A data science team wants to deploy a trained model to production with minimal operational overhead. They need automatic scaling, built-in monitoring for prediction drift, and the ability to update the model without downtime. Which Google Cloud service is designed for this purpose?

Compute Engine with a custom serving container

Which IAM best practice helps reduce the risk of over-permissioning when granting access to Google Cloud resources?

Creating custom roles with all permissions to avoid future changes

Granting roles at the project level to cover all resources

Using predefined roles and granting them at the lowest resource level needed

Using primitive roles for simplicity

What is the purpose of hierarchical firewall policies in Google Cloud?

To encrypt network traffic between VMs

To manage IAM roles for network administrators

To define and enforce firewall rules at the organization or folder level

To monitor network traffic for security threats

Which IAM role type is recommended as a best practice for granting least-privilege access to a Google Cloud resource?

Primitive roles (Owner, Editor, Viewer)

Predefined roles (e.g., roles/storage.objectViewer)

Custom roles with all permissions available in the project

Basic roles (e.g., roles/basic.viewer)

What is the primary purpose of Cloud KMS in Google Cloud?

To store passwords and API keys in a secure vault

To encrypt data at the application layer before storing it

To manage encryption keys used to protect data in Google Cloud services

To provide a firewall for network traffic

Google CloudProfessional Cloud Architect

Domain 3Objective 1

3.1 Designing for Security PROFESSIONAL-CLOUD-ARCHITECT Practice Questions (Page 6)

Part of the Designing for security and compliance domain, which accounts for ~17.5% of the PROFESSIONAL-CLOUD-ARCHITECT exam. Google Cloud does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–9 in this domain), expect 5–5 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

23concepts

~17.5%of the exam

23 Concepts in This Objective

IAM Roles and Permissions
IAM Policy Binding
Resource Hierarchy
IAM Best Practices
Data Encryption at Rest and in Transit
Cloud KMS Key Management
Key Hierarchy and Envelope Encryption
Secret Management
Separation of Duties
Audit Logging
VPC Service Controls
Context-Aware Access
Organization Policy
Hierarchical Firewall Policies
Identity-Aware Proxy (IAP)
Service Account Impersonation
Chrome Enterprise Premium
Workload Identity Federation
Software Supply Chain Security
Secure CI/CD Pipeline
Model Armor
Sensitive Data Protection
Secure Model Deployment

Questions 26–30

26foundation · easy
A data science team wants to deploy a trained model to production with minimal operational overhead. They need automatic scaling, built-in monitoring for prediction drift, and the ability to update the model without downtime. Which Google Cloud service is designed for this purpose?
Select an answer first
27foundation · easy
Which IAM best practice helps reduce the risk of over-permissioning when granting access to Google Cloud resources?
Select an answer first
28foundation · easy
What is the purpose of hierarchical firewall policies in Google Cloud?
Select an answer first
29foundation · easy
Which IAM role type is recommended as a best practice for granting least-privilege access to a Google Cloud resource?
Select an answer first
30foundation · easy
What is the primary purpose of Cloud KMS in Google Cloud?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-ARCHITECT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-ARCHITECT” is a trademark of its owner, used for identification only.