Google Cloud Architect Professional

1. 1.An enterprise groups its Google Cloud projects into folders by business unit. The security team grants the Security Reviewer role at the folder level for the Finance folder. A new project is later created inside that folder. What access does the security team have on the new project?

   • ASecurity Reviewer, inherited automatically from the folder policyCorrect answer
   • BNo access, because policies are only copied to projects that existed when the binding was created
   • CNo access, until an administrator re-applies the folder policy to the project
   • DOwner, because folder-level grants are elevated when propagated downward

   Why

   IAM policies attach to nodes of the resource hierarchy and are inherited transitively by all descendants. A project created under the Finance folder automatically inherits the folder's policy bindings, so the grant applies with no additional action. Inheritance is evaluated at access time, not copied at creation, so the effective policy is the union of the project's own bindings and every ancestor's bindings.

2. 2.A user is granted the Editor role on a project and the Storage Object Viewer role on a bucket inside that project. The intent was to restrict the user to read-only access on that bucket. What is the effective access on the bucket?

   • AFull read and write, because the project-level Editor grant still applies and IAM grants are additiveCorrect answer
   • BRead-only, because the more specific bucket-level binding overrides the project binding
   • CNo access, because the two conflicting bindings cancel each other out
   • DRead-only, because Cloud Storage evaluates only bucket-level policies

   Why

   IAM is purely additive: a binding at a lower level cannot subtract permissions granted higher up. The project-level Editor role already includes object write permissions on buckets in that project, so adding a narrower role on the bucket changes nothing. To actually restrict access, the Editor grant must be removed and replaced with a narrower role, or an IAM deny policy must be used.

3. 3.An application running on a Compute Engine instance needs to write objects to a Cloud Storage bucket. What is the recommended way to authorize the application?

   • AAttach a service account to the instance and grant it the required role on the bucketCorrect answer
   • BDownload a service account JSON key and store it on the instance's boot disk
   • CEmbed a developer's user credentials in the application configuration file
   • DMake the bucket publicly writable and restrict access with a firewall rule

   Why

   Attach a service account to the instance and grant that service account the minimum required role on the bucket. The instance metadata server issues short-lived tokens automatically, so no key material is stored on disk. Exporting a service account key onto the VM creates a long-lived credential that must be rotated and can be exfiltrated, and embedding a user's own credentials ties the workload's lifetime to a person's account.

4. 4.A company onboards and offboards contractors frequently. Each contractor needs the same set of roles across twelve projects. What approach minimizes ongoing IAM administration?

   • AGrant the roles to a Google group and manage contractor membership in that groupCorrect answer
   • BGrant the roles directly to each contractor's account in each project
   • CShare a single service account key among all contractors
   • DGrant each contractor the Owner role so they can self-manage their access

   Why

   Grant roles to a Google group once per project (or once at the folder level) and manage membership in the group. Adding or removing a contractor becomes a single group membership change rather than twelve policy edits, and the audit trail of who is in the group stays in one place. Granting roles to individual accounts multiplies the work by the number of projects and makes offboarding error-prone.

5. 5.An operations team needs to start and stop Compute Engine instances but must not be able to change firewall rules or delete disks. No predefined role matches this exact set. What should the architect do?

   • ACreate a custom role with only the instance start and stop permissionsCorrect answer
   • BGrant the Compute Admin predefined role and rely on documented policy
   • CGrant the Editor primitive role at the project level
   • DGrant Viewer and ask the team to file tickets for every start and stop

   Why

   Create a custom role containing only the specific permissions required, such as compute.instances.start and compute.instances.stop, and grant it at the appropriate level. Custom roles exist precisely for the case where predefined roles are either too broad or split across several roles. Falling back to Editor or Compute Admin would grant firewall and disk deletion permissions the requirement forbids.

Practice all 65 questions

Frequently asked questions