94 free Google Associate Cloud Engineer practice questions from the CertStash pack of 375, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 94 free here, all 375 in the pack, and each step includes the one before it.
Get all 375 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
You need to set up permissions for a set of Compute Engine instances to enable them to write data into a particular Cloud Storage bucket. You want to followGoogle-recommended practices. What should you do?
Show answer and explanation
Correct answer: C. Create a service account and add it to the IAM role 'storage.objectCreator' for that bucket.
Google-recommended practices prioritize using IAM roles over access scopes. Creating a service account and assigning it the storage.objectCreator IAM role on the specific bucket follows the principle of least privilege and is the recommended approach. This role grants write permissions without unnecessary admin capabilities.
Why the other options are wrong
- A. Access scopes are a legacy mechanism; IAM roles are the modern, recommended approach.
- B. cloud-platform is too broad and violates the principle of least privilege.
- D. storage.objectAdmin grants excessive permissions beyond what is needed for writing data.
Question 2
You have sensitive data stored in three Cloud Storage buckets and have enabled data access logging. You want to verify activities for a particular user for these buckets, using the fewest possible steps. You need to verify the addition of metadata labels and which files have been viewed from those buckets. What should you do?
Show answer and explanation
Correct answer: B. Using the GCP Console, filter the Stackdriver log to view the information.
Data access logs in Google Cloud are found in Stackdriver (Cloud Logging). Filtering Stackdriver logs provides visibility into which files were accessed and metadata changes. Activity logs primarily show resource management operations, while Stackdriver logs capture the detailed data access patterns required for this audit.
Why the other options are wrong
- A. Activity logs focus on resource management operations, not detailed data access activities.
- C. The Storage console does not provide user activity tracking or file access verification.
- D. Traces are for application performance monitoring, not for auditing user activities on buckets.
Question 3
You are the project owner of a GCP project and want to delegate control to colleagues to manage buckets and files in Cloud Storage. You want to follow Google-recommended practices. Which IAM roles should you grant your colleagues?
Show answer and explanation
Correct answer: B. Storage Admin
Storage Admin is the appropriate role for colleagues who need to manage both buckets and files in Cloud Storage. This role grants comprehensive permissions over storage resources while maintaining reasonable security boundaries, making it the Google-recommended choice for delegating Cloud Storage management.
Why the other options are wrong
- A. Project Editor grants excessive permissions across all project resources, violating least privilege.
- C. Storage Object Admin only manages objects, not buckets themselves.
- D. Storage Object Creator can only create objects, not manage existing ones or buckets.
Question 4
You have an object in a Cloud Storage bucket that you want to share with an external company. The object contains sensitive data. You want access to the content to be removed after four hours. The external company does not have a Google account to which you can grant specific userbased access privileges. You want to use the most secure method that requires the fewest steps. What should you do?
Show answer and explanation
Correct answer: A. Create a signed URL with a four-hour expiration and share the URL with the company.
Signed URLs are the most secure method for sharing sensitive data with external parties without Google accounts. They provide time-limited access, automatically expire after the specified duration, and require no manual intervention. This achieves the security requirement with the fewest steps.
Why the other options are wrong
- B. Making the object public is insecure and lifecycle management doesn't prevent access before deletion.
- C. Configuring a public website and manually deleting after four hours is insecure and requires manual steps.
- D. Creating and managing a separate bucket with manual deletion is overly complex and less secure.
Question 5
You are creating a Google Kubernetes Engine (GKE) cluster with a cluster autoscaler feature enabled. You need to make sure that each node of the cluster will run a monitoring pod that sends container metrics to a third-party monitoring solution. What should you do?
Show answer and explanation
Correct answer: B. Deploy the monitoring pod in a DaemonSet object.
A DaemonSet ensures that a pod runs on every node in the cluster, including new nodes added by the autoscaler. This is the appropriate Kubernetes object for deploying monitoring agents that must be present on all nodes automatically.
Why the other options are wrong
- A. StatefulSet is for applications requiring stable identity and persistent storage, not monitoring agents.
- C. Deployment does not guarantee a pod on every node; it manages replicas without node-level distribution.
- D. Cluster initializers are not a Kubernetes pattern for ongoing pod deployment across nodes.
Question 6
You want to send and consume Cloud Pub/Sub messages from your App Engine application. The Cloud Pub/Sub API is currently disabled. You will use a service account to authenticate your application to the API. You want to make sure your application can use Cloud Pub/Sub. What should you do?
Show answer and explanation
Correct answer: A. Enable the Cloud Pub/Sub API in the API Library on the GCP Console.
APIs must be explicitly enabled in the GCP Console before they can be used, regardless of service account permissions. Enabling the Cloud Pub/Sub API in the API Library is the required step to make the API accessible to the application.
Why the other options are wrong
- B. APIs do not automatically enable when accessed; they must be explicitly enabled first.
- C. Deployment Manager does not automatically enable APIs during deployment.
- D. Granting roles to service accounts does not enable APIs; the API must be enabled independently.
Question 7
You need to monitor resources that are distributed over different projects in Google Cloud Platform. You want to consolidate reporting under the same StackdriverMonitoring dashboard. What should you do?
Show answer and explanation
Correct answer: C. Configure a single Stackdriver account, and link all projects to the same account.
A single Stackdriver account can monitor resources across multiple GCP projects when they are all linked to that account. This consolidated approach provides unified reporting and dashboarding without requiring complex service account configurations or VPC connections.
Why the other options are wrong
- A. Shared VPC does not enable cross-project Stackdriver monitoring; it only shares network resources.
- B. Creating multiple Stackdriver accounts defeats the purpose of consolidation; one account is required.
- D. Groups in Stackdriver organize monitored resources but do not enable cross-project monitoring without linking projects.
Question 8
You are deploying an application to a Compute Engine VM in a managed instance group. The application must be running at all times, but only a single instance of the VM should run per GCP project. How should you configure the instance group?
Show answer and explanation
Correct answer: A. Set autoscaling to On, set the minimum number of instances to 1, and then set the maximum number of instances to 1.
Setting autoscaling to On with minimum and maximum instances both set to 1 ensures exactly one instance runs at all times while maintaining high availability through the autoscaler's monitoring and recovery capabilities. If an instance fails, the autoscaler will replace it.
Why the other options are wrong
- B. Turning autoscaling Off means the instance won't be automatically replaced if it fails or is deleted.
- C. Setting maximum to 2 allows multiple instances to run, violating the single-instance requirement.
- D. Turning autoscaling Off prevents automatic recovery, and maximum of 2 allows extra instances.
Question 9
You are analyzing Google Cloud Platform service costs from three separate projects. You want to use this information to create service cost estimates by service type, daily and monthly, for the next six months using standard query syntax. What should you do?
Show answer and explanation
Correct answer: D. Export your bill to a BigQuery dataset, and then write time window-based SQL queries for analysis.
BigQuery is the optimal choice for analyzing billing data across multiple projects with time-window-based SQL queries. BigQuery's standard SQL syntax enables flexible querying of cost data by service type and time period, allowing you to generate forecasts for daily and monthly costs over the next six months. The other options lack the query flexibility and analytical power needed for this complex cost analysis task.
Why the other options are wrong
- A. Cloud Bigtable is designed for time-series data but lacks the SQL query capabilities needed for cost forecasting analysis.
- B. Google Sheets can handle data but is not designed for querying large billing datasets with complex time-window SQL logic.
- C. Local file analysis with desktop tools is inefficient for multi-project billing data and lacks scalability.
Question 10
You need to set up a policy so that videos stored in a specific Cloud Storage Regional bucket are moved to Coldline after 90 days, and then deleted after one year from their creation. How should you set up the policy?
Show answer and explanation
Correct answer: B. Use Cloud Storage Object Lifecycle Management using Age conditions with SetStorageClass and Delete actions. Set the SetStorageClass action to 90 days and the Delete action to 365 days.
Cloud Storage Object Lifecycle Management with Age conditions is the correct approach. The SetStorageClass action should be set to 90 days to move videos to Coldline after 90 days. The Delete action should be set to 365 days from the object's creation date (not 275 days), ensuring videos are deleted one year after creation. The Delete condition is based on the original creation date, not relative to the SetStorageClass action.
Why the other options are wrong
- A. Calculating 275 days (365-90) is incorrect because the Delete action uses absolute days from creation, not relative offset from other actions.
- C. gsutil rewrite is a command for copying objects with attribute changes, not for setting lifecycle policies.
- D. While gsutil rewrite uses the correct 365-day value, it is the wrong tool entirely for lifecycle management policies.
What people say about the full Associate Cloud Engineer pack 4.8 from 9
Appreciate the effort that went into this. Passed!
Grateful I found this before sitting ACE. It genuinely helped.
Thank you - clear, accurate, and it got me through ACE.
Question 11
You are building a pipeline to process time-series data. Which Google Cloud Platform services should you put in boxes 1,2,3, and 4?
Show answer and explanation
Correct answer: D. Cloud Pub/Sub, Cloud Dataflow, Cloud Bigtable, BigQuery
For a time-series data processing pipeline, box 1 should be Cloud Pub/Sub to ingest streaming data from devices through the gateway. Box 2 should be Cloud Dataflow to transform and process the time-series data in real-time or batch mode. Box 3 should be Cloud Bigtable, which is specifically optimized for time-series data storage with high throughput and low latency characteristics. Box 4 should be BigQuery for analytics and historical analysis of the processed time-series data. This architecture leverages Pub/Sub for ingestion, Dataflow for processing, Bigtable for high-performance time-series storage, and BigQuery for analytical queries.
Why the other options are wrong
- A. Cloud Datastore is not optimized for time-series data; Bigtable is the correct choice for time-series storage due to its columnar design and performance characteristics.
- B. Firebase Messages is not a GCP service for this use case; Cloud Spanner is a relational database inappropriate for time-series data compared to Bigtable's strengths.
- C. Cloud Storage is for object/file storage and not suitable as an intermediate processing stage for streaming time-series data in a pipeline.
Question 12
An employee was terminated, but their access to Google Cloud was not removed until 2 weeks later. You need to find out if this employee accessed any sensitive customer information after their termination. What should you do?
Show answer and explanation
Correct answer: C. View Data Access audit logs in Cloud Logging. Search for the user's email as the principal.
Data Access audit logs specifically track access to sensitive data and resources. These logs record which users accessed what data and when, making them the correct source to determine if the terminated employee accessed customer information. Searching for the user's email as the principal identifies their specific actions. Data Access logs are enabled separately from Admin Activity logs and are essential for investigating data access incidents.
Why the other options are wrong
- A. System Event Logs do not provide visibility into data access; they track system events like VM creation or deletion.
- B. Service accounts are not the right identifier for a terminated employee user account; the user's email should be searched.
- D. Admin Activity logs track administrative changes, not data access; service account searches would not find a user's access patterns.
Question 13
Your Dataproc cluster runs in a single Virtual Private Cloud (VPC) network in a single subnet with range 172.16.20.128/25. There are no private IP addresses available in the VPC network. You want to add new VMs to communicate with your cluster using the minimum number of steps. What should you do?
Show answer and explanation
Correct answer: A. Modify the existing subnet range to 172.16.20.0/24.
The existing subnet uses 172.16.20.128/25 which provides only 128 IP addresses. Modifying the subnet range to 172.16.20.0/24 expands the available address space to 256 addresses without requiring additional networking complexity. This is the minimum number of steps: a single subnet modification rather than creating new secondary ranges or additional VPCs with peering configurations. All resources remain in the same VPC and subnet, minimizing operational overhead.
Why the other options are wrong
- B. Secondary IP ranges would still consume from the same VPC pool and require additional configuration steps beyond just creating the range.
- C. Creating a separate VPC and peering is more complex than modifying the existing subnet and introduces unnecessary operational complexity.
- D. This approach requires multiple steps including new VPC creation, peering setup, and route configuration, far more work than a simple subnet modification.
Question 14
You are building a new version of an application hosted in an App Engine environment. You want to test the new version with 1% of users before you completely switch your application over to the new version. What should you do?
Show answer and explanation
Correct answer: D. Deploy a new version of your application in App Engine. Then go to App Engine settings in GCP Console and split traffic between the current version and newly deployed versions accordingly.
App Engine natively supports traffic splitting between versions within the same application. You deploy the new version as a separate version in the same App Engine application, then use the GCP Console to configure traffic splitting to send 1% of traffic to the new version and 99% to the current version. This is the built-in feature designed for canary deployments.
Why the other options are wrong
- A. Using Kubernetes Engine adds unnecessary complexity and cost when App Engine has native traffic splitting; you would also need to migrate the entire application architecture.
- B. Using Compute Engine similarly requires migrating the application and adds operational overhead when App Engine's built-in feature is designed for this use case.
- C. Deploying as a separate app in App Engine and trying to split traffic between apps is not how App Engine traffic splitting works; traffic splitting occurs between versions within a single application.
Question 15
You want to select and configure a cost-effective solution for relational data on Google Cloud Platform. You are working with a small set of operational data in one geographic location. You need to support point-in-time recovery. What should you do?
Show answer and explanation
Correct answer: A. Select Cloud SQL (MySQL). Verify that the enable binary logging option is selected.
Cloud SQL with MySQL and binary logging enabled is the cost-effective choice for a small set of operational data in one geographic location that requires point-in-time recovery. Binary logging allows MySQL to perform point-in-time recovery by replaying transaction logs. Cloud SQL is significantly less expensive than Cloud Spanner and more appropriate for single-region, traditional relational workloads. Cloud Spanner is designed for globally distributed, highly scalable applications and would be overkill and costlier for this scenario.
Why the other options are wrong
- B. Failover replicas provide high availability but are not necessary for point-in-time recovery and add cost unnecessarily.
- C. Cloud Spanner is designed for globally distributed, mission-critical applications and is far more expensive than Cloud SQL.
- D. Multi-regional Cloud Spanner setup is even more costly and unnecessary for a single geographic location.
Question 16
You have a single binary application that you want to run on Google Cloud Platform. You decided to automatically scale the application based on underlying infrastructure CPU usage. Your organizational policies require you to use virtual machines directly. You need to ensure that the application scaling is operationally efficient and completed as quickly as possible. What should you do?
Show answer and explanation
Correct answer: B. Create an instance template, and use the template in a managed instance group with autoscaling configured.
Creating an instance template and using it in a managed instance group with CPU-based autoscaling is the operationally efficient solution that meets all requirements. This approach uses virtual machines directly as required, enables automatic scaling based on CPU metrics, and provides rapid scaling responses through managed instance groups. Kubernetes would violate the direct VM requirement. Time-based scaling would not respond to actual infrastructure demand. Third-party tools add unnecessary operational overhead.
Why the other options are wrong
- A. Google Kubernetes Engine uses containers and orchestration, which violates the organizational requirement to use virtual machines directly.
- C. Time-based scaling does not respond to actual CPU usage and is less efficient than metric-based autoscaling.
- D. Third-party tooling adds operational complexity and maintenance burden compared to native GCP autoscaling features.
Question 17
You have a developer laptop with the Cloud SDK installed on Ubuntu. The Cloud SDK was installed from the Google Cloud Ubuntu package repository. You want to test your application locally on your laptop with Cloud Datastore. What should you do?
Show answer and explanation
Correct answer: C. Install the GoogleCloud-sdk-datastore-emulator component using the apt get install command.
When the Cloud SDK is installed from the Ubuntu package repository via apt, additional components like the Datastore emulator must be installed using the apt-get install command (specifically google-cloud-sdk-datastore-emulator). The gcloud components install command is used for Cloud SDK installations from the tarball distribution, not for Ubuntu package repository installations. Exporting data (A) and creating indexes (B) are operations for an existing Datastore service, not for setting up a local emulator. Option D uses the wrong installation method for apt-based Cloud SDK installations.
Why the other options are wrong
- A. Exporting Datastore data is an operation on an existing Datastore instance, not a method to set up a local emulator.
- B. Creating indexes is an operational task for Datastore, not a setup step for the local development emulator.
- D. gcloud components install is the correct command only for Cloud SDK installed from tarball; apt-based installations use apt-get install instead.
Question 18
Your company runs one batch process in an on-premises server that takes around 30 hours to complete. The task runs monthly, can be performed offline, and must be restarted if interrupted. You want to migrate this workload to the cloud while minimizing cost. What should you do?
Show answer and explanation
Correct answer: C. Migrate the workload to a Compute Engine VM. Start and stop the instance as needed.
Preemptible VMs are always stopped after at most 24 hours, so a 30-hour job that must restart when interrupted would never finish. A standard Compute Engine VM that is started only when the monthly job runs and stopped afterwards keeps costs low while allowing the job to complete.
Why the other options are wrong
- A. A Preemptible VM is terminated within 24 hours, so the 30-hour job would be interrupted and restarted endlessly.
- B. Preemptible GKE nodes have the same 24-hour limit and add cluster overhead.
- D. A managed instance group of Preemptible VMs still hits the 24-hour limit, and CPU-based autoscaling does not suit a single batch job.
Question 19
You have a Compute Engine instance hosting a production application. You want to receive an email if the instance consumes more than 90% of its CPU resources for more than 15 minutes. You want to use Google services. What should you do?
Show answer and explanation
Correct answer: B. 1. Create a Cloud Monitoring Workspace and associate your Google Cloud Platform (GCP) project with it. 2. Create a Cloud Monitoring Alerting Policy that uses the threshold as a trigger condition. 3. Configure your email address in the notification channel.
The correct solution uses Cloud Monitoring, Google's native monitoring service, to set up alerting policies based on CPU metrics. Creating a Cloud Monitoring Workspace associated with the GCP project, then defining an alerting policy with CPU utilization exceeding 90% for more than 15 minutes as the trigger condition, and configuring email notification channels is the standard Google Cloud approach for production monitoring and alerting.
Why the other options are wrong
- A. Writing custom scripts to monitor and using Gmail with SMTP on port 25 is unsupported, unreliable, and not a Google Cloud best practice.
- C. Uptime checks monitor availability, not CPU usage, making this approach ineffective for CPU-based alerting.
- D. While Cloud Logging can extract metrics, this approach is overly complex; Cloud Monitoring already provides CPU metrics natively without needing regex extraction from logs.
Question 20
You have a Google Cloud Platform account with access to both production and development projects. You need to create an automated process to list all compute instances in development and production projects on a daily basis. What should you do?
Show answer and explanation
Correct answer: A. Create two configurations using gcloud config. Write a script that sets configurations as active, individually. For each configuration, use gcloud compute instances list to get a list of compute resources.
To automate listing compute instances across multiple projects, create separate gcloud configurations for each project, then write a script that switches between configurations and runs gcloud compute instances list for each. This approach uses the proper gcloud command-line tool with correct syntax and configuration management. gcloud configs allow you to manage authentication and project context for multiple projects in a single script.
Why the other options are wrong
- B. gsutil is for Cloud Storage operations, not for compute instance management; the correct tool is gcloud.
- C. Cloud Shell export to Cloud Storage is manual and not automated; it does not provide the daily scheduling and multi-project iteration needed.
- D. GCP Console export to Cloud SQL is manual, not automated, and does not provide the repeatable scripting capability required for daily execution.
Question 21
Your company has an existing GCP organization with hundreds of projects and a billing account. Your company recently acquired another company that also has hundreds of projects and its own billing account. You would like to consolidate all GCP costs of both GCP organizations onto a single invoice. You would like to consolidate all costs as of tomorrow. What should you do?
Show answer and explanation
Correct answer: A. Link the acquired company's projects to your company's billing account.
The simplest way to consolidate billing from the acquired company's projects onto a single invoice is to link the acquired company's existing projects to the primary company's billing account. Projects can be linked to different billing accounts, and linking multiple projects to a single billing account results in a consolidated invoice. This approach requires no migration of projects between organizations and consolidates billing immediately.
Why the other options are wrong
- B. Exporting billing data to BigQuery allows analysis but does not consolidate billing onto a single invoice.
- C. Migrating projects between organizations is unnecessary complexity when projects can be linked to a different billing account without moving them.
- D. Creating a new organization and migrating all projects adds unnecessary complexity and does not provide benefits over linking to an existing billing account.
Question 22
Your organization is a financial company that needs to store audit log files for 3 years. Your organization has hundreds of Google Cloud projects. You need to implement a cost-effective approach for log file retention. What should you do?
Show answer and explanation
Correct answer: B. Create an export to the sink that saves logs from Cloud Audit to a Coldline Storage bucket.
Coldline Storage is the most cost-effective solution for long-term archival of audit logs that need to be retained for 3 years but are accessed infrequently. Cloud Audit Logs can be exported directly to a Coldline Storage bucket via a logging sink, which is simple to configure across hundreds of projects using organization-level sinks. Coldline Storage has the lowest cost for data that is accessed less than once per quarter, making it ideal for 3-year audit log retention.
Why the other options are wrong
- A. BigQuery is more expensive than Coldline Storage for long-term archival and is better suited for analysis rather than pure retention.
- C. Writing a custom script is unnecessary effort when native export functionality via sinks is available and more maintainable.
- D. Cloud Pub/Sub combined with Dataflow and Cloud SQL adds unnecessary complexity and cost compared to direct Cloud Storage export.
Question 23
You need to create a new billing account and then link it with an existing Google Cloud Platform project. What should you do?
Show answer and explanation
Correct answer: B. Verify that you are Project Billing Manager for the GCP project. Create a new billing account and link the new billing account to the existing project.
To link a new billing account to an existing project, you need the Project Billing Manager role on the project. You create the new billing account and then link it to the existing project. The Billing Administrator role is for managing the billing account itself (payment methods, billing reports), not for linking projects to billing accounts.
Why the other options are wrong
- A. While Project Billing Manager is correct, you cannot link an existing billing account; you must create a new one as required by the question.
- C. Billing Administrator is the wrong role; you need Project Billing Manager on the project. Additionally, creating a new project is unnecessary when you need to link to an existing project.
- D. Both the role (Billing Administrator) and the action (updating instead of creating a new billing account) are incorrect.
Question 24
You are using Google Kubernetes Engine with autoscaling enabled to host a new application. You want to expose this new application to the public, using HTTPS on a public IP address. What should you do?
Show answer and explanation
Correct answer: A. Create a Kubernetes Service of type NodePort for your application, and a Kubernetes Ingress to expose this Service via a Cloud Load Balancer.
To expose a GKE application to the public with HTTPS on a public IP address, you need a Service of type NodePort combined with a Kubernetes Ingress. The Ingress controller automatically provisions a Cloud Load Balancer that handles HTTPS termination and distributes traffic to the NodePort Service across the cluster nodes. This approach is the standard GKE pattern for public HTTPS exposure with autoscaling support.
Why the other options are wrong
- B. ClusterIP services are internal-only and cannot be directly exposed to the public internet.
- C. Using only a NodePort without Ingress is not a managed solution and requires manual DNS configuration with individual node IPs, which breaks when nodes are added/removed by autoscaling.
- D. Manually deploying HAProxy and using iptable rules is complex, not cloud-native, and doesn't leverage GCP's managed load balancing services.
Question 25
Several employees at your company have been creating projects with Cloud Platform and paying for it with their personal credit cards, which the company reimburses. The company wants to centralize all these projects under a single, new billing account. What should you do?
Show answer and explanation
Correct answer: D. In the Google Cloud Platform Console, create a new billing account and set up a payment method.
Creating a new billing account directly in the Google Cloud Platform Console with a payment method is the standard, self-service process for centralizing billing. This approach allows the company to set up a corporate billing account without requiring external support contact or phone calls, and it can then be linked to all existing projects to consolidate billing under a single account.
Why the other options are wrong
- A. Contacting a support email with bank details is not a standard process and poses security risks by sharing sensitive financial information via email.
- B. Creating a support ticket and sharing credit card details over the phone is unnecessary and not the recommended approach for creating a billing account.
- C. Moving projects to the root Organization does not address the need to centralize billing; billing account setup is a separate process.
Question 26
You manage an App Engine Service that aggregates and visualizes data from BigQuery. The application is deployed with the default App Engine Service account. The data that needs to be visualized resides in a different project managed by another team. You do not have access to this project, but you want your application to be able to read data from the BigQuery dataset. What should you do?
Show answer and explanation
Correct answer: B. Ask the other team to grant your default App Engine Service account the role of BigQuery Data Viewer.
The other team must grant the App Engine service account permissions in their project where the BigQuery dataset resides. BigQuery Data Viewer is the appropriate role for read-only access to datasets. The permission must be granted in the project that owns the data, not in your own project. Job User role is for running jobs but does not grant dataset read permissions.
Why the other options are wrong
- A. BigQuery Job User allows submitting jobs but does not grant read access to datasets themselves.
- C. Granting roles in your own project is irrelevant; permissions must be granted by the other team in their project where the data exists.
- D. Creating a service account from the other team in your project is inappropriate; the data owner team must grant permissions to your service account.
Question 27
You want to verify the IAM users and roles assigned within a GCP project named my-project. What should you do?
Show answer and explanation
Correct answer: C. Navigate to the project and then to the IAM section in the GCP Console. Review the members and roles.
The IAM section in the GCP Console displays all members (users, service accounts, groups) assigned to a project along with their associated roles. This is the primary interface for reviewing IAM assignments. The gcloud commands in options A and B list role definitions and service accounts respectively, but do not show the actual role assignments for a specific project.
Why the other options are wrong
- A. gcloud iam roles list shows available role definitions, not the actual role assignments within a specific project.
- B. gcloud iam service-accounts list displays service accounts but not their role assignments to project members.
- D. The Roles section in the Console shows role definitions and metadata, not the member-to-role assignments within the project.
Question 28
You have designed a solution on Google Cloud that uses multiple Google Cloud products. Your company has asked you to estimate the costs of the solution. You need to provide estimates for the monthly total cost. What should you do?
Show answer and explanation
Correct answer: A. For each Google Cloud product in the solution, review the pricing details on the products pricing page. Use the pricing calculator to total the monthly costs for each Google Cloud product.
The standard and most reliable approach for cost estimation before provisioning is to use the Google Cloud Pricing Calculator, which provides accurate pricing for each service based on your specific usage parameters. Reviewing each product's pricing page ensures you understand all cost factors, and the calculator totals the estimates accurately without incurring actual costs.
Why the other options are wrong
- B. While a Google Sheet can organize information, using a spreadsheet instead of the Pricing Calculator is manual and error-prone.
- C. Provisioning for a week to estimate costs is wasteful, incurs unnecessary charges, and doesn't account for seasonal or unexpected traffic patterns.
- D. Provisioning a solution just to measure costs is inefficient and expensive compared to using the Pricing Calculator upfront.
Question 29
You have a virtual machine that is currently configured with 2 vCPUs and 4 GB of memory. It is running out of memory. You want to upgrade the virtual machine to have 8 GB of memory. What should you do?
Show answer and explanation
Correct answer: D. Stop the VM, increase the memory to 8 GB, and start the VM.
To increase memory on a Compute Engine instance, you must stop the VM, modify the memory (or change to a machine type with more memory), and restart it. Memory upgrades require the instance to be stopped since the resource cannot be modified while running. Once stopped, you can increase the memory allocation and restart the instance.
Why the other options are wrong
- A. Live migration moves workloads between machines during maintenance but doesn't upgrade resources on the existing machine.
- B. Metadata keys cannot be used to modify VM memory; this is not a valid approach.
- C. While changing machine types can upgrade resources, option D correctly describes the more direct memory upgrade process without necessarily changing the entire machine type.
Question 30
An application generates daily reports in a Compute Engine virtual machine (VM). The VM is in the project corp-iot-insights. Your team operates only in the project corp-aggregate-reports and needs a copy of the daily exports in the bucket corp-aggregate-reports-storage. You want to configure access so that the daily reports from the VM are available in the bucket corp-aggregate-reports-storage and use as few steps as possible while following Google-recommended practices. What should you do?
Show answer and explanation
Correct answer: B. Grant the VM Service Account the role Storage Object Creator on corp-aggregate-reports-storage.
The VM's service account needs to be granted the Storage Object Creator role on the target bucket in the other project. The other team managing corp-aggregate-reports-storage can grant this permission directly to the service account from corp-iot-insights. This follows Google-recommended practices for cross-project access with minimal configuration steps. Storage Object Creator allows the VM to write objects to the bucket without exposing the bucket publicly or managing complex networking.
Why the other options are wrong
- A. Moving projects under a folder does not grant any IAM permissions or access between projects.
- C. Shared VPC is not necessary for cross-project bucket access; direct IAM role grants are sufficient and simpler.
- D. Making the bucket public is a security anti-pattern and does not follow Google-recommended practices; using folder pseudo-randomization is not a security mechanism.
Question 31
You have a project for your App Engine application that serves a development environment. The required testing has succeeded and you want to create a new project to serve as your production environment. What should you do?
Show answer and explanation
Correct answer: A. Use gcloud to create the new project, and then deploy your application to the new project.
The standard approach is to use gcloud to create a new project and then deploy the application code to that new project. App Engine applications are tied to projects, and the proper way to move to production is to create the new project and deploy the tested application code, not to copy the deployment itself.
Why the other options are wrong
- B. gcloud does not have a copy function for deployed App Engine applications across projects.
- C. Deployment Manager is for infrastructure as code, not for copying App Engine deployments.
- D. Creating a new project is not a parameter of the deploy command; you must create the project separately first.
Question 32
You deployed a new application inside your Google Kubernetes Engine cluster using the YAML file specified below. You check the status of the deployed pods and notice that one of them is still in PENDING status:You want to find out why the pod is stuck in pending status. What should you do?
Show answer and explanation
Correct answer: C. Review details of myapp-deployment-58ddbbb995-lp86m Pod and check for warning messages.
When a pod is stuck in PENDING status, the issue is typically related to pod-level scheduling or resource constraints, not service configuration or application logs. The pod object itself contains events and status information that explain why the scheduler cannot place it on a node. Reviewing the pod details with `kubectl describe pod myapp-deployment-58ddbbb995-lp86m` reveals warning messages about insufficient resources, node selectors, or other scheduling constraints that prevent the pod from being scheduled. Container logs are only accessible when a pod is running, making option D invalid for a PENDING pod.
Why the other options are wrong
- A. Service objects don't affect pod scheduling or pending status; they only define how to access running pods.
- B. Deployment objects define the desired state but don't contain the specific scheduling failure details that appear in individual pod status.
- D. Container logs cannot be viewed for a PENDING pod because the container hasn't started yet; the issue is at the scheduling level, not within the container.
Question 33
You need to create a custom IAM role for use with a GCP service. All permissions in the role must be suitable for production use. You also want to clearly share with your organization the status of the custom role. This will be the first version of the custom role. What should you do?
Show answer and explanation
Correct answer: A. Use permissions in your role that use the 'supported' support level for role permissions. Set the role stage to ALPHA while testing the role permissions.
For production use, all permissions in a custom role must have 'supported' support level, not 'testing'. The role stage should be set to ALPHA during the testing phase to clearly communicate to the organization that this is the first version and still being validated. Once testing is complete and the role is ready for production, the stage can be promoted to GA (General Availability).
Why the other options are wrong
- B. BETA stage indicates the role is closer to production-ready than ALPHA, which is inappropriate for an untested first version.
- C. Testing-level permissions are not suitable for production use as stated in the requirement.
- D. Testing-level permissions are unsuitable for production, and BETA stage misrepresents the maturity of a first version.
Question 34
You are hosting an application on bare-metal servers in your own data center. The application needs access to Cloud Storage. However, security policies prevent the servers hosting the application from having public IP addresses or access to the internet. You want to follow Google-recommended practices to provide the application with access to Cloud Storage. What should you do?
Show answer and explanation
Correct answer: D. 1. Using Cloud VPN or Interconnect, create a tunnel to a VPC in Google Cloud. 2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel. 3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com.
The recommended Google practice for private access to Google APIs is to use Private Google Access via a dedicated IP range (199.36.153.4/30) announced through Cloud Router over a VPN or Interconnect tunnel. This solution allows on-premises servers without public internet access to reach Cloud Storage by routing requests through the VPC. DNS is configured to resolve googleapis.com addresses to restricted.googleapis.com, which directs traffic through the private peering network rather than the public internet.
Why the other options are wrong
- A. Obtaining public IP addresses violates the security policy preventing internet access and is not a recommended practice.
- B. Running a Squid proxy is a manual workaround when Google provides native Private Google Access, which is simpler and more efficient.
- C. Migrating servers to Compute Engine and creating an ILB with storage.googleapis.com as backend is unnecessary and doesn't follow Google recommendations for this scenario.
Question 35
You are operating a Google Kubernetes Engine (GKE) cluster for your company where different teams can run non-production workloads. Your Machine Learning(ML) team needs access to Nvidia Tesla P100 GPUs to train their models. You want to minimize effort and cost. What should you do?
Show answer and explanation
Correct answer: D. Add a new, GPU-enabled, node pool to the GKE cluster. Ask your ML team to add the cloud.google.com/gke -accelerator: nvidia-tesla-p100 nodeSelector to their pod specification.
To minimize cost and effort while providing GPU access to the ML team in GKE, create a new GPU-enabled node pool rather than modifying the entire cluster. This isolates GPU resources to the ML workloads, prevents unnecessary GPU allocation to non-ML teams, and allows independent scaling. The ML team uses a nodeSelector to schedule their pods on GPU nodes, which is the standard Kubernetes pattern for hardware-specific workloads.
Why the other options are wrong
- A. A simple annotation is not sufficient; GPU node pools must be explicitly created and configured at the infrastructure level.
- B. Recreating all nodes with GPUs is wasteful and expensive since only the ML team needs GPU resources.
- C. Creating a separate Kubernetes cluster duplicates infrastructure and management overhead; GKE node pools solve this problem within a single cluster.
Question 36
You are using Deployment Manager to create a Google Kubernetes Engine cluster. Using the same Deployment Manager deployment, you also want to create aDaemonSet in the kube-system namespace of the cluster. You want a solution that uses the fewest possible services. What should you do?
Show answer and explanation
Correct answer: A. Add the cluster's API as a new Type Provider in Deployment Manager, and use the new type to create the DaemonSet.
Adding the GKE cluster's API as a Type Provider in Deployment Manager allows you to define and manage Kubernetes resources like DaemonSets directly within the same Deployment Manager deployment. This uses only Deployment Manager as a single service to orchestrate both the cluster creation and the DaemonSet deployment, minimizing the number of services required.
Why the other options are wrong
- B. Runtime Configurator is used for configuration management, not for creating Kubernetes resources; this does not accomplish the goal.
- C. Creating a Compute Engine instance with a startup script introduces an additional service (Compute Engine) that is not necessary when Type Providers offer native Kubernetes resource management.
- D. Metadata fields on the cluster definition do not support manifest deployment; Kubernetes resources must be created through proper API mechanisms.
Question 37
You need to configure IAM access audit logging in BigQuery for external auditors. You want to follow Google-recommended practices. What should you do?
Show answer and explanation
Correct answer: A. Add the auditors group to the 'logging.viewer' and 'bigQuery.dataViewer' predefined IAM roles.
External auditors should be added as a group (not individual accounts) to the predefined 'logging.viewer' and 'bigQuery.dataViewer' IAM roles. Using groups follows Google-recommended practices for access management by simplifying administration and enabling auditors to view both the audit logs in Cloud Logging and the data in BigQuery without creating custom roles.
Why the other options are wrong
- B. Custom IAM roles are unnecessarily complex when predefined roles provide the required permissions and follow best practices.
- C. Adding individual user accounts instead of groups makes management difficult and does not follow Google-recommended practices.
- D. Using individual accounts with custom roles adds unnecessary complexity compared to using groups with predefined roles.
Question 38
You need to update a deployment in Deployment Manager without any resource downtime in the deployment. Which command should you use?
Show answer and explanation
Correct answer: B. gcloud deployment-manager deployments update --config
The gcloud deployment-manager deployments update command is the correct choice for updating an existing deployment without downtime. This command applies configuration changes while managing resource lifecycle operations to minimize disruption. The create command is for new deployments. Resource-level commands are not the appropriate interface for deployment updates; operations must occur at the deployment level for proper state management.
Why the other options are wrong
- A. The create command is for establishing new deployments, not updating existing ones.
- C. gcloud deployment-manager resources create is not the correct command structure for updating deployments.
- D. gcloud deployment-manager resources update does not exist as a valid command for managing deployments.
Question 39
For analysis purposes, you need to send all the logs from all of your Compute Engine instances to a BigQuery dataset called platform-logs. You have already installed the Cloud Logging agent on all the instances. You want to minimize cost. What should you do?
Show answer and explanation
Correct answer: C. 1. In Cloud Logging, create a filter to view only Compute Engine logs. 2. Click Create Export. 3. Choose BigQuery as Sink Service, and the platform-logs dataset as Sink Destination.
Cloud Logging provides a native export functionality that allows you to create sinks that route logs directly to BigQuery. Option C uses the built-in Cloud Logging export feature with a filter for Compute Engine logs and BigQuery as the sink destination. This is the standard, simplest, and most cost-effective approach as it uses native GCP services without additional intermediary components or custom code.
Why the other options are wrong
- A. Compute Engine instances do not support a logs-destination metadata field; this approach is not valid in GCP.
- B. This adds unnecessary cost and complexity by introducing Cloud Pub/Sub and Cloud Functions when native Cloud Logging export directly to BigQuery is available.
- D. This approach requires a Cloud Function and Cloud Scheduler running daily, incurring additional compute costs when Cloud Logging export provides real-time log delivery at lower cost.
Question 40
Your management has asked an external auditor to review all the resources in a specific project. The security team has enabled the Organization Policy calledDomain Restricted Sharing on the organization node by specifying only your Cloud Identity domain. You want the auditor to only be able to view, but not modify, the resources in that project. What should you do?
Show answer and explanation
Correct answer: C. Create a temporary account for the auditor in Cloud Identity, and give that account the Viewer role on the project.
Since the Organization Policy restricts sharing to the Cloud Identity domain only, the external auditor must have a Cloud Identity account to access the project. Creating a temporary account for the auditor in Cloud Identity and assigning the Viewer role provides read-only access while complying with the Domain Restricted Sharing policy. This approach maintains security by ensuring the auditor operates within the controlled identity ecosystem.
Why the other options are wrong
- A. The auditor's external Google account would violate the Domain Restricted Sharing organization policy that only allows access from the Cloud Identity domain.
- B. While the Security Reviewer role would provide appropriate permissions, using an external Google account violates the organization policy restriction.
- D. The Security Reviewer role grants more permissions than necessary; the Viewer role provides sufficient read-only access for audit purposes.
Question 41
You deployed an App Engine application using gcloud app deploy, but it did not deploy to the intended project. You want to find out why this happened and where the application deployed. What should you do?
Show answer and explanation
Correct answer: D. Go to Cloud Shell and run gcloud config list to review the Google Cloud configuration used for deployment.
The gcloud config list command displays the current Google Cloud configuration being used by the gcloud CLI, including the active project. This command reveals which project was targeted during the deployment, allowing you to diagnose why the application deployed to an unintended project and where it actually went.
Why the other options are wrong
- A. While app.yaml contains application configuration, it doesn't show which project was actually used for deployment.
- B. web-application.xml is a Java web application configuration file, not relevant to App Engine deployments which use app.yaml.
- C. Deployment Manager is for infrastructure-as-code deployments, not App Engine application deployments.
Question 42
You have a Linux VM that must connect to Cloud SQL. You created a service account with the appropriate access rights. You want to make sure that the VM uses this service account instead of the default Compute Engine service account. What should you do?
Show answer and explanation
Correct answer: A. When creating the VM via the web console, specify the service account under the 'Identity and API Access' section.
When creating a Compute Engine VM via the web console, the Identity and API Access section allows you to specify which service account the instance should use. This is the simplest and most direct method to ensure the VM uses the custom service account with Cloud SQL access rights instead of the default Compute Engine service account.
Why the other options are wrong
- B. Project Metadata with JSON keys is not the correct location for specifying per-instance service accounts.
- C. While Custom Metadata exists, it is not the proper mechanism for assigning service accounts to VMs.
- D. Manually saving JSON keys on the VM is insecure and unnecessary when the service account can be assigned at creation time.
Question 43
You want to run a single caching HTTP reverse proxy on GCP for a latency-sensitive website. This specific reverse proxy consumes almost no CPU. You want to have a 30-GB in-memory cache, and need an additional 2 GB of memory for the rest of the processes. You want to minimize cost. How should you run this reverse proxy?
Show answer and explanation
Correct answer: A. Create a Cloud Memorystore for Redis instance with 32-GB capacity.
Cloud Memorystore for Redis is the most cost-effective solution for a dedicated in-memory cache. Since the reverse proxy consumes minimal CPU and requires a 32-GB in-memory cache, a managed Redis instance eliminates the overhead of running a full compute instance. You pay only for the cache capacity without paying for compute resources, network, or storage that would be wasted on a Compute Engine instance.
Why the other options are wrong
- B. A custom Compute Engine instance with 6 vCPUs and 32 GB RAM wastes compute resources since the proxy consumes almost no CPU, making it more expensive than necessary.
- C. Running on Kubernetes Engine with n1-standard-32 nodes is overkill and more expensive, adding unnecessary orchestration overhead for a single proxy.
- D. An n1-standard-1 instance with an SSD disk cannot provide the required 32-GB in-memory cache performance and adds unnecessary disk costs.
Question 44
Your organization has strict requirements to control access to Google Cloud projects. You need to enable your Site Reliability Engineers (SREs) to approve requests from the Google Cloud support team when an SRE opens a support case. You want to follow Google-recommended practices. What should you do?
Show answer and explanation
Correct answer: D. Add your SREs to a group and then add this group to roles/accessapproval.approver role.
The roles/accessapproval.approver role enables users to approve or deny access requests from Google Cloud support when customers open support cases. Google-recommended practices emphasize using group-based role assignments for easier management and auditability rather than assigning roles directly to individuals. Adding SREs to a group first, then assigning the group the approver role, provides better governance and makes it easier to manage membership changes. The roles/iam.roleAdmin role is for managing IAM roles themselves, not for approving support access requests.
Why the other options are wrong
- A. Assigning roles directly to individuals rather than groups does not follow Google-recommended practices for identity management.
- B. While this role is correct functionally, it assigns directly to individuals rather than groups, violating best practices.
- C. roles/iam.roleAdmin is for managing IAM roles and policies, not for approving support team access requests.
Question 45
Your projects incurred more costs than you expected last month. Your research reveals that a development GKE container emitted a huge number of logs, which resulted in higher costs. You want to disable the logs quickly using the minimum number of steps. What should you do?
Show answer and explanation
Correct answer: A. 1. Go to the Logs ingestion window in Stackdriver Logging, and disable the log source for the GKE container resource.
To quickly disable logs from a specific GKE container causing high costs, use the Logs ingestion window in Stackdriver Logging to disable the log source for the GKE container resource. This prevents those logs from being ingested and charged without requiring cluster deletion or recreation.
Why the other options are wrong
- B. GKE Cluster Operations is a different log source and would not target the specific container generating excessive logs.
- C. Deleting and recreating clusters is overly complex and time-consuming; disabling logs at the ingestion level is faster.
- D. Legacy Stackdriver Monitoring controls monitoring metrics, not logging ingestion, and is not the correct mechanism for disabling logs.
Question 46
Your organization has a dedicated person who creates and manages all service accounts for Google Cloud projects. You need to assign this person the minimum role for projects. What should you do?
Show answer and explanation
Correct answer: D. Add the user to roles/iam.serviceAccountAdmin role.
The roles/iam.serviceAccountAdmin role provides the minimum permissions needed to create, manage, and administer service accounts within a project. This role allows the designated person to perform all service account lifecycle operations including creation, deletion, and role assignments, which is exactly what a service account manager needs.
Why the other options are wrong
- A. The roles/iam.roleAdmin role manages custom roles and role definitions, not service accounts.
- B. The roles/iam.securityAdmin role manages security policies and organization policies, exceeding the minimum needed for service account management.
- C. The roles/iam.serviceAccountUser role allows using service accounts, not creating or managing them.
Question 47
Your organization needs to grant users access to query datasets in BigQuery but prevent them from accidentally deleting the datasets. You want a solution that follows Google-recommended practices. What should you do?
Show answer and explanation
Correct answer: D. Create a custom role by removing delete permissions. Add users to the group, and then add the group to the custom role.
Creating a custom role with delete permissions removed and assigning it to a group follows Google-recommended practices by combining least privilege access with group-based identity management. Groups provide easier management of membership changes and better auditability. roles/bigquery.user (A) cannot query datasets at all. roles/bigquery.dataEditor (B) still retains delete permissions on datasets. Option C creates the correct custom role but assigns it to individuals rather than groups, missing the best practice of using groups for role assignment.
Why the other options are wrong
- A. roles/bigquery.user does not grant query permissions; it only allows running queries against datasets you already have access to.
- B. roles/bigquery.dataEditor includes permissions to delete datasets, failing to prevent accidental deletion.
- C. While the custom role is correct, assigning directly to individuals rather than groups violates Google-recommended identity management practices.
Question 48
You have a web application deployed as a managed instance group. You have a new version of the application to gradually deploy. Your web application is currently receiving live web traffic. You want to ensure that the available capacity does not decrease during the deployment. What should you do?
Show answer and explanation
Correct answer: B. Perform a rolling-action start-update with maxSurge set to 1 and maxUnavailable set to 0.
To maintain available capacity during a rolling update, set maxSurge to 1 and maxUnavailable to 0. This means one additional instance is created before old instances are removed, ensuring that capacity never decreases during deployment. maxSurge allows temporary overcapacity, while maxUnavailable set to 0 prevents instances from being removed without replacement.
Why the other options are wrong
- A. Setting maxSurge to 0 means no new instances are created before old ones are removed, reducing available capacity during deployment.
- C. Creating a new managed instance group and switching is more complex and introduces a longer transition period with potential unavailability.
- D. Manually deleting instances and relying on the group to recreate them is unreliable and does not guarantee health checks or proper deployment sequencing.
Question 49
You are building a product on top of Google Kubernetes Engine (GKE). You have a single GKE cluster. For each of your customers, a Pod is running in that cluster, and your customers can run arbitrary code inside their Pod. You want to maximize the isolation between your customers' Pods. What should you do?
Show answer and explanation
Correct answer: C. Create a GKE node pool with a sandbox type configured to gvisor. Add the parameter runtimeClassName: gvisor to the specification of your customers' Pods.
gVisor is a sandbox runtime that provides strong isolation between containers by intercepting system calls and running them in a restricted environment. Creating a GKE node pool with gvisor sandbox type and setting runtimeClassName: gvisor in pod specifications ensures customer pods run with enhanced isolation, preventing one customer's arbitrary code from affecting others. Binary Authorization (A) controls which images can run but doesn't isolate running containers. Container Analysis (B) detects vulnerabilities but doesn't prevent runtime exploitation. The cos_containerd image (D) is a container OS but doesn't provide additional isolation mechanisms.
Why the other options are wrong
- A. Binary Authorization restricts which container images can be deployed but does not isolate running container workloads from each other.
- B. Container Analysis detects security vulnerabilities in images but does not prevent arbitrary code execution or inter-pod isolation.
- D. Using cos_containerd is a node OS choice that does not provide enhanced inter-pod isolation compared to other GKE configurations.
Question 50
You have successfully created a development environment in a project for an application. This application uses Compute Engine and Cloud SQL. Now you need to create a production environment for this application. The security team has forbidden the existence of network routes between these 2 environments and has asked you to follow Google-recommended practices. What should you do?
Show answer and explanation
Correct answer: A. Create a new project, enable the Compute Engine and Cloud SQL APIs in that project, and replicate the setup you have created in the development environment.
Creating a separate project for production ensures complete network isolation from the development environment, meeting the security team's requirement that no network routes exist between the two environments. This follows Google-recommended practices by using projects as the isolation boundary. Each project has its own VPC and resources, preventing any cross-environment network communication.
Why the other options are wrong
- B. Creating a new subnet in the existing VPC does not provide sufficient isolation; network routes can still exist within the same VPC, violating the security requirement.
- C. Using a Shared VPC creates network connectivity between projects, directly violating the requirement to forbid network routes between environments.
- D. Reusing another division's production project violates the principle of separation of duties and creates unnecessary dependencies and risk.
Question 51
You host a static website on Cloud Storage. Recently, you began to include links to PDF files on this site. Currently, when users click on the links to these PDF files, their browsers prompt them to save the file onto their local system. Instead, you want the clicked PDF files to be displayed within the browser window directly, without prompting the user to save the file locally. What should you do?
Show answer and explanation
Correct answer: C. Set Content-Type metadata to application/pdf on the PDF file objects.
Browser behavior for file downloads versus inline display is determined by the Content-Type HTTP header. By setting the Content-Type metadata to application/pdf on PDF objects in Cloud Storage, the browser will receive the correct MIME type and display the PDF inline rather than prompting to save it. This metadata is served as an HTTP header when the file is accessed.
Why the other options are wrong
- A. Cloud CDN optimizes content delivery performance but doesn't affect how browsers handle MIME types.
- B. Sharing files publicly controls access permissions, not how browsers display file types.
- D. Labels are custom metadata tags for organizational purposes and don't affect HTTP headers or browser behavior.
Question 52
You created an instance of SQL Server 2017 on Compute Engine to test features in the new version. You want to connect to this instance using the fewest number of steps. What should you do?
Show answer and explanation
Correct answer: D. Set a Windows username and password in the GCP Console. Verify that a firewall rule for port 3389 exists. Click the RDP button in the GCP Console, and supply the credentials to log in.
Setting a Windows password in the GCP Console, verifying the firewall rule for port 3389 (the standard RDP port), and then clicking the RDP button in the Console with credentials is the streamlined approach. This minimizes steps by using the built-in Console RDP functionality rather than requiring external RDP client installation and manual configuration.
Why the other options are wrong
- A. This requires external RDP client installation and manual connection steps, more labor-intensive than using the Console.
- B. Installing an external RDP client adds unnecessary steps compared to using the Console's built-in RDP feature.
- C. Port 22 is for SSH, not RDP; RDP requires port 3389. Windows instances do not typically use SSH.
Question 53
You create a new Google Kubernetes Engine (GKE) cluster and want to make sure that it always runs a supported and stable version of Kubernetes. What should you do?
Show answer and explanation
Correct answer: B. Enable the Node Auto-Upgrades feature for your GKE cluster.
Node Auto-Upgrades automatically updates nodes to supported, stable Kubernetes versions, ensuring the cluster runs current and secure software. This feature handles version upgrades automatically without requiring manual intervention. Node Auto-Repair fixes failed nodes but does not upgrade versions; selecting a latest version is a one-time choice that becomes outdated; and Container-Optimized OS is about the node operating system, not Kubernetes version management.
Why the other options are wrong
- A. Node Auto-Repair repairs broken nodes but does not upgrade Kubernetes versions.
- C. Manually selecting the latest version does not ensure continuous stability over time as new versions are released.
- D. Container-Optimized OS relates to the node operating system, not to Kubernetes version stability or updates.
Question 54
You have production and test workloads that you want to deploy on Compute Engine. Production VMs need to be in a different subnet than the test VMs. All theVMs must be able to reach each other over Internal IP without creating additional routes. You need to set up VPC and the 2 subnets. Which configuration meets these requirements?
Show answer and explanation
Correct answer: A. Create a single custom VPC with 2 subnets. Create each subnet in a different region and with a different CIDR range.
VMs in different subnets within the same VPC can communicate over Internal IP without additional routes because VPC routing automatically handles communication between subnets. By creating a single custom VPC with two subnets in different regions with different CIDR ranges, production and test workloads are separated while maintaining automatic internal connectivity. Using separate VPCs would require additional peering or routes for internal communication.
Why the other options are wrong
- B. Using the same CIDR range for two subnets in the same VPC causes IP address conflicts and is invalid.
- C. Creating separate VPCs requires VPC peering or other routing configuration to achieve internal communication, violating the 'without creating additional routes' requirement.
- D. Separate VPCs with identical CIDR ranges would conflict and wouldn't communicate internally without peering setup.
Question 55
Your company uses Cloud Storage to store application backup files for disaster recovery purposes. You want to follow Google's recommended practices. Which storage option should you use?
Show answer and explanation
Correct answer: D. Coldline Storage
Coldline Storage is Google's recommended choice for disaster recovery backup files. Coldline Storage is designed for infrequent access (expected to be accessed once per year or less) at a low cost, making it ideal for backup data that should be preserved but accessed rarely. It provides the lowest storage cost while maintaining the ability to retrieve data when disaster recovery is needed, balancing cost-effectiveness with accessibility.
Why the other options are wrong
- A. Multi-Regional Storage is optimized for frequent access across multiple regions and is unnecessarily expensive for backup files.
- B. Regional Storage is more expensive than Coldline for backup data and is intended for frequently accessed data.
- C. Nearline Storage is for data accessed on average once per month, which is more frequent than typical backup access patterns.
Question 56
Your VMs are running in a subnet that has a subnet mask of 255.255.255.240. The current subnet has no more free IP addresses and you require an additional10 IP addresses for new VMs. The existing and new VMs should all be able to reach each other without additional routes. What should you do?
Show answer and explanation
Correct answer: A. Use gcloud to expand the IP range of the current subnet.
GCP allows in-place expansion of subnet IP ranges using gcloud commands. A /28 subnet (255.255.255.240) provides only 14 usable IPs and can be expanded to a wider CIDR range without deleting the subnet. This is the native GCP mechanism for handling IP exhaustion while maintaining all existing resources, routes, and connectivity. The new IPs will be in the same subnet, ensuring existing and new VMs can communicate without additional routing.
Why the other options are wrong
- B. Deleting and recreating the subnet would disrupt existing VMs and is unnecessary since expansion is supported.
- C. Shared VPC is for cross-project sharing, not for expanding IP address space within a single project.
- D. Overwriting a subnet is not a supported operation and would cause service disruption to existing VMs.
Question 57
You are configuring service accounts for an application that spans multiple projects. Virtual machines (VMs) running in the web-applications project need access to BigQuery datasets in crm-databases-proj. You want to follow Google-recommended practices to give access to the service account in the web-applications project. What should you do?
Show answer and explanation
Correct answer: D. Give bigquery.dataViewer role to crm-databases-proj and appropriate roles to web-applications.
The correct approach is to grant the bigquery.dataViewer role to the service account in the crm-databases-proj (granting permissions on the resource side) and give appropriate roles to the web-applications project service account. This follows the principle of least privilege and Google-recommended practices by assigning permissions where the resources are located rather than granting broad project owner roles.
Why the other options are wrong
- A. Giving project owner role from web-applications to crm-databases-proj violates the principle of least privilege.
- B. Giving project owner role to both projects grants excessive permissions and does not follow least privilege.
- C. Giving project owner to crm-databases-proj and only bigquery.dataViewer to web-applications is backwards; permissions should be granted where the resources are, not to the entire project owner.
Question 58
You have deployed an application on a single Compute Engine instance. The application writes logs to disk. Users start reporting errors with the application. You want to diagnose the problem. What should you do?
Show answer and explanation
Correct answer: D. Install and configure the Cloud Logging Agent and view the logs from Cloud Logging.
Applications writing logs to disk require the Cloud Logging Agent to be installed and configured to collect those logs and forward them to Cloud Logging. Once configured, logs can be viewed and analyzed through the Cloud Logging console. This is the standard Google-recommended approach for diagnosing application issues. Native Cloud Logging views only system logs unless the agent is installed; serial console access is for emergency troubleshooting, not routine diagnostics; and Health Checks are for infrastructure monitoring, not application diagnostics.
Why the other options are wrong
- A. Cloud Logging without the agent will not show application logs written directly to disk.
- B. Serial console access is for emergency situations, not the recommended diagnostic approach for application logs.
- C. Health Checks monitor instance availability and health status, not application-level logging or diagnostics.
Question 59
You want to configure 10 Compute Engine instances for availability when maintenance occurs. Your requirements state that these instances should attempt to automatically restart if they crash. Also, the instances should be highly available including during system maintenance. What should you do?
Show answer and explanation
Correct answer: A. Create an instance template for the instances. Set the 'Automatic Restart' to on. Set the 'On-host maintenance' to Migrate VM instance. Add the instance template to an instance group.
To meet both requirements, you need: Automatic Restart enabled so crashed instances automatically restart, and On-host maintenance set to Migrate to ensure instances are migrated to other hardware during Google maintenance rather than terminated, preserving availability. These settings applied via an instance template added to an instance group provide the required high availability and automatic recovery capabilities.
Why the other options are wrong
- B. Disabling Automatic Restart and setting maintenance to Terminate would cause instances to go down during maintenance and not recover from crashes.
- C. Autohealing with health checks addresses crash recovery but doesn't handle on-host maintenance requirements.
- D. The 'do not retry machine creation' setting is unrelated to the high availability and automatic restart requirements specified.
Question 60
Your organization has user identities in Active Directory. Your organization wants to use Active Directory as their source of truth for identities. Your organization wants to have full control over the Google accounts used by employees for all Google services, including your Google Cloud Platform (GCP) organization. What should you do?
Show answer and explanation
Correct answer: A. Use Google Cloud Directory Sync (GCDS) to synchronize users into Cloud Identity.
Google Cloud Directory Sync (GCDS) is the Google-recommended tool for synchronizing user identities from Active Directory into Cloud Identity. It maintains Active Directory as the source of truth while keeping Cloud Identity synchronized, enabling the organization to have full control over Google accounts used by employees across all Google services while maintaining Active Directory as the authoritative identity source.
Why the other options are wrong
- B. While APIs could work, writing a custom synchronization script is not a Google-recommended practice and requires ongoing maintenance and support.
- C. CSV import is a one-time operation that does not maintain ongoing synchronization with Active Directory, violating the requirement for Active Directory to remain the source of truth.
- D. Self-signup does not make Active Directory the source of truth and gives employees control over account creation rather than the organization.
Question 61
You are given a project with a single Virtual Private Cloud (VPC) and a single subnetwork in the us-central1 region. There is a Compute Engine instance hosting an application in this subnetwork. You need to deploy a new instance in the same project in the europe-west1 region. This new instance needs access to the application. You want to follow Google-recommended practices. What should you do?
Show answer and explanation
Correct answer: A. 1. Create a subnetwork in the same VPC, in europe-west1. 2. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint.
Google-recommended practice for multi-region deployments within the same project is to create additional subnetworks in different regions within the same VPC. Instances across regions in the same VPC can communicate directly using private addresses without additional configuration. This is simpler and more efficient than the alternatives.
Why the other options are wrong
- B. Creating a separate VPC and using an internal load balancer adds unnecessary complexity when a single VPC can serve both regions.
- C. Cloud VPN is unnecessary for intra-VPC communication across regions; private addresses work directly within the same VPC.
- D. VPC peering is not required; a single VPC with multiple regional subnetworks is the recommended approach and is simpler.
Question 62
You've deployed a microservice called myapp1 to a Google Kubernetes Engine cluster using the YAML file specified below:You need to refactor this configuration so that the database password is not stored in plain text. You want to follow Google-recommended practices. What should you do?
Show answer and explanation
Correct answer: B. Store the database password inside a Secret object. Modify the YAML file to populate the DB_PASSWORD environment variable from the Secret.
Kubernetes Secrets are the appropriate mechanism for storing sensitive data like database passwords in GKE. Secrets encrypt data at rest and provide secure access patterns through environment variable injection or volume mounts. The YAML file should reference the Secret object using valueFrom.secretKeyRef to populate the DB_PASSWORD environment variable, keeping sensitive credentials separate from the deployment manifest. This follows Google Cloud and Kubernetes security best practices by ensuring passwords are not stored in plain text and are managed through Kubernetes' native secret management system.
Why the other options are wrong
- A. Storing passwords in Docker images is insecure as image layers can be inspected and the password would be visible to anyone with access to the image registry.
- C. ConfigMaps are designed for non-sensitive configuration data and are not encrypted, making them unsuitable for storing passwords or other secrets.
- D. Using persistent volumes for password storage is unnecessarily complex, harder to rotate credentials, and does not follow Kubernetes security best practices for handling sensitive data.
Question 63
You have 32 GB of data in a single file that you need to upload to a Nearline Storage bucket. The WAN connection you are using is rated at 1 Gbps, and you are the only one on the connection. You want to use as much of the rated 1 Gbps as possible to transfer the file rapidly. How should you upload the file?
Show answer and explanation
Correct answer: B. Enable parallel composite uploads using gsutil on the file transfer.
Parallel composite uploads with gsutil divide large files into chunks, upload them concurrently, and compose them server-side. This maximizes bandwidth utilization and significantly speeds up transfers for large files like the 32 GB file in this scenario. The feature is specifically designed to leverage available bandwidth when uploading single large objects.
Why the other options are wrong
- A. The GCP Console does not offer better throughput than gsutil for large file transfers.
- C. Decreasing TCP window size reduces throughput rather than increasing it; this would negatively impact transfer speed.
- D. Changing storage class does not affect upload speed; it only affects storage cost and retrieval latency characteristics.
Question 64
You are the organization and billing administrator for your company. The engineering team has the Project Creator role on the organization. You do not want the engineering team to be able to link projects to the billing account. Only the finance team should be able to link a project to a billing account, but they should not be able to make any other changes to projects. What should you do?
Show answer and explanation
Correct answer: C. Assign the finance team the Billing Account User role on the billing account and the Project Billing Manager role on the organization.
To allow the finance team to link projects to billing accounts while preventing other changes, assign the Billing Account User role on the billing account (which grants permission to link projects) and the Project Billing Manager role on the organization (which allows management of billing for existing projects). This combines both permissions needed for billing linkage while restricting engineering from these capabilities.
Why the other options are wrong
- A. Billing Account User alone does not grant permission to link projects from an organizational level; Project Billing Manager is also required.
- B. The engineering team should not have Billing Account User role; the requirement is to restrict their ability to link projects to billing.
- D. Assigning these roles to the engineering team defeats the purpose of restricting their ability to link projects to billing accounts.
Question 65
Your company has a Google Cloud Platform project that uses BigQuery for data warehousing. Your data science team changes frequently and has few members. You need to allow members of this team to perform queries. You want to follow Google-recommended practices. What should you do?
Show answer and explanation
Correct answer: C. 1. Create a dedicated Google group in Cloud Identity. 2. Add each data scientist's user account to the group. 3. Assign the BigQuery jobUser role to the group.
Google-recommended practice for managing frequently changing team membership is to create a dedicated Google group in Cloud Identity and assign roles to the group rather than individual user accounts. This minimizes administrative overhead when team members change. The BigQuery jobUser role allows team members to run queries, which is the appropriate permission for data scientists performing analysis work.
Why the other options are wrong
- A. Assigning roles directly to individual user accounts creates administrative burden when team membership changes and does not follow best practices.
- B. Assigning roles to individual accounts lacks scalability, and dataViewer is insufficient, jobUser is required to execute queries.
- D. While using a group is correct, dataViewer only permits viewing datasets but does not grant query execution permissions.
Question 66
A team of data scientists infrequently needs to use a Google Kubernetes Engine (GKE) cluster that you manage. They require GPUs for some longrunning, non-restartable jobs. You want to minimize cost. What should you do?
Show answer and explanation
Correct answer: A. Enable node auto-provisioning on the GKE cluster.
Node auto-provisioning on GKE automatically creates and manages node pools with appropriate machine types and GPUs based on workload requirements. This dynamically allocates resources only when needed and removes them when not in use, minimizing costs for infrequent workloads. It handles the variability of data science team usage patterns efficiently.
Why the other options are wrong
- B. VerticalPodAutoscaler adjusts resource requests for existing pods but does not address the cost of underutilized node pools.
- C. Preemptible VMs reduce costs but cannot be used for non-restartable jobs as they may be interrupted at any time.
- D. A static minimum size of 1 keeps nodes running constantly even during periods of no usage, increasing costs unnecessarily.
Question 67
You want to select and configure a solution for storing and archiving data on Google Cloud Platform. You need to support compliance objectives for data from one geographic location. This data is archived after 30 days and needs to be accessed annually. What should you do?
Show answer and explanation
Correct answer: D. Select Regional Storage. Add a bucket lifecycle rule that archives data after 30 days to Coldline Storage.
For compliance-driven, single-region data accessed annually, Regional Storage ensures data residency requirements are met. Coldline Storage is the optimal archive tier for data accessed infrequently (approximately once per 90 days or less), making it cost-effective for annual access patterns. A lifecycle rule archives data to Coldline Storage after 30 days, minimizing storage costs while maintaining compliance with geographic restrictions.
Why the other options are wrong
- A. Multi-Regional Storage replicates data across geographic locations, conflicting with the single-region compliance requirement.
- B. Multi-Regional Storage violates geographic compliance requirements, and Nearline Storage is more expensive than necessary for annual access patterns.
- C. Regional Storage satisfies compliance needs, but Nearline Storage is more costly than Coldline for data accessed only annually.
Question 68
You need a dynamic way of provisioning VMs on Compute Engine. The exact specifications will be in a dedicated configuration file. You want to follow Google's recommended practices. Which method should you use?
Show answer and explanation
Correct answer: A. Deployment Manager
Deployment Manager is Google Cloud's recommended infrastructure-as-code solution for dynamically provisioning VMs based on configuration files. It supports declarative templates that define exact VM specifications and can be version-controlled and reused. Cloud Composer is designed for workflow orchestration, not infrastructure provisioning. Managed and Unmanaged Instance Groups are for scaling existing instances, not for the initial dynamic provisioning based on dedicated configuration specifications.
Why the other options are wrong
- B. Cloud Composer is a workflow orchestration tool based on Apache Airflow, not designed for VM provisioning.
- C. Managed Instance Groups handle scaling of existing instances, not dynamic provisioning from configuration files.
- D. Unmanaged Instance Groups do not provide dynamic provisioning capabilities and require manual VM management.
Question 69
You need to create a custom VPC with a single subnet. The subnet's range must be as large as possible. Which range should you use?
Show answer and explanation
Correct answer: B. 10.0.0.0/8
The /8 CIDR block (10.0.0.0/8) provides the largest usable address range at 16,777,216 addresses. Option A (0.0.0.0/0) cannot be used as it represents the entire internet and is not valid for a subnet. Option C (172.16.0.0/12) provides 1,048,576 addresses and option D (192.168.0.0/16) provides 65,536 addresses. Among the valid private IP ranges defined by RFC 1918, 10.0.0.0/8 is the largest and is suitable for a single subnet.
Why the other options are wrong
- A. The 0.0.0.0/0 range is not a valid subnet range for a VPC.
- C. The 172.16.0.0/12 range provides only 1,048,576 addresses, smaller than 10.0.0.0/8.
- D. The 192.168.0.0/16 range provides only 65,536 addresses, much smaller than 10.0.0.0/8.
Question 70
Your company implemented BigQuery as an enterprise data warehouse. Users from multiple business units run queries on this data warehouse. However, you notice that query costs for BigQuery are very high, and you need to control costs. Which two methods should you use? (Choose two.)
Show answer and explanation
Correct answer: B, E. Apply a user- or project-level custom query quota for BigQuery data warehouse; Change your BigQuery query model from on-demand to flat rate. Apply the appropriate number of slots to each Project.
Query quotas (option B) directly limit query costs by restricting the amount of data processed per user or project, providing granular cost control. The flat-rate pricing model with slots (option E) provides predictable costs by committing to a fixed number of slots regardless of query volume, which is more cost-effective for high-volume workloads than on-demand pricing. Splitting users across projects (A), creating separate data warehouse copies (C), or splitting the warehouse itself (D) increases operational overhead and storage costs without directly controlling query costs.
Why the other options are wrong
- A. Splitting users across projects increases administrative overhead and does not inherently reduce BigQuery query costs.
- C. Creating separate copies of the data warehouse duplicates storage costs and increases maintenance burden.
- D. Splitting the data warehouse into multiple instances increases storage and maintenance costs without controlling query spending.
Question 71
You have a website hosted on App Engine standard environment. You want 1% of your users to see a new test version of the website. You want to minimize complexity. What should you do?
Show answer and explanation
Correct answer: B. Deploy the new version in the same application and use the --splits option to give a weight of 99 to the current version and a weight of 1 to the new version.
App Engine's traffic splitting feature allows you to deploy multiple versions of an application in the same application and allocate traffic between them using weights. Setting weights of 99 for the current version and 1 for the new version directs 1% of traffic to the test version while maintaining all other functionality. This is the simplest and most direct approach.
Why the other options are wrong
- A. The --migrate option immediately routes all traffic to the new version and does not support partial traffic splitting.
- C. Creating a separate App Engine application and using a library to proxy requests adds unnecessary complexity and architectural overhead.
- D. Creating a separate App Engine application and configuring a network load balancer is significantly more complex than using built-in traffic splitting.
Question 72
You need to deploy an application, which is packaged in a container image, in a new project. The application exposes an HTTP endpoint and receives very few requests per day. You want to minimize costs. What should you do?
Show answer and explanation
Correct answer: A. Deploy the container on Cloud Run.
Cloud Run is the most cost-effective option for a containerized application receiving very few requests daily. Cloud Run charges only for actual request execution time and scales to zero when idle, resulting in minimal costs for low-traffic applications. It requires no infrastructure management and provides automatic scaling, making it ideal for this use case.
Why the other options are wrong
- B. Cloud Run on GKE requires maintaining a GKE cluster, which has minimum costs even with no traffic.
- C. App Engine Flexible maintains a minimum number of instances and cannot scale to zero, making it more expensive for low-traffic scenarios.
- D. GKE requires maintaining a cluster and nodes with minimum costs regardless of traffic volume, making it significantly more expensive than Cloud Run.
Question 73
You are using Container Registry to centrally store your company's container images in a separate project. In another project, you want to create a GoogleKubernetes Engine (GKE) cluster. You want to ensure that Kubernetes can download images from Container Registry. What should you do?
Show answer and explanation
Correct answer: A. In the project where the images are stored, grant the Storage Object Viewer IAM role to the service account used by the Kubernetes nodes.
To allow a GKE cluster in one project to pull images from Container Registry in another project, you grant the Storage Object Viewer IAM role to the service account used by the Kubernetes nodes. This service account runs on the node VMs and has access to pull images from the Container Registry bucket in the other project.
Why the other options are wrong
- B. While 'Allow full access to all Cloud APIs' grants broad permissions, it is overly permissive and not the proper least-privilege solution; granting a specific role to a service account is more secure.
- C. Creating a P12 key and using imagePullSecrets adds unnecessary complexity; IAM roles provide seamless authentication without requiring manual secret management.
- D. ACLs on individual images do not grant the necessary cross-project access; Container Registry access is controlled through IAM roles on the storage bucket, not per-image ACLs.
Question 74
You created a Google Cloud Platform project with an App Engine application inside the project. You initially configured the application to be served from the us-central region. Now you want the application to be served from the asia-northeast1 region. What should you do?
Show answer and explanation
Correct answer: D. Create a new GCP project and create an App Engine application inside this new project. Specify asia-northeast1 as the region to serve your application.
App Engine region is set when the application is created and cannot be changed after creation. Once initialized in us-central, the application is bound to that region permanently. To serve from asia-northeast1, you must create a new GCP project with a new App Engine application and specify the desired region during initialization.
Why the other options are wrong
- A. Changing the default region property on a project does not affect an already-created App Engine application.
- B. App Engine region cannot be changed after the application is created; it is set at initialization time.
- C. You cannot create a second App Engine application in the same project; each project can have only one App Engine application.
Question 75
You need to select and configure compute resources for a set of batch processing jobs. These jobs take around 2 hours to complete and are run nightly. You want to minimize service costs. What should you do?
Show answer and explanation
Correct answer: C. Select Compute Engine. Use preemptible VM instances of the appropriate standard machine type.
Preemptible VM instances are the most cost-effective option for batch processing jobs that can tolerate interruptions. They cost significantly less than regular instances and are ideal for nightly batch jobs that can be interrupted and resumed. The two-hour duration is well-suited to preemptible instances, which are particularly economical for non-critical, interruptible workloads that run on a schedule.
Why the other options are wrong
- A. Kubernetes Engine with a single-node cluster adds unnecessary orchestration overhead for simple batch jobs and costs more than preemptible VMs.
- B. A three-node Kubernetes cluster is even more expensive and adds complexity unsuitable for simple batch processing.
- D. Micro bursting is a feature for handling temporary CPU spikes, not for cost optimization in batch processing scenarios.
Question 76
You need to manage multiple Google Cloud projects in the fewest steps possible. You want to configure the Google Cloud SDK command line interface (CLI) so that you can easily manage multiple projects. What should you do?
Show answer and explanation
Correct answer: A. 1. Create a configuration for each project you need to manage. 2. Activate the appropriate configuration when you work with each of your assigned Google Cloud projects.
The most efficient way to manage multiple Google Cloud projects with the fewest steps is to create a separate configuration for each project and then activate the appropriate configuration when needed. The gcloud config configurations feature allows you to switch between projects instantly by activating the relevant configuration, eliminating the need to reinitialize or update settings each time. This approach is faster than using gcloud init repeatedly, which is designed for initial setup rather than switching between existing projects.
Why the other options are wrong
- B. gcloud init is meant for initial setup and is slower than simply activating pre-existing configurations.
- C. Using only a default configuration requires changing settings manually each time you switch projects, which is inefficient.
- D. Using gcloud init to update configuration values for each project change is slow and not the intended workflow for managing multiple projects.
Question 77
You need to host an application on a Compute Engine instance in a project shared with other teams. You want to prevent the other teams from accidentally causing downtime on that application. Which feature should you use?
Show answer and explanation
Correct answer: D. Enable deletion protection on the instance.
Deletion protection prevents accidental or intentional deletion of an instance by requiring explicit removal of the protection flag before the instance can be deleted. This directly prevents other teams from accidentally causing downtime by deleting the application instance. Shielded VMs (A) provide firmware security features but don't prevent deletion. Preemptible VMs (B) are designed to be terminated for cost savings, increasing downtime risk. Sole-tenant nodes (C) provide hardware isolation but don't prevent deletion of individual instances.
Why the other options are wrong
- A. Shielded VM provides firmware security and boot integrity verification but does not prevent instance deletion.
- B. Preemptible VMs are designed to be reclaimed by Google, actually increasing the risk of downtime.
- C. Sole-tenant nodes provide hardware isolation but do not prevent other teams from deleting instances on that node.
Question 78
Your company has a large quantity of unstructured data in different file formats. You want to perform ETL transformations on the data. You need to make the data accessible on Google Cloud so it can be processed by a Dataflow job. What should you do?
Show answer and explanation
Correct answer: B. Upload the data to Cloud Storage using the gsutil command line tool.
Cloud Storage is the appropriate service for staging unstructured data in different file formats before processing by Dataflow. Cloud Storage is designed to handle diverse file types and formats, integrates seamlessly with Dataflow jobs, and provides cost-effective storage for ETL pipelines. This is the standard approach for data ingestion into Google Cloud for processing.
Why the other options are wrong
- A. BigQuery is designed for structured data and SQL querying, not for storing raw unstructured files in multiple formats.
- C. Cloud SQL is a relational database designed for structured data, not suitable for unstructured data files.
- D. Cloud Spanner is a distributed SQL database for structured data, not designed for unstructured file storage.
Question 79
You want to configure an SSH connection to a single Compute Engine instance for users in the dev1 group. This instance is the only resource in this particularGoogle Cloud Platform project that the dev1 users should be able to connect to. What should you do?
Show answer and explanation
Correct answer: A. Set metadata to enable-oslogin=true for the instance. Grant the dev1 group the compute.osLogin role. Direct them to use the Cloud Shell to ssh to that instance.
Enabling OS Login on the instance via metadata (enable-oslogin=true) and granting the dev1 group the compute.osLogin IAM role implements proper identity-based access control. This allows only members of the dev1 group to SSH into that specific instance. OS Login integrates with Cloud IAM for fine-grained access control and is the recommended GCP approach for SSH access management.
Why the other options are wrong
- B. Setting the service account to 'no service account' does not control SSH access; OS Login role assignment to the dev1 group is what restricts access.
- C. Generating individual SSH keys per user and blocking project-wide keys creates unscalable key management overhead and bypasses GCP's centralized IAM controls.
- D. Generating a single SSH key and distributing it to all dev1 users violates the principle of least privilege and does not allow revocation of individual user access without affecting others.
Question 80
You are running an application on multiple virtual machines within a managed instance group and have autoscaling enabled. The autoscaling policy is configured so that additional instances are added to the group if the CPU utilization of instances goes above 80%. VMs are added until the instance group reaches its maximum limit of five VMs or until CPU utilization of instances lowers to 80%. The initial delay for HTTP health checks against the instances is set to 30 seconds. The virtual machine instances take around three minutes to become available for users. You observe that when the instance group autoscales, it adds more instances then necessary to support the levels of end-user traffic. You want to properly maintain instance group sizes when autoscaling. What should you do?
Show answer and explanation
Correct answer: D. Increase the initial delay of the HTTP health check to 200 seconds.
The issue is that instances take three minutes to become ready, but the initial delay for health checks is only 30 seconds. This means unhealthy instances are being counted as healthy and added to the pool, causing overprovisioning. By increasing the initial delay to 200 seconds (well beyond the three-minute startup time), the autoscaler will wait for instances to fully initialize and pass health checks before considering them ready, preventing unnecessary instance additions based on false capacity readings.
Why the other options are wrong
- A. Setting maximum instances to 1 defeats the purpose of autoscaling and doesn't address the root cause of overprovisioning.
- B. Decreasing the maximum to 3 is arbitrary and doesn't solve the problem of instances being added before they're actually healthy.
- C. TCP health checks would still start prematurely since the issue is the timing of health check readiness, not the type of check.
Question 81
You want to deploy an application on Cloud Run that processes messages from a Cloud Pub/Sub topic. You want to follow Google-recommended practices. What should you do?
Show answer and explanation
Correct answer: C. 1. Create a service account. 2. Give the Cloud Run Invoker role to that service account for your Cloud Run application. 3. Create a Cloud Pub/Sub subscription that uses that service account and uses your Cloud Run application as the push endpoint.
The Google-recommended practice for integrating Cloud Run with Cloud Pub/Sub is to use Pub/Sub push subscriptions. This approach involves creating a service account, granting it the Cloud Run Invoker role, and configuring a Pub/Sub subscription to push messages directly to the Cloud Run application's endpoint. This is a push-based model that automatically invokes the Cloud Run service when messages arrive, requiring no additional infrastructure.
Why the other options are wrong
- A. Using a Cloud Function as an intermediary adds unnecessary complexity when direct push integration is available.
- B. Pull-based subscriptions require the Cloud Run application to actively poll for messages, which is less efficient and adds latency compared to push.
- D. Deploying on Cloud Run on GKE with a separate container to pull and forward messages is overly complex and not recommended for this use case.
Question 82
Your company publishes large files on an Apache web server that runs on a Compute Engine instance. The Apache web server is not the only application running in the project. You want to receive an email when the egress network costs for the server exceed 100 dollars for the current month as measured by Google Cloud.What should you do?
Show answer and explanation
Correct answer: C. Export the billing data to BigQuery. Create a Cloud Function that uses BigQuery to sum the egress network costs of the exported billing data for the Apache web server for the current month and sends an email if it is over 100 dollars. Schedule the Cloud Function using Cloud Scheduler to run hourly.
To monitor egress costs specifically for one Apache web server rather than the entire project, the correct approach is to export billing data to BigQuery and use a Cloud Function to analyze the data for that specific instance. This allows granular cost tracking by resource rather than project-wide budgets. Scheduling the function hourly ensures timely email notifications when the threshold is exceeded.
Why the other options are wrong
- A. Project-level budget alerts track all costs in the project, not just the Apache server's egress costs.
- B. Billing account-level budgets apply to multiple projects and don't isolate costs for a single server.
- D. Parsing HTTP response logs to estimate egress is unreliable and indirect; actual billing data from BigQuery provides accurate cost information.
Question 83
You need to provide a cost estimate for a Kubernetes cluster using the GCP pricing calculator for Kubernetes. Your workload requires high IOPs, and you will also be using disk snapshots. You start by entering the number of nodes, average hours, and average days. What should you do next?
Show answer and explanation
Correct answer: A. Fill in local SSD. Fill in persistent disk storage and snapshot storage.
After entering the basic cluster parameters (nodes, average hours, and average days), the next step is to configure storage components specific to the workload requirements. Since the workload requires high IOPs and uses disk snapshots, you must fill in local SSD for the high-performance I/O requirements, and then add persistent disk storage along with snapshot storage to account for the snapshot usage. This directly addresses the stated workload needs before considering optional add-ons like GPUs or cluster management costs.
Why the other options are wrong
- B. While local SSD is correct, cluster management costs are already included in the base Kubernetes Engine pricing and are not the next step after entering basic node parameters.
- C. GPUs are not required for this workload; the requirement is for high IOPs and snapshots, which are addressed through local SSD and persistent disk storage, not GPU acceleration.
- D. GPUs are unnecessary for a high-IOPs workload, and cluster management costs should not be the focus when the primary workload requirement is storage performance and snapshot functionality.
Question 84
Your organization uses G Suite for communication and collaboration. All users in your organization have a G Suite account. You want to grant some G Suite users access to your Cloud Platform project. What should you do?
Show answer and explanation
Correct answer: B. Grant them the required IAM roles using their G Suite email address.
G Suite email addresses are valid Google identities that can be directly granted IAM roles in GCP. Since all users already have G Suite accounts, you can simply grant them the required IAM roles using their existing G Suite email addresses. This is the simplest and most direct approach without requiring additional account creation or configuration steps.
Why the other options are wrong
- A. Cloud Identity is useful for organizations without G Suite, but is unnecessary when G Suite accounts already exist and can be used directly.
- C. Converting G Suite accounts to separate GCP accounts via CSV is redundant and creates duplicate identities when the G Suite email can be used directly.
- D. There is no special [email protected] group with default behavior; IAM roles must be explicitly granted to users or groups.
Question 85
You want to configure autohealing for network load balancing for a group of Compute Engine instances that run in multiple zones, using the fewest possible steps. You need to configure re-creation of VMs if they are unresponsive after 3 attempts of 10 seconds each. What should you do?
Show answer and explanation
Correct answer: C. Create a managed instance group. Set the Autohealing health check to healthy (HTTP)
Creating a managed instance group and setting the Autohealing health check accomplishes the requirement with the fewest steps. Managed instance groups have built-in autohealing capabilities that automatically recreate unhealthy instances based on health check failures. The health check can be configured to attempt 3 checks of 10 seconds each (the default health check interval is 10 seconds). This is simpler than configuring load balancers when autohealing is the primary goal.
Why the other options are wrong
- A. Load balancers do not automatically recreate unresponsive VMs; they only route traffic away from unhealthy instances.
- B. Setting balancing mode and maximum RPS on a load balancer does not provide autohealing or VM recreation.
- D. Autoscaling settings control the number of instances based on load, not autohealing or VM recreation on failure.
Question 86
You need to verify that a Google Cloud Platform service account was created at a particular time. What should you do?
Show answer and explanation
Correct answer: A. Filter the Activity log to view the Configuration category. Filter the Resource type to Service Account.
Service account creation is a configuration change to GCP resources, which is tracked in the Configuration category of the Activity log. The Resource type must be filtered to Service Account to specifically identify when that service account was created. Configuration category logs all structural changes to GCP resources, making it the appropriate choice for tracking resource creation events.
Why the other options are wrong
- B. Filtering by Google Project resource type would show project-level changes, not the specific service account creation event.
- C. Data Access category logs user data access patterns, not resource creation events.
- D. Data Access category combined with Google Project filtering would not capture service account creation metadata.
Question 87
You need to create an autoscaling managed instance group for an HTTPS web application. You want to make sure that unhealthy VMs are recreated. What should you do?
Show answer and explanation
Correct answer: A. Create a health check on port 443 and use that when creating the Managed Instance Group.
To ensure unhealthy VMs are recreated in a managed instance group, you must create a health check and associate it with the group. The health check monitors instance health by making requests to a specified port; for an HTTPS application, port 443 is the appropriate choice. This allows the autoscaler to detect and replace failed instances automatically.
Why the other options are wrong
- B. Multi-zone deployment affects availability and distribution but does not configure health checking for instance recreation.
- C. Labels in the instance template are metadata only and do not trigger health checks or instance recreation.
- D. Heartbeat scripts to the metadata server do not integrate with the managed instance group's health checking and recreation mechanisms.
Question 88
You are building an application that will run in your data center. The application will use Google Cloud Platform (GCP) services like AutoML. You created a service account that has appropriate access to AutoML. You need to enable authentication to the APIs from your on-premises environment. What should you do?
Show answer and explanation
Correct answer: B. Use gcloud to create a key file for the service account that has appropriate permissions.
To authenticate to GCP services from an on-premises environment, you must create a service account key file using gcloud. This key file (typically in JSON format) contains the credentials needed for applications running outside of GCP to authenticate with Google Cloud APIs. The application then uses this key file for authentication.
Why the other options are wrong
- A. While service account credentials are correct conceptually, the question asks what you should do, which is to generate a key file using gcloud to make those credentials available to the on-premises application.
- C. Direct Interconnect is a networking solution for connectivity but does not provide authentication; it is unnecessary and costly for API authentication.
- D. User accounts are designed for human authentication via OAuth and are not suitable for application-to-application authentication; service account key files are the correct mechanism.
Question 89
You have one GCP account running in your default region and zone and another account running in a non-default region and zone. You want to start a newCompute Engine instance in these two Google Cloud Platform accounts using the command line interface. What should you do?
Show answer and explanation
Correct answer: A. Create two configurations using gcloud config configurations create [NAME]. Run gcloud config configurations activate [NAME] to switch between accounts when running the commands to start the Compute Engine instances.
The correct workflow is to create two configurations using `gcloud config configurations create [NAME]`, then use `gcloud config configurations activate [NAME]` to switch between accounts when running the instance startup commands. This ensures each configuration maintains its own project and region/zone settings, allowing you to deploy to both accounts with their respective non-default regions and zones.
Why the other options are wrong
- B. `gcloud configurations list` is a query command that does not activate configurations or start instances.
- C. The activate command syntax is incorrect; the proper command is `gcloud config configurations activate`, not `gcloud configurations activate`.
- D. Both the syntax and the use of `gcloud configurations list` are incorrect for this task.
Question 90
Your development team needs a new Jenkins server for their project. You need to deploy the server using the fewest steps possible. What should you do?
Show answer and explanation
Correct answer: D. Use GCP Marketplace to launch the Jenkins solution.
GCP Marketplace provides pre-configured Jenkins solutions that can be deployed with minimal steps, reducing setup time and operational burden. This is the fastest path to a functioning Jenkins server. Deploying the WAR to App Engine Standard is non-standard and may have compatibility issues. Manual Compute Engine installation requires multiple setup steps. Kubernetes deployment, while viable, involves unnecessary orchestration complexity for a single Jenkins instance.
Why the other options are wrong
- A. Deploying a Java WAR to App Engine Standard is not the standard deployment method for Jenkins.
- B. Manual installation on Compute Engine requires multiple CLI steps including OS setup, Java installation, and Jenkins configuration.
- C. Creating a Kubernetes cluster for a single Jenkins instance adds unnecessary complexity and deployment steps compared to Marketplace.
Question 91
You want to configure a solution for archiving data in a Cloud Storage bucket. The solution must be cost-effective. Data with multiple versions should be archived after 30 days. Previous versions are accessed once a month for reporting. This archive data is also occasionally updated at month-end. What should you do?
Show answer and explanation
Correct answer: B. Add a bucket lifecycle rule that archives data with newer versions after 30 days to Nearline Storage.
Data with multiple versions accessed once monthly for reporting benefits from Nearline Storage, which offers lower cost than standard storage while supporting frequent access patterns (typically for data accessed less than once per month but at least occasionally). Nearline Storage is also suitable for month-end updates. A lifecycle rule targeting data with newer versions (noncurrent versions) after 30 days transitions previous versions to Nearline Storage, balancing cost-effectiveness with access requirements.
Why the other options are wrong
- A. Coldline Storage is designed for infrequent access (approximately once per 90 days), making it unsuitable for monthly reporting access.
- C. Regional Storage selection is correct, but Coldline Storage's infrequent access profile does not match the monthly reporting requirement.
- D. While Regional Storage is appropriate, Coldline Storage's 90-day access pattern does not align with monthly access requirements.
Question 92
You are deploying an application to App Engine. You want the number of instances to scale based on request rate. You need at least 3 unoccupied instances at all times. Which scaling type should you use?
Show answer and explanation
Correct answer: D. Automatic Scaling with min_idle_instances set to 3.
Automatic Scaling with min_idle_instances set to 3 is the correct choice because it maintains at least 3 unoccupied instances ready to handle requests while scaling dynamically based on request rate. Manual Scaling requires a fixed number of instances with no dynamic adjustment. Basic Scaling does not support the min_idle_instances parameter needed to maintain idle capacity. The min_idle_instances setting ensures operational efficiency by keeping spare capacity available without over-provisioning.
Why the other options are wrong
- A. Manual Scaling with 3 instances provides no dynamic scaling based on request rate.
- B. Basic Scaling with min_instances does not guarantee unoccupied idle instances; it only ensures minimum running instances.
- C. Basic Scaling with max_instances set to 3 does not address the requirement for idle instances and prevents proper scaling.
Question 93
You need to create a copy of a custom Compute Engine virtual machine (VM) to facilitate an expected increase in application traffic due to a business acquisition. What should you do?
Show answer and explanation
Correct answer: D. Create a custom Compute Engine image from a snapshot. Create your instances from that image.
The correct workflow is to create a custom image from a snapshot, then create new VM instances from that image. Custom images are the proper mechanism for capturing and deploying multiple instances with identical configurations. Images are immutable templates designed for scaling, while snapshots are point-in-time backups. Creating instances directly from snapshots is not the standard practice.
Why the other options are wrong
- A. Snapshots should not be used to create images; images must be explicitly created from snapshots.
- B. While you can create instances from snapshots, this is not the recommended practice; custom images should be used.
- C. This correctly creates an image from a snapshot but then incorrectly attempts to create images from that image rather than instances.
Question 94
You are managing several Google Cloud Platform (GCP) projects and need access to all logs for the past 60 days. You want to be able to explore and quickly analyze the log contents. You want to follow Google-recommended practices to obtain the combined logs for all projects. What should you do?
Show answer and explanation
Correct answer: B. Create a Stackdriver Logging Export with a Sink destination to a BigQuery dataset. Configure the table expiration to 60 days.
Creating a Stackdriver Logging Export with a sink to BigQuery is the Google-recommended practice for exploring and analyzing combined logs from multiple projects. BigQuery provides powerful SQL querying capabilities for log analysis and exploration. Configuring table expiration to 60 days automatically manages retention and cost. This approach is superior to Cloud Storage for analysis purposes since BigQuery enables direct querying, whereas Cloud Storage would require additional processing steps.
Why the other options are wrong
- A. Navigating to Stackdriver Logging with a wildcard query does not work across multiple projects and does not provide the scalability or query power needed for 60 days of combined logs.
- C. Cloud Storage is suitable for long-term archival but not for quick exploration and analysis; it would require additional tools to query the data.
- D. Cloud Scheduler is unnecessary; the native logging export functionality handles this more efficiently without requiring a scheduler job.
That was 94 of 375.
The full Google Associate Cloud Engineer pack has all 375 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 138 free as one PDF by email. Get the Half Pack →