Google Professional-Cloud-Architect 問題集

質問 1：
You are designing the storage configuration for a critical Cloud Storage bucket. This bucket will store trade confirmation documents for a financial services company. These documents are immutable and serve as a legal record. Your design must meet two primary data protection requirements:
* The system must allow for the rapid recovery of any document that is accidentally deleted or maliciously overwritten.
* Once a document is written, it must be impossible for anyone, including administrators, to delete or modify it for seven years.
What should you do?
A. Grant only the roles/storage.objectCreator IAM role to the application ' s service account. Remove all other admin permissions from the bucket.
B. Configure an Object Lifecycle Management rule on the bucket to ensure all objects are retained for at least seven years before they can be deleted.
C. Use Storage Transfer Service to create a daily replication job that synchronizes the bucket to a separate archive bucket in another region.
D. Enable Object Versioning on the bucket. Additionally, configure the bucket with a Bucket Lock and a retention policy of seven years.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 2：
For this question, refer to the EHR Healthcare case study. EHR has single Dedicated Interconnect connection between their primary data center and Googles network. This connection satisfies EHR's network and security policies:
* On-premises servers without public IP addresses need to connect to cloud resources without public IP addresses
* Traffic flows from production network mgmt. servers to Compute Engine virtual machines should never traverse the public internet.
You need to upgrade the EHR connection to comply with their requirements. The new connection design must support business critical needs and meet the same network and security policy requirements. What should you do?
A. Add a new Carrier Peering connection
B. Upgrade the bandwidth on the Dedicated Interconnect connection to 100 G
C. Add a new Dedicated Interconnect connection
D. Add three new Cloud VPN connections
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Your company has an application running on a deployment in a GKE cluster. You have a separate cluster for development, staging and production. You have discovered that the team is able to deploy a Docker image to the production cluster without first testing the deployment in development and then staging. You want to allow the team to have autonomy but want to prevent this from happening. You want a Google Cloud solution that can be implemented quickly with minimal effort. What should you do?
A. Implement a corporate policy to prevent teams from deploying Docker image to an environment unless the Docker image was tested in an earlier environment
B. Configure the binary authorization policies for the development, staging and production clusters. Create attestations as part of the continuous integration pipeline"
C. Create a Kubernetes admission controller to prevent the container from starting if it is not approved for usage in the given environment
D. Configure a Kubernetes lifecycle hook to prevent the container from starting if it is not approved for usage in the given environment
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 4：
You are configuring the cloud network architecture for a newly created project m Google Cloud that will host applications in Compote Engine Compute Engine virtual machine instances will be created in two different subnets (sub-a and sub-b) within a single region
* Instances in sub-a win have public IP addresses
* Instances in sub-b will have only private IP addresses
To download updated packages, instances must connect to a public repository outside the boundaries of Google Cloud You need to allow sub-b to access the external repository. What should you do?
A. Configure Cloud NAT and select sub b m the NAT mapping section
B. Enable Private Google Access on sub-b
C. Configure a bastion host instance in sub a to connect to instances in sub-b
D. Enable Identity Aware Proxy for TCP forwarding for instances in sub-b
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 5：
You are leading a large-scale Google Cloud implementation project Your development teams need to deploy applications, but they lack deep expertise in cloud-native patterns. This leads to inconsistent and insecure deployments, such as GKE clusters without proper logging and overly permissive 1AM roles. You need to implement a system that empowers these teams to deploy complete, pre-approved architectural patterns in a self-service manner. The system must ensure security and consistency by default while maintaining high developer velocity and avoiding manual approval bottlenecks. What should you do?
A. Enforce a mandatory CI ' CD pipeline using Cloud Build that requires every Terraform deployment to be reviewed and approved before the Terraform apply step can run.
B. Use a combination of organization policies to restrict resource configurations and 1AM recommender to periodically suggest improvements.
C. Create a central Cloud Monitoring dashboard and a set of custom alerts that fire whenever a non- compliant resource is detected
D. Use Service Catalog to define, govern, and offer a portfolio of approved products Include Terraform scripts into Service Catalog items.
正解：D
解説: (Topexam メンバーにのみ表示されます)