Pre-Winter Sale Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: force70

Pass the Google Google Cloud Certified Professional-Cloud-Architect Questions and answers with CertsForce

Viewing page 4 out of 7 pages
Viewing questions 31-40 out of questions
Questions # 31:

Your team plans to use Vertex AI to develop and deploy machine learning models for various use cases for fraud detection, product recommendations, and customer churn prediction. You want to enhance the security posture of the Vertex AI and Workbench environment by restricting data exfiltration. What should you do?

Options:

A.

Create a service perimeter and include ml.googleapis.com and document.googleapis.com as protected services.


B.

Enable VPC Flow Logs to monitor network traffic to and from Vertex AI services and to identify suspicious activity.


C.

Create a service perimeter and include aiplatform.googleapis.com and notebooks.googleapis.com as protected services.


D.

Enable Private Google Access for the VPC network to allow Vertex AI services to access public Google services without traversing the public internet.


Expert Solution
Questions # 32:

You are designing a new insurance claims processing application that will be deployed on Google Kubernetes Engine (GKE). Your company ' s compliance team requires a complete and non-repudiable audit trail for all administrative actions from day one. Your application must capture who deploys a new container image, who modifies the GKE cluster ' s configuration, and who interacts with running pods or Kubernetes secrets using kubectl. What should you do?

Options:

A.

Enable Binary Authorization on the GKE cluster and create a policy that requires all deployed container images to be signed by a trusted attestor.


B.

Enable GKE Audit Logging to send Kubernetes API server logs to Cloud Logging, and ensure Cloud Audit Logs are enabled for the project.


C.

Activate the Security Command Center Premium tier to analyze GKE logs and detect threats, vulnerabilities, and misconfigurations in real time.


D.

Deploy a DaemonSet to every node in the GKE cluster that runs a logging agent to collect and forward all container logs to Cloud Logging.


Expert Solution
Questions # 33:

You are a cloud architect for a financial services company that is building a new application on Google Kubernetes Engine (GKE). Currently, developers build container images on their workstations and manually push them to Artifact Registry. You need to design a secure CI/CD pipeline that automates the build and deployment process from your company ' s GitHub repository. The pipeline must ensure that only trusted, verified container images are deployed to the production GKE cluster and that every deployment can be traced back to its source code. What should you do?

Options:

A.

Connect your GitHub repository to Cloud Build, and create a trigger to automatically start builds on commits. Use the pipeline to build the container image, push it to Artifact Registry, and generate build provenance. Configure Binary Authorization with an attestor to require sign-off before deploying to the production GKE cluster using Cloud Deploy.


B.

Connect your GitHub repository to Cloud Build to create the container images and store them in Artifact Registry. Write a custom script that runs on a schedule to check for new image tags in Artifact Registry and deploys the latest image to the production GKE cluster.


C.

Create a Cloud Run function that triggers on changes to a Cloud Storage bucket where developers upload source code archives from GitHub. Have the function use Kaniko cache to build the image and push it to Artifact Registry. Use kubectl commands within the function to deploy the image to GKE.


D.

Use Jenkins on Compute Engine to build container images from the GitHub repository and push them to Artifact Registry. Promote images by adding tags in the registry. Use a service account key file stored in the Jenkins instance to grant deployment permissions to the production GKE cluster.


Expert Solution
Questions # 34:

For this question, refer to the Cymbal Retail case study. Cymbal ' s generative Al models require high-performance storage for temporary files generated during model training and inference. These files are ephemeral and frequently accessed and modified You need to select a storage solution that minimizes latency and cost and maximizes performance for generative Al workloads. What should you do?

Options:

A.

Use a Cloud Storage bucket in the same region as your virtual machines Configure lifecycle policies to delete files after processing


B.

Use Filestore to store temporary files


C.

Use performance persistent disks.


D.

Use Local SSDs attached to the VMs running the generative Al models


Expert Solution
Questions # 35:

For this question, refer to the EHR Healthcare case study. You are a developer on the EHR customer portal team. Your team recently migrated the customer portal application to Google Cloud. The load has increased on the application servers, and now the application is logging many timeout errors. You recently incorporated Pub/Sub into the application architecture, and the application is not logging any Pub/Sub publishing errors. You want to improve publishing latency. What should you do?

Options:

A.

Increase the Pub/Sub Total Timeout retry value.


B.

Move from a Pub/Sub subscriber pull model to a push model.


C.

Turn off Pub/Sub message batching.


D.

Create a backup Pub/Sub message queue.


Expert Solution
Questions # 36:

You need to upgrade the EHR connection to comply with their requirements. The new connection design must support business-critical needs and meet the same network and security policy requirements. What should you do?

Options:

A.

Add a new Dedicated Interconnect connection.


B.

Upgrade the bandwidth on the Dedicated Interconnect connection to 100 G.


C.

Add three new Cloud VPN connections.


D.

Add a new Carrier Peering connection.


Expert Solution
Questions # 37:

For this question, refer to the Helicopter Racing League (HRL) case study. Recently HRL started a new regional

racing league in Cape Town, South Africa. In an effort to give customers in Cape Town a better user

experience, HRL has partnered with the Content Delivery Network provider, Fastly. HRL needs to allow traffic

coming from all of the Fastly IP address ranges into their Virtual Private Cloud network (VPC network). You are

a member of the HRL security team and you need to configure the update that will allow only the Fastly IP

address ranges through the External HTTP(S) load balancer. Which command should you use?

Options:

A.

Apply a Cloud Armor security policy to external load balancers using a named IP list for Fastly.


B.

Apply a Cloud Armor security policy to external load balancers using the IP addresses that Fastly has published. C. Apply a VPC firewall rule on port 443 for Fastly IP address ranges.


C.

Apply a VPC firewall rule on port 443 for network resources tagged with scurceiplisr-fasrly.


Expert Solution
Questions # 38:

For this question, refer to the Helicopter Racing League (HRL) case study. HRL is looking for a cost-effective

approach for storing their race data such as telemetry. They want to keep all historical records, train models

using only the previous season ' s data, and plan for data growth in terms of volume and information collected.

You need to propose a data solution. Considering HRL business requirements and the goals expressed by

CEO S. Hawke, what should you do?

Options:

A.

Use Firestore for its scalable and flexible document-based database. Use collections to aggregate race data

by season and event.


B.

Use Cloud Spanner for its scalability and ability to version schemas with zero downtime. Split race data

using season as a primary key.


C.

Use BigQuery for its scalability and ability to add columns to a schema. Partition race data based on

season.


D.

Use Cloud SQL for its ability to automatically manage storage increases and compatibility with MySQL. Use

separate database instances for each season.


Expert Solution
Questions # 39:

For this question, refer to the Helicopter Racing League (HRL) case study. HRL wants better prediction

accuracy from their ML prediction models. They want you to use Google’s AI Platform so HRL can understand

and interpret the predictions. What should you do?

Options:

A.

Use Explainable AI.


B.

Use Vision AI.


C.

Use Google Cloud’s operations suite.


D.

Use Jupyter Notebooks.


Expert Solution
Questions # 40:

For this question, refer to the Helicopter Racing League (HRL) case study. The HRL development team

releases a new version of their predictive capability application every Tuesday evening at 3 a.m. UTC to a

repository. The security team at HRL has developed an in-house penetration test Cloud Function called Airwolf.

The security team wants to run Airwolf against the predictive capability application as soon as it is released

every Tuesday. You need to set up Airwolf to run at the recurring weekly cadence. What should you do?

Options:

A.

Set up Cloud Tasks and a Cloud Storage bucket that triggers a Cloud Function.


B.

Set up a Cloud Logging sink and a Cloud Storage bucket that triggers a Cloud Function.


C.

Configure the deployment job to notify a Pub/Sub queue that triggers a Cloud Function.


D.

Set up Identity and Access Management (IAM) and Confidential Computing to trigger a Cloud Function.


Expert Solution
Viewing page 4 out of 7 pages
Viewing questions 31-40 out of questions