Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
An enterprise is designing a decoupled, event-driven processing pipeline on Google Cloud. When new image files are uploaded to a private Cloud Storage bucket, an Eventarc trigger must capture the event and deliver it directly to a backend processing service. The backend service is hosted at an internal HTTP endpoint within a private Virtual Private Cloud (VPC) network and is addressed using an internal DNS domain name managed by Cloud DNS.
To ensure private network connectivity and follow the principle of least privilege, which combination of networking and Identity and Access Management (IAM) configurations should you implement?
This configuration establishes a secure, private event-routing pathway from Cloud Storage through Eventarc to an internal HTTP destination hosted inside a Virtual Private Cloud (VPC) without traversing the public internet.
StudyCerts
StudyCertsroles/pubsub.publisher) role to the project's Cloud Storage service agent (service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com) allows it to publish storage mutation events securely.service-PROJECT_NUMBER@gcp-sa-eventarc.iam.gserviceaccount.com) requires the DNS Peer (roles/dns.peer) role on the VPC host project to resolve the internal record.This architecture adheres to the Google Cloud security best practices for event-driven computing by combining native VPC network attachments with granular, least-privilege IAM roles for Google-managed service agents.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.