MediumTechnical

42 practiced

You're asked to create a customer-facing architecture diagram for a proposal. What information should be included (components, data flows, security boundaries, SLAs), how would you tailor the diagram to different audiences (engineers, architects, executives), and what common mistakes should you avoid when presenting it?

EasyBehavioral

40 practiced

How do Google's culture and values (for example: openness, innovation, scale, and focus on users) influence the way you design solutions as a Solutions Architect? Give one concrete example where aligning to these values changed a technical decision you made for a customer and why.

HardTechnical

36 practiced

You discover that a large customer's production deployment on GCP has been misconfigured and exposes sensitive data to the public. You're the Solutions Architect on record. Describe the immediate technical remediation steps, the customer communication plan (what you tell them and when), legal/compliance notifications, and how you will coordinate with relevant Google teams to resolve and remediate. Also summarize how you will restore customer trust post-incident.

Sample Answer

Situation: During a routine review I discover a large customer's GCP production environment has a misconfiguration (publicly exposed Cloud Storage buckets / BigQuery tables) leaking sensitive data.

Immediate technical remediation (first 4 hours):- Isolate and contain: apply least-privilege ACLs and remove publicBindings (remove all-allUsers/allAuthenticatedUsers ACLs) and set uniform bucket-level access; for BigQuery, revoke PUBLIC access and set dataset IAM to specific principals.- Snapshots & evidence: make immutable copies (preserve logs, object metadata) in a secured, access-controlled project for forensic review.- Rotate credentials and secrets that may have been exposed (service accounts, API keys), add short-term deny policies where needed.- Enable and verify audit logging (Cloud Audit Logs, Access Transparency) and VPC Flow logs if relevant.- Apply protective controls: enable CMEK or revoke keys if key exposure suspected; apply firewall rules and Identity-Aware Proxy where applicable.- Short-term monitoring: add alerting (Cloud Monitoring, Security Command Center) for further suspicious access.

Customer communication plan:- Within 1 hour: notify primary technical and executive contacts that an exposure was identified, that it has been contained, and an incident response is underway. Provide high-level next steps and ETA for a more detailed report (within 4 hours).- At 4 hours: deliver a technical summary: what was exposed, duration estimate, immediate remediation performed, initial evidence preserved, recommended actions for credential rotation and compliance hold. Be transparent about unknowns.- Ongoing: daily updates until resolved; immediate alerts for new findings. Offer 24/7 technical support and a dedicated incident liaison (myself + security engineer).

Legal / compliance notifications:- Trigger customer’s internal legal/compliance workflow and advise them to assess data classification and breach notification obligations (jurisdictional timelines).- Recommend engaging Data Protection Officer / privacy counsel and, if regulated data affected (PII/PHI), prepare breach notification templates.- Preserve chain of custody for forensic artifacts; advise on regulatory reporting requirements (e.g., GDPR 72-hour window) and assist with evidence packages.

Coordination with Google teams:- Engage Google Cloud Support and Security (P1 escalation) immediately for assistance with audit logs, access transparency, and if malicious activity suspected, request DLP and Trust & Safety support.- If required, escalate to Google’s Incident Response / Professional Services for on-site remediation help and to request historical access logs beyond standard retention.- Work with Product/Engineering teams if the issue involves a platform bug or requires backend fixes.

Restoring customer trust:- Deliver a full RCA within agreed SLA showing root cause, timeline, and corrective actions (technical fix, process changes).- Implement and hand over a remediation roadmap: hardened baseline (IaC templates with secure defaults), automated scans (Cloud Asset Inventory + Forseti/SCC), enforce Organization policies, mandatory pre-production security reviews.- Offer remediation assistance: run a security hardening engagement, provide cost-free PoC for automated monitoring, and a follow-up audit at 30/90 days with measurable KPIs (no exposures, maturity improvements).- Document lessons learned, update runbooks, and ensure contractual transparency (credit/compensation if appropriate).This approach balances rapid containment, transparent communication, compliance observance, close coordination with Google, and a structured plan to rebuild confidence.

MediumTechnical

34 practiced

A Fortune 500 customer requires an architecture that supports ML inference at low latency near the edge. Which Google services (for example Edge TPU, Cloud Run, Anthos, Vertex AI) would you combine, and why? Sketch the high-level deployment topology, model distribution and update strategy, and how you'd measure SLA compliance.

Sample Answer

Recommended approach: hybrid edge-cloud ML using Edge TPU devices for ultra-low-latency inference at sites, Anthos on bare metal / GKE Edge for cluster management and secure orchestration, Vertex AI for training/validation/model registry, and Cloud Run (or Anthos Service Mesh + Cloud Run for Anthos) for cloud-hosted microservices (ingest, telemetry, model orchestration).

High-level deployment topology:- Edge site: small Anthos cluster or GKE on-prem with node(s) that host inference containers compiled for Edge TPU (Coral) using TensorFlow Lite. Edge TPU attached to the node; local API served via a lightweight container (gRPC/REST).- Cloud control plane: Vertex AI handles training, evaluation, model lineage, A/B experiments and model artifact registry. CI/CD pipeline (Cloud Build) pushes signed model bundles to GCS + Artifact Registry.- Orchestration: Anthos Config Management + Fleet for centralized policy and rollout control. Cloud Run (central) hosts inference fallback and aggregation services; Pub/Sub for telemetry/events.

Model distribution & update strategy:- Models packaged as TFLite with version metadata and cryptographic signatures.- Canary rollout: push new model to a small percentage of edge sites via Anthos-managed rollout; run shadow traffic and compare outputs to baseline.- Automatic rollback on drift or higher error rate. Periodic scheduled pulls from Artifact Registry or push via secure gRPC from control plane. Use delta updates to minimize bandwidth.

SLA measurement & compliance:- Key metrics: 95/99th percentile latency at edge, model accuracy (precision/recall), inference availability, end-to-end request success rate.- Telemetry: local Prometheus + Fluentd forwarding to Cloud Monitoring. Export histograms for p95/p99, error rates, resource (CPU/TPU) saturation, model version per inference.- Alerts: SLOs defined (e.g., p95 < 20ms, availability > 99.9%). Use Cloud Monitoring SLO policies to trigger automated rollback or traffic shift if breached.- Audit & reporting: Vertex AI lineage + Anthos logs for compliance and traceability.

Why this mix:- Edge TPU gives deterministic low-latency inference; Anthos provides consistent, secure orchestration across edge and cloud; Vertex AI centralizes ML lifecycle; Cloud Run offers scalable cloud microservices and integration with monitoring/CI. This balances latency, manageability, security, and operational control.

HardTechnical

64 practiced

A customer asks you to design a federated identity strategy across multiple cloud providers and on-prem systems with strict audit trails. Detail an architecture using Google Cloud Identity (or equivalent), specify the protocols (SAML, OIDC), token lifetimes, trust boundaries, audit logging strategy, and how you would detect and respond to anomalous authentication patterns.

Sample Answer

Requirements & approach:- Centralize identity control with Google Cloud Identity as primary IdP (or equivalent). Federate to other clouds (AWS IAM Identity Center, Azure AD) and on-prem AD via secure federation (SAML/OIDC or ADFS/AD Connect) and use SCIM for provisioning.

High-level architecture:- Cloud Identity (IdP) — federation endpoints (SAML/OIDC) → Service Providers (GCP, AWS, Azure, SaaS).- On-prem AD sync via AD Connect / LDAP bridge to Cloud Identity; AD FS or proxy for legacy SAML apps.- Identity-aware proxy or API gateway for microservices (OIDC).- Logging pipeline: Cloud Audit Logs → Logging sink → Pub/Sub → SIEM/BigQuery/Cold storage (GCS w/ WORM).

Protocols & patterns:- SAML 2.0 for enterprise SSO to legacy SAML SPs.- OIDC for modern web/mobile apps, APIs (use JWT ID/access tokens).- OAuth2 authorization code + PKCE for public clients.- SCIM 2.0 for user/group provisioning and deprovisioning.

Token lifetimes & session control:- ID token: 15 minutes- Access token: 1 hour (shorter for high-risk apps, e.g., 15m)- Refresh tokens: rotating, single-use, short absolute lifetime (7–30 days) with refresh token revocation on suspicious events- Use session cookies for long UX sessions but enforce periodic re-auth (MFA every 24h or after risk)- Enforce token audience, scope, and signature verification; use JWKS with caching and rotation.

Trust boundaries & hardening:- Explicit trust anchors per domain/tenant; mutual TLS between federation endpoints where supported.- Signed and timestamped assertions; require audience, issuer, subject confirmation.- Least-privilege claims mapping; restrict role elevation through attribute-based access control (ABAC) or short-lived role credentials (STS).- Key management via KMS/Cloud KMS; rotate keys regularly; store private keys in HSM.

Audit logging strategy:- Enable all authentication, admin, provisioning, and token lifecycle logs at IdP and SPs.- Standardize logs to CEF/JSON schema, stream to SIEM (Chronicle, Splunk, or Elastic).- Retain logs per compliance (90–730+ days); archive to WORM GCS/Cold Storage.- Log enrichments: device fingerprint, geolocation, client IP, user agent, MFA status, risk score, token IDs, correlation IDs.- Ensure immutable audit trails with tamper-evident storage and integrity checks (hash chains).

Anomaly detection & response:- Detection: - UEBA rules: impossible travel, new device, sudden privilege escalation, abnormal hourly/daily login volume. - Threshold rules: failed auth spikes, brute-force patterns, excessive refresh token use. - Machine-learning models in SIEM to surface deviations; integrate threat intelligence for suspicious IPs.- Automated response: - Risk-based enforcement: step-up MFA, block session, revoke refresh tokens, revoke short-lived STS creds. - Quarantine account (disable SCIM), revoke active sessions via token introspection/revocation. - Create incident in ticketing system, capture forensic snapshot (logs, device fingerprint), escalate to SOC.- Playbooks & telemetry: - Predefined playbooks for common scenarios, runbooks for manual forensics. - Continuous testing through red-team exercises, and periodic review of rules to reduce false positives.

Trade-offs & rationale:- Shorter tokens reduce attack window but increase UX friction—mitigate with seamless MFA and refresh token rotation.- Central IdP simplifies audit and policy enforcement; requires robust high-availability and DR for IdP endpoints.- Combining rule-based and ML detection balances explainability and detection coverage.

Key deliverables for client:- Federation matrix (which apps use SAML/OIDC), token policy, trust boundary diagram, logging retention and sink design, SIEM integration plan, incident response playbooks, and implementation roadmap with timelines and rollback/DR steps.

Motivation for Google and Solutions Architect Role Questions

Sample Answer

Sample Answer

Sample Answer

Sample Answer

Sample Answer

Unlock Full Question Bank