Google Cloud Professional Cloud Architect Practice Exam 2025: Latest Questions

A retail company wants to host a stateless web application on Google Cloud. Traffic is unpredictable and can spike rapidly during promotions. The team wants automatic scaling and minimal infrastructure management. What should you recommend?

A security team requires that all new Cloud Storage buckets are prevented from allowing public access, even if someone later tries to add public IAM bindings. What is the recommended control to enforce this organization-wide?

Your organization wants to ensure that only corporate-managed devices can access the Google Cloud Console and gcloud for production projects. Which approach best meets this requirement?

An application team is seeing intermittent 502 errors from a backend service running on Compute Engine behind an external HTTP(S) Load Balancer. The load balancer health checks show the backend as unhealthy. Which is the most likely cause?

A financial services company needs to separate duties so that the networking team can manage shared VPC networks while application teams can deploy resources into their own projects without being able to modify networks. What architecture should you implement?

A company wants to adopt Infrastructure as Code with a repeatable, auditable process. They also want to ensure that infrastructure changes are peer-reviewed and applied consistently across dev, test, and prod. What is the best approach on Google Cloud?

A data platform ingests streaming events that must be processed at-least-once and written to BigQuery. The team needs to replay messages during incident recovery and wants to minimize custom infrastructure. Which solution best fits?

A company is experiencing unexpectedly high egress traffic costs between services deployed in multiple regions. They suspect chatty microservices are calling each other across regions. What should you do first to validate and identify the main contributors?

A healthcare company must ensure that no user or service account can disable or delete audit logs for projects in a regulated environment. What should you implement to best meet this requirement?

A global SaaS runs on GKE across two regions. The control plane is regional, and workloads are spread across multiple zones per region. The company needs to survive a full regional outage with minimal user impact and automated failover. Which architecture is most appropriate?

Your organization wants to enforce that only approved Google Cloud services can be used across all projects, and any attempt to use unapproved services should be blocked. You need a centrally managed, preventive control. What should you implement?

A team needs short-lived, least-privilege access for developers to troubleshoot production issues. They want approvals, time-bound elevation, and auditing without permanently granting broad roles. What Google Cloud capability best meets this requirement?

You are deploying a stateless web application to Cloud Run. The application must connect privately to a Cloud SQL instance without using public IPs. What is the recommended approach?

A company needs to share a set of internal HTTP(S) services with partners over private connectivity. Partners connect via Cloud VPN/Interconnect and must reach the services using private IPs. You want a managed solution that publishes services across networks while keeping them private. What should you use?

Your security team requires that every workload uses customer-managed encryption keys (CMEK) and that keys are rotated and centrally controlled. They also need to prevent projects from creating resources without CMEK where supported. What is the best approach?

A data pipeline writes millions of small JSON objects per hour to Cloud Storage. Downstream analytics in BigQuery is slow and expensive due to many small files. You need to improve query performance and reduce overhead while preserving schema evolution. What should you do?

A production service runs on Managed Instance Groups (MIGs) across multiple zones. After a recent change, you need to roll out a new instance template but ensure minimal risk and fast rollback if errors occur. Which MIG update strategy should you choose?

A company wants to standardize resource creation across many teams using Terraform. They need to enforce baseline configurations (labels, logging settings, approved networks), and they want a review workflow before changes reach production. What is the best approach?

A critical backend service must achieve high availability and withstand a regional outage with minimal manual intervention. The service stores relational data requiring strong consistency. Which architecture best meets this requirement on Google Cloud?

Your organization uses a shared VPC with hundreds of projects. A security incident revealed that an application in one project accessed a sensitive Cloud Storage bucket in another project. You need to reduce the risk of data exfiltration by restricting access paths to sensitive services while still allowing approved workloads. What should you implement?

A global company runs an internal web app on Compute Engine. Users around the world report inconsistent latency, and the security team requires that the app is only reachable through a single, centrally managed HTTPS entry point with protection against common L7 attacks. The app can remain on VMs for now. What should you implement?

Your company needs centralized control over resource locations due to data residency rules. Teams frequently create new projects and occasionally deploy resources in disallowed regions. You want to enforce allowed regions organization-wide with minimal operational effort. What should you do?

A team uses Cloud Build to deploy to a production project. Security wants to ensure the build pipeline can deploy only specific resources and cannot be used to modify IAM policies or create new service accounts. What is the best approach?

A production workload in GKE has strict SLOs. After a recent cluster upgrade, a subset of Pods is repeatedly evicted, and node CPU utilization spikes even though average cluster CPU looks normal. You want to identify the cause and prevent recurrence. What should you do?

A data engineering team ingests clickstream events into BigQuery. They notice high query costs and slow dashboards because analysts often scan an entire multi-terabyte table to filter by date and a small set of customer IDs. You want to improve performance and reduce scanned data without changing analyst workflows significantly. What should you do?