Hard1 markMultiple Choice

Domain 1: Designing and Planning a Cloud Solution ArchitectureCloud ArmorCloud Load BalancingData Residency

This question is part of a case study — click to read the full scenario(Case 01)

CASE STUDY: TechStream Gaming

Overview: 500 employees, $100M revenue. On-prem US/EU, 200 servers, 5TB MySQL. 2M peak users, $100K/mo cost.
Business: Reduce cost 40%, 5x growth, launch APAC/SA/Africa, daily deployments.
Executives:

CEO: "Scale rapidly to compete. Cloud is critical."
CFO: "Cost reduction paramount. Max $100K/mo. ROI in 18 months."
CTO: "Team has limited cloud experience. 99.95% uptime non-negotiable."
Tech: <100ms latency globally, real-time analytics, 5x seasonal spikes, EU data residency, DDoS protection, CI/CD.
Constraints: 12-month migration, 4hr max downtime, 20 devs (Java/MySQL), 5 ops (limited cloud), $2M budget.

Which migration strategy should you recommend for the core gaming application to meet the business and technical requirements?

View full case study page →

GCP PCA · Question 03 · Domain 1: Designing and Planning a Cloud Solution Architecture

CASE STUDY: TechStream Gaming

Overview: 500 employees, $100M revenue. On-prem US/EU, 200 servers, 5TB MySQL. 2M peak users, $100K/mo cost.
Business: Reduce cost 40%, 5x growth, launch APAC/SA/Africa, daily deployments.
Executives:

CEO: "Scale rapidly to compete. Cloud is critical."

CFO: "Cost reduction paramount. Max $100K/mo. ROI in 18 months."

CTO: "Team has limited cloud experience. 99.95% uptime non-negotiable."
Tech: <100ms latency globally, real-time analytics, 5x seasonal spikes, EU data residency, DDoS protection, CI/CD.
Constraints: 12-month migration, 4hr max downtime, 20 devs (Java/MySQL), 5 ops (limited cloud), $2M budget.

How should you design the network architecture to ensure DDoS protection and compliance with the EU data residency requirement?

Q: CASE STUDY: TechStream Gaming Overview: 500 employees, $100M revenue. On-prem US/EU, 200 servers, 5TB MySQL. 2M peak users, $100K/mo cost. Business: Reduce cost 40%, 5x growth, launch APAC/SA/Africa, daily deployments. Executives: - CEO: "Scale rapidly to compete. Cloud is critical." - CFO: "Cost reduction paramount. Max $100K/mo. ROI in 18 months." - CTO: "Team has limited cloud experience. 99.95% uptime non-negotiable." Tech: <100ms latency globally, real-time analytics, 5x seasonal spikes, EU data residency, DDoS protection, CI/CD. Constraints: 12-month migration, 4hr max downtime, 20 devs (Java/MySQL), 5 ops (limited cloud), $2M budget. How should you design the network architecture to ensure DDoS protection and compliance with the EU data residency requirement?

Match the security requirement (DDoS) to the correct GCP service (Cloud Armor) and ensure the load balancer type supports it.

Q: What mistakes do candidates make on this GCP PCA question?

Selecting Network Load Balancer (A) - Cloud Armor is for Layer 7 (HTTP/S), not Layer 4.

Answer options:

Use a Network Load Balancer with Cloud Armor, and set up a separate VPC for EU users.

Use a Global External HTTP(S) Load Balancer with Cloud Armor for DDoS protection, and configure backend services to ensure EU users are only routed to EU clusters.

Use Cloud DNS routing with Internal Load Balancers and VPC Service Controls.

Deploy third-party virtual firewall appliances in each region and use Cloud NAT.

How to approach this question

Match the security requirement (DDoS) to the correct GCP service (Cloud Armor) and ensure the load balancer type supports it.

Full Answer

B.Use a Global External HTTP(S) Load Balancer with Cloud Armor for DDoS protection, and configure backend services to ensure EU users are only routed to EU clusters.✓ Correct

Use a Global External HTTP(S) Load Balancer with Cloud Armor for DDoS protection, and configure backend services to ensure EU users are only routed to EU clusters.

Cloud Armor provides WAF and DDoS protection at Google's network edge, but it must be attached to a Global External HTTP(S) Load Balancer. To meet the EU data residency requirement, the load balancer's URL maps and backend services can be configured to route EU-originated traffic strictly to EU-based GKE clusters.

Common mistakes

Selecting Network Load Balancer (A) - Cloud Armor is for Layer 7 (HTTP/S), not Layer 4.

Question 02 All questions Question 04

Practice the full GCP Professional Cloud Architect Practice Exam 4

50 questions · hints · full answers · grading

How to approach this question

Full Answer

Common mistakes

Practice the full GCP Professional Cloud Architect Practice Exam 4

More questions from this exam