An enterprise is planning to migrate a tier of interdependent application servers hosted on on-premises VMware vSphere virtual machines (VMs) to Compute Engine on Google Cloud. The migration team has identified the following technical requirements: Interdependent VMs supporting the application must be organized and migrated together in coordinated batches. The application's functionality and automated OS adaptations must be verified in Google Cloud without interrupting active production traffic on-premises. Production downtime during the final switchover must be kept to a minimum. Which migration approach and tooling should the enterprise implement?

Install the Migrate Connector in the VMware environment, organize the interdependent VMs into migration groups using Migrate to Virtual Machines, validate functionality with test clones in an isolated VPC during background replication, and execute cutover during a scheduled maintenance window.: What Migrate to Virtual Machines Is Migrate to Virtual Machines (formerly Migrate for Compute Engine) is Google Cloud's native, fully managed service designed to replicate and rehost physical servers and virtual machines from on-premises environments (such as VMware vSphere) or other public clouds directly into Compute Engine. How It Meets the Requirements Coordinated Batches via Groups: Migrate to Virtual Machines allows administrators to organize interdependent VMs into logical units called groups. Operations across the entire VM migration lifecycle—such as replication, testing, and cutover—can be orchestrated collectively across the group to ensure multi-tier application consistency. Risk-Free Pre-Migration Validation: During continuous background disk replication, the tool supports creating test clones in an isolated Virtual Private Cloud (VPC) sandbox. This enables operations teams to thoroughly test workloads, networking, and automated OS adaptations without disrupting active source VMs or on-premises production traffic. Minimal Downtime Cutover: Data replication occurs continuously in the background. When the team is ready to complete the transition, a brief cutover window stops the source VM, synchronizes final delta changes, and starts the production Compute Engine instance. Key Advantages and Capabilities Automated OS Adaptations: Automatically modifies drivers, boot configurations, and guest environments for seamless operation on Compute Engine. Non-Disruptive Background Replication: Continuously streams storage changes without degrading on-premises application performance. Repeatable Test Cycles: Allows teams to create and destroy test clones multiple times to validate configuration fixes before cutover. Centralized Management: Integrates directly into the Google Cloud console with support for granular IAM controls and Cloud Monitoring. Why This Is Optimal This approach provides an end-to-end, structured lifecycle for lift-and-shift migrations. By leveraging test clones and migration groups, teams eliminate operational risk and reduce the final cutover duration to minutes rather than hours.

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Intermediate

Prepare and test your skills

Coordinated VMware Migration Using Test Clones

Section: Data and system migration and management tooling

...

Explanations

...

View source documentation

Keep the momentum going with these hand-picked practice scenarios

IntermediateProfessional Cloud Architect

Declarative Infrastructure as Code

Data and system migration and management tooling

IntermediateProfessional Cloud Architect

Transfer Appliance vs STS vs BigQuery DTS

Data and system migration and management tooling

IntermediateProfessional Cloud Architect

A financial services organization is implementing customer-managed encryption keys (CMEK) using Cloud Key Management Service (Cloud KMS) to protect data across several Cloud Storage buckets. The compliance team requires a strict separation of duties and the enforcement of least privilege across cryptographic assets: Key administrators must create, rotate, and manage keys and permissions, but must be prevented from encrypting or decrypting data payloads. The Cloud Storage service agent must be capable of encrypting and decrypting data using the cryptographic keys, but must have no administrative privileges over key configurations. Access should be scoped to the minimal necessary resource level. Which IAM role configuration should you implement to satisfy these requirements?

Managing customer-managed encryption keys with Cloud Key Management Service (Cloud KMS)

IntermediateProfessional Cloud Architect

GCVE Route Summarization and Filtering

Cloud-native network configuration for compute resources (e.g., Compute Engine, GKE, serverless networking, and Google Cloud VMware Engine)

IntermediateProfessional Cloud Architect

Binary Authorization Attestation

Continuous integration/continuous deployment

AdvancedProfessional Cloud Security Engineer

An enterprise manages multiple database workloads across several projects located inside a single folder named Application-Services. The security team needs to grant members of the database administration team permissions to inspect and configure Cloud SQL instances across all current and future projects in this folder. The access control architecture must satisfy the following constraints: Administrators must be able to view instance configuration details and navigate Cloud SQL resources seamlessly within the Google Cloud console. Administrators must NOT have permission to delete instances, delete databases, or modify IAM policy bindings. Administrators must NOT receive read or write permissions to any non-database services in the projects. What should the security engineer do to enforce the principle of least privilege?

Defining access control at the organization, folder, project, and resource level using the principle of least privilege.

Want more questions like this?

Get a free certification question every week.

Last updated August 28, 2026

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Intermediate

Prepare and test your skills

Coordinated VMware Migration Using Test Clones

Section: Data and system migration and management tooling

An enterprise is planning to migrate a tier of interdependent application servers hosted on on-premises VMware vSphere virtual machines (VMs) to Compute Engine on Google Cloud. The migration team has identified the following technical requirements:

Interdependent VMs supporting the application must be organized and migrated together in coordinated batches.
The application's functionality and automated OS adaptations must be verified in Google Cloud without interrupting active production traffic on-premises.
Production downtime during the final switchover must be kept to a minimum.

Which migration approach and tooling should the enterprise implement?

...

Extract container artifacts from the VMs using Migrate to Containers, deploy the workloads into Google Kubernetes Engine (GKE) Autopilot, and mirror live network traffic between the data center and GKE to validate application logic.

...

Use Migration Center to perform live cutover of the source VMs into Compute Engine Managed Instance Groups (MIGs), and configure automated rollback scripts to restore source workloads if health checks fail.

...

Establish a hybrid connection with VMware HCX, execute cold migrations of individual VMs directly to Compute Engine, and perform post-migration testing after source instances are decommissioned.

...

Install the Migrate Connector in the VMware environment, organize the interdependent VMs into migration groups using Migrate to Virtual Machines, validate functionality with test clones in an isolated VPC during background replication, and execute cutover during a scheduled maintenance window.

...

Explanations

What Migrate to Virtual Machines Is

Migrate to Virtual Machines (formerly Migrate for Compute Engine) is Google Cloud's native, fully managed service designed to replicate and rehost physical servers and virtual machines from on-premises environments (such as VMware vSphere) or other public clouds directly into Compute Engine.

How It Meets the Requirements

Coordinated Batches via Groups: Migrate to Virtual Machines allows administrators to organize interdependent VMs into logical units called groups. Operations across the entire VM migration lifecycle—such as replication, testing, and cutover—can be orchestrated collectively across the group to ensure multi-tier application consistency.
Risk-Free Pre-Migration Validation: During continuous background disk replication, the tool supports creating test clones in an isolated Virtual Private Cloud (VPC) sandbox. This enables operations teams to thoroughly test workloads, networking, and automated OS adaptations without disrupting active source VMs or on-premises production traffic.
Minimal Downtime Cutover: Data replication occurs continuously in the background. When the team is ready to complete the transition, a brief cutover window stops the source VM, synchronizes final delta changes, and starts the production Compute Engine instance.

Key Advantages and Capabilities

Automated OS Adaptations: Automatically modifies drivers, boot configurations, and guest environments for seamless operation on Compute Engine.
Non-Disruptive Background Replication: Continuously streams storage changes without degrading on-premises application performance.
Repeatable Test Cycles: Allows teams to create and destroy test clones multiple times to validate configuration fixes before cutover.
Centralized Management: Integrates directly into the Google Cloud console with support for granular IAM controls and Cloud Monitoring.

Why This Is Optimal

This approach provides an end-to-end, structured lifecycle for lift-and-shift migrations. By leveraging test clones and migration groups, teams eliminate operational risk and reduce the final cutover duration to minutes rather than hours.

...

View source documentation

Keep the momentum going with these hand-picked practice scenarios

IntermediateProfessional Cloud Architect

Declarative Infrastructure as Code

Data and system migration and management tooling

IntermediateProfessional Cloud Architect

Transfer Appliance vs STS vs BigQuery DTS

Data and system migration and management tooling

IntermediateProfessional Cloud Architect

A financial services organization is implementing customer-managed encryption keys (CMEK) using Cloud Key Management Service (Cloud KMS) to protect data across several Cloud Storage buckets. The compliance team requires a strict separation of duties and the enforcement of least privilege across cryptographic assets: Key administrators must create, rotate, and manage keys and permissions, but must be prevented from encrypting or decrypting data payloads. The Cloud Storage service agent must be capable of encrypting and decrypting data using the cryptographic keys, but must have no administrative privileges over key configurations. Access should be scoped to the minimal necessary resource level. Which IAM role configuration should you implement to satisfy these requirements?

Managing customer-managed encryption keys with Cloud Key Management Service (Cloud KMS)

IntermediateProfessional Cloud Architect

GCVE Route Summarization and Filtering

Cloud-native network configuration for compute resources (e.g., Compute Engine, GKE, serverless networking, and Google Cloud VMware Engine)

IntermediateProfessional Cloud Architect

Binary Authorization Attestation

Continuous integration/continuous deployment

AdvancedProfessional Cloud Security Engineer

An enterprise manages multiple database workloads across several projects located inside a single folder named Application-Services. The security team needs to grant members of the database administration team permissions to inspect and configure Cloud SQL instances across all current and future projects in this folder. The access control architecture must satisfy the following constraints: Administrators must be able to view instance configuration details and navigate Cloud SQL resources seamlessly within the Google Cloud console. Administrators must NOT have permission to delete instances, delete databases, or modify IAM policy bindings. Administrators must NOT receive read or write permissions to any non-database services in the projects. What should the security engineer do to enforce the principle of least privilege?

Defining access control at the organization, folder, project, and resource level using the principle of least privilege.

Want more questions like this?

Get a free certification question every week.

Last updated August 28, 2026

An enterprise is planning to migrate a tier of interdependent application servers hosted on on-premises VMware vSphere virtual machines (VMs) to Compute Engine on Google Cloud. The migration team has identified the following technical requirements:

Interdependent VMs supporting the application must be organized and migrated together in coordinated batches.
The application's functionality and automated OS adaptations must be verified in Google Cloud without interrupting active production traffic on-premises.
Production downtime during the final switchover must be kept to a minimum.