Free Google Cloud PCA Practice Questions: Infrastructure Provisioning

Topic snapshot

Sample questions

These are original IT Mastery practice questions aligned to this topic area. They are not official Google Cloud questions, copied live-exam content, or exam dumps. Use them to preview question style and explanation depth before continuing with topic drills, mixed sets, and timed mocks in IT Mastery.

Question 1

Topic: Managing and Provisioning a Solution Infrastructure

A healthcare company wants to replace an internal help desk search portal with a conversational assistant. The architecture review produced this note:

Which next action best reduces implementation effort while preserving the governance and security requirements?

Options:

• A. Fine-tune a Model Garden model on all source documents.

• B. Call Gemini APIs through one shared service account over a merged document export.

• C. Build a custom RAG service on GKE with a self-managed vector database.

• D. Configure Agent Builder in Gemini Enterprise with governed connectors and AI security controls.

Best answer: D

Explanation: The requirements favor a prebuilt agent and enterprise search approach instead of a custom model workflow. Agent Builder in Gemini Enterprise is designed to assemble grounded agents over approved enterprise data sources with less custom infrastructure than building retrieval, orchestration, and chat logic from scratch. Governance can be preserved by using managed identity-aware access, audit logging, and safety layers such as Model Armor and Sensitive Data Protection for prompt/response filtering and PHI/PII handling. The key design implication is to configure a managed, governed agent first, then customize only where requirements are not met.

• Fine-tuning first adds ML lifecycle work and can weaken document-level access control if content is embedded into a model without careful design.
• Custom RAG on GKE may be valid for specialized needs, but it conflicts with the short timeline and lack of ML engineering staff.
• Shared service account access is risky because it can bypass per-user authorization and expose content from the merged export.

Question 2

Topic: Managing and Provisioning a Solution Infrastructure

A financial services company uses separate Google Cloud projects for dev, stage, and prod. Releases are delayed because resource settings differ between environments, and compliance requires auditable approval before production changes.

Exhibit:

Which resource-configuration process is the best next action?

Options:

• A. Allow each team to maintain separate environment-specific scripts.

• B. Use version-controlled Terraform modules with CI/CD promotion gates.

• C. Export production settings after each release and copy them to stage.

• D. Make all production changes manually through the console with approvals.

Best answer: B

Explanation: The core process is infrastructure as code with controlled promotion. Defining Google Cloud resources in version-controlled Terraform modules (or equivalent IaC) makes the intended configuration explicit, reviewable, and repeatable. A CI/CD pipeline can run plan and validation steps, apply changes to dev, then promote the same approved version to stage and prod with required approval gates. This reduces configuration drift because environments are not recreated from memory, wiki steps, or one-off console edits. It also supports compliance because code reviews, pipeline logs, plans, and approvals provide evidence of what changed and who approved it.

Manual approvals alone do not prevent drift; they need to be attached to a repeatable configuration process.

• Configuration export is reactive and can copy production drift backward instead of enforcing a reviewed desired state.
• Separate scripts can be automated, but independent per-environment logic increases drift risk.
• Manual console changes may satisfy an approval checkpoint, but they are not repeatable or easy to promote consistently.

Question 3

Topic: Managing and Provisioning a Solution Infrastructure

A retail company has data scientists training demand-forecasting models in Vertex AI Workbench. The company wants to promote only approved model versions to production, keep lineage from training data through model artifacts for audit reviews, monitor prediction skew after deployment, and minimize custom orchestration code. Which architecture step should the architect recommend?

Options:

• A. Move training jobs to Cloud Composer and write model metrics to Cloud Logging only.

• B. Orchestrate the workflow with Vertex AI Pipelines, register approved models, then deploy with model monitoring enabled.

• C. Export notebook artifacts to Cloud Storage and deploy the latest file to a Vertex AI endpoint manually.

• D. Containerize the model on GKE and build custom drift detection services.

Best answer: B

Explanation: Vertex AI Pipelines is the lifecycle orchestration step that turns model-development work into a repeatable production path. It can coordinate data preparation, training, evaluation, and deployment steps while preserving metadata and artifact lineage. Registering approved outputs in Vertex AI Model Registry supports review and controlled promotion of model versions. Deploying the selected version to a Vertex AI endpoint with Vertex AI Model Monitoring addresses the stated need to detect prediction skew after release. This approach meets governance and operations requirements without forcing the team to build a custom MLOps platform.

• Manual notebook export fails because it lacks repeatable promotion gates and reliable lineage from data through deployed model versions.
• Composer-only orchestration can schedule workflows, but it does not provide the same managed ML lifecycle linkage to model registry and monitoring.
• Custom GKE serving overbuilds the solution and shifts drift detection and lifecycle governance to custom operations work.

Question 4

Topic: Managing and Provisioning a Solution Infrastructure

A research division is moving a generative AI platform to Google Cloud. The workload must run distributed training across thousands of accelerators, use very high-throughput storage for checkpoints, and later serve the model with predictable low latency during demand spikes. The team wants a managed Google Cloud architecture instead of assembling an HPC fabric from individual VM components. Which decision best fits these requirements?

Options:

• A. Build a small GKE cluster on general-purpose VMs

• B. Deploy the model on Cloud Run with CPU autoscaling

• C. Use BigQuery ML with scheduled batch predictions

• D. Use AI Hypercomputer with GPU or TPU accelerator infrastructure

Best answer: D

Explanation: AI Hypercomputer is relevant when the deciding requirement is large-scale AI training or serving that depends on tightly coupled accelerators, high-performance networking, fast storage, and optimized software. In this scenario, the workload spans thousands of accelerators and has demanding checkpointing and low-latency serving needs. That moves the decision beyond ordinary autoscaling compute or ad hoc GPU VMs. AI Hypercomputer provides the Google Cloud architecture pattern for these highly parallel, performance-sensitive AI workloads while reducing the burden of assembling each infrastructure layer independently. Simpler managed platforms can still be appropriate for smaller inference services or batch ML, but they do not match this scale and performance profile.

• CPU autoscaling does not address the accelerator scale or high-throughput training fabric required by the stem.
• Batch ML is unsuitable for foundation-model training and predictable low-latency serving.
• General-purpose GKE can run containers, but a small standard VM cluster misses the specialized accelerator and infrastructure requirements.

Question 5

Topic: Managing and Provisioning a Solution Infrastructure

An ecommerce company is moving its checkout API to private GKE services in two Google Cloud regions. The traffic path is public internet customers over HTTPS to the API. The company needs a single globally reachable endpoint, low latency, DDoS/WAF protection, and no direct public IPs on workloads. The network team wants to avoid managing security appliances. Which recommendation best balances these constraints?

Options:

• A. Internal Application Load Balancers reachable only through Cloud VPN tunnels

• B. Regional external passthrough Network Load Balancers with restrictive VPC firewall rules

• C. Public GKE ingress endpoints with DNS latency routing and IP allowlists

• D. Global external Application Load Balancer, Cloud Armor, GKE NEGs, and restricted backend ingress

Best answer: D

Explanation: Traffic from internet clients to private GKE backends should terminate at a managed global edge service. A global external Application Load Balancer provides a single anycast HTTPS endpoint, TLS termination, cross-region backend selection, and low-latency routing without operating appliances. Cloud Armor adds managed DDoS and WAF policy enforcement at the edge. GKE NEGs let the load balancer target services without assigning public IPs to workloads, and backend ingress can be restricted to the load-balancer path and health checks. This combines availability, latency, security, and operational simplicity better than L4 load balancing, DNS-only routing, or private-only connectivity.

• Passthrough load balancing may be simpler or cheaper, but it does not provide the required HTTPS L7 WAF controls or one global edge endpoint.
• DNS latency routing spreads exposure and policy enforcement across public endpoints, conflicting with centralized protection and no direct workload exposure.
• Private-only VPN access improves isolation for internal users, but it does not fit public internet customer traffic.

Question 6

Topic: Managing and Provisioning a Solution Infrastructure

Your company is provisioning a weekly ML retraining workflow in Google Cloud. Training data must be read from governed BigQuery datasets and Cloud Storage buckets in a data project. Requirements include no raw data copies into the ML project, no public internet path for pipeline components to reach Google APIs, auditable least-privilege access per workflow, managed orchestration, and room for more pipelines. Which recommendation best balances these constraints?

Options:

• A. Schedule shared Vertex AI Workbench notebooks with broad data project permissions

• B. Use Vertex AI Pipelines in-perimeter with workflow service accounts and private Google API access

• C. Export raw datasets to an ML project and orchestrate Compute Engine jobs with Cloud Composer

• D. Run Kubeflow Pipelines on GKE and copy training data to cluster storage

Best answer: B

Explanation: Vertex AI Pipelines is the best fit when the requirement is managed ML lifecycle orchestration with controlled data integration. Provisioning the pipelines in a governed project or perimeter, using user-managed service accounts per workflow, and granting only the required BigQuery and Cloud Storage permissions lets components read data in place without expanding raw data copies. Private access to Google APIs, such as through restricted Google APIs or Private Service Connect patterns where applicable, supports the no-public-internet requirement. This also scales operationally as more pipelines are added because the team manages pipeline definitions and IAM rather than a self-managed orchestration platform. The key trade-off is choosing managed orchestration and governed identity/network controls over approaches that optimize flexibility or familiarity but increase data movement and operations burden.

• Self-managed orchestration can offer control, but adding GKE operations and copied data conflicts with the managed and in-place access requirements.
• Scheduled notebooks are convenient for experimentation, but they are weak for repeatable production lineage, least privilege, and operational governance.
• Raw data exports simplify local access for training jobs, but they violate the no-copy requirement and expand the compliance boundary.

Question 7

Topic: Managing and Provisioning a Solution Infrastructure

An architect reviews an AI proposal for a retailer.

Exhibit: AI workflow note

Which design implication best follows from the exhibit?

Options:

• A. Proceed with Model Garden fine-tuning on historical tickets.

• B. Use Agent Builder with grounded data stores and API tools.

• C. Use a prebuilt Natural Language API for ticket classification.

• D. Deploy Gemini Enterprise as an employee knowledge portal.

Best answer: B

Explanation: The proposed Model Garden approach does not match the visible constraints. Model Garden is useful when the team needs to choose, customize, or host a model, but this scenario explicitly avoids training or tuning on customer PII and lacks a model-training team. The business outcome is an application-level customer agent that must answer from approved sources and call existing order/returns APIs. Agent Builder is the stronger fit because it supports building grounded agents over selected data sources and integrating tools or APIs for transactional actions. Prebuilt AI APIs are better for narrow tasks such as classification or extraction, not a full governed conversational workflow.

• Model tuning fails because the source tickets contain customer PII and the team lacks training capacity.
• Single-task APIs miss the requirement for a grounded conversational agent that calls order and returns APIs.
• Employee portal misses the customer-facing web/mobile outcome and transactional API integration requirement.

Question 8

Topic: Managing and Provisioning a Solution Infrastructure

A retailer is moving a public customer website and API to Google Cloud. Users are in North America and Europe, and the app will run in two Google Cloud regions. The platform team needs HTTPS termination, path-based routing to separate services, Cloud Armor policies, and automatic failover without operating appliances. What load balancing recommendation best balances latency, availability, security, and operational effort?

Options:

• A. Use an internal Application Load Balancer

• B. Use a global external Application Load Balancer

• C. Use an external passthrough Network Load Balancer

• D. Use a regional external Application Load Balancer

Best answer: B

Explanation: The workload is public, globally accessed, and needs application-layer features. A global external Application Load Balancer is designed for internet-facing HTTP(S) workloads that need global reach, Layer 7 routing, TLS termination, security policy integration, and backend selection across regions. That balances low user latency and availability with a managed control plane, rather than making the team operate regional failover logic or proxy appliances. A transport-layer load balancer can be useful for TCP/UDP pass-through, but it does not meet the stated HTTP routing and Cloud Armor needs in the same way.

• Regional scope optimizes locality but does not provide the same global anycast entry point or cross-region failover pattern.
• Transport pass-through can fit non-HTTP workloads, but it misses the required Layer 7 path routing and HTTPS termination behavior.
• Internal access is appropriate for private service-to-service traffic, not a public customer website.

Question 9

Topic: Managing and Provisioning a Solution Infrastructure

A media company is provisioning the first phase of an AI-enabled asset catalog. The architecture principle is to use managed prebuilt capabilities and avoid custom model training for this phase.

Exhibit: Phase 1 requirements

Which next action best matches the requirements?

Options:

• A. Use Vision API for images and videos, and BigQuery search for policies and audio.

• B. Use Speech-to-Text for all media, then use keyword search only.

• C. Use Agent Builder or Vertex AI Search, Vision API, Video Intelligence API, and Speech-to-Text.

• D. Use Model Garden to fine-tune one multimodal model for all requirements.

Best answer: C

Explanation: The key interpretation is that each requirement has a different prebuilt Google AI fit. Enterprise document search with grounded responses belongs with Agent Builder or Vertex AI Search. Image metadata extraction belongs with Vision API. Video labels and shot changes belong with Video Intelligence API. Audio transcription belongs with Speech-to-Text. Because the team wants managed prebuilt capabilities and no custom training, a Model Garden or custom model path is not the best first-phase provisioning choice.

The architecture should route each asset type to the service designed for that modality, then index the resulting metadata for discovery.

• Single custom model adds training and lifecycle work that the phase explicitly avoids.
• Vision for videos misses video-specific analysis such as shot changes.
• Keyword-only search ignores the grounded enterprise search requirement and does not handle image or video understanding.

Question 10

Topic: Managing and Provisioning a Solution Infrastructure

A retailer runs a stateless checkout service on Compute Engine managed instance groups across dev, staging, and production. Incidents often follow monthly patching. Review the deployment notes. What is the best next action to improve operational reliability?

Options:

• A. Increase SSH access for faster manual patching

• B. Adopt version-controlled templates and immutable rollouts

• C. Keep a longer wiki checklist for rebuilds

• D. Snapshot production VMs after each successful patch

Best answer: B

Explanation: The exhibit shows configuration drift, skipped patches, manual builds, and slow rollback. These are classic signals for infrastructure as code and immutable infrastructure. For a stateless service on managed instance groups, the team should define resources in version-controlled declarative templates, build patched images or instance templates through CI/CD, and roll out replacements instead of changing running VMs by hand. This makes environments reproducible, lets reviews catch configuration changes, and enables rollback by returning the group to a previous template. Manual procedures may still exist for exceptions, but they should not be the primary provisioning or patching method.

• More SSH access increases the chance of inconsistent changes and does not solve skipped or untracked patches.
• VM snapshots can help recovery, but they preserve drift rather than making environments reproducible.
• Longer checklists document manual work, but they do not enforce consistent configuration or reliable rollback.

Continue in the web app

Use IT Mastery for interactive Google Cloud Professional Cloud Architect practice with mixed sets, timed mocks, topic drills, explanations, and progress tracking.

Try Google Cloud Professional Cloud Architect on Web

Related focused pages

• Free Google Cloud Professional Cloud Architect Full-Length Practice Exam
• Cloud Architecture Design
• Security and Compliance
• Process Optimization
• Managing Implementation
• Operations Excellence