[Jul 12, 2025] Get New Professional-Cloud-Architect Practice Test Questions Answers [Q116-Q140]

Rate this post

[Jul 12, 2025] Get New Professional-Cloud-Architect Practice Test Questions Answers

Professional-Cloud-Architect Dumps and Exam Test Engine

NEW QUESTION 116
Your company has developed a monolithic, 3-tier application to allow external users to upload and share files.
The solution cannot be easily enhanced and lacks reliability. The development team would like to re-architect the application to adopt microservices and a fully managed service approach, but they need to convince their leadership that the effort is worthwhile. Which advantage(s) should they highlight to leadership?

The new approach will be significantly less costly, make it easier to manage the underlying infrastructure, and automatically manage the CI/CD pipelines.

The monolithic solution can be converted to a container with Docker. The generated container can then be deployed into a Kubernetes cluster.

The new approach will make it easier to decouple infrastructure from application, develop and release new features, manage the underlying infrastructure, manage CI/CD pipelines and perform A/B testing, and scale the solution if necessary.

The process can be automated with Migrate for Compute Engine.

NEW QUESTION 117
A lead engineer wrote a custom tool that deploys virtual machines in the legacy data center. He wants to migrate the custom tool to the new cloud environment. You want to advocate for the adoption of Google Cloud Deployment Manager.
What are two business risks of migrating to Cloud Deployment Manager? Choose 2 answers.

Cloud Deployment Manager uses Python

Cloud Deployment Manager APIs could be deprecated in the future

Cloud Deployment Manager is unfamiliar to the company’s engineers

Cloud Deployment Manager requires a Google APIs service account to run

Cloud Deployment Manager can be used to permanently delete cloud resources

Cloud Deployment Manager only supports automation of Google Cloud resources

NEW QUESTION 118
Your company is using BigQuery as its enterprise data warehouse. Data is distributed over several Google Cloud projects. All queries on BigQuery need to be billed on a single project. You want to make sure that no query costs are incurred on the projects that contain the data. Users should be able to query the datasets, but not edit them.
How should you configure users’ access roles?

Add all users to a group. Grant the group the role of BigQuery user on the billing project and BigQuery dataViewer on the projects that contain the data.

Add all users to a group. Grant the group the roles of BigQuery dataViewer on the billing project and BigQuery user on the projects that contain the data.

Add all users to a group. Grant the group the roles of BigQuery jobUser on the billing project and BigQuery dataViewer on the projects that contain the data.

Add all users to a group. Grant the group the roles of BigQuery dataViewer on the billing project and BigQuery jobUser on the projects that contain the data.

NEW QUESTION 119
You need to ensure reliability for your application and operations by supporting reliable task a scheduling for compute on GCP. Leveraging Google best practices, what should you do?

Using the Cron service provided by App Engine, publishing messages directly to a message- processing utility service running on Compute Engine instances.

Using the Cron service provided by App Engine, publish messages to a Cloud Pub/Sub topic.
Subscribe to that topic using a message-processing utility service running on Compute Engine instances.

Using the Cron service provided by Google Kubernetes Engine (GKE), publish messages directly to a message-processing utility service running on Compute Engine instances.

Using the Cron service provided by GKE, publish messages to a Cloud Pub/Sub topic. Subscribe to that topic using a message-processing utility service running on Compute Engine instances.

NEW QUESTION 120
You are migrating third-party applications from optimized on-premises virtual machines to Google Cloud.
You are unsure about the optimum CPU and memory options. The application have a consistent usage patterns across multiple weeks. You want to optimize resource usage for the lowest cost. What should you do?

Create a Compute engine instance with CPU and Memory options similar to your application’s current on-premises virtual machine. Install the cloud monitoring agent, and deploy the third party application.
Run a load with normal traffic levels on third party application and follow the Rightsizing Recommendations in the Cloud Console

Create an App Engine flexible environment, and deploy the third party application using a Docker file and a custom runtime. Set CPU and memory options similar to your application’s current on-premises virtual machine in the app.yaml file.

Create an instance template with the smallest available machine type, and use an image of the third party application taken from the current on-premises virtual machine. Create a managed instance group that uses average CPU to autoscale the number of instances in the group. Modify the average CPU utilization threshold to optimize the number of instances running.

Create multiple Compute Engine instances with varying CPU and memory options. Install the cloud monitoring agent and deploy the third-party application on each of them. Run a load test with high traffic levels on the application and use the results to determine the optimal settings.

NEW QUESTION 121
Your company wants to try out the cloud with low risk. They want to archive approximately
100 TB of their log data to the cloud and test the analytics features available to them there, while also retaining that data as a long-term disaster recovery backup. Which two steps should they take? Choose 2 answers

Load logs into Google BigQuery.

Load logs into Google Cloud SQL.

Import logs into Google Stackdriver.

Insert logs into Google Cloud Bigtable.

Upload log files into Google Cloud Storage.

NEW QUESTION 122
Case Study: 2 – TerramEarth Case Study
Company Overview
TerramEarth manufactures heavy equipment for the mining and agricultural industries: About
80% of their business is from mining and 20% from agriculture. They currently have over 500 dealers and service centers in 100 countries. Their mission is to build products that make their customers more productive.
Company Background
TerramEarth formed in 1946, when several small, family owned companies combined to retool after World War II. The company cares about their employees and customers and considers them to be extended members of their family.
TerramEarth is proud of their ability to innovate on their core products and find new markets as their customers’ needs change. For the past 20 years trends in the industry have been largely toward increasing productivity by using larger vehicles with a human operator.
Solution Concept
There are 20 million TerramEarth vehicles in operation that collect 120 fields of data per second.
Data is stored locally on the vehicle and can be accessed for analysis when a vehicle is serviced.
The data is downloaded via a maintenance port. This same port can be used to adjust operational parameters, allowing the vehicles to be upgraded in the field with new computing modules.
Approximately 200,000 vehicles are connected to a cellular network, allowing TerramEarth to collect data directly. At a rate of 120 fields of data per second, with 22 hours of operation per day.
TerramEarth collects a total of about 9 TB/day from these connected vehicles.
Existing Technical Environment

TerramEarth’s existing architecture is composed of Linux-based systems that reside in a data center. These systems gzip CSV files from the field and upload via FTP, transform and aggregate them, and place the data in their data warehouse. Because this process takes time, aggregated reports are based on data that is 3 weeks old.
With this data, TerramEarth has been able to preemptively stock replacement parts and reduce unplanned downtime of their vehicles by 60%. However, because the data is stale, some customers are without their vehicles for up to 4 weeks while they wait for replacement parts.
Business Requirements
– Decrease unplanned vehicle downtime to less than 1 week, without
increasing the cost of carrying surplus inventory
– Support the dealer network with more data on how their customers use
their equipment IP better position new products and services.
– Have the ability to partner with different companies-especially with
seed and fertilizer suppliers in the fast-growing agricultural
business-to create compelling joint offerings for their customers
CEO Statement
We have been successful in capitalizing on the trend toward larger vehicles to increase the productivity of our customers. Technological change is occurring rapidly and TerramEarth has taken advantage of connected devices technology to provide our customers with better services, such as our intelligent farming equipment. With this technology, we have been able to increase farmers’ yields by 25%, by using past trends to adjust how our vehicles operate. These advances have led to the rapid growth of our agricultural product line, which we expect will generate 50% of our revenues by 2020.
CTO Statement
Our competitive advantage has always been in the manufacturing process with our ability to build better vehicles for tower cost than our competitors. However, new products with different approaches are constantly being developed, and I’m concerned that we lack the skills to undergo the next wave of transformations in our industry. Unfortunately, our CEO doesn’t take technology obsolescence seriously and he considers the many new companies in our industry to be niche players. My goals are to build our skills while addressing immediate market needs through incremental innovations.
For this question, refer to the TerramEarth case study. TerramEarth has equipped unconnected trucks with servers and sensors to collet telemetry data. Next year they want to use the data to train machine learning models. They want to store this data in the cloud while reducing costs.
What should they do?

Have the vehicle’ computer compress the data in hourly snapshots, and store it in a Google Cloud storage (GCS) Nearline bucket.

Push the telemetry data in Real-time to a streaming dataflow job that compresses the data, and store it in Google BigQuery.

Push the telemetry data in real-time to a streaming dataflow job that compresses the data, and store it in Cloud Bigtable.

Have the vehicle’s computer compress the data in hourly snapshots, a Store it in a GCS Coldline bucket.

NEW QUESTION 123
You are tasked with building an online analytical processing (OLAP) marketing analytics and reporting tool.
This requires a relational database that can operate on hundreds of terabytes of data. What is the Google recommended tool for such applications?

Cloud Spanner, because it is globally distributed

Cloud SQL, because it is a fully managed relational database

Cloud Firestore, because it offers real-time synchronization across devices

BigQuery, because it is designed for large-scale processing of tabular data

NEW QUESTION 124
Case Study: 7 – Mountkirk Games
Company Overview
Mountkirk Games makes online, session-based, multiplayer games for mobile platforms. They build all of their games using some server-side integration. Historically, they have used cloud providers to lease physical servers.
Due to the unexpected popularity of some of their games, they have had problems scaling their global audience, application servers, MySQL databases, and analytics tools.
Their current model is to write game statistics to files and send them through an ETL tool that loads them into a centralized MySQL database for reporting.
Solution Concept
Mountkirk Games is building a new game, which they expect to be very popular. They plan to deploy the game’s backend on Google Compute Engine so they can capture streaming metrics, run intensive analytics, and take advantage of its autoscaling server environment and integrate with a managed NoSQL database.
Business Requirements
Increase to a global footprint.

Improve uptime – downtime is loss of players.

Increase efficiency of the cloud resources we use.

Reduce latency to all customers.

Technical Requirements
Requirements for Game Backend Platform
Dynamically scale up or down based on game activity.

Connect to a transactional database service to manage user profiles and game state.

Store game activity in a timeseries database service for future analysis.

As the system scales, ensure that data is not lost due to processing backlogs.

Run hardened Linux distro.

Requirements for Game Analytics Platform
Dynamically scale up or down based on game activity

Process incoming data on the fly directly from the game servers

Process data that arrives late because of slow mobile networks

Allow queries to access at least 10 TB of historical data

Process files that are regularly uploaded by users’ mobile devices

Executive Statement
Our last successful game did not scale well with our previous cloud provider, resulting in lower user adoption and affecting the game’s reputation. Our investors want more key performance indicators (KPIs) to evaluate the speed and stability of the game, as well as other metrics that provide deeper insight into usage patterns so we can adapt the game to target users.
Additionally, our current technology stack cannot provide the scale we need, so we want to replace MySQL and move to an environment that provides autoscaling, low latency load balancing, and frees us up from managing physical servers.
For this question, refer to the Mountkirk Games case study. Mountkirk Games wants to migrate from their current analytics and statistics reporting model to one that meets their technical requirements on Google Cloud Platform.
Which two steps should be part of their migration plan? (Choose two.)

Evaluate the impact of migrating their current batch ETL code to Cloud Dataflow.

Write a schema migration plan to denormalize data for better performance in BigQuery.

Draw an architecture diagram that shows how to move from a single MySQL database to a MySQL cluster.

Load 10 TB of analytics data from a previous game into a Cloud SQL instance, and run test queries against the full dataset to confirm that they complete successfully.

Integrate Cloud Armor to defend against possible SQL injection attacks in analytics files uploaded to Cloud Storage.

NEW QUESTION 125
You are designing an application for use only during business hours. For the minimum viable product release, you’d like to use a managed product that automatically “scales to zero” so you don’t incur costs when there is no activity.
Which primary compute resource should you choose?

Cloud Functions

Compute Engine

Kubernetes Engine

AppEngine flexible environment

NEW QUESTION 126
Your customer wants to capture multiple GBs of aggregate real-time key performance indicators (KPIs) from their game servers running on Google Cloud Platform and monitor the KPIs with low latency. How should they capture the KPIs?

Store time-series data from the game servers in Google Bigtable, and view it using Google Data Studio.

Output custom metrics to Stackdriver from the game servers, and create a Dashboard in Stackdriver Monitoring Console to view them.

Schedule BigQuery load jobs to ingest analytics files uploaded to Cloud Storage every ten minutes, and visualize the results in Google Data Studio.

Insert the KPIs into Cloud Datastore entities, and run ad hoc analysis and visualizations of them in Cloud Datalab.

NEW QUESTION 127
For this question, refer to the TerramEarth case study.
TerramEarth’s CTO wants to use the raw data from connected vehicles to help identify approximately when a vehicle in the development team to focus their failure. You want to allow analysts to centrally query the vehicle data. Which architecture should you recommend?

NEW QUESTION 128
The current Dress4win system architecture has high latency to some customers because it is located in one data center.
As of a future evaluation and optimizing for performance in the cloud, Dresss4win wants to distribute its system architecture to multiple locations when Google cloud platform.
Which approach should they use?

Use regional managed instance groups and a global load balancer to increase performance because the regional managed instance group can grow instances in each region separately based on traffic.

Use a global load balancer with a set of virtual machines that forward the requests to a closer group of virtual machines managed by your operations team.

Use regional managed instance groups and a global load balancer to increase reliability by providing automatic failover between zones in different regions.

Use a global load balancer with a set of virtual machines that forward the requests to a closer group of virtual machines as part of a separate managed instance groups.

NEW QUESTION 129
Your BigQuery project has several users. For audit purposes, you need to see how many queries each user ran in the last month.

Connect Google Data Studio to BigQuery. Create a dimension for the users and a metric for the amount of queries per user.

In the BigQuery interface, execute a query on the JOBS table to get the required information.

Use ‘bq show’ to list all jobs. Per job, use ‘bq Is’ to list job information and get the required information.

Use Cloud Audit Logging to view Cloud Audit Logs, and create a filter on the query operation to get the required information.

NEW QUESTION 130
You need to develop procedures to test a disaster plan for a mission-critical application. You want to use Google-recommended practices and native capabilities within GCP.
What should you do?

Use Deployment Manager to automate service provisioning. Use Activity Logs to monitor and debug your tests.

Use Deployment Manager to automate provisioning. Use Stackdriver to monitor and debug your tests.

Use gcloud scripts to automate service provisioning. Use Activity Logs monitor and debug your tests.

Use automated scripts to automate service provisioning. Use Activity Logs monitor and debug your tests.

NEW QUESTION 131
Your company is using BigQuery as its enterprise data warehouse. Data is distributed over several Google Cloud projects. All queries on BigQuery need to be billed on a single project. You want to make sure that no query costs are incurred on the projects that contain the data. Users should be able to query the datasets, but not edit them.
How should you configure users’ access roles?

Add all users to a group. Grant the group the role of BigQuery user on the billing project and BigQuery dataViewer on the projects that contain the data.

Add all users to a group. Grant the group the roles of BigQuery dataViewer on the billing project and BigQuery user on the projects that contain the data.

Add all users to a group. Grant the group the roles of BigQuery jobUser on the billing project and BigQuery dataViewer on the projects that contain the data.

Add all users to a group. Grant the group the roles of BigQuery dataViewer on the billing project and BigQuery jobUser on the projects that contain the data.

NEW QUESTION 132
Your web application has several VM instances running within a VPC. You want to restrict communications between instances to only the paths and ports you authorize, but you don’t want to rely on static IP addresses or subnets because the app can autoscale. How should you restrict communications?

Use separate VPCs to restrict traffic

Use firewall rules based on network tags attached to the compute instances

Use Cloud DNS and only allow connections from authorized hostnames

Use service accounts and configure the web application particular service accounts to have access

NEW QUESTION 133
Your company uses the Firewall Insights feature in the Google Network Intelligence Center. You have several firewall rules applied to Compute Engine instances. You need to evaluate the efficiency of the applied firewall ruleset. When you bring up the Firewall Insights page in the Google Cloud Console, you notice that there are no log rows to display. What should you do to troubleshoot the issue?

Enable Virtual Private Cloud (VPC) flow logging.

Enable Firewall Rules Logging for the firewall rules you want to monitor.

Verify that your user account is assigned the compute.networkAdmin Identity and Access Management (IAM) role.

Install the Google Cloud SDK, and verify that there are no Firewall logs in the command line output.

NEW QUESTION 134
Case Study: 5 – Dress4win
Company Overview
Dress4win is a web-based company that helps their users organize and manage their personal wardrobe using a website and mobile application. The company also cultivates an active social network that connects their users with designers and retailers. They monetize their services through advertising, e-commerce, referrals, and a freemium app model. The application has grown from a few servers in the founder’s garage to several hundred servers and appliances in a collocated data center. However, the capacity of their infrastructure is now insufficient for the application’s rapid growth. Because of this growth and the company’s desire to innovate faster.
Dress4Win is committing to a full migration to a public cloud.
Solution Concept
For the first phase of their migration to the cloud, Dress4win is moving their development and test environments. They are also building a disaster recovery site, because their current infrastructure is at a single location. They are not sure which components of their architecture they can migrate as is and which components they need to change before migrating them.
Existing Technical Environment
The Dress4win application is served out of a single data center location. All servers run Ubuntu LTS v16.04.
Databases:
MySQL. 1 server for user data, inventory, static data:

– MySQL 5.8
– 8 core CPUs
– 128 GB of RAM
– 2x 5 TB HDD (RAID 1)
Redis 3 server cluster for metadata, social graph, caching. Each server is:

– Redis 3.2
– 4 core CPUs
– 32GB of RAM
Compute:
40 Web Application servers providing micro-services based APIs and static content.

– Tomcat – Java
– Nginx
– 4 core CPUs
– 32 GB of RAM
20 Apache Hadoop/Spark servers:

– Data analysis
– Real-time trending calculations
– 8 core CPUS
– 128 GB of RAM
– 4x 5 TB HDD (RAID 1)
3 RabbitMQ servers for messaging, social notifications, and events:

– 8 core CPUs
– 32GB of RAM
Miscellaneous servers:

– Jenkins, monitoring, bastion hosts, security scanners
– 8 core CPUs
– 32GB of RAM
Storage appliances:
iSCSI for VM hosts

Fiber channel SAN – MySQL databases

– 1 PB total storage; 400 TB available
NAS – image storage, logs, backups

– 100 TB total storage; 35 TB available
Business Requirements
Build a reliable and reproducible environment with scaled parity of production.

Improve security by defining and adhering to a set of security and Identity and Access

Management (IAM) best practices for cloud.
Improve business agility and speed of innovation through rapid provisioning of new resources.

Analyze and optimize architecture for performance in the cloud.

Technical Requirements
Easily create non-production environment in the cloud.

Implement an automation framework for provisioning resources in cloud.

Implement a continuous deployment process for deploying applications to the on-premises

datacenter or cloud.
Support failover of the production environment to cloud during an emergency.

Encrypt data on the wire and at rest.

Support multiple private connections between the production data center and cloud

environment.
Executive Statement
Our investors are concerned about our ability to scale and contain costs with our current infrastructure. They are also concerned that a competitor could use a public cloud platform to offset their up-front investment and free them to focus on developing better features. Our traffic patterns are highest in the mornings and weekend evenings; during other times, 80% of our capacity is sitting idle.
Our capital expenditure is now exceeding our quarterly projections. Migrating to the cloud will likely cause an initial increase in spending, but we expect to fully transition before our next hardware refresh cycle. Our total cost of ownership (TCO) analysis over the next 5 years for a public cloud strategy achieves a cost reduction between 30% and 50% over our current model.
For this question, refer to the Dress4Win case study. Which of the compute services should be migrated as -is and would still be an optimized architecture for performance in the cloud?

Web applications deployed using App Engine standard environment

RabbitMQ deployed using an unmanaged instance group

Hadoop/Spark deployed using Cloud Dataproc Regional in High Availability mode

Jenkins, monitoring, bastion hosts, security scanners services deployed on custom machine types

NEW QUESTION 135
One of the developers on your team deployed their application In Google Container Engine with the Dockerfile below. They report that their application deployments are taking too long.

You want to optimize this Dockerfile for faster deployment times without adversely affecting the app’s functionality. Which two actions should you take? Choose 2 answers

Remove Python after running pip.

Remove dependencies from requirements.txt.

Use a slimmed-down base image like Alpine linux.

Use larger machine types for your Google Container Engine node pools.

Copy the source after the package dependencies (Python and pip) are installed.

NEW QUESTION 136
The database administration team has asked you to help them improve the performance of their new database server running on Google Compute Engine. The database is for importing and normalizing their performance statistics and is built with MySQL running on Debian Linux. They have an n1- standard-8 virtual machine with 80 GB of SSD persistent disk.
What should they change to get better performance from this system?

Increase the virtual machine’s memory to 64 GB.

Create a new virtual machine running PostgreSQL.

Dynamically resize the SSD persistent disk to 500 GB.

Migrate their performance metrics warehouse to BigQuery.

Modify all of their batch jobs to use bulk inserts into the database.

NEW QUESTION 137
Your company has just acquired another company, and you have been asked to integrate their existing Google Cloud environment into your company’s data center. Upon investigation, you discover that some of the RFC
1918 IP ranges being used in the new company’s Virtual Private Cloud (VPC) overlap with your data center IP space. What should you do to enable connectivity and make sure that there are no routing conflicts when connectivity is established?

Create a Cloud VPN connection from the new VPC to the data center, create a Cloud Router, and apply new IP addresses so there is no overlapping IP space.

Create a Cloud VPN connection from the new VPC to the data center, and create a Cloud NAT instance to perform NAT on the overlapping IP space.

Create a Cloud VPN connection from the new VPC to the data center, create a Cloud Router, and apply a custom route advertisement to block the overlapping IP space.

Create a Cloud VPN connection from the new VPC to the data center, and apply a firewall rule that blocks the overlapping IP space.

NEW QUESTION 138
Case Study: 3 – JencoMart Case Study
Company Overview
JencoMart is a global retailer with over 10,000 stores in 16 countries. The stores carry a range of goods, such as groceries, tires, and jewelry. One of the company’s core values is excellent customer service. In addition, they recently introduced an environmental policy to reduce their carbon output by 50% over the next 5 years.
Company Background
JencoMart started as a general store in 1931, and has grown into one of the world’s leading brands known for great value and customer service. Over time, the company transitioned from only physical stores to a stores and online hybrid model, with 25% of sales online. Currently, JencoMart has little presence in Asia, but considers that market key for future growth.
Solution Concept
JencoMart wants to migrate several critical applications to the cloud but has not completed a technical review to determine their suitability for the cloud and the engineering required for migration. They currently host all of these applications on infrastructure that is at its end of life and is no longer supported.
Existing Technical Environment
JencoMart hosts all of its applications in 4 data centers: 3 in North American and 1 in Europe, most applications are dual-homed.
JencoMart understands the dependencies and resource usage metrics of their on-premises architecture.
Application Customer loyalty portal
LAMP (Linux, Apache, MySQL and PHP) application served from the two JencoMart-owned U.S.
data centers.
Database
* Oracle Database stores user profiles

* PostgreSQL database stores user credentials
-homed in US West

Authenticates all users
Compute
* 30 machines in US West Coast, each machine has:

* 20 machines in US East Coast, each machine has:
-core CPU

RAID 1)

Storage
* Access to shared 100 TB SAN in each location
* Tape backup every week
Business Requirements
* Optimize for capacity during peak periods and value during off-peak periods
* Guarantee service availably and support
* Reduce on-premises footprint and associated financial and environmental impact.
* Move to outsourcing model to avoid large upfront costs associated with infrastructure purchase
* Expand services into Asia.
Technical Requirements
* Assess key application for cloud suitability.
* Modify application for the cloud.
* Move applications to a new infrastructure.
* Leverage managed services wherever feasible
* Sunset 20% of capacity in existing data centers
* Decrease latency in Asia
CEO Statement
JencoMart will continue to develop personal relationships with our customers as more people access the web. The future of our retail business is in the global market and the connection between online and in-store experiences. As a large global company, we also have a responsibility to the environment through ‘green’ initiatives and polices.
CTO Statement
The challenges of operating data centers prevents focus on key technologies critical to our long- term success. Migrating our data services to a public cloud infrastructure will allow us to focus on big data and machine learning to improve our service customers.
CFO Statement
Since its founding JencoMart has invested heavily in our data services infrastructure. However, because of changing market trends, we need to outsource our infrastructure to ensure our long- term success. This model will allow us to respond to increasing customer demand during peak and reduce costs.
For this question, refer to the JencoMart case study.
The JencoMart security team requires that all Google Cloud Platform infrastructure is deployed using a least privilege model with separation of duties for administration between production and development resources. What Google domain and project structure should you recommend?

Create two G Suite accounts to manage users: one for development/test/staging and one for production. Each account should contain one project for every application.

Create two G Suite accounts to manage users: one with a single project for all development applications and one with a single project for all production applications.

Create a single G Suite account to manage users with each stage of each application in its own project.

Create a single G Suite account to manage users with one project for the development/test/staging environment and one project for the production environment.

NEW QUESTION 139
You are designing a large distributed application with 30 microservices. Each of your distributed microservices needs to connect to a database back-end. You want to store the credentials securely.
Where should you store the credentials?

In the source code

In an environment variable

In a secret management system

In a config file that has restricted access through ACLs

NEW QUESTION 140
Case Study: 5 – Dress4win
Company Overview
Dress4win is a web-based company that helps their users organize and manage their personal wardrobe using a website and mobile application. The company also cultivates an active social network that connects their users with designers and retailers. They monetize their services through advertising, e-commerce, referrals, and a freemium app model. The application has grown from a few servers in the founder’s garage to several hundred servers and appliances in a collocated data center. However, the capacity of their infrastructure is now insufficient for the application’s rapid growth. Because of this growth and the company’s desire to innovate faster.
Dress4Win is committing to a full migration to a public cloud.
Solution Concept
For the first phase of their migration to the cloud, Dress4win is moving their development and test environments. They are also building a disaster recovery site, because their current infrastructure is at a single location. They are not sure which components of their architecture they can migrate as is and which components they need to change before migrating them.
Existing Technical Environment
The Dress4win application is served out of a single data center location. All servers run Ubuntu LTS v16.04.
Databases:
MySQL. 1 server for user data, inventory, static data:

– MySQL 5.8
– 8 core CPUs
– 128 GB of RAM
– 2x 5 TB HDD (RAID 1)
Redis 3 server cluster for metadata, social graph, caching. Each server is:

– Redis 3.2
– 4 core CPUs
– 32GB of RAM
Compute:
40 Web Application servers providing micro-services based APIs and static content.

– Tomcat – Java
– Nginx
– 4 core CPUs
– 32 GB of RAM
20 Apache Hadoop/Spark servers:

– Data analysis
– Real-time trending calculations
– 8 core CPUS
– 128 GB of RAM
– 4x 5 TB HDD (RAID 1)
3 RabbitMQ servers for messaging, social notifications, and events:

– 8 core CPUs
– 32GB of RAM
Miscellaneous servers:

– Jenkins, monitoring, bastion hosts, security scanners
– 8 core CPUs
– 32GB of RAM
Storage appliances:
iSCSI for VM hosts

Fiber channel SAN – MySQL databases

– 1 PB total storage; 400 TB available
NAS – image storage, logs, backups

– 100 TB total storage; 35 TB available
Business Requirements
Build a reliable and reproducible environment with scaled parity of production.

Improve security by defining and adhering to a set of security and Identity and Access

Management (IAM) best practices for cloud.
Improve business agility and speed of innovation through rapid provisioning of new resources.

Analyze and optimize architecture for performance in the cloud.

Technical Requirements
Easily create non-production environment in the cloud.

Implement an automation framework for provisioning resources in cloud.

Implement a continuous deployment process for deploying applications to the on-premises

datacenter or cloud.
Support failover of the production environment to cloud during an emergency.

Encrypt data on the wire and at rest.

Support multiple private connections between the production data center and cloud

environment.
Executive Statement
Our investors are concerned about our ability to scale and contain costs with our current infrastructure. They are also concerned that a competitor could use a public cloud platform to offset their up-front investment and free them to focus on developing better features. Our traffic patterns are highest in the mornings and weekend evenings; during other times, 80% of our capacity is sitting idle.
Our capital expenditure is now exceeding our quarterly projections. Migrating to the cloud will likely cause an initial increase in spending, but we expect to fully transition before our next hardware refresh cycle. Our total cost of ownership (TCO) analysis over the next 5 years for a public cloud strategy achieves a cost reduction between 30% and 50% over our current model.
For this question, refer to the Dress4Win case study. You are responsible for the security of data stored in Cloud Storage for your company, Dress4Win. You have already created a set of Google Groups and assigned the appropriate users to those groups. You should use Google best practices and implement the simplest design to meet the requirements.
Considering Dress4Win’s business and technical requirements, what should you do?

Assign custom IAM roles to the Google Groups you created in order to enforce security requirements.
Encrypt data with a customer-supplied encryption key when storing files in Cloud Storage.

Assign custom IAM roles to the Google Groups you created in order to enforce security requirements.
Enable default storage encryption before storing files in Cloud Storage.

Assign predefined IAM roles to the Google Groups you created in order to enforce security requirements. Utilize Google’s default encryption at rest when storing files in Cloud Storage.

Assign predefined IAM roles to the Google Groups you created in order to enforce security requirements. Ensure that the default Cloud KMS key is set before storing files in Cloud Storage.