Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Your company is expanding its AI-powered operations nationwide and has chosen accelerator-based compute for the AI workloads. The batch image processing workloads are not time-sensitive and can tolerate interruptions. You need to rapidly deploy cost-effective accelerator nodes for these batch tasks, ensuring data persistence when necessary. What should you do?
For batch processing workloads that are 'not time-sensitive' and 'can tolerate interruptions,' Spot VMs (formerly Preemptible VMs) are the Google-recommended best practice for cost optimization. Spot VMs offer the same performance as standard VMs (including support for GPUs and TPUs) at a discount of up to 91%.
However, because Spot VMs can be reclaimed by Google Cloud at any time, the architecture must be fault-tolerant. According to Vertex AI and Compute Engine best practices, using Persistent Disks (rather than Local SSDs, which are wiped upon VM termination) ensures that data is not lost when an instance is preempted. By implementing a checkpointing mechanism, the AI model periodically saves its state (weights, processed image metadata, etc.) to the persistent disk. When a new Spot VM is automatically provisioned by a Managed Instance Group to replace the preempted one, the application can resume from the last saved checkpoint rather than starting from the beginning.
Option C is less ideal because Local SSD data does not persist through preemption/reclamation cycles. Option B uses standard VMs, which fails the requirement for 'cost-effective' deployment. Option D perfectly balances the extreme cost savings of Spot provisioning with the reliability requirements of large-scale batch image processing.
Your company provides a recommendation engine for retail customers. You are providing retail customers with an API where they can submit a user ID and the API returns a list of recommendations for that user. You are responsible for the API lifecycle and want to ensure stability for your customers in case the API makes backward-incompatible changes. You want to follow Google-recommended practices. What should you do?
https://cloud.google.com/apis/design/versioning
All Google API interfaces must provide a major version number, which is encoded at the end of the protobuf package, and included as the first part of the URI path for REST APIs. If an API introduces a breaking change, such as removing or renaming a field, it must increment its API version number to ensure that existing user code does not suddenly break.
Mountkirk Games wants to limit the physical location of resources to their operating Google Cloud regions.
What should you do?
You have broken down a legacy monolithic application into a few containerized RESTful microservices. You want to run those microservices on Cloud Run. You also want to make sure the services are highly available with low latency to your customers. What should you do?
https://cloud.google.com/run/docs/multiple-regions
Your organization has stored sensitive data in a Cloud Storage bucket. For regulatory reasons, your company must be able to rotate the encryption key used to encrypt the data in the bucket. The data will be processed in Dataproc. You want to follow Google-recommended practices for security What should you do?
https://cloud.google.com/storage/docs/encryption/using-customer-managed-keys#add-object-key
https://cloud.google.com/storage/docs/encryption/using-customer-managed-keys
Your company has hired an external auditing firm to perform a compliance audit. Your company's governance policy requires that external auditors be managed in a single Google Group that is granted temporary, read-only access to a Cloud Storage bucket named audit-evidence-bucket. Access must be traceable to the individual auditor's identity and be active only for the duration of the audit engagement, which runs the entire month of October. You need a secure access control strategy that avoids administrative overhead and complies with your company's governance policy. What should you do?
According to Google Cloud IAM documentation, IAM Conditions are the recommended way to grant temporary, time-bound access without the need for manual intervention or custom automation scripts.
By applying a condition to the IAM binding for the Google Group, you can specify an expression that evaluates the current timestamp. If the request occurs between October 1 and November 1, the access is granted; otherwise, it is denied. This satisfies all requirements:
Traceability: Access is tied to the Google Group (and thus individual corporate identities), and all activity is recorded in Cloud Audit Logs.
Temporary Access: It is automatically enforced by the Google Cloud IAM engine without requiring a 'cleanup' task.
Low Overhead: It avoids the complexity of writing and maintaining scripts (Option B) or managing individual signed URLs (Option C).
Option A (Workforce Identity Federation) is used for external identity provider integration but does not inherently manage resource-level access timing as elegantly or simply as an IAM Condition.
For this question, refer to the EHR Healthcare case study. You need to define the technical architecture for securely deploying workloads to Google Cloud. You also need to ensure that only verified containers are deployed using Google Cloud services. What should you do? (Choose two.)
Binary Authorization to ensure only verified containers are deployed To ensure deployment are secure and and consistent, automatically scan images for vulnerabilities with container analysis (https://cloud.google.com/docs/ci-cd/overview?hl=en&skip_cache=true)
Exam domains verified against: Official Google Professional-Cloud-Architect exam guide, last checked October 2026.
Develop infrastructure that aligns with business requirements, including cost optimization, system integration, and data handling. Evaluate trade-offs in architecture decisions and establish success metrics that balance technical capability with business outcomes.
Configure and manage network topologies, storage systems, and compute resources in production environments. Handle security implementation, resource scaling, and lifecycle management while supporting hybrid and multi-cloud connectivity.
Sample question from this domain above: Q6
Implement identity and access management, encryption, and security controls across your infrastructure. Address regulatory requirements and industry standards relevant to your organization's data and workloads.
Apply software development lifecycle practices, continuous integration and deployment patterns, and operational procedures to maintain reliability. Align technical decisions with business objectives through stakeholder management and cost optimization.
Guide development and operations teams through deployment using Google Cloud SDK tools and programmatic interfaces. Oversee system migration, API design, and testing strategies to ensure successful solution delivery.
Establish monitoring, logging, and alerting practices for production systems. Manage deployments, releases, and support operations while maintaining quality standards through testing and validation.
Common questions about the exam itself
