Planning and implementing a cloud solution

A backup pipeline writes nightly database dumps that are typically read again about once every three months for restore drills, and the team wants the class whose minimum storage duration and access profile best match a quarterly read pattern. Which Cloud Storage class should they select?

• ANearline storage, because its 30-day minimum storage duration comfortably covers quarterly restores and its retrieval fees are the lowest of the colder classes.
• BArchive storage, because quarterly reads are infrequent and its 365-day minimum storage duration gives the lowest at-rest cost for backup data.
• CStandard storage, because backups must restore quickly and its absence of a minimum storage duration avoids penalties as dumps are rotated each quarter.
• DColdline storage, because it is intended for data accessed about once a quarter and its 90-day minimum storage duration lines up with a three-month restore cadence.check_circle Correct

Why A is wrong: Nearline is tuned for monthly access, so for data read only quarterly it charges more at rest than a colder class would, making it a suboptimal match for a three-month cycle.

Why B is wrong: Archive suits yearly-or-rarer access, and its 365-day minimum would trigger early-deletion charges when dumps rotate every quarter, so it does not fit a three-month cadence despite the low storage price.

Why C is wrong: Standard restores fast and has no minimum duration, but its at-rest price is the highest, so using it for data read only quarterly overpays heavily for availability the backup rarely needs.

Why D is correct: Coldline is designed for data read roughly every 90 days, and its 90-day minimum duration matches a quarterly restore drill while pricing storage below Nearline for that access rate.

An industrial monitoring platform ingests roughly two million sensor writes per second and must serve single-row lookups keyed by device and time range with single-digit millisecond latency, growing into petabytes over several years. The engineers are comfortable with MySQL and want to keep the workload on Cloud SQL. Which product suits this access pattern?

• ACloud SQL for MySQL with read replicas and range-partitioned tables to absorb the high write rate.
• BBigtable, using a row key that combines device identifier and reversed timestamp for lookups.check_circle Correct
• CBigQuery with streaming inserts and clustered tables to store and query the sensor readings.
• DFirestore in Native mode, relying on automatic scaling to handle the incoming sensor documents.

Why A is wrong: Read replicas ease reads but not writes, and a single MySQL primary cannot sustain millions of inserts per second or petabyte-scale storage, so the familiar option collapses under this load.

Why B is correct: Bigtable is a wide-column store built for very high write throughput, petabyte scale, and low-latency key-range reads, so a device-plus-timestamp row key delivers exactly the required access pattern.

Why C is wrong: BigQuery ingests streams well, but it is an analytics warehouse built for scans and aggregations, not for millisecond single-row key lookups, so per-device point reads would be slow and costly.

Why D is wrong: Firestore scales for document apps, but sustained per-document write rates hit throughput limits and its pricing and design do not fit petabyte time-series at millions of writes per second.

A retail organisation runs its production workloads across eight separate projects, one per application team. A central platform team must own every subnet, route and firewall rule, while each application team keeps permission only to deploy Compute Engine instances into subnets the platform team assigns to them. The teams' workloads must reach each other over internal IP addresses. Which connectivity design meets these requirements?

• ACreate a VPC in each application project and establish VPC Network Peering between every pair of project VPCs, delegating firewall management to each team.
• BConfigure the platform team's project as a Shared VPC host project, attach the eight application projects as service projects, and grant each team the Compute Network User role on assigned subnets.check_circle Correct
• CPlace all eight teams' instances directly in the platform team's single project and rely on IAM conditions to restrict which team can edit each subnet.
• DPeer each application VPC with a central hub VPC owned by the platform team so that routing between teams passes transitively through the hub.

Why A is wrong: Full-mesh peering does give internal reachability, but it leaves each team administering its own VPC, routes and firewall rules, which is the opposite of the central-ownership requirement stated in the scenario.

Why B is correct: A Shared VPC host project centralises subnets, routes and firewall rules under the platform team, while the Network User role lets each service project deploy instances into named subnets without managing the network itself.

Why C is wrong: Collapsing everything into one project removes the per-team project isolation the organisation relies on for billing and quota, and subnet-level edit restrictions do not reproduce the service-project deployment boundary.

Why D is wrong: This looks like a clean hub design, but VPC Network Peering is not transitive, so spoke projects would not reach each other through the hub, and each spoke would still administer its own VPC.

A team distributes an internal application that consists of several Kubernetes Deployments, Services, and ConfigMaps, and wants to package these manifests as a single versioned, parameterised unit that other teams can install and upgrade on their own Google Kubernetes Engine clusters. Which tool is purpose-built for this packaging task?

• AConfig Connector, because it bundles Kubernetes Deployments and Services into a versioned artefact that other clusters install as one release.
• BHelm, because a chart packages the application's manifests as a versioned unit that teams can install and upgrade with parameter overrides.check_circle Correct
• CTerraform, because its module registry is the standard way to package and version Kubernetes Deployments and Services for reuse across clusters.
• DGemini Cloud Assist, because it generates the manifests on request and stores each generated set as a reusable, versioned application package.

Why A is wrong: Config Connector is tempting because it works inside Kubernetes, but its job is exposing Google Cloud resources as custom resources, not packaging an application's manifests into a distributable, versioned unit.

Why B is correct: Helm charts template a set of Kubernetes manifests into one versioned package with configurable values, so consumers can install, override parameters, and upgrade the application as a single release.

Why C is wrong: Terraform modules do package infrastructure configuration, but the native way to template and version a bundle of Kubernetes application manifests for cluster installation is a chart, not a Terraform module.

Why D is wrong: Gemini Cloud Assist can help author configuration through AI guidance, but it is not a packaging system and does not produce versioned, installable application bundles for other teams to deploy.

A team is exposing a public web application over HTTPS to users in several continents, and wants a single anycast IP address that terminates TLS close to each user and routes to the nearest healthy backend. Which Google Cloud load balancer suits this requirement?

• AThe global external Application Load Balancer, because it provides one anycast IP, terminates HTTPS at the edge, and routes requests to the closest healthy backend.check_circle Correct
• BThe internal passthrough Network Load Balancer, because it forwards TCP and UDP traffic to backends within a region without altering packet headers.
• CThe external passthrough Network Load Balancer, because it distributes Layer 4 traffic and preserves the client source IP to the backend instances.
• DThe regional internal Application Load Balancer, because it applies Layer 7 URL routing to backends serving private clients inside one region.

Why A is correct: This Layer 7 balancer offers a single global anycast address, terminates TLS at Google edge points of presence, and directs each request to the nearest available backend.

Why B is wrong: This is a regional, internal-only Layer 4 balancer, so it neither serves external users nor terminates TLS or offers a global anycast address.

Why C is wrong: It is tempting because it is external, but it operates at Layer 4 without HTTPS termination or content-based routing, so it cannot terminate TLS near the user.

Why D is wrong: It does handle Layer 7 traffic, but it is regional and internal, so it cannot present a global anycast IP or serve public users across continents.