
Answer: When queries frequently filter by multiple columns or require high-cardinality grouping.. Clustering improves query performance for filters and groupings on columns with high cardinality or when filtering by multiple columns within a partition. It is not for row-level inserts (Option C) and is usually used in conjunction with partitioning, not as a replacement (Option D).
From lesson: BigQuery β Architecture and Basics
You have a dashboard that runs the same query every hour on a table that is only updated once a day. How can you optimize for both cost and performance?
Answer: Use BigQuery cached results for subsequent queries.. BigQuery caches query results for 24 hours. If the underlying data has not changed, running the same query retrieves results from cache at zero cost. Option A increases cost unnecessarily. Option C is not possible in standard BigQuery. Option D would incur unnecessary processing costs.
From lesson: BigQuery β Architecture and Basics
A table receives data continuously throughout the day, and queries primarily filter by 'event_timestamp'. To optimize cost and performance, what is the best strategy?
Answer: Partition by event_timestamp (day) and cluster by frequently filtered columns.. Partitioning by day on the timestamp is the standard approach to enable partition pruning. Clustering then allows further narrowing of data within those partitions. Option 0 is redundant as the partition already acts as a filter. Option 2 is less efficient than native partitioning. Option 3 creates massive management overhead.
From lesson: BigQuery β Partitioning, Clustering, and Optimization
Which of the following scenarios best justifies the use of Clustering instead of Partitioning?
Answer: The data is queried based on a specific, high-cardinality ID field used for joining.. Clustering is designed for high-cardinality columns that are frequently used in filters or joins, allowing for efficient data block skipping. Partitioning (Option 1) is better for data lifecycle management. Option 2 does not benefit significantly from either. Option 3 is irrelevant, as clustering is ineffective if queries don't prune data.
From lesson: BigQuery β Partitioning, Clustering, and Optimization
If you have a query that filters by multiple columns frequently, how should you configure the clustering keys?
Answer: Order the clustering columns by frequency and selectivity, placing the most used ones first.. The order of clustering columns matters; BigQuery sorts data based on the defined order. Placing highly selective and frequently filtered columns first maximizes the efficacy of data pruning. Option 0 ignores the significance of order. Option 1 is incorrect as query selectivity is key. Option 3 is the opposite of the best practice.
From lesson: BigQuery β Partitioning, Clustering, and Optimization
Why does BigQuery's automatic re-clustering happen in the background?
Answer: To ensure that new data inserted into the table remains optimized for performance.. As data is streamed or modified, the 'clustering' order can become fragmented. Background re-clustering maintains the performance benefits of the original clustering configuration. Option 1 is false (compression is automatic). Option 2 is unrelated to clustering. Option 3 is incorrect as partitioning limits are a constraint, not a goal.
From lesson: BigQuery β Partitioning, Clustering, and Optimization
When considering the cost of queries, how do Partitioning and Clustering differ in their impact?
Answer: Both reduce costs by only scanning data blocks that match the query filters.. Both techniques enable BigQuery to skip scanning irrelevant data blocks, which directly reduces the amount of data processed and thus reduces query costs. Option 0 is wrong as both primarily affect compute costs by reducing bytes processed. Option 2 depends on data structure, not just size. Option 3 is a misconception about the purpose of these features.
From lesson: BigQuery β Partitioning, Clustering, and Optimization
When a Dataflow job experiences 'Hot Keys' during a GroupByKey operation, what is the most effective approach to mitigate performance bottlenecks?
Answer: Use a Combine transform with pre-aggregation (like map-side combine) to reduce data volume. Pre-aggregation reduces the amount of data shuffled, which is the primary cause of hot key latency. Increasing workers (A) doesn't solve the skew where one key is too large for a single partition. (C) and (D) do not address the fundamental logic of data distribution.
From lesson: Dataflow β Apache Beam on GCP
Which component of Dataflow automatically scales the number of workers based on the current workload?
Answer: The Dataflow Service autoscaler. The Dataflow Service includes an autoscaler that dynamically adjusts worker counts. Pub/Sub (B) is an input source, the SDK (C) is for configuration, and BigQuery (D) is an output destination; none of these manage Dataflow compute resources.
From lesson: Dataflow β Apache Beam on GCP
Why should you use the 'setup()' method instead of the class constructor in a DoFn?
Answer: It allows for resource initialization once per worker instance rather than per element. Setup is called when a worker initializes the instance, making it perfect for expensive operations like creating database clients. Constructors (A) are inefficient, and (B) and (D) are incorrect because setup does not control concurrency or memory management.
From lesson: Dataflow β Apache Beam on GCP
What is the primary difference between Fixed Windows and Sliding Windows in Dataflow?
Answer: Fixed windows create non-overlapping segments, while sliding windows create overlapping segments. Fixed windows (tumbling) partition data into distinct, non-overlapping intervals, while sliding windows allow for periods of overlap to analyze trends across specific time durations. (A) is the reverse, (B) is a misunderstanding, and (D) is incorrect as both are fully managed.
From lesson: Dataflow β Apache Beam on GCP
When building a pipeline that writes to BigQuery, which mode should be chosen to ensure Dataflow doesn't block while waiting for BigQuery streaming inserts?
Answer: Use Storage Write API for high-throughput streaming. The Storage Write API is designed to handle high-throughput, low-latency streaming inserts into BigQuery without the bottlenecks associated with older legacy methods. (A) is slower, (C) adds unnecessary steps, and (D) does not impact how data is written to BigQuery.
From lesson: Dataflow β Apache Beam on GCP
When migrating an existing Hadoop/Spark workload to Google Cloud, what is the primary benefit of choosing Dataproc over a self-managed cluster on Compute Engine?
Answer: It provides managed orchestration, automated scaling, and integration with GCP monitoring tools.. Option 2 is correct because Dataproc is a managed service that handles cluster lifecycle and monitoring. Option 1 is false as you still pay for VMs. Option 3 is false as code conversion does not happen. Option 4 is false as encryption requires explicit configuration.
From lesson: Dataproc β Managed Spark and Hadoop
A data engineer needs to run a periodic batch process that takes 30 minutes to complete once per day. Which Dataproc cluster strategy is most cost-effective?
Answer: Use ephemeral clusters that are created specifically for the job and deleted immediately after completion.. Option 3 is the most cost-effective as you only pay for the 30 minutes of compute. Option 1 wastes money on idle time. Option 2 does not provide distributed processing. Option 4 ignores the benefit of dynamic scaling for short bursts.
From lesson: Dataproc β Managed Spark and Hadoop
Why is the Dataproc 'Connector for Cloud Storage' critical for modern data architectures?
Answer: It converts GCS buckets into HDFS-compatible file systems to allow decoupling compute and storage.. Option 0 is correct as it enables the use of GCS as the primary data store instead of local HDFS. Option 1 is incorrect as GCS requires network access. Option 2 is incorrect as this would crash the master. Option 3 is incorrect as it is for object storage, not local shuffle disk.
From lesson: Dataproc β Managed Spark and Hadoop
If a Dataproc job is failing due to 'Out of Memory' errors during a shuffle operation, what is the best first step to resolve it?
Answer: Adjust Spark configuration properties like 'spark.executor.memory' or partition counts.. Option 2 is the standard technical fix for Spark memory issues. Increasing master nodes (Option 0) does not help worker memory. Preemptible instances (Option 1) actually increase failure risk. Changing regions (Option 3) affects latency, not memory allocation.
From lesson: Dataproc β Managed Spark and Hadoop
Which of the following describes the purpose of using Preemptible/Spot VMs in a Dataproc cluster?
Answer: To reduce costs by using excess compute capacity that can be reclaimed by GCP.. Option 2 is the definition of Preemptible/Spot VMs. Option 0 is false as these VMs can be reclaimed. Option 1 is false as these VMs are not meant for permanent storage. Option 3 is false as they are not dedicated to the ResourceManager.
From lesson: Dataproc β Managed Spark and Hadoop
An application requires that messages published with the same 'user_id' are processed in the order they were published. What must be configured?
Answer: Enable ordering keys on the topic and include the user_id. Ordering keys are required for message sequencing within a partition. Option 0 is not a standard Pub/Sub configuration, Option 2 is not a built-in feature of Cloud Functions, and Option 3 would cause immediate redelivery, not ordering.
From lesson: Pub/Sub β Event Messaging
A system is experiencing high costs due to repeated message redelivery. What is the most effective way to resolve this?
Answer: Ensure the consumer acknowledges the message before the ack deadline expires. Redelivery happens if the consumer fails to acknowledge in time. Increasing retention (Option 0) keeps messages longer but does not solve redelivery. Push vs Pull (Option 1) doesn't change the need for acknowledgement, and batch size (Option 3) affects throughput, not the acknowledgement lifecycle.
From lesson: Pub/Sub β Event Messaging
When should you prefer a 'Push' subscription over a 'Pull' subscription?
Answer: When the subscriber is a serverless application like Cloud Run. Push subscriptions are ideal for webhooks and serverless endpoints. Pull is better for controlling flow (Option 1) and high throughput (Option 3). Push requires a reachable endpoint (Option 2).
From lesson: Pub/Sub β Event Messaging
What is the primary function of a Dead Letter Topic (DLT) in Pub/Sub?
Answer: To hold messages that have failed to be processed after multiple attempts. DLTs are specifically for handling 'poison pills' or failed messages. They are not for archiving (Option 0), standard retention expiry (Option 2), or load balancing (Option 3).
From lesson: Pub/Sub β Event Messaging
If your application logic is idempotent, which delivery configuration provides the best performance?
Answer: At-least-once delivery. At-least-once is the default and most performant. Exactly-once (Option 0) requires extra overhead, Synchronous (Option 2) isn't a performance optimization, and Ordered delivery (Option 3) limits parallelism.
From lesson: Pub/Sub β Event Messaging
An application requires high availability and strong consistency across multiple regions with a global footprint. Which service is the most appropriate choice?
Answer: Cloud Spanner. Cloud Spanner provides global consistency and high availability across regions. Cloud SQL is regional; while read replicas provide global read-only access, they do not support synchronous multi-region writes or global strong consistency.
From lesson: Cloud SQL and Cloud Spanner
Why is primary key design critical in Cloud Spanner compared to traditional relational databases like Cloud SQL?
Answer: Poorly designed keys can lead to write hotspots in the distributed architecture. Spanner shards data across nodes based on primary keys. Sequential keys create hotspots on a single node. Cloud SQL runs on a single node, so key order does not impact distribution performance. Spanner supports various key types, and keys can be managed.
From lesson: Cloud SQL and Cloud Spanner
Your team needs to migrate an existing MySQL application to Google Cloud with minimal code changes. Which service should you choose?
Answer: Cloud SQL for MySQL. Cloud SQL for MySQL is a fully managed service designed to support existing MySQL applications with minimal configuration changes. Spanner uses a different SQL dialect and requires significant schema refactoring, while BigQuery and Firestore are not relational databases.
From lesson: Cloud SQL and Cloud Spanner
What is the primary benefit of using the Cloud SQL Auth Proxy when connecting to a Cloud SQL instance?
Answer: It provides secure, encrypted connections without requiring SSL certificates to be managed manually. The Cloud SQL Auth Proxy secures connections by wrapping them in an encrypted tunnel and handling IAM-based authentication, removing the complexity of managing SSL certificates. It does not handle version upgrades, storage scaling, or bypass IAM requirements.
From lesson: Cloud SQL and Cloud Spanner
A global application expects varying traffic patterns and needs to scale compute resources horizontally without downtime. Which architecture is best?
Answer: Cloud Spanner with node count adjustment. Cloud Spanner allows for seamless horizontal scaling by adding nodes without downtime. Cloud SQL generally requires vertical scaling (changing instance size), which often involves a brief restart. Read replicas add read capacity but do not address write scaling or horizontal compute expansion.
From lesson: Cloud SQL and Cloud Spanner
When configuring a custom training job in Vertex AI, why is it recommended to use a Docker container rather than a direct script upload?
Answer: Containers allow you to package specific dependencies and environment configurations, ensuring reproducibility.. Option 2 is correct because containers ensure the environment is identical across runs, avoiding dependency conflicts. Option 1 is wrong because you can use pre-built containers. Option 3 is wrong because access is controlled by IAM, not packaging. Option 4 is wrong because provisioning occurs regardless of the code source.
From lesson: Vertex AI β Training Pipelines
What is the purpose of the AIP_MODEL_DIR environment variable in a Vertex AI training container?
Answer: It points to the Cloud Storage URI where the model artifacts should be saved.. Option 3 is correct because Vertex AI automatically injects this path for saving model binaries. Option 1 is wrong as it is for saving, not reading data. Option 2 is wrong because logs are handled by Cloud Logging. Option 4 is wrong because dependencies should be pre-installed in the image.
From lesson: Vertex AI β Training Pipelines
You have a large training job that needs to run on specialized hardware. How should you scale the training infrastructure in Vertex AI?
Answer: Specify the machine type and number of replicas in the training pipeline definition.. Option 2 is correct as Vertex AI abstracts infrastructure scaling via the configuration object. Option 1 is unnecessary as Vertex AI handles provisioning. Option 3 is wrong because it doesn't change the hardware. Option 4 is inappropriate as App Engine is for serving, not model training.
From lesson: Vertex AI β Training Pipelines
A developer wants to trigger a training pipeline based on new data arriving in a bucket. Which approach is most effective within the GCP ecosystem?
Answer: Use a Cloud Function triggered by a Storage event to launch the Vertex AI pipeline.. Option 2 is correct as it creates an event-driven serverless architecture. Option 1 is inefficient and error-prone. Option 3 lacks automation. Option 4 introduces unnecessary management overhead compared to serverless triggers.
From lesson: Vertex AI β Training Pipelines
Why would you choose to use a pre-built container provided by Vertex AI instead of creating a custom one?
Answer: They offer pre-configured environments for popular machine learning frameworks like TensorFlow or Scikit-learn.. Option 2 is correct as these containers come with optimized framework versions. Option 1 is wrong because custom containers support tuning too. Option 3 is wrong because model accuracy is code-dependent, not container-dependent. Option 4 is wrong because Vertex AI is a cloud-native managed service.
From lesson: Vertex AI β Training Pipelines
When updating a model on an existing Vertex AI Endpoint, what is the safest approach to ensure zero downtime?
Answer: Use traffic splitting to route a small percentage of requests to the new model version before shifting all traffic.. Traffic splitting allows for canary deployments, which is the standard for zero downtime. Deleting the model first causes downtime, creating a new endpoint is unnecessary overhead, and overwriting files is not how the Registry handles immutable versions.
From lesson: Vertex AI β Model Registry and Endpoints
Why is it recommended to register a model in the Vertex AI Model Registry before deploying it to an endpoint?
Answer: To manage model lineage, versioning, and simplify the deployment workflow across environments.. The Registry serves as a catalog that tracks versions and metadata, facilitating reproducible deployments. Compression, retraining, and skipping containerization are not the primary functions or benefits of the Registry.
From lesson: Vertex AI β Model Registry and Endpoints
You have a model deployed to an endpoint that is experiencing intermittent latency spikes during high traffic. What is the most cost-effective way to address this using Vertex AI features?
Answer: Configure auto-scaling with a specific CPU or request-per-second utilization target.. Auto-scaling is designed to handle spikes efficiently by adding nodes only when necessary. Higher machine types or high minimum replicas increase base costs, and manual intervention is not scalable.
From lesson: Vertex AI β Model Registry and Endpoints
Which of the following scenarios is best handled by creating a new version in the Model Registry rather than just updating the existing model artifact?
Answer: Deploying a model trained on a new dataset to compare its performance against the current production model.. Registry versions are intended for tracking model changes resulting from training experiments. Typos and metadata changes don't require new versions, and re-deploying the same model is unnecessary.
From lesson: Vertex AI β Model Registry and Endpoints
What is the primary function of a Vertex AI Endpoint?
Answer: To provide a managed service environment for serving predictions from models.. Endpoints provide the serving infrastructure (HTTP/REST interface). Storage buckets, feature pipelines, and tuning jobs are separate components of the Vertex AI stack.
From lesson: Vertex AI β Model Registry and Endpoints
When building an application on GCP that requires consistent, reproducible outputs for data extraction, which configuration is most appropriate?
Answer: Setting temperature to 0.0 to minimize randomness. Setting temperature to 0.0 makes the model deterministic, ensuring identical inputs yield identical outputs. Option 0 increases randomness, Option 2 doesn't control temperature directly, and Option 3 relates to length, not precision.
From lesson: Gemini API and Vertex AI Generative AI
Which service should you use to securely store and retrieve Gemini API credentials without embedding them in your application code?
Answer: Secret Manager. Secret Manager is the GCP-native service designed for storing sensitive secrets. Cloud Storage and Cloud SQL are for data storage, and Metadata is for instance-specific information, not secure secret retrieval.
From lesson: Gemini API and Vertex AI Generative AI
Your application using Vertex AI Generative AI is intermittently failing with 429 errors. What is the recommended approach to resolve this?
Answer: Implement an exponential backoff retry strategy. Exponential backoff is the standard architectural pattern for handling rate limits (429). Hardcoding sleep is inefficient, switching regions doesn't change project-wide quotas, and disabling safety filters is a violation of security best practices.
From lesson: Gemini API and Vertex AI Generative AI
In a multi-turn chat application on Vertex AI, how does the model 'remember' previous parts of the conversation?
Answer: The developer must append the dialogue history to each new request. Vertex AI models are stateless; they do not remember context automatically. Developers are responsible for passing the conversation history back to the API in each turn. The other options describe non-existent automatic behaviors.
From lesson: Gemini API and Vertex AI Generative AI
What is the primary purpose of 'Safety Settings' in Vertex AI?
Answer: To prevent the model from generating harmful or inappropriate content. Safety settings define thresholds for content categories like hate speech or harassment. They do not affect speed, creativity (that is temperature), or output formatting.
From lesson: Gemini API and Vertex AI Generative AI
When creating a model in BigQuery ML, why is the TRANSFORM clause considered a best practice?
Answer: It automatically ensures that preprocessing steps applied during training are also applied during inference.. The TRANSFORM clause ensures that feature engineering logic is stored with the model. Option 0 is incorrect as it affects inference consistency, not speed. Option 2 is false as SQL works outside the clause too. Option 3 is unrelated to the clause's purpose.
From lesson: BigQuery ML
If you are building a model to predict a continuous numerical value, which configuration should be prioritized in your CREATE MODEL statement?
Answer: Set the model_type to LINEAR_REGRESSION.. LINEAR_REGRESSION is for continuous values. Option 0 is for classification. Option 1 is incorrect because regression requires numeric targets. Option 3 is bad practice as it includes noise or high-cardinality identifiers.
From lesson: BigQuery ML
What is the primary benefit of using ML.PREDICT versus exporting a model to a cloud storage bucket?
Answer: ML.PREDICT allows for predictions directly within the SQL interface without moving data.. ML.PREDICT enables in-database inference, minimizing data movement. Options 1, 2, and 3 are incorrect as they do not accurately describe the role of the inference function in the BQML workflow.
From lesson: BigQuery ML
How does using ML.EVALUATE help a developer during the model development lifecycle?
Answer: It compares the predicted values against the actual values to produce performance metrics.. ML.EVALUATE computes metrics like precision, recall, or RMSE based on ground truth. The other options describe actions (retraining, code conversion, visualization) that ML.EVALUATE does not perform.
From lesson: BigQuery ML
Why might a user choose to use K-MEANS in BigQuery ML?
Answer: To group similar observations together without predefined labels.. K-MEANS is an unsupervised algorithm for clustering. Option 0 describes classification. Option 1 describes time-series models. Option 3 is incorrect as K-MEANS is not a query optimizer.
From lesson: BigQuery ML
An architect needs to connect two VPCs in different projects to share services. Which mechanism provides the most performant, low-latency connection without needing a VPN or public internet?
Answer: VPC Peering. VPC Peering allows internal IP connectivity between networks. Cloud Interconnect is for on-premises connectivity, VPN uses the internet, and external IPs are insecure for internal traffic.
From lesson: VPC β Virtual Private Cloud
A team requires a subnet with a specific CIDR range to adhere to corporate compliance. Which VPC configuration should they select?
Answer: Custom-mode VPC. Custom-mode VPCs allow you to define the exact CIDR ranges. Auto-mode creates default subnets in all regions, which lacks the required precision.
From lesson: VPC β Virtual Private Cloud
Your security policy mandates that instances should only communicate with instances labeled as 'web-server'. How should you configure your firewall rules?
Answer: Use network tags on the instances and reference the tag in the firewall rule. Network tags provide identity-based security, which is easier to maintain than IP-based rules. Subnets are for network topology, and opening ports globally is a major security risk.
From lesson: VPC β Virtual Private Cloud
You have a VPC network that spans multiple regions. If you have an instance in us-central1 and an instance in europe-west1, how do they communicate using private IPs?
Answer: They communicate natively over Google's internal global network. Google Cloud VPCs are global, meaning instances across regions are on the same network and route traffic over Google's global backbone. No extra routers or VPNs are needed.
From lesson: VPC β Virtual Private Cloud
Why would an administrator choose to use a Shared VPC instead of VPC Peering?
Answer: To centralize network management across multiple projects under a single host project. Shared VPC is designed for organizational structure where a central admin team manages the network, while service teams consume subnets. It simplifies management compared to managing multiple peerings.
From lesson: VPC β Virtual Private Cloud
An application generates logs that contain PII. How can you ensure these logs are not stored in their original form while maintaining observability?
Answer: Apply a Log Router sink with a filter that uses transformation logic to redact sensitive fields. Option 2 is correct because Log Sinks allow for the transformation of log entries before storage, enabling redaction. Option 0 only excludes logs entirely, losing observability. Option 1 is not a native feature for PII redaction. Option 3 bypasses the Logging infrastructure, complicating centralized log management.
From lesson: Cloud Monitoring and Cloud Logging
You need to monitor the health of a custom application running on Compute Engine. What is the recommended way to collect application-specific metrics?
Answer: Install the Ops Agent on the VM and configure it to scrape metrics from the application. Option 1 is correct as the Ops Agent is designed to collect application-level metrics and system logs. Option 0 only provides infrastructure metrics (CPU/RAM). Option 2 is inefficient and inaccurate for high-frequency metrics. Option 3 is overkill and adds significant architectural complexity.
From lesson: Cloud Monitoring and Cloud Logging
An alert policy is firing too frequently during minor traffic spikes. What is the most effective way to tune the alert without losing visibility into actual issues?
Answer: Increase the duration of the 'rolling window' for the metric-based alert. Option 0 allows for a sustained condition over time, filtering out transient spikes. Option 1 is dangerous as it ignores trends before failure. Option 2 is an anti-pattern. Option 3 does not resolve the underlying sensitivity issue.
From lesson: Cloud Monitoring and Cloud Logging
You want to troubleshoot an intermittent latency issue in a microservice. Which tool allows you to inspect the lifecycle of a single request across multiple services?
Answer: Cloud Trace. Option 1 is correct as Cloud Trace provides distributed tracing for requests. Option 0 is for searching logs, not request flow. Option 2 analyzes code performance. Option 3 displays aggregated metrics, not individual request lifecycles.
From lesson: Cloud Monitoring and Cloud Logging
What is the primary difference between logs-based metrics and standard metrics in Cloud Monitoring?
Answer: Standard metrics are pre-defined by GCP, whereas logs-based metrics are derived from the content of log entries. Option 1 is the definition of logs-based metrics, which allow for metric creation from unstructured log data. Option 0 is false as logs-based metrics are service-agnostic. Option 2 is false as both can incur costs. Option 3 is incorrect as logs-based metrics are limited to the information extracted from the log entry string.
From lesson: Cloud Monitoring and Cloud Logging
An administrator needs to restrict access to a web application based on the user's geographic location. Which feature of Cloud Armor should be used?
Answer: Geo-based restriction rules within a Cloud Armor security policy. Cloud Armor natively supports geo-based blocking or allowing using rule conditions. VPC Firewalls do not handle geo-data. IAP is for authentication, not geo-filtering. Cloud DNS policies manage name resolution, not traffic content filtering.
From lesson: Cloud Armor and Security Policies
When a security policy rule is set to 'Preview' mode, what is the impact on actual incoming traffic?
Answer: The traffic is logged but no action is taken based on the rule.. Preview mode logs match events so administrators can evaluate rule effectiveness without actually affecting traffic flow. Blocking occurs only in 'Enforce' mode.
From lesson: Cloud Armor and Security Policies
A Cloud Armor security policy has a rule with priority 500 set to 'Deny' and a rule with priority 1000 set to 'Allow'. What happens to traffic that matches both rules?
Answer: The traffic is denied because Cloud Armor uses the lowest integer as the highest priority.. Cloud Armor evaluates rules in ascending order of priority, where the lowest number has the highest precedence. Therefore, priority 500 is evaluated before priority 1000.
From lesson: Cloud Armor and Security Policies
Why is it recommended to use a default 'Deny' rule in a Cloud Armor policy?
Answer: It prevents accidental exposure of backend services to unauthorized traffic.. A default 'Deny' rule implements a 'least privilege' security model, ensuring that only explicitly permitted traffic is allowed, which prevents accidental exposure. Performance, compliance, and authentication are separate concerns.
From lesson: Cloud Armor and Security Policies
Which type of traffic can be protected by a Cloud Armor security policy?
Answer: External HTTP(S) traffic destined for a Global External Application Load Balancer.. Cloud Armor is an edge security service designed specifically to protect applications behind Google Cloud Load Balancers. Internal IP traffic, inter-service traffic, and VPN traffic are managed by other VPC-level controls.
From lesson: Cloud Armor and Security Policies
An application requires sub-millisecond latency for stateful operations between microservices. Which GCP service provides the most performant shared-memory-like experience?
Answer: Memorystore for Redis. Memorystore provides in-memory data storage, essential for sub-millisecond latency. Cloud Spanner and Persistent Disk involve network or disk I/O latency, while Cloud Storage is object storage unsuitable for microservice state.
From lesson: GCP Interview Questions
You need to run a batch processing job that can be interrupted at any time without data loss. Which Compute Engine configuration is most cost-effective?
Answer: Preemptible VMs with Managed Instance Groups. Preemptible VMs (or Spot VMs) are designed for fault-tolerant, interruptible workloads at a fraction of the cost. Standard VMs and Sole-tenants are significantly more expensive, and machine types do not address the interruption capability.
From lesson: GCP Interview Questions
A global application serves users in Asia, Europe, and North America. You must ensure the lowest possible latency for static assets. Which configuration should you choose?
Answer: Cloud Storage with a Global External HTTP(S) Load Balancer using Cloud CDN. Cloud CDN integrated with a global load balancer caches content at the edge, closest to the user. Simply using a Multi-regional bucket is insufficient because it doesn't provide edge caching, and regional approaches lack the global reach required.
From lesson: GCP Interview Questions
You are migrating a relational database that requires horizontal scaling and global consistency. Which service is the correct choice?
Answer: Cloud Spanner. Cloud Spanner is designed for global scale and strong consistency. Cloud SQL does not scale horizontally for writes, Bigtable is a NoSQL wide-column store, and Firestore is a NoSQL document database that lacks the relational capabilities of Spanner.
From lesson: GCP Interview Questions
How do you best implement a 'defense-in-depth' strategy for a Cloud Run service accessing a Cloud SQL database?
Answer: Use the Cloud SQL Auth Proxy with a private IP address and IAM-based authentication. The Cloud SQL Auth Proxy combined with private IP ensures traffic stays within the Google network and uses IAM, which is secure. Public IPs, hardcoded credentials, and excessive IAM roles violate security best practices and increase the attack surface.
From lesson: GCP Interview Questions
An application requires sub-millisecond latency for real-time analytics. Which storage option provides the highest throughput and lowest latency on GCP?
Answer: Cloud Memorystore for Redis. Memorystore is an in-memory data store, providing sub-millisecond latency. Cloud Spanner is for relational consistency, Persistent Disk is block storage, and Cloud Storage is object storage, all of which have higher latency than memory.
From lesson: GCP Architecture Design Questions
You need to host a global web application that requires HTTPS load balancing and static content distribution. What is the most cost-effective and performant architecture?
Answer: Global HTTP(S) Load Balancer with Cloud CDN and Cloud Storage. The Global HTTP(S) Load Balancer enables traffic to be routed to the nearest instance, while Cloud CDN caches static content at the edge. A single VM is not global, Cloud SQL is for databases, and Standard Load Balancers lack the global features required.
From lesson: GCP Architecture Design Questions
A microservices application on GKE needs to communicate securely without exposing services to the public internet. What is the best networking approach?
Answer: Use Internal Load Balancers and Private GKE Clusters. Private GKE clusters ensure nodes do not have public IPs, and Internal Load Balancers restrict traffic to the VPC. Public IPs expose the service to the internet, and Cloud NAT/Armor do not provide the internal-only isolation required.
From lesson: GCP Architecture Design Questions
When designing a disaster recovery plan for a mission-critical database, what is the primary benefit of using Cloud Spanner over a standard MySQL setup on Compute Engine?
Answer: It provides synchronous replication and automatic failover across regions. Spanner offers multi-region synchronous replication, ensuring high availability and zero-RPO failover. A MySQL setup requires manual management for replication and failover, whereas Spanner handles it as a managed service.
From lesson: GCP Architecture Design Questions
Which IAM design pattern follows the principle of least privilege for a developer needing to deploy code to Cloud Functions?
Answer: Granting 'Cloud Functions Developer' and 'Service Account User' roles. Cloud Functions Developer allows the deployment of code, and Service Account User is necessary to attach an identity to the function. Granting Owner or Editor roles provides far too much access, violating security best practices.
From lesson: GCP Architecture Design Questions
