Practice Test #1

Cloud SQL supports relational modeling for hierarchies, but it does not provide Google client SDKs with built-in offline persistence and automatic sync for mobile/tablet apps. You would need to implement local storage, change tracking, conflict resolution, and sync logic yourself. roles/cloudsql.editor also doesn’t directly grant database-level DML permissions; it manages instances and is broader than needed for app-level writes.

Bigtable can handle high write throughput and large scale, but it is a wide-column store optimized for time-series/analytics-style access patterns, not hierarchical document navigation with offline-first mobile sync. There are no Firestore-like client SDKs for offline caching/synchronization. Additionally, roles/bigtable.viewer is read-only, so it cannot support the backend requirement to enrich records with writes.

Firestore in Datastore mode is primarily for Datastore API compatibility and does not align as directly with Firebase-style offline synchronization expectations for client apps. Even if the database choice were acceptable, roles/datastore.viewer is read-only and cannot support the Cloud Run backend’s requirement to perform up to 5,000 writes per minute to enrich records.

Downloading the binary during the build is fragile and typically fails the stated constraints. Outbound internet access is restricted, so the download may be blocked entirely. Even if allowed, network variability and upstream availability can easily exceed the 5-second startup requirement and threaten the 10-minute SLA. It also reduces reproducibility unless you pin checksums and handle mirrors, which adds complexity and risk.

Committing a 120 MB binary into the source repository can make builds work without internet, but it is a poor practice for CI/CD. It bloats the repo, slows cloning and mirroring, complicates code review, and can create supply-chain governance issues (binary provenance, scanning, licensing). It also couples tool distribution to source changes and can be error-prone when multiple services or pipelines need the same tool.

Filing a feature request does not solve the immediate requirement and is not a reliable strategy for meeting SLAs. Default Cloud Build environments change on Google’s schedule and may not include niche tools or specific versions. Even if added, you still need version pinning for reproducibility. On exams, “wait for the platform to add it” is almost never the correct operational answer when you have clear constraints.

Incorrect. Granting Service Account Token Creator enables impersonation, which is powerful and risky for external users. It effectively gives reviewers a pathway to obtain credentials and potentially access beyond assigned objects, depending on permissions. It also assumes reviewers can use Google IAM-based flows and identities, conflicting with “some do not have Google accounts,” and is not least privilege.

Incorrect. Distributing a service account key to external reviewers is a major security anti-pattern: keys can be copied, reused, and exfiltrated. Also, service account keys do not support a native “expire after 24 hours” setting in the way implied; you would need to rotate/delete keys manually. This approach grants broad access and violates best practices for credential management.

Incorrect. IAM roles (even with IAM Conditions that expire) require binding to a principal identity. Reviewers without Google accounts cannot be directly granted Storage Object User on the bucket. Additionally, bucket-level role assignment is broader than per-object access unless combined with complex conditional logic; signed URLs are simpler and more precise for object-level, time-bound external access.

Incorrect. Downloading a service account JSON key violates the stated policy (no long-lived keys) and is explicitly discouraged by Google best practices due to key exfiltration risk and operational overhead (rotation, revocation). With impersonation available, Terraform does not need a key file for the deployment service account; it should mint short-lived tokens instead.

Incorrect. While gcloud auth/impersonate_service_account and exporting GOOGLE_OAUTH_ACCESS_TOKEN can work in some ad-hoc scenarios, it is fragile for Terraform because tokens are short-lived and must be refreshed manually. It also bypasses the standard ADC flow that Terraform and Google libraries expect, making automation and repeatability worse than using ADC + provider impersonation.

Incorrect. Even if Vault delivers the key dynamically, it still depends on a service account JSON key, which is a long-lived credential and explicitly forbidden by policy. This approach adds complexity and operational burden (Vault integration, secret lifecycle) without addressing the core requirement. Google’s preferred solution is keyless impersonation using short-lived tokens.

Incorrect. Using the gcloud CLI to invoke scans introduces an explicit operational step to trigger scanning for each image, which is unnecessary when Artifact Registry is already integrated with automatic vulnerability scanning. That approach adds avoidable pipeline complexity and does not align with the requirement to avoid custom scanning logic. Google best practice here is to rely on managed scanning on image push rather than manually orchestrating scans.

Incorrect. Although enabling Container Analysis and relying on automatic scanning is the right foundation, reviewing only CRITICAL vulnerabilities is too limited for the stated requirement. The prompt says you must be alerted to any known OS-level vulnerabilities in the newly pushed images before rollout, which implies considering all reported vulnerability findings rather than filtering only the highest severity. Severity-based triage can be useful operationally, but it does not fully satisfy the wording of this question.

Incorrect. Calling the Container Analysis REST API to trigger scans per image requires custom integration and orchestration logic in the pipeline, which the question explicitly wants to avoid. It is also unnecessary because Artifact Registry can automatically produce vulnerability findings for pushed images through its managed integration. For exam purposes, manual API-driven triggering is less preferable than enabling the built-in scanning workflow.