✅ Question 1

Correct Answer: 🟩 Enable VPC Service Controls, define a network perimeter, and enable VPC Flow Logs
❌ Enable VPC Service Controls + audit logs
❌ Use IAP + audit logs
❌ Require Cloud VPN for all users

Explanation:
VPC Service Controls + a network perimeter restricts access to trusted networks only.
VPC Flow Logs provide detailed network visibility for auditing and forensics.

---

✅ Question 2

Correct Answer: 🟩 Deploy web app on App Engine standard, MIG for chat servers, and use external passthrough NLB for TCP
❌ Other options use wrong LB types or unmanaged groups

Explanation:

• Web app = HTTP → App Engine Standard + Application Load Balancer

• Chat servers = TCP → External passthrough NLB

• MIG = scalable backend

---

❌ Question 3

Correct Answer: 🟩 Temporarily disable account → Export to Cloud Storage → auto-delete after 60 days
❌ Restore DB
❌ Disable 30 days only
❌ Ask users to save their own data

Explanation:
For compliance + returns: store account snapshot externally with Cloud Storage + lifecycle deletion after 60 days.

---

❗ Question 4

Correct Answer: 🟩 Set up repo → Check in code → Run tests → Build container → Deploy
❌ Other orderings incorrect

Explanation:
Standard CI pipeline:
Repo → Code → Tests → Container → Deploy

---

❗ Question 5

Correct Answer: 🟩 Deploy as Compute Engine VMs (Terraform optional but simplest is CE directly)
❌ App Engine (needs refactor)
❌ GKE (requires containerization)
❌ Microservices refactor (heavy rewrite)

Explanation:
Minimal refactor → Compute Engine running Ubuntu VM images.

---

❗ Question 6

Correct Answer: 🟩 Automate with Terraform
❌ Deployment Manager
❌ GKE manifests
❌ Docker alone

Explanation:
Terraform = multi-cloud, declarative, parallel execution → best match.

---

❗ Question 7

Correct Answer: 🟩 Backend loosely coupled + REST over HTTPS
❌ Tight coupling
❌ gRPC for external (not ideal)
❌ Tightly coupled gRPC

Explanation:
External partner APIs = REST + loose coupling requirements.

---

❗ Question 8

Correct Answer: 🟩 Use network tags + Secure Boot + vTPM
❌ labels (labels don’t enforce firewall rules)
❌ using only service accounts
❌ wrong combos

Explanation:
Security layers:

• Network tags → firewall restrictions

• Secure Boot + vTPM → VM integrity

---

❗ Question 9

Correct Answer: 🟩 kubectl autoscale deployment to max 6 pods
❌ Editing pods (not allowed)
❌ Editing pod replicas
❌ Autoscale pod (wrong target)

Explanation:
Autoscaling applies to deployments, not pods.

---

❗ Question 10

Correct Answer: 🟩 Global Application Load Balancer → URL map → target proxy → backend service
❌ Proxy NLB (doesn’t use URL maps)
❌ NLB (not global HTTP)
❌ Wrong sequence

Explanation:
URL-based routing + global proximity routing → Global External Application Load Balancer.

---

🧾 Summary Table

---