Google Professional-Cloud-Architect - Google Certified Professional - Cloud Architect (GCP)

From Scenario:

A few of their games were more popular than expected, and they had problems scaling their application servers, MySQL databases, and analytics tools.

Requirements for Game Analytics Platform include: Dynamically scale up or down based on game activity

From scenario: Requirements for Game Backend Platform

Dynamically scale up or down based on game activity

Connect to a managed NoSQL database service

Run customize Linux distro

A real time requires Stream / Messaging so Pub/Sub, Analytics by Big Query .

Ingest millions of streaming events per second from anywhere in the world with Cloud Pub/Sub, powered by Google ' s unique, high-speed private network. Process the streams with Cloud Dataflow to ensure reliable, exactly-once, low-latency data transformation. Stream the transformed data into BigQuery, the cloud-native data warehousing service, for immediate analysis via SQL or popular visualization tools.

From scenario: They plan to deploy the game’s backend on Google Compute Engine so they can capture streaming metrics, run intensive analytics.

Requirements for Game Analytics Platform

Dynamically scale up or down based on game activity

Process incoming data on the fly directly from the game servers

Process data that arrives late because of slow mobile networks

Allow SQL queries to access at least 10 TB of historical data

Process files that are regularly uploaded by users’ mobile devices

Use only fully managed services

503 is service unavailable error. If the database was online everyone would get the 503 error.

https://cloud.google.com/docs/quota#capping_usage

According to the Google Cloud Architecture Framework and Google Cloud Armor documentation , Google Cloud Armor is the enterprise-grade solution for protecting applications and services against Distributed Denial of Service (DDoS) attacks and web-based exploits. Altostrat requires a solution that addresses " multi-vector " attacks at " various layers, " specifically the Network/Transport layers ( L3/L4 ) and the Application layer ( L7 ).

Google Cloud Armor provides built-in, always-on protection against L3 and L4 volumetric attacks at the edge of Google’s network, preventing malicious traffic from reaching the backend GKE clusters or Cloud Run functions. For L7 (Application Layer) protection, Cloud Armor offers Web Application Firewall (WAF) capabilities, including pre-configured rule sets (based on OWASP Top 10 ), rate limiting, and Adaptive Protection . The latter uses machine learning to detect anomalies in traffic patterns specific to Altostrat’s applications, automatically suggesting rules to block sophisticated botnets or application-layer floods.

While Cloud NGFW (Option B) provides essential network filtering, it lacks the native L7 inspection and global DDoS scrubbing capabilities inherent to Cloud Armor. VPC Service Controls (Option A) focus on data exfiltration and API security perimeters, and Security Command Center (Option D) is a posture management and threat detection tool rather than an active traffic mitigation service. Deploying Cloud Armor at the global load balancing tier ensures Altostrat maintains the high availability and reliability required for its global media streaming audience.

According to Google Cloud documentation on Application Performance Management (APM) , Cloud Profiler is the most effective tool for identifying resource-intensive parts of an application ' s source code. For Altostrat ' s Java-based media processing pipeline, which likely involves CPU-intensive tasks such as metadata extraction or transcoding, understanding exactly which methods or lines of code consume the most CPU or memory is critical.

Cloud Profiler is a statistical, low-overhead profiler that continuously gathers performance data (CPU usage, heap allocation, etc.) from production applications with less than 0.5% impact on performance. It presents this data in an interactive flame graph , allowing developers to pinpoint bottlenecks in the media processing logic.

While Cloud Trace (Option C) is excellent for monitoring latency across distributed services, it primarily tracks the " outer shell " of the request—showing how long a function took to execute or how long an external API call lasted—but does not provide the deep, code-level insight into internal Java method execution that Profiler does. Cloud Logging (Option A) is useful for troubleshooting specific events but is not a performance analysis tool, and Snapshot Debugger (Option D) is designed for inspecting variables at specific execution points rather than aggregate performance profiling. Given Altostrat ' s goal to " Optimize cloud storage costs " and " Accelerate... operational workflows, " using Cloud Profiler to create more efficient, less resource-hungry processing code is the architecturally sound choice.

According to the Google Cloud Architecture Framework: Software Development and Delivery section, unit testing is the foundational practice for verifying the smallest parts of an application—such as functions, classes, or individual microservices—in complete isolation . The requirement specifically asks for a method to ensure services function correctly " in isolation, " which is the primary definition of a unit test.

In Altostrat’s modernized CI/CD environment, unit tests are executed early in the pipeline (the " left " side of DevSecOps). They typically use " mocks " or " stubs " to simulate external dependencies like BigQuery, Cloud Storage, or other microservices. This ensures that the internal logic of a specific service—for instance, the metadata extraction logic or the pricing algorithm—is mathematically and logically sound before it interacts with the rest of the system.

While Integration testing (Option D) is vital for ensuring services talk to each other correctly, it does not test them " in isolation. " End-to-end testing (Option C) validates the entire user journey but is slow and complex to debug. Load testing (Option B) focuses on performance under stress rather than functional correctness. To meet the technical requirement of " Modernize CI/CD for containerized deployments, " Altostrat must prioritize a robust suite of unit tests to provide developers with rapid feedback and ensure the high reliability of their operational workflows.

According to Google Cloud Architecture Framework and Cloud KMS documentation , when a customer requires direct control and auditability over the encryption keys used for data at rest, Customer-Managed Encryption Keys (CMEK) is the recommended path.

While Google Cloud encrypts all data at rest by default using Google-managed keys (Option B), Altostrat specifically requires control and auditability . By using CMEK through Cloud Key Management Service (Cloud KMS) , Altostrat can manage the key rotation schedules, revoke access to keys immediately to " kill " access to the data, and view detailed logs in Cloud Audit Logs every time the key is used to encrypt or decrypt a media asset.

Option D is superior to Option C because client-side encryption with a self-managed HashiCorp Vault adds significant operational overhead and complexity, contradicting the business requirement to " Simplify infrastructure management . " CMEK integrates natively with Cloud Storage, allowing for a seamless experience while meeting the strict security requirements for sensitive documentaries and interviews. Furthermore, the use of IAM roles and groups for fine-grained access control aligns with the principle of least privilege, ensuring that only authorized service accounts and users can access the sensitive buckets and the keys required to decrypt them.

According to Google Cloud Compute Engine documentation , Spot VMs (formerly Preemptible VMs) are the most cost-effective choice for fault-tolerant, batch processing workloads. Since Altostrat’s jobs are " not time-critical " and can " tolerate occasional interruptions, " Spot VMs offer a significant discount—typically 60-91% —compared to standard on-demand prices.

The " Reliability and cost management " priority mentioned in the executive statement is directly addressed by utilizing the spare capacity that Spot VMs provide. While these instances can be reclaimed by Google Cloud at any time (preempted) with a 30-second notice, Altostrat’s batch processing architecture (likely running on GKE or managed in stance groups) can automatically reschedule these tasks when capacity becomes available again.

Option A (Reserved instances) requires a long-term commitment (1 or 3 years) and is better suited for predictable, constant workloads, not fluctuating batch jobs. Option C (Standard VMs) is unnecessarily expensive for workloads that do not require 100% uptime. Option D (Cloud Run functions) is excellent for event-driven, short-lived tasks but can become more expensive than Spot VMs for heavy, long-running batch computational demands. By leveraging Spot VMs, Altostrat achieves its goal of optimizing cloud storage and compute costs while maintaining the scalability required for its vast media library.

According to the Apigee API Platform documentation , the Quota policy is the primary mechanism used to enforce business-level constraints by limiting the number of request messages an API proxy allows over a specific period of time (such as a minute, hour, day, week, or month). For a media company like Altostrat, which aims to " unlock new revenue streams through targeted marketing " and " drive revenue growth, " managing API consumption is critical for cost predictability and monetization strategies.

Google Cloud distinguishes between Spike Arrest and Quota policies . While Spike Arrest is designed for operational safety—protecting backend systems from sudden traffic bursts—the Quota policy is specifically used to enforce business contracts, Service Level Agreements (SLAs), and cost management . By configuring a Quota policy, Altostrat can ensure that no single consumer or application exceeds the total volume of calls that would result in unexpected infrastructure costs or exceed the limits of their current subscription tier.

Options A and B (API Key and OAuth) are essential for authentication and authorization —identifying who is making the call—but they do not inherently limit the volume of calls. Option D (XML threat protection) is a security measure to prevent malformed payload attacks. Therefore, to meet the specific business requirement of " Reliability and cost management, " implementing Quota policies within Apigee is the architecturally correct choice to prevent API abuse and manage operational expenditure.