Free Google Cloud Professional Cloud Architect Practice Questions: Process Optimization

Topic snapshot

Sample questions

These are original IT Mastery practice questions aligned to this topic area. They are not official Google Cloud questions, copied live-exam content, or exam dumps. Use them to preview question style and explanation depth before continuing with topic drills, mixed sets, and timed mocks in IT Mastery.

Question 1

Topic: Analyzing and Optimizing Technical and Business Processes

A retailer is improving disaster recovery for workloads running on Google Cloud. Budget constraints require matching protection to workload criticality, not duplicating every system.

Which DR improvement should the architect recommend?

Options:

• A. Build active-active deployments for checkout and analytics across two regions, including a full analytics processing duplicate.

• B. Use nightly database exports for all systems and redeploy application infrastructure manually during a regional outage.

• C. Create a warm standby checkout stack in a second region, replicate Cloud SQL cross-region, add redundant private connectivity to inventory, and test failover.

• D. Enable regional Cloud SQL high availability for checkout and keep the existing single VPN connection to inventory.

Best answer: C

Explanation: Disaster-recovery design should follow workload criticality and dependency mapping. The checkout API has the tightest RTO/RPO and cannot function without both its database and the on-prem inventory dependency, so the DR improvement must cover compute, data replication, network connectivity, and tested failover. A warm standby in another region with cross-region database replication and redundant private connectivity targets a regional failure without overbuilding the lower-priority analytics workload. Marketing analytics can use lower-cost backup, export, or rebuild procedures that fit its 48-hour RTO and 24-hour RPO.

The key is to protect the complete critical service path, not just the most visible component.

• Manual recovery is too slow and relies on nightly exports, which do not meet the checkout RTO/RPO.
• Active-active everything overbuilds the analytics workload and ignores the stated cost constraint.
• Regional database HA only improves zonal resilience but does not address regional DR or the inventory connectivity dependency.

Question 2

Topic: Analyzing and Optimizing Technical and Business Processes

An enterprise runs a Cloud Run order API in a Shared VPC. A canary release moves the production revision to a new Serverless VPC Access connector while keeping the same container image and service account. Requirements include private egress only, inventory calls to an on-prem service over Cloud VPN, and rollback within 15 minutes.

Exhibit: Canary symptoms

inventory call: connect ETIMEDOUT 10.50.12.20:443
iam_denied: false
order_db_latency_ms: 18
on-prem firewall: allows old connector CIDR only

Which architecture decision best focuses the root-cause investigation and remediation?

Options:

• A. Treat it as data performance and scale the order database

• B. Treat it as IAM authorization and grant broader service account roles

• C. Treat it as deployment process and lengthen canary bake time

• D. Treat it as network reachability and allow the new connector CIDR

Best answer: D

Explanation: The symptom pattern points to a network issue, specifically reachability and firewall alignment for the private hybrid path. The changed element is the Serverless VPC Access connector CIDR, and the failing dependency is an on-prem private IP over Cloud VPN. ETIMEDOUT indicates the connection is not completing, while the stem rules out IAM denials and database latency. The canary process exposed the problem and limited blast radius; it is not the primary root cause. Remediation should validate routes, firewall allowlists, and connector egress settings before continuing the rollout.

• Broader IAM ignores that no authorization denial is present and would weaken least privilege.
• Database scaling misses the observed dependency because order database latency is normal.
• Longer canary time does not fix blocked hybrid connectivity; the canary already detected the failure.

Question 3

Topic: Analyzing and Optimizing Technical and Business Processes

A team deployed a canary revision of a Cloud Run order API. Within minutes, only users routed to the canary receive intermittent 500 responses. The team needs to identify the most likely root-cause investigation step before changing production traffic.

Exhibit: Observability and deployment notes

Which next investigation step is best supported by the evidence?

Options:

• A. Audit load balancer firewall rules for the service

• B. Analyze Cloud SQL query performance for saturation

• C. Verify Secret Manager access for the canary service account

• D. Increase Cloud Run max instances for the canary

Best answer: C

Explanation: The strongest evidence points to an identity and permission issue in the new Cloud Run revision. Only the canary revision is failing, it runs as a different service account, and the logs show PERMISSION_DENIED when reading the Secret Manager secret used for the database password. A good root-cause investigation step is to compare the canary revision’s runtime service account permissions with the prior revision and confirm it has the needed Secret Manager access. The normal old revision and baseline Cloud SQL metrics make database capacity or query saturation less likely.

• Scaling the canary does not match the evidence because the visible failure is an authorization error, not concurrency or capacity pressure.
• Database saturation is not supported because Cloud SQL CPU and connections remain at baseline.
• Firewall investigation is less likely because only one Cloud Run revision is affected and the log error is Secret Manager permission denial.

Question 4

Topic: Analyzing and Optimizing Technical and Business Processes

A retailer is asking the architecture board to approve moving a customer-offer API to Google Cloud. Stakeholders disagree about the first release.

Which stakeholder communication best clarifies the trade-offs, risks, and measurable outcomes?

Options:

• A. Recommend active-active multi-region deployment to maximize availability; accept higher cost and operational complexity.

• B. Recommend the cheapest lift-and-shift release; report monthly spend and address latency or security gaps later.

• C. Recommend GKE first to maximize portability and control; decide team readiness and success metrics after launch.

• D. Recommend managed services first, trading platform control for lower operations effort; measure cost, latency, audit evidence, and rollback criteria.

Best answer: D

Explanation: A strong architecture recommendation for stakeholders should connect the proposed approach to business and technical constraints, not just name a preferred technology. Here, the communication should show how the first release balances cost reduction, latency, security evidence, and operational readiness. A managed-services-first approach reduces operational burden for a small team while leaving a clear trade-off: less low-level platform control. The communication also defines measurable outcomes, such as run cost, p95 latency, audit evidence, and rollback criteria, so stakeholders can approve the risk knowingly and evaluate success after release. Optimizing only for control, availability, or cost would hide important constraints and weaken the decision process.

• GKE-first control fails because it prioritizes portability while deferring team readiness and success metrics.
• Maximum availability fails because the stem does not make availability the top constraint and it conflicts with cost and team capacity.
• Spend-only reporting fails because cost savings alone do not prove latency performance or security compliance.

Question 5

Topic: Analyzing and Optimizing Technical and Business Processes

A team asks you to review its Google Cloud provisioning workflow before expanding to regulated workloads. Company policy requires production infrastructure changes to be approved before implementation, traceable to version-controlled artifacts, promoted from nonproduction, and recoverable quickly.

Which next action best addresses the main gap?

Options:

• A. Keep manual production changes but require detailed tickets.

• B. Introduce gated, versioned IaC promotion for production.

• C. Use Cloud Audit Logs as the rollback mechanism.

• D. Merge dev and prod projects to reduce drift.

Best answer: B

Explanation: The exhibit shows a provisioning governance gap, not just a documentation issue. Development uses Terraform and Cloud Build, but production is changed manually with broad privileges, approvals occur after implementation, test is skipped, and rollback depends on memory or manual reconstruction. A PCA-level remediation is to make production provisioning follow a controlled IaC path: changes are proposed in Git, reviewed and approved before apply, promoted through separate environments, executed by limited service accounts, and tied to tagged versions or previous known-good configurations for rollback. Auditability is improved because the source, approval, plan, and deployment outcome are connected.

The key takeaway is that production changes should be reproducible and reversible, not merely logged after the fact.

• Detailed tickets improve traceability but still allow unreviewed, non-reproducible production changes.
• Audit logs show what happened, but they do not provide a tested rollback artifact or approval gate.
• Merging environments reduces separation and increases blast radius, which conflicts with controlled promotion.

Question 6

Topic: Analyzing and Optimizing Technical and Business Processes

A retailer is migrating its order platform to Google Cloud and adding Vertex AI-based recommendations. Business teams want faster feature delivery, security requires privacy and audit evidence, and operators need clear SLOs and rollback expectations. Recent releases were delayed because architecture, security, and operations concerns were discovered late. Which process intervention should the cloud architect recommend?

Options:

• A. Create cross-functional design reviews with ADRs and shared acceptance criteria.

• B. Move all architecture decisions to a central cloud architecture team.

• C. Let developers prototype first and request security approval before launch.

• D. Hold separate business, security, and operations reviews after release.

Best answer: A

Explanation: The core intervention is to make architecture decisions collaborative, explicit, and early. A lightweight cross-functional design review that includes business, architecture, development, operations, and security can turn goals into shared acceptance criteria such as privacy controls, SLOs, rollback needs, and audit evidence. Architecture Decision Records (ADRs) preserve the reasoning and trade-offs so teams can align during implementation and revisit decisions when requirements change. This improves delivery speed by reducing late rework, not by removing governance. The key is integrated decision-making with documented outcomes, rather than late-stage approvals or isolated handoffs.

• Prototype first delays security and operations input, which repeats the late-rework problem described in the scenario.
• Centralized decisions can create a bottleneck and excludes the teams that must build, operate, and secure the system.
• Post-release reviews may find issues, but they do not prevent misalignment before implementation.

Question 7

Topic: Analyzing and Optimizing Technical and Business Processes

An order-processing API runs on Cloud Run and connects to Cloud SQL using the runtime service account configured on each revision. After a routine release, the SRE team sees failed checkouts.

Exhibit: Incident signals

Which interpretation best fits the symptom?

Options:

• A. Architecture design flaw requiring a move from Cloud Run

• B. Data corruption in the Cloud SQL instance

• C. Network path failure between the load balancer and Cloud Run

• D. IAM/configuration regression in revision orders-0041

Best answer: D

Explanation: The visible signals isolate the failure to the deployed revision’s access path to Cloud SQL. The load balancer is forwarding requests to Cloud Run, so the primary symptom is not the frontend network path. Cloud SQL is healthy, so there is no evidence of a database outage or saturation. The application log shows PERMISSION_DENIED: cloudsql.instances.connect, and rollback to the previous revision resolves the issue. That combination points to an IAM or revision configuration regression, such as changing the runtime service account or removing the required Cloud SQL permission. The next validation step would be to compare revision configuration and IAM bindings, then restore least-privilege access for the intended service account.

• Network failure does not fit because requests are successfully forwarded to Cloud Run.
• Data corruption is unsupported because the database is healthy and the error is permission-related.
• Architecture replacement is premature because a revision-specific IAM/configuration issue explains the rollback behavior.

Question 8

Topic: Analyzing and Optimizing Technical and Business Processes

A team deploys a Cloud Run service and Terraform-managed IAM changes with Cloud Build and Cloud Deploy. Staging deployments are stable, but production promotion is approved only by a human release manager.

Exhibit: Release review findings

What is the best next action before allowing promotion to production?

Options:

• A. Run policy validation only after production deployment

• B. Move production applies to a break-glass account

• C. Promote after manual approval and monitor production alerts

• D. Add automated validation gates to the promotion pipeline

Best answer: D

Explanation: The core issue is release assurance before production promotion. The exhibit shows required evidence that cannot be reliably satisfied by reading release notes: test results, service health, and infrastructure policy compliance. In a Google Cloud CI/CD architecture, these checks should run automatically in the delivery path, such as Cloud Build test steps, Terraform plan validation, policy checks, and Cloud Deploy promotion gates or approval conditions. This reduces human error, provides audit evidence, and preserves the weekly release goal by avoiding slow manual rework. Post-deployment monitoring is still important, but it does not replace pre-production validation for known release risks.

• Manual approval only misses the need for repeatable evidence before production changes are promoted.
• Post-deployment validation detects problems too late, after risky IAM or service changes are already live.
• Break-glass deployment is for emergency access, not routine release quality control.

Question 9

Topic: Analyzing and Optimizing Technical and Business Processes

Your team is reviewing production readiness for a new regional order-management service on Google Cloud. The service runs on GKE, uses Cloud SQL for PostgreSQL with HA, and publishes order events to Pub/Sub. The business requirement is to keep accepting orders during a single-zone outage with an RTO of 15 minutes. Which next action best addresses the unresolved readiness risk shown in the exhibit?

Exhibit:

Options:

• A. Schedule another penetration test

• B. Run a controlled failover test

• C. Increase the load test multiplier

• D. Start broad production chaos experiments

Best answer: B

Explanation: The unresolved concern is failover readiness. The exhibit already shows evidence for load capacity, security remediation, and end-to-end integration. What remains unproven is whether the architecture behaves correctly when a zone or database primary fails. A controlled failover test should verify Cloud SQL failover behavior, application connection recovery, GKE workload availability, Pub/Sub processing, monitoring, and whether the business RTO is met. Chaos testing can be useful later for broader resilience learning, but the visible requirement is a specific failover objective with a defined outage and RTO.

• More load testing does not address the untested zone or database failover path.
• Another penetration test targets security exposure, but the exhibit says penetration findings were already remediated.
• Broad chaos experiments are too general for this specific RTO validation and should not replace a controlled failover exercise.

Question 10

Topic: Analyzing and Optimizing Technical and Business Processes

An image-sharing company runs an upload and transformation platform on Google Cloud. A cost review shows 70% of monthly spend is Cloud Storage Standard for original and transformed images; compute costs are much smaller but spike during marketing events. Images are read heavily for 30 days, rarely after 90 days, and must be retained for 7 years for licensing audits. The business wants material savings this quarter, no visible latency impact for recent images, minimal engineering work, and existing Google Cloud audit controls preserved. Which recommendation best balances these constraints?

Options:

• A. Rebuild transformations on Cloud Run and Pub/Sub

• B. Export historical images to an external archive platform

• C. Rightsize transformation workers based on average CPU utilization

• D. Transition objects after 90 days with lifecycle rules

Best answer: D

Explanation: Resource optimization should start with the largest cost driver and then choose the least disruptive lever that still meets business constraints. In this scenario, older Cloud Storage objects dominate spend, while compute is a smaller and bursty cost. Cloud Storage lifecycle rules can move objects after 90 days to lower-cost storage classes and keep recent objects in Standard storage, preserving the user experience for frequently accessed images. The data stays in Google Cloud, so existing IAM, audit logging, and retention controls remain usable with minimal application change. Compute optimization may still be useful later, but it does not address the main near-term savings opportunity.

• Rightsizing workers targets a smaller cost area and using average CPU can underprovision campaign spikes.
• Managed serverless may reduce compute operations, but it requires engineering work and leaves the dominant storage cost mostly unchanged.
• External archive optimizes storage price but adds data movement and conflicts with preserving existing Google Cloud audit controls.

Continue in the web app

Use IT Mastery for interactive Google Cloud Professional Cloud Architect practice with mixed sets, timed mocks, topic drills, explanations, and progress tracking.

Try Google Cloud Professional Cloud Architect on Web

Related focused pages

• Free Google Cloud Professional Cloud Architect Full-Length Practice Exam
• Cloud Architecture Design
• Infrastructure Provisioning
• Security and Compliance
• Managing Implementation
• Operations Excellence