Correct answer is C as SQL server can be configured for high availability with Windows Server Failover Clustering and SQL Server AlwaysOn Availability Groups.
Refer GCP documentation - SQL Server - Configure Availability
If you run multiple SQL Server Enterprise instances on Compute Engine, you can configure those instances to use Windows Server Failover Clustering and SQL Server AlwaysOn Availability Groups to support high availability and disaster recovery.
If you need high availability and redundancy for your Microsoft SQL Server on Compute Engine, you can configure Always On Failover Cluster Instances (FCI) with Storage Spaces Direct (S2D).
Always On FCI provides a single Microsoft SQL Server instance that is installed across Windows Server Failover Cluster (WSFC) nodes. Only one node in the WSFC actively hosts the SQL instance. In the event of a failover, the WSFC service transfers ownership of the instance's resources to a designated failover node.
Option A is wrong as it is not a direct replacement for Microsoft SQL server.
Option B is wrong as Read replicas are not available for Microsoft SQL server, and they are only for read only purpose.
Option D is wrong as it does not support Microsoft SQL server and it is also zonal and failover needs to be configured.

Correct answers are B & D
Option B as both are zones are tuned to handle 100% traffic, even if one of the zone goes down there would be no capacity loss.
Option D as with 3 zones with 50% capacity, even if one of the zone goes down the other 2 zones would provide 100% capacity.
Refer GCP documentation - Distributing Instances with Regional Instance Groups
If you are creating a regional managed instance group in a region with at least three zones, Google recommends overprovisioning your instance group by at least 50%. By default, a regional managed instance group creates instances in three zones. Having VM instances in three zones already helps you preserve at least 2/3 of your serving capacity and if a single zone fails, the other two zones in the region can continue to serve traffic without interruption. By overprovisioning to 150%, you can ensure that if 1/3 of the capacity is lost, 100% of traffic is supported by the remaining zones.
Option A is wrong as if multi-zone is not selected all instances would be launched in the same zone and subject to 100% loss, in case the zone goes down.
Option C is wrong as unmanaged instance groups are not recommended as they cannot be autoscaled.

Correct answer is B as Google App Engine provides connectivity to on-premises using Cloud VPN.
Refer GCP documentation - App Engine Flexible Network Settings
Advanced network configuration
You can segment your Compute Engine network into subnetworks. This allows you to enable VPN scenarios, such as accessing databases within your corporate network.
To enable subnetworks for your App Engine application:
Create a custom subnet network.
Add the network name and subnetwork name to your app.yaml file, as specified above.
To establish a simple VPN based on static routing, create a gateway and a tunnel for a custom subnet network. Otherwise, see how to create other types of VPNs.
Option A is wrong as Google App Engine Standard cannot use Cloud VPN.
Options C & D are wrong as you need a Cloud VPN to connect to on-premises data center. Cloud Route support dynamic routing.

Correct answer is D as the primary and secondary IPs of VPCs should not overlap with on-premises data center network.
VM alias IP ranges must be assigned from a range owned by the subnet that the VM is in. All subnets have a primary range, which is the standard range of internal IP addresses that defines the subnet. A subnet may also have one or more secondary IP ranges of internal IP addresses. You can assign alias IP ranges from either the primary or secondary ranges of the subnet.
You must give each secondary range a name that is unique for the subnet. When assigning an alias IP range to a VM, the secondary range name tells GCP from which subnet range to assign the alias IPs.
All ranges, both primary and secondary, must be unique across across all subnets in the VPC network and in any networks attached via VPC Network Peering, VPN, or Interconnect.

Correct answer is C as GCP and GKE provides you will tools and approaches to make you hosting and applications PCI-DSS complaint.
Refer GCP documentation - PCI-DSS Compliance in GCP
Approach the nodes and pods in a GKE cluster the same way as any merchant-managed server. Implement logging, instrumentation, and patching at both the node and pod level. Don't keep cardholder data at the node level; however, nodes will still be in scope if they contain or might contain any in-scope pods.
To restrict access to your cluster master, use authorized networks to block untrusted IP addresses from outside GCP. These CIDR rules are compatible with private clusters and act as a whitelist.
Implement network policies in the GKE cluster when your in-scope projects contain different types of pods. Network policies work similar to the virtual private cloud (VPC) firewalls that you might already be familiar with. You can allow or deny traffic based on IP rules or labels.
Requirement 2.2.1 stipulates that only one primary function can be implemented per server. This requirement does not prohibit the case of a single GKE cluster hosting more than one pod type. The primary function of GKE nodes is to serve and manage containers. If designed properly, individual pods can also adhere to this primary function rule in a single cluster.
Options A & D is wrong as the application hosting using GKE to be PCI-DSS complaint is customers responsibility.
Option B is wrong as GKE hosting can be made PCI-DSS complaint.

Correct answer is A as the image can be directly updated using the kubectl command and Kubernetes Engine performs a rolling update.
Refer GCP documentation - Kubernetes Engine Rolling updates
You can perform a rolling update to update the images, configuration, labels, annotations, and resource limits/requests of the workloads in your clusters. Rolling updates incrementally replace your resource's Pods with new ones, which are then scheduled on nodes with available resources. Rolling updates are designed to update your workloads without downtime.
You can use kubectl set to make changes to an object's image, resources(compute resource such as CPU and memory), or selector fields.
For example, to update a Deployment from nginx version 1.7.9 to 1.9.1, run the following command:
kubectl set image deployment nginx nginx=nginx:1.9.1
The kubectl set image command updates the nginx image of the Deployment's Pods one at a time.
Option B is wrong as creating a new deployment would result in downtime.
Option C is wrong as service does not have a mapping of image.
Option D is wrong as Kubernetes Engine does not work with instance template and managed instance groups

Correct answer is C as Cloud Storage upload events can push Cloud Pub/Sub to trigger a Cloud Function to ingest and process the image.
Refer GCP documentation - Cloud Storage Pub/Sub Notifications
Cloud Pub/Sub Notifications sends information about changes to objects in your buckets to Cloud Pub/Sub, where the information is added to a Cloud Pub/Sub topic of your choice in the form of messages. For example, you can track objects that are created and deleted in your bucket. Each notification contains information describing both the event that triggered it and the object that changed.
Cloud Pub/Sub Notifications are the recommended way to track changes to objects in your Cloud Storage buckets because they're faster, more flexible, easier to set up, and more cost-effective.
Options A, B & D are wrong as they cannot be configured for notifications from Cloud Storage.

Correct answers are B as Data Loss Prevention API can help handle and redact the sensitive PII data.
Refer GCP documentation - Data Loss Prevention API
Cloud DLP helps you better understand and manage sensitive data. It provides fast, scalable classification and redaction for sensitive data elements like credit card numbers, names, social security numbers, US and selected international identifier numbers, phone numbers and GCP credentials. Cloud DLP classifies this data using more than 90 predefined detectors to identify patterns, formats, and checksums, and even understands contextual clues. You can optionally redact data as well using techniques like masking, secure hashing, bucketing, and format-preserving encryption.

Classify and Redact Sensitive Data Image

Correct answer is C as as a first step you need to perform root cause analysis, because you don't know from the information given whether the issue had to do with the Cloud Provider or was in the application or something to do with the interface between the application and cloud resources. The goal of identifying root cause is to prevent future failures, that might include changing procedures.

Correct answer is C as Dataprep provides data cleaning and automatically identifies anomalies in the data. It can integrated with Cloud Storage and BigQuery
Refer GCP documentation - Dataprep
Cloud Dataprep by Trifacta is an intelligent data service for visually exploring, cleaning, and preparing structured and unstructured data for analysis. Cloud Dataprep is serverless and works at any scale. There is no infrastructure to deploy or manage. Easy data preparation with clicks and no code.
Cloud Dataprep automatically detects schemas, datatypes, possible joins, and anomalies such as missing values, outliers, and duplicates so you get to skip the time-consuming work of profiling your data and go right to the data analysis.
Cloud Dataprep automatically identifies data anomalies and helps you to take corrective action fast. Get data transformation suggestions based on your usage pattern. Standardize, structure, and join datasets easily with a guided approach.
Easily process data stored in Cloud Storage, BigQuery, or from your desktop. Export clean data directly into BigQuery for further analysis. Seamlessly manage user access and data security with Cloud Identity and Access Management.
Option A is wrong as Dataprep would not be able interact directly with local system.
Options B & D are wrong as Cloud Dataflow is a fully-managed service for transforming and enriching data in stream (real time) and batch (historical) modes with equal reliability and expressiveness -- no more complex workarounds or compromises needed. It does not provide anomaly detection.

Correct answer is A as the groups needs to be given User role to be able to run jobs and access datasets within the billing project with a data viewer role to the different projects.
Refer GCP documentation - BigQuery roles
roles/bigquery.jobUser BigQuery Job User Provides permissions to run jobs, including queries, within the project. The jobUser role can enumerate their own jobs and cancel their own jobs. bigquery.jobs.create Project
resourcemanager.projects.get
resourcemanager.projects.list
roles/bigquery.user BigQuery User Provides permissions to run jobs, including queries, within the project. The user role can enumerate their own jobs, cancel their own jobs, and enumerate datasets within a project. Additionally, allows the creation of new datasets within the project; the creator is granted the bigquery.dataOwner role for these new datasets. bigquery.config.get Project
bigquery.datasets.create
bigquery.datasets.get
bigquery.datasets.getIamPolicy
bigquery.jobs.create
bigquery.jobs.list
bigquery.readsessions.*
bigquery.savedqueries.get
bigquery.savedqueries.list
bigquery.tables.list
bigquery.transfers.get
resourcemanager.projects.get
resourcemanager.projects.list
Option B is wrong as jobUser does not give the ability to enumerate the datasets.
Options C & D are wrong as the billing needs to be in a single project, the jobs needs to be executed from the billing project with data access to the dataset from different projects.

Correct answer is D as the requirement is that the file cannot be decrypted in the cloud, so encrypt it before it is uploaded and after it is downloaded adds a layer of encryption.
Refer GCP documentation - Data Encryption Options
Server-side encryption: encryption that occurs after Cloud Storage receives your data, but before the data is written to disk and stored.
Customer-supplied encryption keys: You can create and manage your own encryption keys for server-side encryption, which act as an additional encryption layer on top of the standard Cloud Storage encryption.
Customer-managed encryption keys: You can generate and manage your encryption keys using Cloud Key Management Service, which act as an additional encryption layer on top of the standard Cloud Storage encryption.
Client-side encryption: encryption that occurs before data is sent to Cloud Storage. Such data arrives at Cloud Storage already encrypted but also undergoes server-side encryption.

Correct answer is B as read replica will increase the availability of the service and can be located closer to the users in the new geographies.
Refer GCP documentation - Cloud SQL Replication Options
Cloud SQL provides the ability to replicate a master instance to one or more read replicas. A read replica is a copy of the master that reflects changes to the master instance in almost real time.
Option A is wrong as Cloud Spanner is suitable for read/write operations, as the requirement is mainly for read, read replicas would be best fit.
Option C is wrong as high availability is for failover and not for performance.
Option D is wrong as Cloud Storage is not ideal storage for relational data.

Correct answer is C as this grants the least privilege required to access the data and minimizes the risk of accidentally granting access to the wrong people.
Refer GCP documentation - Cloud Storage Access Control
Option A is wrong as Signed URLs could potentially be leaked as anyone who gets access to the URL can access the data.
Option B is wrong as this is needlessly permissive, users only require one permission in order to get access.
Option D is wrong as this is security through obscurity, also known as no security at all.

Correct answer is B as NoSQL like Bigtable and Datastore solution is an ideal solution to store sensor ID and several different discrete items of information. It also provides an ability to join with other data. Datastore can also be configured to store data in multi-region locations.
Refer GCP documentation - Storage Options
Option A is wrong as flat file is not an ideal storage option. It is not scalable.
Option C is wrong as relational database like Cloud SQL is not an ideal solution to store schema less data.
Option D is wrong as blob storage like Cloud Storage is not an ideal solution to store, analyze schema less data and join with other sources.