GCP Professional Data Engineer Certification – Higher
Education Cloud Computing
Section 1: Designing Data Processing Systems
Questions 1–30
Question 1
A university is migrating its student records database to Google Cloud. The system
must comply with FERPA regulations and ensure that only authorized faculty can
access sensitive student data. Which IAM approach should the data engineer
implement to enforce least-privilege access?
A. Grant all faculty members the roles/bigquery.dataEditor role at the project
level
B. Use IAM conditions to grant time-bound access to student data tables
C. Assign roles/bigquery.dataViewer at the dataset level and use authorized views
to restrict access to specific columns
D. Grant roles/iam.serviceAccountUser to all faculty members
Correct Answer: C
Rationale: Authorized views in BigQuery allow you to restrict access to
specific rows and columns without granting direct table access. This is a best
practice for implementing column-level security and FERPA compliance. IAM
conditions (B) can restrict time-based access but don't provide the granular
column-level control needed. Granting project-level editor roles (A) violates least-
privilege principles. Service account user roles (D) are for enabling services to run
as service accounts, not for data access control.
Question 2
A higher education institution is designing a data processing system that must
handle student enrollment data from multiple campuses across different regions.
,Data sovereignty regulations require that student data from the EU campus
remain stored in the EU region. Which design consideration is MOST critical?
A. Using Cloud CDN to cache data globally
B. Implementing region-specific encryption keys
C. Configuring dataset locations to match the region of data origin and
implementing organization policies to restrict data transfer
D. Using a single multi-region bucket for all data to simplify management
Correct Answer: C
Rationale: Data sovereignty requires that data remain in specific geographic
regions. Configuring dataset locations per region and using organization policies
to restrict data movement outside approved regions addresses this requirement.
Cloud CDN (A) caches content but doesn't address data residency. Encryption keys
(B) are important for security but don't enforce geographic restrictions. A single
multi-region bucket (D) would violate data sovereignty requirements.
Question 3
A university's data pipeline processes financial aid applications. The pipeline must
guarantee that each application is processed exactly once, even in the event of
failures. Which design principle addresses this requirement?
A. At-least-once delivery with idempotent processing
B. Implementing ACID compliance with Cloud Spanner
C. Using Cloud Storage as a staging area before processing
D. Implementing a dead-letter queue for failed messages
Correct Answer: A
Rationale: Exactly-once processing is difficult to achieve in distributed
systems. The practical approach is to use at-least-once delivery combined with
idempotent processing—ensuring that processing the same message multiple
times produces the same result. This pattern effectively provides exactly-once
semantics. ACID compliance (B) is for transactional databases, not stream
,processing. Cloud Storage staging (C) doesn't guarantee exactly-once. Dead-letter
queues (D) handle failures but don't address duplicate processing.
Question 4
A university data engineer is designing a data lake architecture using Cloud
Storage and BigLake. They need to catalog data assets and enable data discovery
across the organization. Which service should they use?
A. Cloud Data Catalog
B. Cloud Dataproc
C. Cloud Data Fusion
D. Cloud Composer
Correct Answer: A
Rationale: Cloud Data Catalog (now integrated with Dataplex) provides a fully
managed, scalable metadata management service that allows you to discover,
manage, and understand data assets. It enables data discovery, tagging, and
search across your data lake. Cloud Dataproc (B) is for Hadoop/Spark clusters.
Cloud Data Fusion (C) is for ETL/ELT pipelines. Cloud Composer (D) is for workflow
orchestration.
Question 5
A university is migrating 50 TB of historical student data from on-premises
Hadoop clusters to Google Cloud. The migration must complete within 2 weeks
with minimal network impact. Which Google Cloud service should they use?
A. Cloud Storage Transfer Service
B. Transfer Appliance
C. BigQuery Data Transfer Service
D. Database Migration Service
Correct Answer: B
, Rationale: Transfer Appliance is a physical appliance that can transfer up to 1
PB of data to Google Cloud. For 50 TB of data that must be migrated within 2
weeks, Transfer Appliance is the most appropriate solution as it avoids network
bandwidth constraints. Cloud Storage Transfer Service (A) is for moving data
between cloud storage locations. BigQuery Data Transfer Service (C) is for loading
data into BigQuery from SaaS applications. Database Migration Service (D) is for
live database migrations.
Question 6
A university needs to maintain separate development, testing, and production
environments for its data platform. Which design pattern should the data
engineer implement?
A. Use separate Google Cloud projects for each environment
B. Use different datasets within a single project
C. Use different tables within a single dataset
D. Use different IAM roles for each environment
Correct Answer: A
Rationale: Using separate Google Cloud projects for development, testing,
and production provides the strongest isolation, enabling independent IAM
controls, billing, and resource management. This is the recommended best
practice for multi-environment setups. Different datasets (B) within a single
project don't provide project-level isolation. Different tables (C) don't provide any
meaningful environment separation. Different IAM roles (D) alone don't provide
resource isolation.
Question 7
A university is designing a data pipeline that ingests real-time student activity
data from multiple sources. The pipeline must handle late-arriving data and
ensure accurate windowed aggregations. Which Apache Beam concept should the
data engineer use?
Education Cloud Computing
Section 1: Designing Data Processing Systems
Questions 1–30
Question 1
A university is migrating its student records database to Google Cloud. The system
must comply with FERPA regulations and ensure that only authorized faculty can
access sensitive student data. Which IAM approach should the data engineer
implement to enforce least-privilege access?
A. Grant all faculty members the roles/bigquery.dataEditor role at the project
level
B. Use IAM conditions to grant time-bound access to student data tables
C. Assign roles/bigquery.dataViewer at the dataset level and use authorized views
to restrict access to specific columns
D. Grant roles/iam.serviceAccountUser to all faculty members
Correct Answer: C
Rationale: Authorized views in BigQuery allow you to restrict access to
specific rows and columns without granting direct table access. This is a best
practice for implementing column-level security and FERPA compliance. IAM
conditions (B) can restrict time-based access but don't provide the granular
column-level control needed. Granting project-level editor roles (A) violates least-
privilege principles. Service account user roles (D) are for enabling services to run
as service accounts, not for data access control.
Question 2
A higher education institution is designing a data processing system that must
handle student enrollment data from multiple campuses across different regions.
,Data sovereignty regulations require that student data from the EU campus
remain stored in the EU region. Which design consideration is MOST critical?
A. Using Cloud CDN to cache data globally
B. Implementing region-specific encryption keys
C. Configuring dataset locations to match the region of data origin and
implementing organization policies to restrict data transfer
D. Using a single multi-region bucket for all data to simplify management
Correct Answer: C
Rationale: Data sovereignty requires that data remain in specific geographic
regions. Configuring dataset locations per region and using organization policies
to restrict data movement outside approved regions addresses this requirement.
Cloud CDN (A) caches content but doesn't address data residency. Encryption keys
(B) are important for security but don't enforce geographic restrictions. A single
multi-region bucket (D) would violate data sovereignty requirements.
Question 3
A university's data pipeline processes financial aid applications. The pipeline must
guarantee that each application is processed exactly once, even in the event of
failures. Which design principle addresses this requirement?
A. At-least-once delivery with idempotent processing
B. Implementing ACID compliance with Cloud Spanner
C. Using Cloud Storage as a staging area before processing
D. Implementing a dead-letter queue for failed messages
Correct Answer: A
Rationale: Exactly-once processing is difficult to achieve in distributed
systems. The practical approach is to use at-least-once delivery combined with
idempotent processing—ensuring that processing the same message multiple
times produces the same result. This pattern effectively provides exactly-once
semantics. ACID compliance (B) is for transactional databases, not stream
,processing. Cloud Storage staging (C) doesn't guarantee exactly-once. Dead-letter
queues (D) handle failures but don't address duplicate processing.
Question 4
A university data engineer is designing a data lake architecture using Cloud
Storage and BigLake. They need to catalog data assets and enable data discovery
across the organization. Which service should they use?
A. Cloud Data Catalog
B. Cloud Dataproc
C. Cloud Data Fusion
D. Cloud Composer
Correct Answer: A
Rationale: Cloud Data Catalog (now integrated with Dataplex) provides a fully
managed, scalable metadata management service that allows you to discover,
manage, and understand data assets. It enables data discovery, tagging, and
search across your data lake. Cloud Dataproc (B) is for Hadoop/Spark clusters.
Cloud Data Fusion (C) is for ETL/ELT pipelines. Cloud Composer (D) is for workflow
orchestration.
Question 5
A university is migrating 50 TB of historical student data from on-premises
Hadoop clusters to Google Cloud. The migration must complete within 2 weeks
with minimal network impact. Which Google Cloud service should they use?
A. Cloud Storage Transfer Service
B. Transfer Appliance
C. BigQuery Data Transfer Service
D. Database Migration Service
Correct Answer: B
, Rationale: Transfer Appliance is a physical appliance that can transfer up to 1
PB of data to Google Cloud. For 50 TB of data that must be migrated within 2
weeks, Transfer Appliance is the most appropriate solution as it avoids network
bandwidth constraints. Cloud Storage Transfer Service (A) is for moving data
between cloud storage locations. BigQuery Data Transfer Service (C) is for loading
data into BigQuery from SaaS applications. Database Migration Service (D) is for
live database migrations.
Question 6
A university needs to maintain separate development, testing, and production
environments for its data platform. Which design pattern should the data
engineer implement?
A. Use separate Google Cloud projects for each environment
B. Use different datasets within a single project
C. Use different tables within a single dataset
D. Use different IAM roles for each environment
Correct Answer: A
Rationale: Using separate Google Cloud projects for development, testing,
and production provides the strongest isolation, enabling independent IAM
controls, billing, and resource management. This is the recommended best
practice for multi-environment setups. Different datasets (B) within a single
project don't provide project-level isolation. Different tables (C) don't provide any
meaningful environment separation. Different IAM roles (D) alone don't provide
resource isolation.
Question 7
A university is designing a data pipeline that ingests real-time student activity
data from multiple sources. The pipeline must handle late-arriving data and
ensure accurate windowed aggregations. Which Apache Beam concept should the
data engineer use?
