Google Updated Professional-Cloud-Architect Exam Questions and Answers by alyssia

A Cloud NAT gateway can perform NAT for nodes and Pods in a private cluster, which is a type of VPC-native cluster. The Cloud NAT gateway must be configured to apply to at least the following subnet IP address ranges for the subnet that your cluster uses:

Subnet primary IP address range (used by nodes)

Subnet secondary IP address range used for Pods in the cluster

Subnet secondary IP address range used for Services in the cluster

The simplest way to provide NAT for an entire private cluster is to configure a Cloud NAT gateway to apply to all of the cluster ' s subnet ' s IP address ranges.

https://cloud.google.com/nat/docs/overview

This option can help minimize cost and time by using views and authorized datasets. Views are virtual tables defined by a SQL query that can exclude PII columns from the source tables. Views do not incur storage costs and do not duplicate data. Authorized datasets are datasets that have access to another dataset’s data without granting direct access to individual users or groups. By creating a dataset for the data science team and creating views of tables that exclude PII, you can share only the relevant information with the team. By assigning an appropriate project-level IAM role to the members of the data science team, you can grant them access to the BigQuery service and resources. By assigning access controls to the dataset that contains the view, you can grant them access to query the views. By authorizing the view to access the source dataset, you can enable the view to read data from the source tables without exposing PII. The other options are not optimal for this scenario, because they either use materialized views instead of views, which incur storage costs and duplicate data (B, D), or do not create a separate dataset for the data science team, which makes it harder to manage access controls (A). References:

https://cloud.google.com/bigquery/docs/views

https://cloud.google.com/bigquery/docs/authorized-datasets

Designing a security landing zone for financial migrations requires balancing business agility with strict infrastructure perimeters. VPC Service Controls (VPC-SC) can inadvertently block legitimate service requests if misconfigured, causing application disruptions during migrations. To avoid these issues, Google Cloud recommends using the VPC-SC " Dry Run " mode feature.

Dry Run mode allows security teams to configure perimeters and evaluate prospective violations against active workloads by logging telemetry to Cloud Logging without blocking actual API invocations. Embedding this validation into a centralized CI/CD pipeline ensures automated policy validation runs alongside application deployments. Developers can iterate quickly without experiencing perimeter blockages, while the architecture team gathers the data required to build a zero-trust perimeter before enforcing it in production. Granting unvalidated template access or omitting dry-run protections introduces severe risks of perimeter-induced application downtime.

For batch processing workloads that are " not time-sensitive " and " can tolerate interruptions, " Spot VMs (formerly Preemptible VMs) are the Google-recommended best practice for cost optimization. Spot VMs offer the same performance as standard VMs (including support for GPUs and TPUs) at a discount of up to 91% .

However, because Spot VMs can be reclaimed by Google Cloud at any time, the architecture must be fault-tolerant . According to Vertex AI and Compute Engine best practices , using Persistent Disks (rather than Local SSDs, which are wiped upon VM termination) ensures that data is not lost when an instance is preempted. By implementing a checkpointing mechanism , the AI model periodically saves its state (weights, processed image metadata, etc.) to the persistent disk. When a new Spot VM is automatically provisioned by a Managed Instance Group to replace the preempted one, the application can resume from the last saved checkpoint rather than starting from the beginning.

Option C is less ideal because Local SSD data does not persist through preemption/reclamation cycles. Option B uses standard VMs, which fails the requirement for " cost-effective " deployment. Option D perfectly balances the extreme cost savings of Spot provisioning with the reliability requirements of large-scale batch image processing.