Examkin

All practice questions

262 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 1Question →

A cloud engineer needs to onboard a new business unit into an existing Google Cloud organization. The engineer must set up a dedicated environment that inherits organization policies, enable necessary infrastructure services, ensure resource usage is billed appropriately, and grant access to the development team while enforcing the principle of least privilege. In what sequential order should the engineer execute these setup operations?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence places container structure creation first, followed by project instantiation, billing linkage, API enablement, and finally access control assignment.
The correct sequence follows the dependency path of Google Cloud resource administration: establishing the parent folder container under the organization, creating the project within that folder to inherit organizational policies, linking the billing account to satisfy service prerequisites, enabling the required APIs for the project, and finally applying IAM policy bindings for team access.

Step-by-Step Solution

1
Establish the resource hierarchy container
Create the targeted environment folder under the organization node
Folders provide the structural boundaries for organization policy inheritance before projects are provisioned.
2
Instantiate the GCP project
Create the project under the specified folder node
Projects represent the fundamental billing, quota, and API enablement boundaries within the hierarchy.
3
Associate billing account
Link the enterprise billing account to the project
GCP services and APIs cannot consume paid resources until a billing account is linked to the project.
4
Enable cloud service APIs
Enable required APIs for the project
Service APIs must be enabled within the billing-active project context before resource creation can occur.
5
Grant access permissions
Bind predefined IAM roles to user identities at the project level
Assigning predefined roles to user groups ensures administrative control and least privilege access on active resources.

Key Concept

Resource Hierarchy Provisioning Workflow
Question 2Question →

A cloud engineer must create a new project named `finance-analytics-prod` within a corporate folder and link it to an existing Cloud Billing Account (`012345-6789AB-CDEF01`) using the `gcloud` CLI while following Google Cloud least-privilege IAM principles. What is the correct sequence of steps required to successfully provision the project and establish the billing connection?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct procedural sequence is: 1) Acquire Project Creator on the folder and Billing Account User on the billing account; 2) Execute `gcloud projects create` to instantiate the project; 3) Ensure Project Billing Manager role is held on the new project; 4) Execute `gcloud billing projects link` to complete the association.
The workflow follows least-privilege IAM validation and resource lifecycle management. First, the administrator must hold `roles/resourcemanager.projectCreator` on the parent folder to create projects and `roles/billing.user` on the billing account to use it. Second, the project must be created (`gcloud projects create`). Third, the administrator needs `roles/billing.projectManager` on the newly created project to modify its billing configuration. Finally, running `gcloud billing projects link` associates the project with the billing account.

Step-by-Step Solution

1
Ensure initial organization and billing account IAM roles are assigned.
User has rights to create projects in the folder (`roles/resourcemanager.projectCreator`) and use the billing account (`roles/billing.user`).
Without folder-level project creation privileges and billing account usage privileges, subsequent project creation and billing linkage commands will fail.
2
Provision the project resource using the Google Cloud CLI.
The project `finance-analytics-prod` is created under the specified folder.
A project ID must exist as an active resource within the GCP resource hierarchy before billing accounts can be associated with it.
3
Validate project-level billing permissions.
User holds `roles/billing.projectManager` (or `roles/owner`) on `finance-analytics-prod`.
Linking a project to a billing account requires dual permissions: `billing.resourceAssociations.create` on the billing account AND `resourcemanager.projects.createBillingAssignment` on the project.
4
Run the gcloud billing link command.
Project `finance-analytics-prod` is linked to Cloud Billing Account `012345-6789AB-CDEF01`.
Executing `gcloud billing projects link` completes the association once permission checks on both the project and billing account pass.

Key Concept

Least-Privilege Billing Account and Project Linking Workflow
Question 3Question →

A cloud security engineer is tasking a DevOps team with deploying an automated monitoring agent on a new Google Compute Engine VM instance. The deployment must strictly adhere to Google Cloud security best practices of least privilege and secure service account management. Arrange the following administrative gcloud CLI and IAM setup steps in the correct operational sequence required to create, configure, delegate access for, and attach the custom service account.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: First, create the custom service account using `gcloud iam service-accounts create`. Second, assign the predefined role (`roles/monitoring.metricWriter`) to the service account at the project level using `gcloud projects add-iam-policy-binding`. Third, grant the provisioning user the `roles/iam.serviceAccountUser` role directly on the service account via `gcloud iam service-accounts add-iam-policy-binding`. Fourth, create the Compute Engine VM instance specifying `--service-account` with the service account email via `gcloud compute instances create`.
Provisioning a secure Compute Engine workload requires establishing the service account identity first (`gcloud iam service-accounts create`). Next, granting least-privilege predefined permissions to the service account (`gcloud projects add-iam-policy-binding`) establishes what the workload can do. Then, authorizing the deploying user to use the service account (`roles/iam.serviceAccountUser` via `gcloud iam service-accounts add-iam-policy-binding`) allows resource attachment. Finally, initiating VM creation with `--service-account` attaches the identity to the instance.

Step-by-Step Solution

1
Create the Service Account identity
A non-human service account identity `ops-monitor-sa@PROJECT_ID.iam.gserviceaccount.com` is provisioned.
IAM roles cannot be assigned to an identity that does not yet exist in Google Cloud IAM.
2
Assign predefined IAM role to the Service Account
The service account gains authorization to write monitoring metrics to Google Cloud Monitoring.
Granting least-privilege predefined roles directly to the workload service account ensures strict access control before deployment.
3
Grant Service Account User permission to the deploying entity
The DevOps engineer receives authorization to attach the service account to compute resources.
Compute Engine instance creation requires the user executing the command to have `iam.serviceAccounts.actAs` permission, provided by `roles/iam.serviceAccountUser` on the targeted service account.
4
Attach the Service Account during instance creation
The VM instance is created with the dedicated service account attached, avoiding static service account key exports.
Attaching the service account allows applications running on the instance to access Google Cloud APIs securely through the internal metadata server.

Key Concept

Creating and attaching custom service accounts to Compute Engine instances following least-privilege IAM configuration and ServiceAccountUser role delegation.
Estimated Time:2m 0s
Question 4Question →

Arrange the components of the Google Cloud resource hierarchy in sequence, starting from the highest level of administrative control down to the lowest level where individual services exist.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from highest level to lowest level is: Organization Node, Folder, Project, and Individual Resource.
In Google Cloud, the resource hierarchy is structured sequentially from the root Organization node down through Folders, then Projects, and finally to individual Cloud Resources.

Step-by-Step Solution

1
Identify the top root element of Google Cloud organizational management.
Organization Node is first.
The Organization node is the mandatory or structural root of the resource tree.
2
Identify the sub-organizational grouping mechanism beneath the root.
Folder is second.
Folders exist under the Organization node to organize departments, environments, or teams.
3
Identify the base boundary container for quotas, APIs, and billing.
Project is third.
Projects are contained within folders (or directly under an Organization) and group resources.
4
Identify the actual deployed infrastructure or asset.
Individual Resource is fourth.
Cloud resources (VMs, buckets, databases) must always reside inside a project.

Key Concept

Google Cloud Resource Hierarchy Structure
Question 5Question →

You are setting up a new project environment and need to enable the Compute Engine API using the Google Cloud CLI (`gcloud`). Which of the following represents the correct sequence of steps to safely verify context, enable the API, and confirm activation?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins by targeting the proper project context with `gcloud config set project`, checking current enabled services with `gcloud services list --enabled`, enabling the specific service via `gcloud services enable compute.googleapis.com`, and finally verifying activation with a filtered `gcloud services list` command.
Enabling a service API requires selecting the target project first so that modifications affect the intended GCP resource. Inspecting existing enabled services before enabling and filtering the enabled list after enabling establishes standard operational hygiene for managing Service Usage in Google Cloud.

Step-by-Step Solution

1
Set active gcloud project context
CLI configuration points to the desired GCP project ID
Prevents enabling APIs in the wrong project or organization scope
2
Inspect currently enabled APIs
List of active services for the target project is displayed
Establishes baseline status of enabled APIs
3
Enable the target API service
Service Usage API processes the enablement request for `compute.googleapis.com`
Activates the required underlying GCP service capabilities
4
Filter and confirm enabled status
Confirmation that `compute.googleapis.com` appears in the enabled services list
Validates that enablement completed without error

Key Concept

Enabling Cloud Service APIs via gcloud CLI workflow
Question 6Question →

An enterprise organization is onboarding a specialized engineering team and needs to establish a new, isolated project environment under an existing Organization node. The administrator must create a dedicated folder, create a project inside it, link an active enterprise billing account, enable the Compute Engine API, and grant the team necessary permissions using least-privilege predefined roles via the gcloud CLI. What is the correct sequence of administrative steps to configure this environment?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: 1) Create the parent folder under the organization, 2) Create the project inside the folder, 3) Link the project to the billing account, 4) Enable the Compute Engine API on the project, and 5) Apply IAM policy bindings to grant permissions.
The deployment sequence must follow physical and logical resource dependencies in Google Cloud: establish the parent hierarchy container (Folder), instantiate the child project inside it, link monetary resource tracking (Billing Account), activate required service capabilities (APIs), and grant scoped access permissions (IAM Policy Bindings).

Step-by-Step Solution

1
Create the structural Folder container under the Organization
A new folder resource is established under the organization node.
Folders serve as logical grouping mechanisms and IAM/policy inheritance boundaries for projects.
2
Instantiate the Project within the created Folder
The project is created under the specified folder in the resource hierarchy.
Projects are child nodes of folders or organizations and host actual GCP resources.
3
Link the Project to an enterprise Billing Account
Billing is linked to the project ID.
Google Cloud requires an active billing account association before enabling paid APIs or provisioning infrastructure.
4
Activate the required Cloud Service APIs
The Compute Engine API (`compute.googleapis.com`) is enabled for the project.
APIs are disabled by default on new projects and must be enabled before underlying resources can be accessed.
5
Bind predefined IAM roles at the Project level
Developer Google Group receives scoped predefined roles on the project.
Applying least-privilege IAM bindings at the project level secures resource access after service initialization.

Key Concept

Resource Hierarchy Provisioning Lifecycle and Administrative Scoping Sequence
Question 7Question →

Your enterprise organization is preparing a new Google Cloud project `prod-ml-app-402` to host an automated image processing pipeline. You need to enable the Cloud Vision API (`vision.googleapis.com`) using the `gcloud` CLI while following Google Cloud security and operational best practices. In what logical sequence should you perform the configuration, authorization, enablement, and verification steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence starts with setting the target project context in gcloud CLI, verifying that the deploying identity possesses the Service Usage Admin role, executing the API enablement command for vision.googleapis.com, and finally running a list command to verify that the service status is enabled.
The correct operational sequence mandates establishing the target project context in gcloud CLI first to avoid misconfiguration across environments. Next, administrative IAM authorization must be confirmed using the specific predefined role required for API management (Service Usage Admin). Once authorized within the correct context, the gcloud services enable command initiates API activation. Finally, operational state verification using gcloud services list ensures that the API endpoint is fully active before application deployment.

Step-by-Step Solution

1
Set project context
Local CLI environment is bound to prod-ml-app-402
Prevents targeting the wrong project or inheriting unintended environment defaults.
2
Check/Grant IAM permissions
Operating principal holds roles/serviceusage.serviceUsageAdmin
Required least-privilege predefined role to modify API enablement states on the project.
3
Run service enablement
vision.googleapis.com state is updated to enabled
Activates the specific service endpoint in Service Usage API for the designated project.
4
Validate enabled service state
CLI output confirms vision.googleapis.com is active
Ensures complete propagation of enablement before application workloads attempt API requests.

Key Concept

API Enablement Workflow and Privilege Scoping using gcloud CLI
Question 8Question →

A Cloud Engineer needs to enable the Cloud Run API (`run.googleapis.com`) on a newly created Google Cloud project named `app-prod-101` using the `gcloud` command-line interface and verify that it is properly activated. In what order should the engineer execute the following procedural steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is: 1) Authenticate to Google Cloud CLI using gcloud auth login, 2) Set the active project context using gcloud config set project app-prod-101, 3) Enable the Cloud Run service using gcloud services enable run.googleapis.com, and 4) Confirm activation by running gcloud services list --enabled.
The correct procedural order requires authentication first, followed by establishing the project context, enabling the service API, and finally verifying that the API status is enabled.

Step-by-Step Solution

1
Authenticate user or service account session
Establishes credentials needed to invoke API management calls.
Without authenticating with sufficient IAM permissions (e.g., Service Usage Admin), subsequent gcloud commands will fail due to lack of authorization.
2
Configure gcloud CLI project property
Sets `app-prod-101` as the default target project for command execution.
The gcloud CLI needs to know which Google Cloud project resource to target for enabling services.
3
Execute API enablement command
Enables the Cloud Run API (`run.googleapis.com`) for the specified project.
`gcloud services enable` sends an API call to Service Usage to activate the API infrastructure.
4
Verify enabled APIs in the project
Filters enabled services and verifies `run.googleapis.com` is present and active.
Auditing enabled services ensures the operational state matches requirements prior to deploying application workloads.

Key Concept

Managing Google Cloud Service APIs via gcloud CLI
Question 9Question →

An organization is setting up a new Google Cloud environment from scratch. Arrange the following steps in the correct sequential order to establish the resource hierarchy and prepare a project for application workloads according to Google Cloud best practices.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with provisioning the top-level Organization resource, followed by creating environment Folders beneath it, creating the Cloud Project inside the appropriate Folder, linking an active Billing Account to the Project, and finally enabling Cloud Service APIs and configuring IAM roles.
Google Cloud resources strictly follow a top-down dependency hierarchy: Organization -> Folder -> Project. Operational setup requires establishing the project container, attaching an active billing account, and then enabling project APIs and granting access permissions.

Step-by-Step Solution

1
Establish the root node of the resource hierarchy.
Provision the Google Cloud Organization resource via Cloud Identity.
The Organization resource is the top-level root node required for folder creation and centralized governance.
2
Create administrative groupings under the root node.
Create environment Folders under the Organization node.
Folders allow administrative isolation and inheritance of policy constraints for child projects.
3
Instantiate the resource container.
Create a Google Cloud Project within the designated Folder.
Projects are child elements of Folders and serve as the physical containers for GCP resources.
4
Attach billing capabilities to the project container.
Link an active Billing Account to the Cloud Project.
Google Cloud requires an active billing attachment before enabling APIs or creating paid billable resources.
5
Configure services and access controls.
Enable required APIs and grant least-privilege IAM permissions on the Project.
Service APIs must be explicitly enabled within a billing-enabled project container before deploying workload resources.

Key Concept

Google Cloud Resource Hierarchy Provisioning Order
Question 10Question →

Your team needs to enable the Cloud Vision API (`vision.googleapis.com`) in a Google Cloud project named `proj-ai-prod` using the `gcloud` CLI while adhering to Google Cloud security and administrative best practices. Which of the following sequences represents the correct order of steps to configure permissions, set project context, activate the service, and verify its status?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is: 1) Assign the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) to the engineer's identity on project `proj-ai-prod`; 2) Set the active project context in the gcloud CLI by executing `gcloud config set project proj-ai-prod`; 3) Enable the Cloud Vision API by executing `gcloud services enable vision.googleapis.com`; 4) Confirm the API is enabled by executing `gcloud services list --enabled --filter="NAME:vision.googleapis.com"`.
The correct workflow follows standard GCP administration sequence: first authorization, then workspace context initialization, service execution, and status verification. Assigning `roles/serviceusage.serviceUsageAdmin` grants permissions to modify API states. Executing `gcloud config set project proj-ai-prod` explicitly targets the target project. Running `gcloud services enable vision.googleapis.com` enables the service API. Finally, running `gcloud services list --enabled --filter="NAME:vision.googleapis.com"` validates the operational status of the service.

Step-by-Step Solution

1
Grant requisite IAM access role on the project
The identity receives the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on `proj-ai-prod`
Administrative permissions (`serviceusage.services.enable`) are required before invoking API enablement operations.
2
Set active CLI project context
The gcloud environment targets `proj-ai-prod` as the active project
Prevents accidental modification of incorrect project environments during CLI administration.
3
Execute the API enablement command
The `vision.googleapis.com` service API is enabled for `proj-ai-prod`
Activates the specific service API endpoints required for application workloads.
4
Inspect enabled services list
Output displays `vision.googleapis.com` as active
Provides empirical verification that the API enablement succeeded.

Key Concept

Enabling Cloud Service APIs via the gcloud CLI requires establishing appropriate IAM roles, targeting the correct project context, executing enablement, and verifying status.
Question 11Question →

You need to link an unlinked Google Cloud project to an active Cloud Billing account using the Google Cloud Console. Arrange the steps in the correct chronological order to complete this configuration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order to link a project to a billing account in the console is: 1) Open the Google Cloud Console navigation menu and select Billing; 2) Select the target Cloud Billing account name from the billing account selector; 3) Click the My Projects tab to view all projects associated with or available for the billing account; 4) Locate the target project, open its action menu, and select Change billing to link the project.
To link a project to a billing account in the Google Cloud Console, you must first open the Billing navigation menu, select the target Billing Account, navigate to the My Projects tab, and finally choose Change billing for the unlinked project.

Step-by-Step Solution

1
Navigate to Billing in the Google Cloud Console.
Accesses the main Billing management area.
Billing operations are centralized under the Billing section of the console.
2
Choose the target Cloud Billing Account.
Displays management options specific to that billing account.
Project linking must be performed within the context of the billing account that will assume payment responsibility.
3
Open the My Projects tab.
Lists linked and unlinked projects under your administrative scope.
This view enables project-level billing management.
4
Use the project's action menu to select Change billing and confirm.
Links the project to the billing account.
This final action updates the project's billing configuration and enables resource provisioning.

Key Concept

Configuring billing account and project linking in Google Cloud Console
Question 12Question →

An administrator is setting up a new application environment in Google Cloud. Arrange the administrative steps in the correct order to configure the resource hierarchy and project access from top-level container creation to user access assignment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with creating a folder under the Organization resource, followed by creating the project inside that folder, linking the project to an active Billing Account, and finally granting IAM roles to developers on the project.
The Google Cloud resource hierarchy follows a strict top-down structure: Organization > Folder > Project > Resources. Creating a folder first establishes the required container under the Organization. Next, creating the project inside that folder establishes the resource boundary. Linking an active Billing Account ensures resources can be consumed. Finally, assigning project-level IAM roles grants developers the necessary privileges to operate within the newly provisioned environment.

Step-by-Step Solution

1
Establish the folder container under the Organization.
A folder container is created under the Organization node.
Folders provide structural grouping within the Google Cloud resource hierarchy before child projects can be created.
2
Create the project under the parent folder.
A project container is instantiated inside the designated folder.
Projects represent the fundamental container for Google Cloud resources and must reside within the hierarchy.
3
Attach a billing account to the new project.
The project is enabled for paid Google Cloud service consumption.
Projects cannot deploy billing-enabled resources without an attached active billing account.
4
Configure IAM access permissions on the project.
Developers receive authorized roles to work within the project.
IAM roles are assigned to principals on the project container after it and its billing foundation are established.

Key Concept

Google Cloud Resource Hierarchy Setup Sequence
Question 13Question →

A Cloud Engineer needs to request an increase for a Compute Engine CPU resource quota in a specific region using the Google Cloud Console. What is the correct sequence of steps to submit this quota request?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for requesting a GCP resource quota increase is to first navigate to the Quotas page, select the specific quota and region, enter the requested limit with justification, and submit the request.
Requesting a quota increase requires first navigating to the Quotas page in IAM & Admin, finding and selecting the specific quota metric and region, entering the new limit and required business justification, and finally submitting the request.

Step-by-Step Solution

1
Navigate to the Quotas section
Access to current quota limits across GCP services and regions
The IAM & Admin > Quotas section is the central location in the Cloud Console for viewing and editing quotas.
2
Select the target quota metric and location
Identification of the specific Compute Engine CPU quota in the intended region
GCP quotas are scoped by service and region, requiring precise selection before modification.
3
Specify new quota value and justification
Completion of the quota change form
Google Cloud requires a target limit and business justification to evaluate quota increase requests.
4
Submit the form
Request queued for automated processing or support review
Submitting completes the workflow and initiates the evaluation process.

Key Concept

Standard Console procedure for requesting GCP resource quota increases
Question 14Question →

A DevOps engineer needs to establish a new application environment in Google Cloud following standard operational procedures. In which order should the engineer execute the administrative steps to correctly position the project in the resource hierarchy, enable billing, and grant access?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with creating the parent folder under the organization node, creating the project inside that folder, linking an active billing account to the project, enabling the necessary Cloud Service APIs, and finally granting predefined IAM roles to the development team.
Setting up a cloud solution environment follows a strict dependency workflow: the organizational folder must exist first to establish policy boundaries, followed by project creation inside that folder. Billing must then be linked so that required Cloud Service APIs can be enabled. Finally, IAM roles are assigned to grant user access to the enabled services.

Step-by-Step Solution

1
Create the parent organizational folder.
Establishes the resource hierarchy node under which the project will be grouped.
Folders act as logical parent containers for projects in the Google Cloud resource hierarchy.
2
Create the Google Cloud project inside the folder.
Establishes the fundamental container for resources, policies, and billing associations.
Projects cannot host services or receive billing associations until the project resource itself exists.
3
Link the Billing Account to the project.
Enables the project to consume GCP billable resources and services.
Google Cloud requires an active billing link before enabling paid service APIs or provisioning infrastructure.
4
Enable required Cloud Service APIs.
Activates service endpoints (such as Compute Engine or GKE APIs) within the project context.
Service APIs are disabled by default on new projects and must be enabled before resource creation commands succeed.
5
Grant IAM access roles on the project.
Provides team members with appropriate least-privilege permissions.
IAM roles are configured after establishing project infrastructure readiness so principals can safely begin operations.

Key Concept

Sequential administration for initializing Google Cloud projects within the resource hierarchy.
Question 15Question →

An administrator needs to enable the Cloud Vision API (`vision.googleapis.com`) for a Google Cloud project named `media-proc-prod` using the `gcloud` command-line tool. Place the following steps in the correct sequential order from first to last to complete this configuration and verification process under least-privilege principles.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: First, set the active gcloud project context to media-proc-prod. Second, ensure the administrator identity has the Service Usage Admin role granted on the target project. Third, execute gcloud services enable vision.googleapis.com. Finally, run gcloud services list --enabled to confirm the API activation.
The workflow follows standard Google Cloud management practices: first configure project context in the CLI, ensure required permissions are present on the target project, execute the enablement command, and finally verify the resulting state.

Step-by-Step Solution

1
Set the project context in gcloud CLI.
The CLI environment now directs subsequent service usage requests to `media-proc-prod`.
Prevents accidentally enabling APIs in the wrong project or organization node.
2
Verify IAM role assignment for API management.
The user identity holds `roles/serviceusage.serviceUsageAdmin` privileges.
API enablement requires explicit IAM permissions such as `serviceusage.services.enable`.
3
Enable the Cloud Vision API service.
Google Cloud enables `vision.googleapis.com` for project `media-proc-prod`.
Invokes the core operation to register the project with the specific service API.
4
List enabled services using `gcloud services list --enabled`.
Output contains `vision.googleapis.com`.
Confirms operational readiness before dependent application workloads are deployed.

Key Concept

API Enablement and Verification Workflow using gcloud CLI
Estimated Time:1m 30s
Question 16Question →

A Google Cloud administrator needs to migrate an existing project (`corp-analytics-prod`) from a legacy billing account to a newly established billing account (`01A2B3-4C5D6E-7F8901`) using the Google Cloud CLI (`gcloud`). The administrator has already been granted `roles/billing.projectManager` on the project and `roles/billing.user` on the target billing account. Which sequence of operations must the administrator execute to identify the new billing account ID, link the project to the new billing account, and verify the successful linkage?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution order requires first discovering the target Cloud Billing account ID, then describing the project to record its baseline state, followed by running the link command with the target billing account ID, and finally running describe again to verify that the project billing account ID and billing status have updated.
The proper administrative workflow begins by listing accessible billing accounts to obtain the exact target billing account ID. Next, describing the project provides a baseline view of current billing settings. Running `gcloud billing projects link` applies the new billing account binding. Finally, re-describing the project confirms that the `billingAccountId` field reflects the new ID and that `billingEnabled` is set to `true`.

Step-by-Step Solution

1
Run `gcloud billing accounts list`
Returns all Cloud Billing accounts accessible by the current IAM identity, revealing the ID `01A2B3-4C5D6E-7F8901`.
You must obtain the exact billing account ID before attempting CLI binding operations.
2
Run `gcloud billing projects describe corp-analytics-prod`
Displays current project billing metadata including existing `billingAccountId` and `billingEnabled: true`.
Establishing a baseline state allows confirmation of existing billing linkage prior to modification.
3
Run `gcloud billing projects link corp-analytics-prod --billing-account=01A2B3-4C5D6E-7F8901`
Links the target project to the specified billing account.
This is the primary administrative step required to associate the Google Cloud project with the new billing account using least-privilege roles (`roles/billing.projectManager` on the project and `roles/billing.user` on the billing account).
4
Run `gcloud billing projects describe corp-analytics-prod`
Outputs `billingAccountId: 01A2B3-4C5D6E-7F8901` and `billingEnabled: true`.
Verification confirms that the asynchronous or synchronous binding completed successfully and billing status remains active.

Key Concept

Managing Google Cloud project billing account links via `gcloud billing projects` CLI commands requires appropriate IAM roles (`roles/billing.projectManager` or `roles/billing.admin` on project, and `roles/billing.user` on billing account) and proper operational sequence.
Question 17Question →

A Cloud Engineer is tasked with setting up a new production workload environment in Google Cloud. The workload requires creating a new project named `analytics-prod-99` inside an existing folder named `Production` (Folder ID: `987654321`), linking it to the organization's Cloud Billing Account (ID: `01A2B3-4C5D6E-7F8901`), enabling the Compute Engine API, and assigning the predefined Compute Admin role (`roles/compute.admin`) to the Operations group (`[email protected]`). Arrange the `gcloud` CLI commands in the correct logical order required to execute this end-to-end configuration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct procedural order is: 1) Create the project inside the target folder, 2) Link the project to the billing account, 3) Enable the Compute Engine API on the project, and 4) Grant the predefined Compute Admin IAM role to the operations group.
The proper administrative sequence mandates creating the resource hierarchy node first (`gcloud projects create --folder`), establishing billing association (`gcloud billing projects link`), activating required API endpoints (`gcloud services enable`), and finally applying scoped predefined IAM roles (`gcloud projects add-iam-policy-binding`).

Step-by-Step Solution

1
Provision the project under the resource hierarchy
Project `analytics-prod-99` is created directly beneath Folder ID `987654321`.
Google Cloud resources must be instantiated in the hierarchy before target-specific project configurations can be performed.
2
Link the billing account to the newly created project
Billing account `01A2B3-4C5D6E-7F8901` is linked to `analytics-prod-99`.
Google Cloud service APIs (like Compute Engine) require an associated billing account to consume paid cloud resources.
3
Enable required API services for the project
The `compute.googleapis.com` API service is enabled for `analytics-prod-99`.
Services must be explicitly enabled on a billed project before their corresponding APIs and infrastructure resources become manageable.
4
Apply IAM policy bindings for administrative access
The `[email protected]` group receives the `roles/compute.admin` role on `analytics-prod-99`.
Granting predefined roles adhering to least privilege follows service enabling so users can manage the enabled compute resources.

Key Concept

GCP Project Provisioning and Hierarchy Setup Sequence
Question 18Question →

A platform engineer needs to configure a project named `app-backend-dev` so that an automated deployment pipeline can manage the Cloud Translation API and request higher rate limits for translation requests. Place the administrative steps in the correct sequential order from first to last to complete this configuration following Google Cloud security and operational best practices.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of operations is: 1) Grant the Service Usage Admin role to the service account on project app-backend-dev, 2) Execute gcloud services enable translate.googleapis.com --project=app-backend-dev, 3) Execute gcloud services list --enabled --project=app-backend-dev to verify API state, 4) Navigate to Service Usage > Quotas in the Google Cloud Console and submit a quota increase request.
To manage Cloud Service APIs and request higher quotas in Google Cloud, the principal must first be granted the appropriate IAM role (`roles/serviceusage.serviceUsageAdmin`). Next, the API (`translate.googleapis.com`) must be enabled within the target project context using `gcloud services enable`. After verifying that the service status is active with `gcloud services list --enabled`, the administrator can request a quota limit increase under Service Usage > Quotas in the Google Cloud Console.

Step-by-Step Solution

1
Assign IAM roles for API administration
The identity receives `serviceusage.services.enable` and associated API administration privileges on the target project.
Without least-privilege IAM permissions like Service Usage Admin, subsequent API enablement commands will be denied with permission errors.
2
Enable the Cloud Translation API using gcloud CLI
The target project `app-backend-dev` provisions resources to allow requests to `translate.googleapis.com`.
Service APIs are disabled by default in new projects and must be explicitly enabled before consumption or quota requests.
3
Verify API activation status
The output confirms `translate.googleapis.com` is present in the list of enabled services.
Validating enablement prevents automated deployment scripts from failing when calling uninitialized API endpoints.
4
Submit a quota increase request in the GCP Console
Google Cloud Support receives the request to raise the default rate limits for the active API metric.
Quota increases apply to enabled services and require administrative submission through the Service Usage Quotas interface.

Key Concept

API Enablement and Quota Management Workflow
Estimated Time:2m 0s
Question 19Question →

An enterprise organization is restructuring its Google Cloud environment to establish proper governance and centralized resource management. A cloud engineer is tasked with migrating a standalone GCP project into a newly established 'Finance-Prod' folder beneath the Organization node, linking it to the organization's central billing account, and enforcing resource configuration constraints. Arrange the administrative steps in the correct chronological order to complete this deployment while following Google recommended best practices.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with provisioning the destination folder under the Organization root, moving the standalone project into that folder, linking the project to the designated billing account, enforcing the required Organization Policy constraint at the folder level, and finally verifying that the project correctly inherits the effective policy constraints.
The correct operational order follows the logical dependency tree of Google Cloud resource hierarchy creation: first establish the parent container (folder under organization), second move the child resource (project into folder), third establish financial linkage (link billing account), fourth apply policy constraints at the container node (folder organization policy), and fifth audit effective inherited governance at the leaf level (project policy evaluation).

Step-by-Step Solution

1
Provision the destination folder within the resource hierarchy
The 'Finance-Prod' folder is created under the Organization node.
Projects cannot be moved into non-existent hierarchy containers.
2
Relocate the standalone project to the new parent folder
The project is nested beneath the 'Finance-Prod' folder node.
Placing the project into its intended folder ensures it receives appropriate hierarchical governance.
3
Link the project to the centralized Billing Account
Project resource consumption is billed to the central billing account.
Billing accounts must be attached to projects to enable paid GCP services under organization management.
4
Apply Organization Policy constraints at the folder level
The policy constraint is set on the 'Finance-Prod' folder.
Applying policies at the folder level enforces uniform security rules across all current and future projects in that folder via inheritance.
5
Inspect effective policy evaluations at the project level
Confirmation that inherited folder rules apply to the project.
Validation ensures inheritance rules function as designed without conflicting local overrides.

Key Concept

GCP Resource Hierarchy Lifecycle & Policy Inheritance Sequence
Question 20Question →

A site reliability engineer is task-driven to scale up an enterprise AI workspace in Google Cloud by increasing the regional GPU quota for a specific production project. The project currently operates under strict security controls where least privilege and proper quota management workflows must be maintained. What is the correct sequence of administrative steps required to successfully submit this quota increase request using the Google Cloud Console?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with verifying adequate IAM quota permissions, navigating to IAM & Admin > Quotas & System Limits in the GCP Console, filtering for the target regional GPU resource metric, selecting the item to click Edit Quotas, and concluding with specifying the desired limit along with a business justification before submitting the request.
The workflow follows logical administrative security and operational steps in GCP. First, IAM rights must be established to avoid permission failure. Next, navigating to the Quotas page allows the administrator to filter and locate the specific regional GPU metric. Once selected, initiating the edit form and providing a clear operational justification allows Google Cloud to process the request.

Step-by-Step Solution

1
Confirm IAM permissions
Ensures the user has the roles/servicemanagement.quotaAdmin role or serviceusage.quotas.update permission.
Quota modifications require administrative permissions at the project or organization level.
2
Access Quotas page
Opens IAM & Admin > Quotas & System Limits in the GCP Console.
This is the primary location for viewing current usage and requesting higher resource limits.
3
Filter metrics
Isolates the specific regional GPU quota metric.
Quotas are enforced per region/zone and service; precise filtering avoids requesting adjustments on the wrong resource.
4
Initiate edit workflow
Opens the quota edit side panel after clicking Edit Quotas.
Enables form fields for target limit inputs.
5
Submit request
Inputs new limit and justification, then submits to Google Cloud Support.
Requests above default thresholds require rationale for approval by Google quota engineering teams.

Key Concept

Standard administrative workflow for viewing and requesting regional GCP resource quota increases in the Google Cloud Console.
Page 1 / 14Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin