10 beginner questions on the Professional Cloud Architect exam guide: high availability, Spanner and RTO/RPO (Designing and planning), Cloud Interconnect and Shared VPC (Managing and provisioning), VPC Service Controls and CMEK (Security and compliance), canary releases (Technical and business processes), Google Cloud CLI tools (Managing implementation) and error budgets (Solution and operations excellence). The real exam also uses case studies, which are not reproduced here.

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. A company runs a stateless web tier on Compute Engine and requires that it keeps serving traffic if one zone fails. Which design meets this requirement?

    • A. A zonal managed instance group with a larger target size
    • B. A single VM with a regional persistent disk
    • C. A regional managed instance group behind a load balancer ✔ correct
    • D. Two VMs in the same zone with different machine types

    Answer: C. A regional MIG spreads instances across several zones in a region, and a load balancer sends traffic only to healthy instances, so a zone failure does not stop the service. Zonal groups stay inside one failure domain.

    Source: docs.cloud.google.com/compute/docs/instance-groups/regional-migs · Domain: Designing and planning a cloud solution architecture

  2. A global business needs a relational database with SQL, strong consistency and horizontal scaling across regions for its order system. Which Google Cloud database fits best?

    • A. Bigtable
    • B. Spanner ✔ correct
    • C. Firestore
    • D. Memorystore

    Answer: B. Spanner is a relational database with virtually unlimited scale, guaranteed consistent transactions and single-, dual- or multi-region configurations. Bigtable and Firestore are NoSQL databases, and Memorystore is an in-memory store.

    Source: cloud.google.com/spanner · Domain: Designing and planning a cloud solution architecture

  3. When planning disaster recovery, what does the recovery point objective (RPO) describe?

    • A. The maximum time the application can be offline
    • B. The total cost of the backup storage per month
    • C. The number of regions used by the application
    • D. The maximum period of data that might be lost in an incident ✔ correct

    Answer: D. RPO is the maximum acceptable length of time during which data might be lost due to a major incident. The maximum acceptable offline time is the recovery time objective (RTO).

    Source: docs.cloud.google.com/architecture/dr-scenarios-planning-guide · Domain: Designing and planning a cloud solution architecture

  4. An enterprise needs a high-bandwidth, private physical connection between its own data center and Google's network that does not travel over the public internet. Which option should the architect recommend?

    • A. Dedicated Interconnect ✔ correct
    • B. HA VPN over the internet
    • C. VPC Network Peering
    • D. Cloud NAT

    Answer: A. Dedicated Interconnect gives a direct physical connection between the on-premises network and Google's network. HA VPN encrypts traffic but uses the internet, peering links VPC networks, and Cloud NAT handles outbound access.

    Source: docs.cloud.google.com/network-connectivity/docs/interconnect/concepts/dedicated- · Domain: Managing and provisioning a cloud solution infrastructure

  5. An organization wants a central network team to manage one VPC network, including subnets and firewall rules, while application teams deploy resources from their own projects into it. What should the architect use?

    • A. One VPC network per application with no connectivity
    • B. Shared VPC with a host project and service projects ✔ correct
    • C. Cloud VPN tunnels between every pair of projects
    • D. A separate organization for each application team

    Answer: B. Shared VPC lets a host project own the VPC network while attached service projects use its subnets, so network administration stays central and teams keep their own projects and billing.

    Source: docs.cloud.google.com/vpc/docs/shared-vpc · Domain: Managing and provisioning a cloud solution infrastructure

  6. A healthcare company wants to reduce the risk that data in Cloud Storage and BigQuery is copied to projects outside its control, even by users with valid credentials. Which control helps most?

    • A. Cloud CDN in front of the buckets
    • B. Larger Compute Engine machine types
    • C. VPC Service Controls service perimeters ✔ correct
    • D. Cloud Storage object versioning

    Answer: C. VPC Service Controls service perimeters block copying data from supported services, such as Cloud Storage and BigQuery, to resources outside the perimeter, which helps prevent data exfiltration. Versioning and CDN do not.

    Source: docs.cloud.google.com/vpc-service-controls/docs/overview · Domain: Designing for security and compliance

  7. Customer-managed encryption keys (CMEK) in Cloud KMS let a customer control the keys that protect their data at rest in supported Google Cloud services.

    • A. True ✔ correct
    • B. False

    Answer: A. True. Data is encrypted at rest by default with Google-managed keys. With CMEK you create and manage the keys in Cloud KMS, controlling rotation, access and disabling, which can help meet compliance needs.

    Source: docs.cloud.google.com/kms/docs/cmek · Domain: Designing for security and compliance

  8. A development team wants each new release to receive only part of the production traffic first, so problems affect a limited group of users before the full rollout. Which release strategy is this?

    • A. Canary deployment ✔ correct
    • B. Recreate deployment
    • C. Manual hotfix deployment
    • D. Big-bang deployment

    Answer: A. A canary deployment is a progressive rollout that splits traffic between the deployed version and the new version, so the new version reaches a limited group first. Recreate and big-bang approaches switch everything at once.

    Source: docs.cloud.google.com/deploy/docs/deployment-strategies/canary · Domain: Analyzing and optimizing technical and business processes

  9. An architect advises an operations team to automate tasks from the command line. Which two are command-line tools that are installable components of the Google Cloud CLI? (Select TWO)

    • A. gcloud ✔ correct
    • B. Cloud Armor
    • C. bq ✔ correct
    • D. Looker Studio
    • E. Cloud CDN

    Answer: A, C. The Google Cloud CLI includes the gcloud tool and the bq tool for BigQuery (plus the legacy gsutil). Cloud Armor, Looker Studio and Cloud CDN are services, not CLI tools.

    Source: docs.cloud.google.com/sdk/docs/components · Domain: Managing implementation

  10. A team sets a 99.9% availability service level objective (SLO) for an API. What is its error budget?

    • A. The money set aside to pay for outages
    • B. The number of engineers on call each week
    • C. The allowed unreliability, which starts at 1 minus the SLO ✔ correct
    • D. The maximum number of releases per month

    Answer: C. An error budget starts at 1 minus the SLO (here 0.1%) and shrinks as actual performance misses the SLO. Teams use it to balance reliability work against releasing new features.

    Source: docs.cloud.google.com/stackdriver/docs/solutions/slo-monitoring · Domain: Ensuring solution and operations excellence

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public Google Cloud exam objectives (Professional Cloud Architect standard exam guide (current PDF, checked 2026-10-25; case studies Altostrat Media, Cymbal Retail, EHR Healthcare, KnightMotives Automotive)), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by Google Cloud; exam names are trademarks of their owners. Official exam page: cloud.google.com/learn/certification/cloud-architect.

Last modified: Sunday, 25 October 2026, 9:57 PM