Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 201Question →

A digital health enterprise is designing a compute architecture to process incoming HTTP webhooks containing patient telemetry. The application is packaged as a custom container image requiring specific system-level C++ binaries. Traffic is highly unpredictable, spiking during daytime hours and dropping to zero overnight. The organization requires a solution with zero infrastructure management overhead that automatically scales to zero instances when idle to minimize costs. Which Google Cloud compute solution best satisfies these requirements?

Show answer & explanation

Answer: Deploy the application using Cloud Run.

Answer

Deploying the application using Cloud Run is the optimal solution because it supports custom container images with specialized system dependencies, requires zero server administration, and scales down to zero when no webhooks are received.
Cloud Run is a fully managed serverless compute platform that automatically scales HTTP webhooks from zero to handle unpredictable traffic spikes without requiring node management or cluster maintenance. Because it runs standard container images, it accommodates custom OS-level binaries and C++ libraries while ensuring costs are only incurred during active request processing.

Step-by-Step Solution

1
Analyze workload packaging and dependency requirements.
The application requires custom Linux system libraries packaged inside a container image.
Standard serverless function platforms without full container runtime support cannot accommodate custom system C++ libraries easily.
2
Evaluate scaling behavior and infrastructure management constraints.
The workload must scale to zero instances overnight and demand zero operational management.
Virtual machine pools and GKE Standard clusters require infrastructure management and maintain minimum node resources that incur costs even when idle.
3
Select the matching serverless container execution platform.
Cloud Run meets all criteria: full container customizability, fully managed infrastructure, and scale-to-zero HTTP scaling.
Cloud Run allows container execution while eliminating cluster node maintenance and billing when no traffic is present.

Key Concept

Selecting serverless compute platforms based on workload packaging, scaling behavior, and operational overhead.
Question 202Question →

A cloud administrator is organizing resources for a team in Google Cloud. Which TWO statements correctly describe the fundamental rules of the Google Cloud resource hierarchy and IAM policy inheritance? (Select TWO)

Select all that apply

Show answer & explanation

Answer: IAM policies applied at a parent node in the resource hierarchy are automatically inherited by all child resources underneath it.; Projects can be contained inside Folders or directly under the Organization node within the resource hierarchy.

Answer

Permissions granted at a parent node are inherited by all child resources, and Projects can be placed inside Folders or directly under the Organization node.
The resource hierarchy in Google Cloud flows from Organization > Folder > Project > Resource. IAM policy inheritance is strictly additive, meaning child resources automatically inherit all permissions granted on parent folders or the organization. Additionally, projects can be child nodes of either a folder or the organization node directly.

Step-by-Step Solution

1
Analyze how IAM policy inheritance works in the Google Cloud resource hierarchy.
IAM permissions flow downward from Organization to Folders to Projects and resources in an additive manner.
Understanding additive inheritance confirms that parent node permissions cannot be revoked at lower levels.
2
Evaluate valid structural parent-child relationships in the Google Cloud resource hierarchy.
Projects can exist directly under the Organization root or grouped inside Folders.
Folders provide grouping mechanisms, but projects can also sit directly under the organization.

Key Concept

Google Cloud Resource Hierarchy Structure and Additive IAM Inheritance
Question 203Question →

A company's cloud operations team is configuring access control within their Google Cloud resource hierarchy. The hierarchy contains an Organization node with top-level folders for different business units, including a folder named Retail Operations. The team needs to allow a lead developer to create new projects inside the Retail Operations folder only, while preventing them from creating projects in other folders or managing folder policies. Which IAM role configuration meets these requirements while adhering to the principle of least privilege?

Show answer & explanation

Answer: Grant the Project Creator role (roles/resourcemanager.projectCreator) to the lead developer on the Retail Operations folder node.

Answer

Grant the Project Creator role (roles/resourcemanager.projectCreator) to the lead developer on the Retail Operations folder node.
Assigning the Project Creator predefined role (roles/resourcemanager.projectCreator) specifically on the Retail Operations folder node grants the required permission to provision projects under that folder. Because IAM policies inherit downwards in the Google Cloud resource hierarchy, binding the role at the folder level ensures the developer cannot create projects in sibling or parent nodes, adhering strictly to the principle of least privilege.

Step-by-Step Solution

1
Identify the specific task required.
The user needs to create new Google Cloud projects.
Selecting the predefined role specifically designed for project creation requires the Project Creator role (roles/resourcemanager.projectCreator).
2
Determine the correct resource hierarchy level for scoping access.
Scope the IAM binding to the Retail Operations folder node.
In GCP resource hierarchy (Organization > Folder > Project > Resource), IAM policies inherit downward. Scoping the binding to the target folder limits project creation rights strictly to that folder.
3
Evaluate against the principle of least privilege.
The configuration grants only project creation within the designated folder.
Avoid broad primitive roles (Owner) or higher-level administrative roles (Folder Admin, Organization Admin) to prevent over-privileging.

Key Concept

Resource Hierarchy IAM Policy Scoping and Inheritance
Estimated Time:1m 30s
Question 204Question →

An organization wants to automatically stop running Compute Engine instances in a specific Google Cloud project whenever project spending exceeds 100% of its designated monthly budget limit. You need to design an automated cost-control workflow while accounting for GCP billing budget capabilities and limitations. Which implementation strategy should you choose?

Show answer & explanation

Answer: Configure the Cloud Billing budget to publish alert notifications to a Cloud Pub/Sub topic, subscribe a Cloud Function that executes Compute Engine stop API calls upon receiving budget messages, and account for eventual consistency since billing data processing includes an inherent reporting latency.

Answer

Publish Cloud Billing budget alert notifications to a Cloud Pub/Sub topic, subscribe a Cloud Function to execute Compute Engine stop API calls upon notification, and account for reporting latency.
The correct strategy requires recognizing that Google Cloud billing budgets do not natively stop resources or cap costs. To achieve automated cost control, budget alerts must publish messages to a Cloud Pub/Sub topic, which triggers a serverless function (such as Cloud Functions) to invoke Compute Engine APIs to halt running instances. Additionally, billing data processing involves inherent latency, so automated remediation is asynchronously executed rather than instantaneous.

Step-by-Step Solution

1
Identify billing budget notification limits
Recognize that GCP billing budgets only generate notifications and do not automatically stop running resources or cap spending.
GCP Cloud Billing budgets are informational alerting tools rather than automated resource governors.
2
Connect programmatic alerting mechanisms
Attach a Cloud Pub/Sub topic to the Cloud Billing budget to receive JSON notification payloads when spending threshold percentages are crossed.
Pub/Sub serves as the event bus between billing threshold events and downstream programmatic remediation scripts.
3
Implement programmatic resource management
Deploy a Cloud Function or Cloud Run service triggered by the Pub/Sub topic to call Compute Engine APIs and stop instance workloads.
Custom code is required to translate the notification event into active GCP infrastructure modifications.
4
Factor in billing telemetry latency
Acknowledge that billing metrics and cost processing incur a delay (typically a few hours), meaning automated actions mitigate overruns rather than providing hard real-time caps.
Billing data processing is asynchronously batch-aggregated across Google Cloud infrastructure.

Key Concept

Automated Budget Notification Handling via Pub/Sub and Cloud Functions
Question 205Question →

An organization isolates client vulnerability assessments inside dedicated Google Cloud projects. A newly onboarded security engineer, assigned the Cloud Identity identity `[email protected]`, needs to associate an existing project (`client-eval-sec-99`) with the centralized Cloud Billing account (`01AB23-45CD67-89EF01`). The engineer has already been granted the Billing Account User (`roles/billing.user`) role directly on the Cloud Billing account. When running the `gcloud beta billing projects link` command, the request fails with an IAM permission denied error on the project resource. Following Google Cloud's principle of least privilege, which IAM role should be granted to `[email protected]` on the target project to resolve this failure?

Show answer & explanation

Answer: Project Billing Manager (roles/billing.projectManager) on the target project

Answer

Granting Project Billing Manager (`roles/billing.projectManager`) on the target project resource provides the minimum necessary permission (`resourcemanager.projects.createBillingAssignment`) required to link an existing project to a billing account.
Linking a Cloud Billing account to a project requires permissions on both sides of the association. On the billing account side, `roles/billing.user` grants `billing.resourceAssociations.create`. On the project side, the user must have `resourcemanager.projects.createBillingAssignment`. The predefined role Project Billing Manager (`roles/billing.projectManager`) provides this exact project permission without conferring unnecessary management capabilities over compute, storage, or security settings.

Step-by-Step Solution

1
Analyze the permission requirements for project-billing linking
Linking a project requires `billing.resourceAssociations.create` on the Billing Account AND `resourcemanager.projects.createBillingAssignment` on the Project.
Google Cloud IAM enforces dual-sided authorization to prevent unauthorized projects from consuming billing account credits.
2
Evaluate the user's existing permissions
The user already has `roles/billing.user` on the Billing Account, providing `billing.resourceAssociations.create`.
The missing permission is on the target project resource side (`resourcemanager.projects.createBillingAssignment`).
3
Apply the principle of least privilege to select the target role
Assign `roles/billing.projectManager` on the target project.
`roles/billing.projectManager` grants `resourcemanager.projects.createBillingAssignment` without granting broad primitive permissions like Owner or Editor.

Key Concept

Dual-sided IAM permissions for linking Google Cloud projects to Cloud Billing accounts under least privilege
Question 206Question →

A platform automation service account named `[email protected]` is tasked with creating new Google Cloud projects under the `Engineering` folder and associating them with the enterprise Billing Account `01A2B3-456C78-9DEF01`. The service account has already been granted the Project Creator (`roles/resourcemanager.projectCreator`) role on the `Engineering` folder. However, automated deployments fail when attempting to link newly created projects to the billing account. Following the principle of least privilege, which additional IAM role configuration is required to enable the service account to complete project-to-billing linking?

Show answer & explanation

Answer: Grant the service account the Billing Account User (`roles/billing.user`) role directly on Billing Account `01A2B3-456C78-9DEF01`.

Answer

Grant the service account the Billing Account User (`roles/billing.user`) role directly on Billing Account `01A2B3-456C78-9DEF01`.
To link a Google Cloud project to a billing account, an identity must hold specific permissions on both target resources: Project Creator (or Project Owner/Editor) on the parent folder or project, and Billing Account User (`roles/billing.user`) on the specific billing account. Granting `roles/billing.user` directly on the billing account fulfills the least privilege principle while enabling the required association capability.

Step-by-Step Solution

1
Analyze the permission requirements for linking a Google Cloud project to a billing account.
Linking requires dual permissions: project creation/management rights on the project/folder AND billing association rights on the billing account.
Security boundary isolation ensures that project administrators cannot arbitrarily attach projects to billing accounts without explicit authorization on the billing resource.
2
Evaluate existing service account permissions.
The service account has `roles/resourcemanager.projectCreator` on the target folder, satisfying the folder-level project creation requirement.
This allows project instantiation under the `Engineering` folder but does not grant rights on external billing account resources.
3
Determine the least-privilege predefined role needed on the billing account.
Assigning `roles/billing.user` directly on the billing account provides `billing.resourceAssociations.create` without over-granting billing administrative access.
This role grants permission to link projects to the specified billing account without giving rights to manage billing account payment methods or user access.

Key Concept

Dual-permission requirement for GCP Billing Account linking across the Resource Hierarchy
Question 207Question →

An online retail organization is designing a serverless backend infrastructure on Google Cloud to handle two distinct operational workloads:
1. Workload A: A high-throughput API gateway service packaged as a custom Docker container image that must handle up to 80 concurrent HTTP requests per instance to optimize resource utilization.
2. Workload B: A lightweight event processor executing a single JavaScript file whenever a new PDF invoice is generated and saved to a Cloud Storage bucket.

Which two architectural decisions should the cloud engineer select to meet these requirements with minimal operational overhead? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Deploy Workload A to Cloud Run and configure container concurrency to allow multiple requests per instance.; Deploy Workload B as a Cloud Function configured with a Cloud Storage event trigger.

Answer

Deploy Workload A to Cloud Run with multi-request concurrency configured, and deploy Workload B to Cloud Functions triggered directly by Cloud Storage events.
Cloud Run is the optimal platform for Workload A because it allows deploying custom Docker containers with configured concurrency to process up to 80 requests simultaneously per container instance. Cloud Functions is the optimal choice for Workload B because it natively integrates with Cloud Storage events to execute lightweight code snippets without needing container maintenance.

Step-by-Step Solution

1
Evaluate Workload A requirements against GCP serverless compute options.
Workload A requires running a custom Docker container with explicit support for serving multiple concurrent HTTP requests per instance.
Cloud Run supports containerized applications with configurable request concurrency up to 1000 requests per instance, making it the correct choice for Workload A.
2
Evaluate Workload B requirements against GCP serverless compute options.
Workload B requires executing a simple JavaScript file in response to Cloud Storage object creation events.
Cloud Functions provides a fully managed, event-driven runtime specifically designed for executing code snippets triggered by Google Cloud infrastructure events.

Key Concept

Differentiating serverless compute platforms (Cloud Run vs. Cloud Functions) based on containerization, concurrency capabilities, and event trigger mechanisms.
Question 208Question →

A digital media engineering team needs to run long-running video transcoding processing tasks using a custom compiled C++ binary on Google Cloud. The workload requires maximum single-thread CPU clock speeds, consistent processor performance, and runs uninterrupted in contiguous 12-hour job windows. If a node terminates mid-job, the entire 12-hour transcoding process fails and must restart from the beginning. Which Compute Engine resource planning strategy should the cloud engineer recommend?

Show answer & explanation

Answer: Provision Compute-optimized (C2 or C3) machine family instances running as standard Virtual Machines.

Answer

Provision Compute-optimized machine family instances (such as C2 or C3) configured as standard Compute Engine virtual machines.
Compute-optimized machine types (C2 and C3) provide high per-core CPU performance and high clock frequencies tailored for CPU-intensive compute workloads like video encoding. Using standard VMs ensures uninterrupted execution, satisfying the strict requirement that the 12-hour process must not be interrupted.

Step-by-Step Solution

1
Analyze workload compute profile requirements.
The application requires high single-thread CPU performance and sustained high clock frequency for CPU-bound video transcoding tasks.
Matching CPU performance profiles to Google Cloud machine families requires picking Compute-optimized (C2/C3) machines rather than General-purpose or Memory-optimized types.
2
Evaluate fault tolerance and availability constraints.
The job runs continuously for 12 hours and fails completely if interrupted.
Because the workload cannot recover from sudden termination, Spot/Preemptible VMs must be ruled out in favor of standard Compute Engine VMs.
3
Verify execution environment limits for alternative cloud offerings.
Serverless functions (Cloud Functions) cannot be used due to strict 9-minute execution timeouts.
Long-running batch workloads exceeding serverless timeouts must run on Compute Engine virtual instances.

Key Concept

Compute Engine Machine Family Selection and Spot VM Suitability
Estimated Time:1m 30s
Question 209Question →

A cloud administration team is planning Compute Engine resource configurations for two distinct applications:

1. A stateless, fault-tolerant batch image processing worker service that can easily resume processing if interrupted.
2. A memory-intensive caching service that requires continuous uptime and high RAM-to-vCPU ratios.

Which TWO deployment options represent recommended Compute Engine resource planning decisions for these workloads? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision Spot VMs for the stateless batch image processing worker service to optimize compute costs.; Select a memory-optimized machine type for the high-throughput caching service to fulfill high memory demand.

Answer

The team should provision Spot VMs for the stateless batch processing service and select a memory-optimized machine type for the high-throughput caching service.
Selecting Spot VMs for stateless, fault-tolerant batch processing reduces compute expenses significantly while ensuring the batch job can withstand preemption. Choosing a memory-optimized machine family for the caching service ensures adequate RAM per core for memory-intensive workloads while maintaining reliable continuous operation.

Step-by-Step Solution

1
Analyze the requirements for the batch image processing worker service.
The service is stateless, fault-tolerant, and batch-oriented.
Fault-tolerant workloads that tolerate preemption are ideal candidates for Spot VMs to maximize cost savings.
2
Analyze the requirements for the caching service.
The service requires continuous uptime and high memory capacity.
Memory-optimized machine families provide the required RAM ratio without needing standard Compute instances to be over-provisioned with excess CPU.

Key Concept

Selecting machine families based on memory demands and choosing Spot VMs for fault-tolerant batch processing.
Estimated Time:1m 0s
Question 210Question →

A software engineering team is planning the deployment architecture for an internal HTTP REST API on Google Cloud. The application requires a custom Go runtime packaged alongside specific Linux system libraries compiled directly into a container image. To optimize operational costs during traffic spikes, the service must support handling up to 80 concurrent HTTP requests on each active instance. Which serverless compute option should the team select?

Show answer & explanation

Answer: Deploy the container image to Cloud Run, as it natively supports custom container runtimes and configurable multi-concurrency per instance.

Answer

Deploy the container image to Cloud Run, as it natively supports custom container runtimes and configurable multi-concurrency per instance.
Cloud Run is Google Cloud's serverless platform for deploying arbitrary container images that listen for incoming HTTP/gRPC requests. It allows teams to bring custom binaries and system libraries in a Dockerfile while supporting multi-concurrency configuration (handling multiple simultaneous requests on a single instance) for high efficiency.

Step-by-Step Solution

1
Identify key technical and operational requirements
The application needs custom container image support (Linux system libraries compiled with Go) and configurable multi-concurrency (80 requests per instance) over HTTP.
Understanding runtime requirements and concurrency needs is critical when choosing between serverless options on GCP.
2
Evaluate GCP serverless platform capabilities
Cloud Run executes any container image that listens on the PORT environment variable and allows configuring concurrency up to 1000 requests per container instance.
Cloud Functions focuses on deploying source code snippets for event processing, whereas Cloud Run is designed for arbitrary containerized web applications.
3
Select the optimal compute solution
Cloud Run is the correct platform because it fulfills both container customization and multi-concurrency requirements.
Cloud Run provides serverless autoscaling without server management while supporting custom containerized environments.

Key Concept

Planning Serverless Compute Options (Cloud Run vs Cloud Functions)
Question 211Question →

A logistics enterprise is planning the serverless architecture for two distinct microservices on Google Cloud:

1. Microservice A: A public order-receiving REST service experiencing bursty, unpredictable traffic. To optimize memory usage and reduce cost, the application must handle up to 80 concurrent HTTP requests per instance within a custom container environment.
2. Microservice B: An event-driven processing script that executes short Python logic whenever a new shipment manifest file is uploaded to a specific Cloud Storage bucket.

Which serverless deployment plan aligns with Google Cloud architectural best practices to meet these requirements?

Show answer & explanation

Answer: Deploy Microservice A to Cloud Run to utilize multi-concurrency within container instances, and deploy Microservice B to Cloud Functions (2nd gen) triggered directly by Cloud Storage events.

Answer

Deploy Microservice A to Cloud Run to utilize multi-concurrency within container instances, and deploy Microservice B to Cloud Functions (2nd gen) triggered directly by Cloud Storage events.
Cloud Run is designed to host stateless containerized microservices and supports configurable request concurrency (up to 80 concurrent requests per instance in this scenario), allowing multiple requests to share CPU and memory resources. Cloud Functions (2nd gen) offers seamless integration with Eventarc and Cloud Storage event triggers for single-purpose event handlers like processing uploaded manifest files.

Step-by-Step Solution

1
Analyze Microservice A requirements
Microservice A requires a containerized environment and must process up to 80 concurrent HTTP requests per instance.
Cloud Run natively supports request concurrency (up to 1000 requests per instance) for containerized web microservices, reducing container footprint and total cost.
2
Analyze Microservice B requirements
Microservice B is a lightweight, single-purpose Python script triggered by file uploads in a Cloud Storage bucket.
Cloud Functions (2nd gen) built on Eventarc is designed specifically for lightweight event-driven execution responding to Cloud Storage state changes.
3
Evaluate and combine serverless choices
Cloud Run for Microservice A and Cloud Functions for Microservice B.
This combination leverages the unique strengths of each Google Cloud serverless compute platform while meeting all operational constraints.

Key Concept

Planning Serverless Compute Options: Cloud Run vs. Cloud Functions Concurrency and Triggers
Estimated Time:2m 0s
Question 212Question →

A system architect is using the Google Cloud Pricing Calculator to model monthly infrastructure costs for a major system migration. The architectural design comprises two primary compute workloads: a critical relational transactional database that must run continuously with 99.99% availability on dedicated Compute Engine instances, and a highly fault-tolerant, stateless batch processing pipeline designed to handle sudden instance terminations without data loss. Additionally, transactional backups will be stored long-term but must be read hourly by automated compliance validation scripts. Which configuration strategy in the Google Cloud Pricing Calculator correctly reflects Google Cloud pricing rules to provide the lowest valid cost estimate?

Show answer & explanation

Answer: Configure 3-year Committed Use Discounts (CUDs) for the transactional database Compute Engine instances, select Spot VMs without Committed Use Discounts for the batch processing pipeline, and assign Standard Storage for the hourly accessed transaction backups.

Answer

Configure 3-year Committed Use Discounts for predictable stateful database instances, leverage Spot VMs without stacking CUDs for fault-tolerant stateless processing, and use Standard Storage for frequently read log backups.
The option advocating 3-year Committed Use Discounts for the 24/7 database, Spot VMs for the stateless batch processing pipeline, and Standard Storage for hourly-accessed backups accurately aligns with Google Cloud pricing structures. CUDs maximize savings for steady-state databases, Spot VMs drastically reduce costs for interruptible tasks without invalid stacking, and Standard Storage avoids costly retrieval fees incurred by accessing colder storage classes on an hourly basis.

Step-by-Step Solution

1
Evaluate workload operational requirements for compute resource pricing models.
The transactional database requires constant 99.99% uptime, making it eligible for steady-state baseline discounts like 1-year or 3-year Committed Use Discounts (CUDs). The batch processing pipeline is stateless and fault-tolerant, making it an ideal candidate for Spot VMs.
Spot VMs provide up to 60-91% savings over standard pricing for interruptible workloads, while CUDs provide up to 57-70% savings for steady 24/7 compute workloads.
2
Validate discount stacking and applicability rules in the Pricing Calculator.
CUDs apply to standard, non-preemptible compute usage and cannot be combined or stacked on top of Spot VM pricing.
Applying CUDs to Spot VMs in cost estimations leads to an inaccurate and artificially reduced estimate.
3
Analyze storage class lifecycle and retrieval cost trade-offs.
Because compliance scripts read the transaction backups hourly, the data access pattern is frequent. Standard Cloud Storage must be selected.
Coldline or Archive storage classes incur high retrieval fees per gigabyte when accessed continuously, making total costs higher than Standard Storage despite lower per-gigabyte storage pricing.

Key Concept

GCP Pricing Calculator Discount Rules and Storage Tier Retrieval Mechanics
Question 213Question →

An enterprise cloud engineering team is planning a new Google Kubernetes Engine (GKE) cluster architecture. The application workload includes high-throughput network microservices that require custom host Linux kernel sysctl parameters to be configured on the underlying nodes. The team also wants to minimize node management operational overhead where possible and utilize Spot VMs to reduce costs for stateless, fault-tolerant background workloads. Which GKE cluster setup and node pool strategy best satisfies these operational requirements?

Show answer & explanation

Answer: Deploy a GKE Standard cluster with dedicated node pools, configure the custom sysctl parameters via node pool configuration, and create a separate node pool using Spot VMs for the fault-tolerant background workloads.

Answer

Deploy a GKE Standard cluster with dedicated node pools, configure the custom sysctl parameters via node pool configuration, and create a separate node pool using Spot VMs for the fault-tolerant background workloads.
GKE Standard provides complete node configuration control, enabling administrators to set custom Linux kernel sysctl parameters for specialized microservices. Utilizing separate node pools allows non-critical, fault-tolerant background workloads to run on low-cost Spot VMs while keeping primary services on resilient standard nodes.

Step-by-Step Solution

1
Analyze the operational boundary between GKE Autopilot and GKE Standard regarding host OS kernel customizations.
GKE Autopilot fully manages nodes and locks down host security configurations, preventing custom Linux kernel sysctl modifications. Therefore, GKE Standard must be selected.
Security boundaries in GKE Autopilot restrict elevated node access and custom host kernel parameter tuning.
2
Analyze the node pool design requirements for cost optimization and workload separation.
Core microservices should run on standard On-Demand node pools, while fault-tolerant background processing jobs are placed on a separate node pool configured with Spot VMs.
Spot VMs offer significant cost savings for stateless, fault-tolerant workloads that can handle unexpected node preemption.

Key Concept

Evaluating GKE Autopilot vs. Standard operational boundaries for node OS kernel customization and implementing dedicated node pool architectures with Spot VMs.
Question 214Question →

A media analytics firm processes daily log archives in Google Cloud Storage. Engineers access these log files frequently during the first 7 days to analyze performance anomalies. After 7 days, access decreases to approximately once every six months for regulatory compliance checks, but when accessed, the data must be available in milliseconds. The compliance policy requires preserving all log files for exactly 365 days from creation before permanently removing them. Which Cloud Storage lifecycle configuration minimizes total storage and retrieval costs while satisfying all latency and retention requirements?

Show answer & explanation

Answer: Store objects in the Standard storage class initially, set an Object Lifecycle Management rule to transition objects to Coldline storage after 7 days, and set a lifecycle rule to delete objects after 365 days.

Answer

Store objects in the Standard storage class initially, set an Object Lifecycle Management rule to transition objects to Coldline storage after 7 days, and set a lifecycle rule to delete objects after 365 days.
The correct strategy starts objects in Standard storage to eliminate retrieval costs during the initial high-access 7-day window. Moving objects to Coldline after 7 days reduces ongoing capacity costs while maintaining millisecond retrieval latency for semi-annual queries. Because objects remain in Coldline for 358 days (from day 7 to day 365), the 90-day minimum storage duration for Coldline is satisfied, avoiding any early deletion fees.

Step-by-Step Solution

1
Analyze access frequency and latency constraints
Heavy access during days 1–7 requires Standard storage to avoid retrieval costs. Millisecond access needed after day 7 rules out offline tape-like storage.
Standard storage has no retrieval fee, making it ideal for active data.
2
Evaluate storage class minimum durations and access patterns
Accessing once every 6 months aligns with Coldline storage (designed for data accessed at most once per quarter).
Coldline provides low monthly storage costs with millisecond access latency and a 90-day minimum storage commitment.
3
Calculate lifecycle transition and deletion timelines
Transitioning to Coldline at day 7 and deleting at day 365 retains data in Coldline for 358 days, easily surpassing Coldline's 90-day minimum storage duration without early deletion penalties.
Transitioning to Archive at day 90 and deleting at day 365 would mean only 275 days in Archive, triggering early deletion fees for Archive's 365-day commitment.

Key Concept

Cloud Storage Classes and Lifecycle Management Cost Optimization
Question 215Question →

An enterprise organization manages data across multiple Google Cloud projects. A data engineer needs to run automated BigQuery jobs in Project B (`analytics-prod`) that extract log files from a specific Cloud Storage bucket in Project A (`logs-archive`) and write the processed results into a dataset in Project B. The engineer must also be able to execute query jobs in Project B, but must not be granted permissions to modify bucket configurations in Project A or alter IAM access controls in either project. Which IAM role assignment strategy follows Google's recommended security practices and strictly adheres to the principle of least privilege?

Show answer & explanation

Answer: Grant `roles/storage.objectViewer` on the specific Cloud Storage bucket in Project A, and grant `roles/bigquery.dataEditor` on the target BigQuery dataset and `roles/bigquery.jobUser` at the project level in Project B.

Answer

Grant `roles/storage.objectViewer` on the specific Cloud Storage bucket in Project A, and grant `roles/bigquery.dataEditor` on the target BigQuery dataset and `roles/bigquery.jobUser` at the project level in Project B.
The optimal solution assigns predefined roles at the narrowest possible resource scope. Assigning `roles/storage.objectViewer` on the specific bucket grants read-only access to objects in Project A. Assigning `roles/bigquery.dataEditor` on the dataset in Project B allows table manipulation, while `roles/bigquery.jobUser` at the Project B level allows job execution. This combination perfectly satisfies all operational requirements while honoring the principle of least privilege.

Step-by-Step Solution

1
Analyze source storage requirements in Project A
The engineer only needs to read files from a specific Cloud Storage bucket.
Granting `roles/storage.objectViewer` at the bucket level provides read access to objects without granting project-wide storage permissions or bucket modification rights.
2
Analyze destination data writing requirements in Project B
The engineer needs to write processed data into a BigQuery dataset in Project B.
Granting `roles/bigquery.dataEditor` scoped specifically to the target dataset allows table creation and updates without exposing other datasets in the project.
3
Analyze job execution requirements in Project B
Running BigQuery queries consumes compute resources in Project B.
The `roles/bigquery.jobUser` role at the project level is required to run query jobs and allocate compute resources in Project B.

Key Concept

Least Privilege IAM Role Scoping Across Projects
Question 216Question →

A platform engineering team is setting up a new Google Cloud project named `customer-insights-prod`. An automated deployment pipeline using a dedicated service account must enable the Cloud Pub/Sub API (`pubsub.googleapis.com`) and the Cloud SQL Admin API (`sqladmin.googleapis.com`) within this target project. Which of the following actions must be taken to ensure the APIs are enabled successfully using the principle of least privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the deployment service account the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on the `customer-insights-prod` project.; Execute `gcloud services enable pubsub.googleapis.com sqladmin.googleapis.com --project=customer-insights-prod` in the CLI environment.

Answer

Granting the deployment service account the Service Usage Admin role on the target project and executing the gcloud command with the --project flag enables the required APIs with appropriate permissions.
To enable Google Cloud APIs, an identity requires the `serviceusage.services.enable` permission provided by `roles/serviceusage.serviceUsageAdmin` on the target project. Furthermore, APIs must be enabled at the project level by executing `gcloud services enable` with the full service names and the `--project` flag specified.

Step-by-Step Solution

1
Identify the required IAM permissions for API enablement.
The service account requires a role containing `serviceusage.services.enable`, which is provided by the predefined Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`).
Principle of least privilege dictates granting Service Usage Admin rather than broad primitive roles like Owner or Editor.
2
Determine the correct CLI syntax to enable the service APIs.
Execute `gcloud services enable pubsub.googleapis.com sqladmin.googleapis.com --project=customer-insights-prod`.
APIs are enabled specifically per Google Cloud project using their full service identifiers.

Key Concept

Enabling Cloud Service APIs via IAM and gcloud CLI
Estimated Time:1m 30s
Question 217Question →

A financial analytics company is evaluating Google Cloud compute solutions for a stateless web application containerized with Docker. The application receives unpredictable, bursty HTTP traffic throughout the day and experiences long stretches of complete inactivity during off-peak hours. The operations team requires a fully managed solution that automatically scales instances to zero during inactive periods to eliminate idle infrastructure costs, while eliminating the operational overhead of managing Kubernetes clusters or virtual machine instance groups. Which compute service best meets these operational and financial requirements?

Show answer & explanation

Answer: Deploy the container image to Cloud Run.

Answer

Deploy the container image to Cloud Run.
Cloud Run is the optimal Google Cloud compute choice for deploying stateless containerized web applications that experience bursty traffic and idle periods. It provides automatic scaling down to zero instances when no HTTP requests are being processed, ensuring zero idle infrastructure cost, while completely abstracting away cluster and virtual machine management.

Step-by-Step Solution

1
Analyze workload characteristics and deployment artifact.
The application is packaged as a standard Docker container image, is stateless, and handles HTTP traffic.
Container packaging requires a runtime environment capable of launching arbitrary container images.
2
Evaluate scaling and financial constraints.
The application must scale down to zero instances during inactive periods to ensure zero cost when idle.
Serverless container platforms like Cloud Run charge only for compute resources consumed during request execution, whereas cluster-based or VM-based architectures incur baseline platform costs.
3
Evaluate operational management overhead requirements.
The team explicitly requested avoiding cluster management and virtual machine administration.
Cloud Run eliminates the need to configure Kubernetes control planes, node pools, or virtual machine operating systems.

Key Concept

Selecting serverless container execution paradigms for stateless web applications to minimize operational overhead and idle costs.
Estimated Time:2m 0s
Question 218Question →

An associate cloud engineer is designing a Google Cloud Storage solution for a media processing application. The application requires immediate, frequent access to newly uploaded video files during the first month, and automated cost optimization for files older than 30 days. Which TWO storage planning decisions should the engineer implement? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Use Standard Storage as the default storage class for the bucket to accommodate frequent daily access without data retrieval charges.; Implement an Object Lifecycle Management policy with a rule to transition objects to Nearline Storage after 30 days.

Answer

The correct decisions are to select Standard Storage as the default storage class for active daily media processing and to set an Object Lifecycle Management rule transitioning files to Nearline Storage after 30 days.
Standard Storage is the correct choice for frequently accessed active uploads because it carries no data retrieval fees. Nearline Storage is the correct tier for data accessed once a month or less, matching the 30-day lifecycle transition boundary.

Step-by-Step Solution

1
Determine initial storage class based on access pattern
Newly uploaded media files are accessed daily, making Standard Storage optimal because it has zero retrieval fees.
Frequent data retrieval under Nearline, Coldline, or Archive classes would incur extra operation costs.
2
Configure lifecycle policy for secondary storage phase
Files older than 30 days with infrequent access should transition to Nearline Storage.
Nearline Storage provides lower at-rest storage costs and requires a minimum storage duration of 30 days.

Key Concept

Selecting optimal Cloud Storage classes based on data access frequency and setting automated Object Lifecycle Management rules.
Question 219Question →

A cloud administrator needs to grant a user the minimum predefined IAM roles required to link an existing Google Cloud project to an active Cloud Billing account. Which combination of IAM roles should be assigned to fulfill this requirement according to the principle of least privilege?

Show answer & explanation

Answer: Billing Account User (roles/billing.user) on the billing account and Project Billing Manager (roles/billing.projectManager) on the project

Answer

Assigning Billing Account User on the billing account and Project Billing Manager on the project provides the minimum required permissions to link a project to an existing billing account.
Linking an existing project to a Cloud Billing account requires permissions on both resources: Billing Account User (roles/billing.user) grants authority to associate the billing account with projects, while Project Billing Manager (roles/billing.projectManager) grants authority to manage the billing link on the project itself. This combination adheres strictly to the principle of least privilege.

Step-by-Step Solution

1
Identify the permission required on the billing account
The principal requires billing.accounts.get and billing.accounts.usePermissions, provided by the predefined role Billing Account User (roles/billing.user).
Users must be authorized to attach charges to the target billing account.
2
Identify the permission required on the target project
The principal requires resourcemanager.projects.createBillingAssignment permission, provided by the predefined role Project Billing Manager (roles/billing.projectManager).
Users must be authorized to modify the billing association on the specific project.
3
Evaluate options for least privilege compliance
Combining Billing Account User and Project Billing Manager satisfies both permission requirements without granting excess primitive or administrative access.
Google Cloud security best practices dictate using specific predefined roles over broad administrative or primitive roles.

Key Concept

Least-privilege IAM roles required for linking Google Cloud projects to billing accounts
Estimated Time:45s
Question 220Question →

An enterprise cloud engineering team needs to enforce financial governance across their Google Cloud organization. They are tasked with two primary objectives: first, executing automated, custom remediation code whenever project spending exceeds a specific budget threshold; second, performing continuous, detailed SQL analytics on billing data. Which TWO configuration steps are required to implement this architecture? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Attach a Cloud Pub/Sub topic to the Cloud Billing budget notification settings, and configure an event-driven subscriber such as a Cloud Function to execute automated remediation logic.; Grant the user or service account configuring the BigQuery billing export the Billing Account Administrator role on the billing account and the BigQuery Data Editor role on the project hosting the destination dataset.

Answer

To implement programmatic budget remediation and detailed cost analysis, administrators must connect the budget alerts to a Cloud Pub/Sub topic (which triggers serverless functions) and assign both the Billing Account Administrator role on the billing account and BigQuery Data Editor role on the export destination project.
The correct requirements involve two distinct configurations: First, Google Cloud Billing budgets do not halt billing or terminate workloads natively when a threshold is crossed. To execute programmatic actions, the budget must publish messages to a Cloud Pub/Sub topic, which triggers a serverless application (such as a Cloud Function) to disable billing or delete resources. Second, configuring BigQuery billing export requires proper authorization across both scope boundaries: the Billing Account Administrator role on the billing account to configure the export, and the BigQuery Data Editor (or Admin) role on the project hosting the dataset to store the exported tables.

Step-by-Step Solution

1
Analyze the requirement for automated remediation upon budget threshold breach.
Identify that Google Cloud Billing budgets are strictly notification mechanisms and do not shut down services natively.
To automate actions (e.g., stopping VMs or capping API usage), budget notifications must be published to Cloud Pub/Sub and consumed by a Cloud Function or Cloud Run service.
2
Analyze the IAM role requirements for setting up BigQuery billing exports.
Determine that permissions are required on both the source billing account and the destination project dataset.
Configuring the export pipeline requires Billing Account Administrator on the billing account to initiate export, and BigQuery Data Editor (or Admin) on the target project to write the tables.
3
Evaluate the incorrect options regarding budget capabilities and primitive permissions.
Reject native budget auto-capping and granting blanket Project Owner roles.
Budget rules lack native auto-cap controls, and least-privilege IAM mandates specific predefined billing and BigQuery roles.

Key Concept

Programmatic Billing Budget Enforcement and BigQuery Billing Export IAM Permissions
PreviousPage 11 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin