Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
Which service is best suited for running containerized applications with minimal infrastructure management?
Compare and contrast core infrastructure and application services
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
Terraform modules and infrastructure blueprints for advanced exploration of Google Cloud design. This is supporting engineering material, not an exam course.
Try it: Read one small VPC or service-account module. Draw the resources and permission boundaries it creates, and explain a least-privilege change without deploying an entire landing zone.
Reading the code is free. Deployment requires suitable permissions and can create billable infrastructure.
Official certification paths with exam-specific guides and preparation links for cloud roles.
Try it: Open the guide for your chosen role. For each weak domain, write one service-selection decision you cannot yet explain and find its product documentation.
Public certification information is free; training, labs, and exam registration may be paid.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
Which service is best suited for running containerized applications with minimal infrastructure management?
Cloud Run
Compute Engine
App Engine
Kubernetes Engine
Correct answer
Cloud Run
Cloud Run is a fully managed service that automatically scales containerized applications based on request volume. It removes the need to manage servers or clusters, making it ideal for event-driven workloads.
What is the primary purpose of a service account in Google Cloud?
To authenticate automated processes and applications
To provide temporary user login credentials
To manage billing for a project
To define network firewall rules
Correct answer
To authenticate automated processes and applications
Service accounts are used by applications and virtual machines to interact with Google Cloud APIs securely. They use keys or short-lived tokens for authentication instead of user credentials.
Which storage class is optimized for data that is accessed less frequently but requires rapid access when needed?
Archive Storage
Standard Storage
Coldline Storage
Regional Storage
Correct answer
Coldline Storage
Coldline Storage is designed for data with low access frequency but needing quick retrieval within minutes. It is more cost-effective than Archive Storage for such access patterns.
What does Infrastructure as Code (IaC) enable teams to do?
Automate the provisioning and management of resources
Monitor application performance in real time
Secure network perimeters using firewalls
Optimize database query performance
Correct answer
Automate the provisioning and management of resources
IaC allows teams to define infrastructure using configuration files, enabling consistent deployments and version control. Tools like Deployment Manager support this approach on Google Cloud.
Which feature ensures high availability for applications across multiple zones?
Zonal persistent disks
Regional managed instance groups
Single-zone Compute Engine instances
Static external IP addresses
Correct answer
Regional managed instance groups
Regional managed instance groups distribute instances across multiple zones within a region. This protects applications from zone-level failures and supports autoscaling.
What is the main benefit of using Cloud Build over local CI/CD tools?
It provides integrated artifact storage and scalable build workers
It eliminates the need for source code repositories
It automatically fixes code quality issues
It reduces the need for container images
Correct answer
It provides integrated artifact storage and scalable build workers
Cloud Build runs builds in the cloud with managed resources, reducing local infrastructure needs. It integrates with source repositories and can produce container images for deployment.
Which networking component allows internal resources to communicate with external endpoints without a public IP address?
External HTTP(S) Load Balancer
Cloud NAT
VPC Peering
Firewall Rules
Correct answer
Cloud NAT
Cloud NAT enables outbound internet access for instances without public IPs by performing network address translation. It is commonly used in private subnet designs.
When should you use a preemptible VM instead of a regular Compute Engine instance?
For production databases requiring high reliability
For fault-tolerant, batch-oriented workloads
For applications needing consistent low latency
For services requiring static external IPs
Correct answer
For fault-tolerant, batch-oriented workloads
Preemptible VMs are short-lived and significantly cheaper, making them suitable for interruptible tasks like batch processing or testing. They are not appropriate for critical stateful services.
What is the primary use case for Cloud Pub/Sub in application architecture?
To store structured data for analytics
To enable asynchronous messaging between services
To manage user authentication flows
To host static website content
Correct answer
To enable asynchronous messaging between services
Pub/Sub is a messaging service that decouples services by allowing them to publish and subscribe to events. It supports reliable delivery and real-time data streaming use cases.
Which practice helps reduce the risk of misconfigured resources in Google Cloud?
Using default service account permissions
Applying organization policies and constraints
Disabling audit logging
Allowing unrestricted ingress access
Correct answer
Applying organization policies and constraints
Organization policies enforce governance rules across projects, such as restricting resource locations or required tags. This prevents unintended configurations and improves security posture.
What is a key advantage of using Cloud Functions over traditional virtual machines?
You must manage operating system patches
You pay only for execution time and resources used
You need to configure load balancing manually
You have to provision long-running instances
Correct answer
You pay only for execution time and resources used
Cloud Functions is a serverless execution environment that runs code in response to events. You are charged per invocation and do not manage infrastructure, which reduces operational overhead.
Which tool is commonly used to manage container images and automate deployments on Google Cloud?
Cloud Scheduler
Artifact Registry
Cloud Monitoring
Cloud DNS
Correct answer
Artifact Registry
Artifact Registry securely stores container images and packages, and integrates with deployment pipelines. It provides fine-grained access control and vulnerability scanning.
What does autoscaling help maintain in a cloud application?
Fixed monthly costs
Consistent performance under variable load
Static IP address assignment
Manual instance configuration
Correct answer
Consistent performance under variable load
Autoscaling adjusts the number of running instances based on metrics like CPU utilization or request rate. This helps maintain performance and availability while optimizing costs.
Which logging practice supports security investigation and compliance requirements?
Disabling log exports to BigQuery
Retaining logs for a defined period
Storing logs only in local disk
Ignoring admin activity logs
Correct answer
Retaining logs for a defined period
Centralized log retention enables analysis of security events and meets regulatory requirements. Google Cloud Logging allows exporting logs to storage and analytics platforms for long-term use.
Which mechanism ensures that only authorized services can access specific resources in a zero-trust security model?
Identity and Access Management (IAM) policies
Static IP whitelisting
VPC firewall rules
Cloud Armor preconfigured rules
Correct answer
Identity and Access Management (IAM) policies
Identity and Access Management (IAM) policies enforce the principle of least privilege by granting granular access to resources based on authenticated identity, aligning with zero-trust principles.
Recall the answer before opening each card.
Cloud Run. It fully manages scaling, networking, and infrastructure, so you only provide the container image and request configuration.
To authenticate automated processes and applications. Service accounts enable secure, programmatic access to Google Cloud APIs without human credentials.
Coldline Storage. It balances lower cost with retrieval times in minutes, suitable for quarterly backups or archival with occasional access.
Automating provisioning and management of resources using configuration files. This ensures consistency, version control, and repeatable deployments.
Regional managed instance groups. They distribute VM instances across multiple zones within a region, protecting against zone failures.
Integrated artifact storage and scalable build workers. Cloud Build runs builds in the cloud without managing infrastructure and stores outputs in Container Registry/Artifact Registry.
Cloud NAT. It performs network address translation so instances in private subnets can reach external services while remaining unreachable from the internet.
For fault-tolerant, batch-oriented workloads. Preemptible VMs are cheaper but can be terminated at any time, so they are ideal for jobs that can be interrupted and restarted.
To enable asynchronous messaging between services. It decouples publishers and subscribers, providing reliable event delivery for real-time data streaming.
Applying organization policies and constraints. These policies enforce rules like allowed locations or required tags across all projects, preventing non-compliant configurations.
You pay only for execution time and resources used. Cloud Functions is serverless – no infrastructure management, scaling automatically per event.
Artifact Registry. It securely stores container images and packages, integrates with CI/CD, and provides vulnerability scanning and fine-grained access control.
Consistent performance under variable load. Autoscaling adjusts the number of instances based on metrics like CPU or request rate to meet demand while optimizing costs.
Retaining logs for a defined period. Log retention enables analysis of past events, forensics, and meeting regulatory requirements. Google Cloud Logging allows custom retention and export.
Identity and Access Management (IAM) policies. IAM grants granular permissions based on authenticated identity, enforcing the principle of least privilege.
Cloud Run runs containers with gRPC/HTTP request handling, while Cloud Functions runs single-purpose functions triggered by events. Cloud Run supports more complex runtimes and continuous requests.
To authenticate as a service account. Keys are JSON files or short-lived tokens that allow external applications or VMs to access Google Cloud APIs securely.
Coldline retrieves data in minutes; Archive takes hours to days. Coldline is for data needing quick access less than quarterly; Archive for rarely accessed data with long retrieval times.
Cloud Build triggers automatically on changes to GitHub, Cloud Source Repositories, etc. It clones the code, runs defined build steps, and pushes artifacts to Artifact Registry or Container Registry.
For private instances in a VPC that need to download updates or access Google APIs without public IPs. Cloud NAT allows outbound connections while keeping the instances isolated.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
This section focuses on selecting the appropriate compute service based on workload characteristics. Cloud Run is highlighted for containerized applications with minimal infrastructure management, while Cloud Functions is best for event-driven, pay-per-use execution. Preemptible VMs are recommended for fault-tolerant batch jobs to reduce costs. Understanding when to use each service helps optimize performance and budget. The practice bank emphasizes that serverless options reduce operational overhead but are subject to execution time limits, whereas VMs offer more control but require management.
Security and governance are core to cloud development. Service accounts authenticate automated processes without user credentials. IAM policies enforce least privilege in a zero-trust model. Organization policies prevent misconfigurations by restricting resource locations or enabling required constraints. Cloud NAT allows private instances to reach external endpoints securely. The practice bank reinforces that proper identity management and policy enforcement are critical for compliance and protection against misconfigurations.
Choosing the right storage class and messaging service impacts cost and performance. Coldline Storage balances infrequent access with rapid retrieval. Cloud Pub/Sub decouples services via asynchronous messaging, enabling event-driven architectures. Artifact Registry securely stores container images and integrates with CI/CD pipelines. The practice bank shows how these services fit into application designs for reliability and scalability.
Automation and observability are key to operating cloud applications efficiently. Infrastructure as Code (IaC) enables consistent and version-controlled deployments. Cloud Build provides scalable build workers and integrated artifact storage. Regional managed instance groups ensure high availability across zones, and autoscaling maintains performance under variable load. Log retention supports security investigations and compliance. These practices reduce manual effort and improve system resilience.
Study workflow
For any application component, first determine if it is event-driven, long-running, stateful, or fault-tolerant. This drives compute choice: serverless for short-lived events, containers for portable microservices, VMs for full control. Also assess access patterns to select storage class.
Create a service account for each application component with minimal IAM roles. Use Cloud NAT for private instances needing outbound access. Apply organization policies to enforce resource location and required tags. Enable audit logging for critical operations.
Use regional managed instance groups or Cloud Run multi-region to survive zone failures. Implement autoscaling with appropriate metrics. Decouple services with Pub/Sub to avoid cascading failures. Use preemptible VMs only for interruptible workloads.
Store container images in Artifact Registry. Configure Cloud Build to build from source and deploy to Cloud Run or GKE. Use IaC templates (e.g., Deployment Manager) to define infrastructure. Integrate with source repos for automatic triggers.
Set up Cloud Logging to collect logs from all services. Define log retention periods based on compliance needs. Export logs to BigQuery or Cloud Storage for analysis. Create alerts for error rates and performance anomalies.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
Cloud Run abstracts cluster management and is ideal for stateless containers that scale quickly per request. GKE offers more control over orchestration and is better for complex stateful or long-running workloads. Use Cloud Run for simple microservices; use GKE when you need fine-grained scheduling or sidecar patterns.
Service accounts are non-human identities used by applications and VMs to authenticate to Google Cloud APIs. They have roles assigned like user accounts but use keys or short-lived tokens instead of passwords. They enable automated access without sharing user credentials.
Coldline Storage is cheaper for data accessed less than once every 90 days, while Nearline is for data accessed less than once a month. Coldline has a 90-day minimum storage duration and retrieval costs, making it cost-effective for cold data that still needs quick access (within minutes).
No. Cloud NAT only provides outbound internet connectivity for private instances. It does not allow inbound connections from the internet. For inbound, you need a public IP, load balancer, or Cloud VPN/Interconnect for hybrid scenarios. Cloud NAT is used to let instances initiate outbound connections without public IPs.
An organization policy sets constraints on Google Cloud resources across projects (e.g., allowed locations, resource types). IAM policies control who (users/service accounts) has what role on specific resources. Organization policies are like guardrails, while IAM policies grant permissions within those guardrails.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
