Google Professional-Cloud-Architect - Google Certified Professional - Cloud Architect (GCP)

According to the Google Cloud Architecture Framework: Software Development and Delivery section, unit testing is the foundational practice for verifying the smallest parts of an application—such as functions, classes, or individual microservices—in complete isolation. The requirement specifically asks for a method to ensure services function correctly "in isolation," which is the primary definition of a unit test.

In Altostrat’s modernized CI/CD environment, unit tests are executed early in the pipeline (the "left" side of DevSecOps). They typically use "mocks" or "stubs" to simulate external dependencies like BigQuery, Cloud Storage, or other microservices. This ensures that the internal logic of a specific service—for instance, the metadata extraction logic or the pricing algorithm—is mathematically and logically sound before it interacts with the rest of the system.

While Integration testing (Option D) is vital for ensuring services talk to each other correctly, it does not test them "in isolation." End-to-end testing (Option C) validates the entire user journey but is slow and complex to debug. Load testing (Option B) focuses on performance under stress rather than functional correctness. To meet the technical requirement of "Modernize CI/CD for containerized deployments," Altostrat must prioritize a robust suite of unit tests to provide developers with rapid feedback and ensure the high reliability of their operational workflows.

According to Google Cloud Compute Engine documentation, Spot VMs (formerly Preemptible VMs) are the most cost-effective choice for fault-tolerant, batch processing workloads. Since Altostrat’s jobs are "not time-critical" and can "tolerate occasional interruptions," Spot VMs offer a significant discount—typically 60-91%—compared to standard on-demand prices.

The "Reliability and cost management" priority mentioned in the executive statement is directly addressed by utilizing the spare capacity that Spot VMs provide. While these instances can be reclaimed by Google Cloud at any time (preempted) with a 30-second notice, Altostrat’s batch processing architecture (likely running on GKE or managed instance groups) can automatically reschedule these tasks when capacity becomes available again.

Option A (Reserved instances) requires a long-term commitment (1 or 3 years) and is better suited for predictable, constant workloads, not fluctuating batch jobs. Option C (Standard VMs) is unnecessarily expensive for workloads that do not require 100% uptime. Option D (Cloud Run functions) is excellent for event-driven, short-lived tasks but can become more expensive than Spot VMs for heavy, long-running batch computational demands. By leveraging Spot VMs, Altostrat achieves its goal of optimizing cloud storage and compute costs while maintaining the scalability required for its vast media library.

https://cloud.google.com/compute/docs/troubleshooting/troubleshooting-ssh

D: Handling "Unable to connect on port 22" error message

Possible causes include:

There is no firewall rule allowing SSH access on the port. SSH access on port 22 is enabled on all Compute Engine instances by default. If you have disabled access, SSH from the Browser will not work. If you run sshd on a port other than 22, you need to enable the access to that port with a custom firewall rule.

The firewall rule allowing SSH access is enabled, but is not configured to allow connections from GCP Console services. Source IP addresses for browser-based SSH sessions are dynamically allocated by GCP Console and can vary from session to session.

Note: The principle of least privilege and separation of duties are concepts that, although semantically different, are intrinsically related from the standpoint of security. The intent behind both is to prevent people from having higher privilege levels than they actually need

Principle of Least Privilege: Users should only have the least amount of privileges required to perform their job and no more. This reduces authorization exploitation by limiting access to resources such as targets, jobs, or monitoring templates for which they are not authorized.

Separation of Duties: Beyond limiting user privilege level, you also limit user duties, or the specific jobs they can perform. No user should be given responsibility for more than one related function. This limits the ability of a user to perform a malicious action and then cover up that action.

https://cloud.google.com/iam/docs/understanding-service-accounts

Migrating data to Google Cloud Platform

Let’s say that you have some data processing that happens on another cloud provider and you want to transfer the processed data to Google Cloud Platform. You can use a service account from the virtual machines on the external cloud to push the data to Google Cloud Platform. To do this, you must create and download a service account key when you create the service account and then use that key from the external process to call the Cloud Platform APIs.

https://cloud.google.com/datastore/docs/concepts/overview

Common workloads for Google Cloud Datastore:

User profiles

Product catalogs

Game state