Pass the Google Google Cloud Certified Professional-Cloud-Architect Questions and answers with CertsForce

https://cloud.google.com/community/tutorials/pci-tokenizer Deterministic output means that a given set of inputs (card number, expiration, and userID) will always generate the same token. This is useful if you want to rely on the token value to deduplicate your token stores. You can simply match a newly generated token to your existing catalog of tokens to determine whether the card has been previously stored. Depending on your application architecture, this can be a very useful feature. However, this could also be accomplished using a salted hash of the input values.

According to Google Cloud Storage documentation , the soft-delete policy is a feature enabled by default on new buckets (starting in 2024) to protect against accidental or malicious deletion. It retains deleted objects for a specified retention period (default is seven days). For workloads involving large files—such as the video files Cymbal uses for Vertex AI training—this policy can lead to unexpected cost spikes.

When soft-delete is active, objects that are deleted are not immediately removed from the billing cycle; instead, they continue to incur charges at the same rate as " live " objects until the retention period expires. In an AI training environment where datasets are frequently updated, replaced, or temporary " scratch " files are created and deleted, the volume of soft-deleted bytes can quickly double or triple the effective storage footprint.

Options B and D are incorrect because moving from dual-region or multi-region to a single region would actually reduce storage costs, as regional storage is priced lower. Option A is incorrect because disabling the policy would stop the retention of deleted bytes, thereby lowering the bill. Therefore, checking for an active or recently enabled soft-delete policy is the standard troubleshooting step for sudden increases in storage costs associated with high-churn, large-file datasets.

According to the Google Cloud Architecture Framework for modernizing applications, Google Kubernetes Engine (GKE) is the most suitable compute platform for services requiring high scalability and availability. Cymbal’s AI-powered virtual agents must handle " anticipated growth " and fluctuating customer demands from their web and mobile apps. GKE’s Horizontal Pod Autoscaler (HPA) and Cluster Autoscaler ensure that the compute resources expand automatically during peak shopping hours and shrink during low-traffic periods to " minimize costs. "

GKE is explicitly mentioned in Cymbal’s " Existing Technical Environment " as their preferred platform for containerized applications. Leveraging GKE for the virtual agents allows the development team to use a microservices approach, isolating the agent ' s logic from other catalog enrichment tasks. Option D (Single large VM) is a " legacy " approach that creates a single point of failure and does not scale efficiently. Option A (Cloud SQL) is a database service, not a compute resource for running agent logic. While Vertex AI Agent Builder (Option B) is the tool used to create the agents, the underlying compute that hosts the integrated application and handles the traffic orchestration is best served by a managed Kubernetes environment like GKE, which aligns with their requirement for " Scalability and Performance. "

According to the Google Cloud Migration Framework , a phased approach (also known as a Phased Migration ) is the highly recommended best practice for complex enterprise workloads like Cymbal ' s product catalog. This strategy minimizes business risk and operational disruption by avoiding the " Big Bang " approach (Option D), which is often cited in the Google Cloud Architecture Framework as being high-risk for large-scale migrations.

By starting with a pilot project focused on a specific product category, Cymbal can validate the technical architecture of their new generative AI tools—such as Vertex AI Search and Retail API —in a controlled environment. This allows the team to refine the Human-in-the-Loop (HITL) review processes and ensure that the AI-generated attributes and descriptions meet their accuracy standards before a global rollout. This " crawl-walk-run " methodology aligns with the Google Cloud Adoption Framework , specifically the " Scale " and " Learn " themes, by allowing the organization to build expertise and adjust governance policies based on real-world results from the pilot.

Furthermore, a gradual expansion helps in managing costs effectively, as Cymbal can optimize resource allocation (like moving from on-premises databases to Cloud Spanner or Cloud SQL ) based on the performance metrics observed during the initial phase. Options A and B are too prescriptive regarding specific compute choices without first establishing a successful migration pattern and do not address the primary requirement of " proper change management " and risk mitigation.

https://cloud.google. com/blog/products/gcp/the-five-phases-of-migrating-to-google-cloud-platform

https://cloud.google.com/compute/docs/troubleshooting/troubleshooting-ssh

D: Handling " Unable to connect on port 22 " error message

Possible causes include:

There is no firewall rule allowing SSH access on the port. SSH access on port 22 is enabled on all Compute Engine instances by default. If you have disabled access, SSH from the Browser will not work. If you run sshd on a port other than 22, you need to enable the access to that port with a custom firewall rule.

The firewall rule allowing SSH access is enabled, but is not configured to allow connections from GCP Console services. Source IP addresses for browser-based SSH sessions are dynamically allocated by GCP Console and can vary from session to session.

According to Google Cloud Architecture Framework and Cloud KMS documentation , when a customer requires direct control and auditability over the encryption keys used for data at rest, Customer-Managed Encryption Keys (CMEK) is the recommended path.

While Google Cloud encrypts all data at rest by default using Google-managed keys (Option B), Altostrat specifically requires control and auditability . By using CMEK through Cloud Key Management Service (Cloud KMS) , Altostrat can manage the key rotation schedules, revoke access to keys immediately to " kill " access to the data, and view detailed logs in Cloud Audit Logs every time the key is used to encrypt or decrypt a media asset.

Option D is superior to Option C because client-side encryption with a self-managed HashiCorp Vault adds significant operational overhead and complexity, contradicting the business requirement to " Simplify infrastructure management . " CMEK integrates natively with Cloud Storage, allowing for a seamless experience while meeting the strict security requirements for sensitive documentaries and interviews. Furthermore, the use of IAM roles and groups for fine-grained access control aligns with the principle of least privilege, ensuring that only authorized service accounts and users can access the sensitive buckets and the keys required to decrypt them.

According to the Apigee API Platform documentation , the Quota policy is the primary mechanism used to enforce business-level constraints by limiting the number of request messages an API proxy allows over a specific period of time (such as a minute, hour, day, week, or month). For a media company like Altostrat, which aims to " unlock new revenue streams through targeted marketing " and " drive revenue growth, " managing API consumption is critical for cost predictability and monetization strategies.

Google Cloud distinguishes between Spike Arrest and Quota policies . While Spike Arrest is designed for operational safety—protecting backend systems from sudden traffic bursts—the Quota policy is specifically used to enforce business contracts, Service Level Agreements (SLAs), and cost management . By configuring a Quota policy, Altostrat can ensure that no single consumer or application exceeds the total volume of calls that would result in unexpected infrastructure costs or exceed the limits of their current subscription tier.

Options A and B (API Key and OAuth) are essential for authentication and authorization —identifying who is making the call—but they do not inherently limit the volume of calls. Option D (XML threat protection) is a security measure to prevent malformed payload attacks. Therefore, to meet the specific business requirement of " Reliability and cost management, " implementing Quota policies within Apigee is the architecturally correct choice to prevent API abuse and manage operational expenditure.