Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 321Question →

A retail analytics company is planning its Google Compute Engine infrastructure for two distinct application services:
1. An online, memory-intensive analytics engine requiring large RAM allocations, predictable baseline CPU performance, and continuous 24/7 availability over a multi-year timeframe.
2. A stateless data ingestion pipeline that processes incoming messages asynchronously from a queue and can recover gracefully if individual instances are terminated unexpectedly.

Which TWO deployment strategies should the cloud engineer select to meet operational requirements while optimizing cost efficiency? (Select 2 answers.)

Select all that apply

Show answer & explanation

Answer: Provision High-Memory or Memory-Optimized VM instances coupled with Committed Use Discounts (CUDs) for the 24/7 analytics engine.; Provision Spot Virtual Machines for the stateless data ingestion pipeline to minimize compute costs.

Answer

The cloud engineer should select provisioning High-Memory or Memory-Optimized VM instances with Committed Use Discounts (CUDs) for the steady-state analytics engine, and provisioning Spot Virtual Machines for the fault-tolerant data ingestion pipeline.
Provisioning High-Memory or Memory-Optimized instances with Committed Use Discounts fulfills the high-RAM 24/7 availability requirements of the analytics engine while securing deep steady-state discounts. Provisioning Spot VMs for the stateless data ingestion pipeline leverages maximum discounts for a workload that easily handles sudden instance terminations.

Step-by-Step Solution

1
Analyze the operational profile of the analytics engine workload.
Determined to require high RAM allocations and continuous 24/7 multi-year uptime.
High-Memory / Memory-Optimized machine types satisfy the resource ratio, while Committed Use Discounts (CUDs) minimize costs for steady 24/7 utilization.
2
Analyze the operational profile of the data ingestion pipeline workload.
Determined to be stateless, asynchronous, queue-based, and interruption-tolerant.
Workloads capable of handling abrupt terminations benefit most from the low pricing of Spot Virtual Machines.
3
Evaluate and eliminate anti-pattern architecture proposals.
Rejected using Spot VMs for the continuous analytics engine and Cloud Functions for the memory-intensive engine.
Spot VMs introduce preemption risk to continuous services, while Cloud Functions cannot sustain long-running, memory-heavy database workloads.

Key Concept

Matching Compute Engine machine families and purchasing models (Spot VMs vs. CUDs) to workload memory demands and fault tolerance.
Question 322Question →

A financial institution is designing compute infrastructure on Google Cloud for two distinct sub-components of a credit risk platform:

1. Workload 1: A stateless, containerized HTTP web service that experiences unpredictable request spikes during trading hours and no traffic overnight. Minimizing costs during idle periods by scaling to zero is a critical requirement.
2. Workload 2: A batch processing job that executes highly parallelized risk simulations. The job is fault-tolerant and can easily resume if an underlying instance is suddenly terminated.

Which TWO compute platform strategies should you recommend to meet these requirements efficiently? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Deploy Workload 1 on Cloud Run to automatically scale container instances dynamically with HTTP traffic and scale down to zero when idle.; Provision Compute Engine Spot VMs for Workload 2 to run the parallel batch simulation tasks at a significantly lower cost.

Answer

Deploy Workload 1 on Cloud Run for stateless container scaling to zero, and provision Compute Engine Spot VMs for Workload 2 to execute fault-tolerant batch workloads cost-effectively.
Cloud Run is the optimal compute choice for stateless HTTP container workloads needing automatic scaling down to zero during idle periods. Compute Engine Spot VMs provide maximum cost optimization for batch compute jobs that are resilient to node interruptions.

Step-by-Step Solution

1
Analyze requirements for Workload 1
Identified a stateless, containerized HTTP web service requiring automatic scaling based on HTTP traffic including scaling down to zero.
Cloud Run natively supports container deployments, HTTP autoscaling, and scale-to-zero behavior out of the box.
2
Analyze requirements for Workload 2
Identified a fault-tolerant, parallelized batch processing workload capable of handling node terminations.
Spot VMs provide significant cost reductions for stateless or fault-tolerant batch processing that can tolerate interruptions.

Key Concept

Selecting optimal GCP compute services based on containerization, scaling characteristics, cost sensitivity, and fault tolerance.
Question 323Question →

A cloud engineering team is planning to expand the primary IP address range of an active custom-mode Virtual Private Cloud (VPC) subnet connected to an on-premises data center via Cloud Router using BGP. What is the correct sequence of steps the team must perform to safely plan, execute, and propagate this subnet expansion?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct procedural order begins with auditing contiguous IP space across hybrid networks to prevent IP collisions, validating GCP subnet expansion constraints (prefix length reduction only without shifting base IP), performing the subnet expansion in GCP, and finally updating Cloud Router BGP custom route advertisements to inform on-premises networks.
The sequence follows the required architectural workflow: auditing hybrid IP space first to prevent overlap, verifying GCP netmask expansion rules, modifying the VPC subnet resource, and updating BGP routing advertisements on Cloud Router to complete hybrid connectivity.

Step-by-Step Solution

1
Audit contiguous IP address space across all interconnected environments.
Ensures the expanded block does not overlap with existing subnets, GKE secondary ranges, or on-premises CIDR ranges.
GCP VPC subnets require contiguous unallocated space to expand. Overlapping IP space causes routing failures and IP collisions.
2
Validate the proposed CIDR change against GCP VPC expansion rules.
Confirms the target prefix length is smaller than the current prefix length (e.g., /23/23 expanded to /21/21).
GCP subnets cannot be shrunk, and the network starting address cannot be changed during an expansion.
3
Execute the primary subnet range expansion in GCP.
Modifies the subnet's netmask in the GCP control plane without downtime for existing instances.
Applies the configuration change to the target subnet resource in Google Cloud.
4
Update Cloud Router custom route advertisements.
On-premises BGP routers receive updated prefix announcements covering the newly added IP addresses.
Ensures full bi-directional reachability between on-premises hosts and newly provisioned workloads in the expanded IP range.

Key Concept

Planning and executing non-disruptive primary subnet CIDR expansions in hybrid VPC topologies
Question 324Question →

A DevOps engineer at a logistics company needs to link a newly provisioned project, `supply-chain-analytics-prod`, to the corporate Cloud Billing Account. Organizational security policies mandate strict adherence to the principle of least privilege, ensuring the engineer cannot view financial invoices for other projects linked to the billing account or modify billing payment settings. Which combination of IAM roles grants the minimum required permissions to complete this task?

Show answer & explanation

Answer: Billing Account User (`roles/billing.user`) on the Cloud Billing Account and Project Billing Manager (`roles/resourcemanager.projectBillingManager`) on the target project

Answer

The correct role combination is Billing Account User (`roles/billing.user`) bound on the Cloud Billing Account resource and Project Billing Manager (`roles/resourcemanager.projectBillingManager`) bound on the target project.
Linking a Google Cloud project to a billing account requires permissions on two distinct resources: permission to use the billing account (provided by Billing Account User on the billing account) and permission to change billing configuration on the project (provided by Project Billing Manager on the project). This combination enforces least privilege.

Step-by-Step Solution

1
Identify the minimum billing account permission required to link projects
The identity needs `resourcemanager.projects.createBillingAssignment` capability on the billing account, provided by the predefined Billing Account User (`roles/billing.user`) role.
This permission allows associating projects to the billing account without giving rights to manage payment methods or view overall account spending across all linked projects.
2
Identify the minimum project-level permission required to modify project billing settings
The identity needs `resourcemanager.projects.createBillingAssignment` on the project resource, provided by the Project Billing Manager (`roles/resourcemanager.projectBillingManager`) role.
Linking requires permission on both sides: the billing account and the target project.
3
Evaluate against least-privilege constraints
Combining Billing Account User on the billing account and Project Billing Manager on the project satisfies both requirements with minimal permissions.
Primitive roles like Project Owner or broad roles like Billing Account Administrator grant unnecessary privileges.

Key Concept

Two-Sided Permission Requirement for Project Billing Account Linking
Question 325Question →

A broadcast television network is migrating its video catalog to Google Cloud Storage. The media production team defines two distinct lifecycle phases for video assets:
1. Active Editing Phase: Newly recorded media requires frequent, high-throughput access for active editing during the first 30 days after ingestion.
2. Archival Compliance Phase: After 30 days, assets must be kept for 7 years for regulatory compliance, during which time access is expected less than once per year only during legal discovery audits.

The Cloud Engineer must minimize Total Cost of Ownership (TCO) by eliminating unnecessary retrieval fees and avoiding minimum storage duration penalties.

Which TWO cloud storage bucket configuration and lifecycle management choices should the engineer recommend?

Select all that apply

Show answer & explanation

Answer: Set the initial bucket default storage class to Standard storage, and apply an Object Lifecycle Management rule to transition objects to Archive storage after 30 days.; Ensure that archived video assets remain untouched in Archive storage for a minimum of 365 consecutive days before any deletion or overwrite operation.

Answer

The optimal strategy is to store newly ingested files in Standard storage and use an Object Lifecycle Management rule to transition them to Archive storage after 30 days, while ensuring objects remain in Archive storage for at least 365 days to avoid early deletion fees.
For frequently modified or read data in the first 30 days, Standard storage avoids retrieval fees. Transitioning to Archive storage after 30 days aligns with long-term retention needs (7 years) for data accessed less than once per year. Furthermore, keeping objects in Archive storage for at least 365 days satisfies its minimum storage duration policy, preventing early deletion charges.

Step-by-Step Solution

1
Analyze access frequency during the initial 30-day editing period
Standard storage is required during the first 30 days because frequent reads incur no data retrieval fees, preventing high operational costs.
Coldline, Nearline, and Archive classes assess data retrieval fees per gigabyte, making them cost-prohibitive for high-frequency access patterns.
2
Select the long-term retention class for data accessed less than once a year
Archive storage offers the lowest per-gigabyte monthly storage pricing for compliance assets rarely accessed.
Because the files are kept for 7 years and accessed fewer than once per year, Archive storage provides maximum cost savings despite higher retrieval costs upon access.
3
Evaluate minimum storage duration constraints for lifecycle transitions and deletions
Archive storage has a 365-day minimum storage duration requirement.
Deleting, overwriting, or re-tiering objects before 365 days results in pro-rated early deletion charges.

Key Concept

Cloud Storage Class Selection & Lifecycle Minimum Storage Durations
Estimated Time:2m 0s
Question 326Question →

A financial software company runs an internal batch calculations service on Google Compute Engine. The application requires exactly 6 vCPUs and 28 GB of memory to process daily data efficienty, but none of the predefined machine types match this resource ratio. The workload runs continuously 24 hours a day, 7 days a week, and cannot tolerate unexpected preemptions or terminations. Which Compute Engine machine configuration and pricing model should you select to minimize operational costs while satisfying all system requirements?

Show answer & explanation

Answer: Provision a Custom Machine Type with 6 vCPUs and 28 GB of memory, and purchase a Committed Use Discount (CUD) for the baseline usage.

Answer

Provision a Custom Machine Type with 6 vCPUs and 28 GB of memory, and purchase a Committed Use Discount (CUD) for the baseline usage.
Configuring a Custom Machine Type allows exact allocation of 6 vCPUs and 28 GB of RAM without paying for unused resources of larger predefined types. Pairing continuous, non-interruptible 24/7 workloads with Committed Use Discounts provides the highest cost savings while guaranteeing instance availability.

Step-by-Step Solution

1
Analyze resource ratio requirements
Identified that predefined machine families do not offer a 6 vCPU to 28 GB memory ratio.
Google Compute Engine allows creating Custom Machine Types to fit exact CPU and memory specifications, preventing over-provisioning.
2
Evaluate workload availability and cost optimization constraints
Workload runs continuous 24/7 steady-state and cannot tolerate interruption.
Committed Use Discounts (CUDs) provide deep discounts for steady-state workloads with 1-year or 3-year commitments without preemption risk.

Key Concept

Compute Engine Custom Machine Types and Committed Use Discounts (CUD)
Estimated Time:1m 30s
Question 327Question →

An automated background process running outside Google Cloud needs to publish event telemetry messages to a single Cloud Pub/Sub topic in a project. Following Google Cloud security best practices and the principle of least privilege, which role assignment should be configured?

Show answer & explanation

Answer: Grant the Pub/Sub Publisher (roles/pubsub.publisher) role on the specific Pub/Sub topic to the service account used by the process.

Answer

Grant the predefined Pub/Sub Publisher (roles/pubsub.publisher) role to the service account specifically on the target Cloud Pub/Sub topic resource.
Granting the predefined Pub/Sub Publisher role on the specific topic provides exactly the permissions required to publish messages without granting unnecessary administrative access or access to other project resources.

Step-by-Step Solution

1
Identify the minimum required permissions for the workload.
The background application only requires permission to publish messages to a Pub/Sub topic.
Least privilege requires matching the identity's permissions exactly to its operational needs without extra privileges.
2
Select the appropriate IAM role type and scope.
Choose the predefined Pub/Sub Publisher role (`roles/pubsub.publisher`) rather than a primitive role or admin role, and scope it to the specific topic resource rather than the entire project.
Predefined roles offer fine-grained access, and resource-level bindings prevent unnecessary access to other topics or GCP services.

Key Concept

Principle of Least Privilege using Predefined IAM Roles at Resource Level Scope
Question 328Question →

A biomedical research organization is designing a Google Kubernetes Engine (GKE) cluster architecture on Google Cloud to host two distinct workloads. The first workload is a core API service that requires custom Linux kernel parameters (`sysctl`) configured on the host nodes and guaranteed instance availability. The second workload consists of large-scale, fault-tolerant batch analysis jobs that run statelessly and must be executed at the lowest possible compute cost. Enterprise security rules mandate that cluster nodes must not have public IP addresses and access to the Kubernetes control plane API endpoint must be strictly restricted to the organization's on-premises network CIDR via Cloud VPN. Which cluster architecture meets all technical, operational, and security requirements?

Show answer & explanation

Answer: Deploy a GKE Standard regional cluster configured as a Private Cluster with private endpoint access only, enable Control Plane Authorized Networks specifying the on-premises CIDR, create a Standard node pool for the core API service, and add a secondary Spot VM node pool for the batch analysis jobs.

Answer

Deploying a GKE Standard regional cluster configured as a Private Cluster with private control plane endpoint access, setting Control Plane Authorized Networks to the on-premises CIDR, and provisioning separate Standard and Spot VM node pools for the respective workloads.
GKE Standard mode allows full node configuration including custom OS kernel parameters (`sysctl`). Configuring the cluster as a Private Cluster with private endpoint access and Control Plane Authorized Networks satisfies all security constraints by removing public node IPs and restricting control plane access. Utilizing a separate Spot VM node pool for batch analysis minimizes compute costs without impacting the core API service.

Step-by-Step Solution

1
Evaluate operational cluster mode requirements.
GKE Standard mode must be chosen over Autopilot because GKE Autopilot restricts node-level host access and custom sysctl kernel parameter modifications.
The core API service explicitly requires custom Linux kernel tuning.
2
Evaluate network security constraints.
Configure a Private Cluster with Private Endpoint access enabled and Control Plane Authorized Networks restricted to the on-premises CIDR block.
This prevents public IP assignment to nodes and blocks public access to the Kubernetes API server.
3
Design node pool architecture based on workload characteristics.
Create a standard, persistent node pool for the core API service and a dedicated Spot VM node pool for the stateless batch processing workload.
Spot VMs offer significant cost discounts for fault-tolerant jobs but should not host workloads requiring guaranteed availability.

Key Concept

Planning GKE Cluster Infrastructure & Node Pool Strategies
Question 329Question →

A cloud administrator needs to grant a developer permissions to view Compute Engine virtual machine details and inspect Cloud Logging entries in a Google Cloud project. Following Google Cloud best practices and the principle of least privilege, which of the following predefined roles should be assigned to the developer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Compute Viewer (roles/compute.viewer); Logs Viewer (roles/logging.viewer)

Answer

Assign the Compute Viewer (roles/compute.viewer) and Logs Viewer (roles/logging.viewer) predefined roles.
Google Cloud IAM best practices dictate assigning granular predefined roles instead of broad primitive roles. The Compute Viewer role grants read-only access to inspect VM instance details, and the Logs Viewer role grants read-only access to view logs in Cloud Logging. Assigning both fulfills the requirements under the principle of least privilege.

Step-by-Step Solution

1
Analyze the access requirements described in the scenario
The developer only requires read access to Compute Engine VM details and Cloud Logging logs.
Identifying the minimum required permissions prevents granting excessive privilege.
2
Evaluate role types against Google Cloud IAM best practices
Predefined roles tailored to specific service duties must be chosen over broad primitive roles (Owner, Editor, Viewer).
Primitive roles grant project-wide privileges that exceed the scope of the developer's specific needs.
3
Select the correct predefined roles
Compute Viewer provides read-only VM inspection, while Logs Viewer provides read-only access to log records.
Combining these two predefined roles meets the developer's exact functional needs while maintaining security.

Key Concept

Applying Least Privilege using GCP Predefined IAM Roles
Question 330Question →

An enterprise cloud engineering team is designing a serverless architecture on Google Cloud for two distinct microservices:

1. Microservice A: A web backend that requires long-lived WebSocket connections and needs to process multiple concurrent requests on a single instance to optimize cost efficiency.
2. Microservice B: A lightweight, event-driven Node.js service that processes image metadata whenever a new file is created in a Cloud Storage bucket.

Which TWO deployment options should the team choose to meet these requirements with minimal operational overhead?

Select all that apply

Show answer & explanation

Answer: Deploy Microservice A to Cloud Run, because Cloud Run supports WebSockets and allows configuring container concurrency to handle multiple requests simultaneously on a single instance.; Deploy Microservice B to Cloud Functions (2nd gen), because it seamlessly integrates with Cloud Storage Eventarc triggers to execute lightweight code on object creation.

Answer

Deploy Microservice A to Cloud Run to support WebSockets and multi-concurrency per instance, and deploy Microservice B to Cloud Functions (2nd gen) to leverage event-driven Cloud Storage triggers.
Cloud Run is designed for stateless container workloads supporting WebSockets and multi-concurrency (handling multiple simultaneous requests per container instance), making it the optimal choice for Microservice A. Cloud Functions (2nd gen) provides native integration with Cloud Storage event triggers via Eventarc for lightweight event processing, making it the ideal choice for Microservice B.

Step-by-Step Solution

1
Analyze requirements for Microservice A
Microservice A requires WebSocket support and concurrent request handling per instance.
Cloud Run allows long-lived WebSockets and configurable request concurrency per instance within a containerized environment.
2
Analyze requirements for Microservice B
Microservice B is a lightweight Node.js event handler triggered by Cloud Storage file uploads.
Cloud Functions (2nd gen) natively handles Cloud Storage events via Eventarc triggers with zero server management.
3
Evaluate alternative options against serverless and operational criteria
Compute Engine unmanaged instances introduce server maintenance and inefficient polling.
Fully managed serverless options (Cloud Run and Cloud Functions) are preferred for automatic scaling and zero infrastructure overhead.

Key Concept

Selecting Cloud Run vs. Cloud Functions based on container concurrency, WebSocket support, and event triggers.
Question 331Question →

You are deploying a new stateless microservice to an existing Google Kubernetes Engine (GKE) cluster named `prod-app-cluster` located in zone `us-central1-a`. You have authorized the `gcloud` CLI on a new developer workstation with appropriate IAM permissions for the target Google Cloud project. However, when you attempt to execute `kubectl apply -f deployment.yaml`, the command fails with an error stating `The connection to the server localhost:8080 was refused`. Which command should you execute to enable `kubectl` to communicate with the GKE cluster?

Show answer & explanation

Answer: Run `gcloud container clusters get-credentials prod-app-cluster --zone us-central1-a` to update the local kubeconfig file with cluster authentication details and endpoint information.

Answer

Execute `gcloud container clusters get-credentials prod-app-cluster --zone us-central1-a` to retrieve cluster entry points and credentials into the local environment.
Executing `gcloud container clusters get-credentials prod-app-cluster --zone us-central1-a` writes the cluster endpoint and authentication credentials into the client's `kubeconfig` file (`~/.kube/config`). This step configures `kubectl` with the correct control plane address and token necessary to deploy workloads to GKE.

Step-by-Step Solution

1
Identify the root cause of the `localhost:8080 connection refused` error.
Recognize that `kubectl` defaults to `localhost:8080` when no cluster context or credentials are configured in `~/.kube/config`.
`kubectl` requires cluster endpoint address and valid authentication tokens to communicate with the GKE control plane.
2
Select the Google Cloud command designed to generate `kubeconfig` authentication settings.
Use `gcloud container clusters get-credentials` with the cluster name and region/zone flags.
This command securely retrieves the cluster's CA certificate, API endpoint, and generates an authentication token for the active GCP account.
3
Verify execution workflow.
Once `kubeconfig` is updated, `kubectl apply -f deployment.yaml` successfully targets the control plane of `prod-app-cluster`.
The local context is set as current, enabling seamless Kubernetes API requests.

Key Concept

Fetching GKE Cluster Credentials for kubectl authentication
Question 332Question →

A cloud administrator is planning a new Google Kubernetes Engine (GKE) cluster deployment for a suite of web microservices and wants to reduce node management overhead while optimizing resource utilization. The administrator considers provisioning the cluster in GKE Autopilot mode. Which TWO statements accurately describe the operational characteristics and billing model of GKE Autopilot? (Select TWO options.)

Select all that apply

Show answer & explanation

Answer: Google manages node provisioning, scaling, auto-repair, and node security patching automatically.; Billing is based directly on the CPU, memory, and ephemeral storage resources requested by running Pods rather than provisioned Compute Engine VM capacity.

Answer

Google fully manages node provisioning and security, and billing is calculated based on Pod resource requests rather than total node capacity.
GKE Autopilot abstracts away node management by delegating node provisioning, repair, and security patching to Google. Furthermore, its cost model bills based on the Pod's resource requests rather than paying for unutilized node headroom.

Step-by-Step Solution

1
Analyze GKE Autopilot management responsibilities
Autopilot provides a hands-off experience where Google manages all node infrastructure, auto-scaling, operating system updates, and node security hardening.
This directly fulfills the requirement to minimize operational and node management overhead.
2
Analyze the GKE Autopilot pricing model
GKE Autopilot charges users based on the CPU, memory, and storage resource requests specified in the Pod manifests rather than charging for provisioned Compute Engine VM instance sizes.
This guarantees that users pay only for the resources requested by their workloads, avoiding charges for unallocated node capacity.

Key Concept

GKE Autopilot Cluster Architecture and Resource Billing Model
Question 333Question →

You need to deploy a containerized application to a newly provisioned Google Kubernetes Engine (GKE) cluster using Google Cloud CLI and `kubectl`. Place the following administrative and deployment steps in the correct chronological sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Set the active GCP project context via gcloud, 2) Fetch GKE cluster authentication credentials into kubeconfig via get-credentials, 3) Submit the application deployment manifest via kubectl apply, and 4) Verify pod execution state using kubectl get pods.
The correct operational workflow requires specifying the active GCP project first, fetching the Kubernetes API credentials for the target cluster into `kubeconfig` second, applying the YAML deployment specification third, and verifying workload execution fourth.

Step-by-Step Solution

1
Select the active Google Cloud project context.
Ensures all subsequent gcloud commands target the correct project resources.
Setting the project context prevents accidentally interacting with resources in a different project.
2
Generate local kubeconfig authentication credentials using `gcloud container clusters get-credentials`.
Populates local API endpoint address and authentication certificates into `~/.kube/config`.
Without fetching cluster credentials, `kubectl` commands cannot authenticate to the GKE control plane.
3
Execute `kubectl apply -f deployment.yaml`.
Submits the Deployment manifest definition to the GKE Kubernetes API server.
The API server creates the Deployment, ReplicaSet, and Pod objects on worker nodes.
4
Execute `kubectl get pods` to inspect pod state.
Returns current pod status (e.g., Running, ContainerCreating, CrashLoopBackOff).
Verification confirms whether the containers pull successfully and start without errors.

Key Concept

GKE Workload Deployment Workflow
Question 334Question →

A cloud architect is using the Google Cloud Pricing Calculator to model the monthly expense of a data transformation pipeline running in us-central1 for a 30-day month (730 hours). The architecture specifies the following components:
- 5 `n2-standard-4` VM instances operating 24/7 at an un-discounted rate of 0.16perinstance−hour.A3−yearCommittedUseDiscount(CUD)of55−2TB(2,000GB)ofStandardPersistentDiskstorageat0.16 per instance-hour. A 3-year Committed Use Discount (CUD) of 55% is applied to all compute instances. - 2 TB (2,000 GB) of Standard Persistent Disk storage at 0.04 per GB per month.
- 500 GB of network egress from us-central1 to another North American region at $0.12 per GB per month.

Assuming no additional fees or taxes, what is the estimated total monthly cost in USD for this workload?

Show answer & explanation

Answer: 402.8

Answer

The estimated total monthly cost for this architecture is $402.80 USD.
To accurately estimate GCP costs with the Pricing Calculator, compute instance hours are first calculated (5 instances×730 hours=3,650 instance-hours5 \text{ instances} \times 730 \text{ hours} = 3,650 \text{ instance-hours}) and multiplied by the base hourly rate to reach $584.00\$584.00. Applying the 55% Committed Use Discount results in $262.80\$262.80 ($584.00×0.45\$584.00 \times 0.45). Standard Persistent Disk storage (2,000 GB×$0.04=$80.002,000 \text{ GB} \times \$0.04 = \$80.00) and network egress (500 GB×$0.12=$60.00500 \text{ GB} \times \$0.12 = \$60.00) are added without CUD discounts, yielding a total monthly cost of $402.80\$402.80 USD.

Step-by-Step Solution

1
Calculate un-discounted Compute Engine instance costs
$584.00
5 instances running for 730 hours equals 3,650 total instance-hours at $0.16 per hour.
2
Apply the 3-year Committed Use Discount to the compute total
$262.80
A 55% CUD means paying 45% of the baseline compute rate ($584.00 * 0.45).
3
Calculate monthly Persistent Disk storage costs
$80.00
2 TB equals 2,000 GB, charged at $0.04 per GB per month.
4
Calculate inter-region network egress costs
$60.00
500 GB egress charged at $0.12 per GB.
5
Sum all component costs for the total monthly estimate
$402.80
Combining discounted compute (262.80),storage(262.80), storage ( 80.00), and egress (60.00)yields60.00) yields 402.80.

Key Concept

Estimating GCP Costs with the Pricing Calculator
Question 335Question →

An architecture team is planning storage configurations for a web application deployed on Google Cloud Compute Engine. The solution requires: 1) A ultra-fast, temporary caching tier requiring sub-millisecond I/O latency where data loss during instance termination is acceptable. 2) A fully managed relational database service for handling transaction data. Which TWO storage solutions should the team select? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Local SSD attached to Compute Engine instances for the temporary caching tier; Cloud SQL instance for the transactional database layer

Answer

Local SSD attached to Compute Engine instances for the temporary caching tier, and Cloud SQL instance for the transactional database layer.
Local SSDs are directly attached to the physical host running the Compute Engine instance, providing sub-millisecond latency for caching data where persistence across instance reboot/termination is not required. Cloud SQL is the recommended Google Cloud service for fully managed relational databases needing standard SQL capabilities and high availability.

Step-by-Step Solution

1
Evaluate the requirements for the temporary caching tier.
Identify that sub-millisecond latency and ephemeral transient storage point directly to Local SSD.
Local SSDs are physically attached to the host server, offering maximum IOPS and lowest latency for temporary cache data.
2
Evaluate the requirements for the database tier.
Identify that a fully managed relational database engine aligns with Cloud SQL.
Cloud SQL provides managed MySQL, PostgreSQL, and SQL Server instances for relational OLTP workloads.

Key Concept

Selecting GCP Database and Persistent Disk types based on latency, transactional compliance, and persistence requirements.
Question 336Question →

You need to deploy a containerized web application to an existing Google Kubernetes Engine (GKE) cluster from a freshly provisioned administrator workstation. Arrange the following steps in the correct sequential order from first to last to establish cluster access and deploy the application.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct deployment sequence begins with setting the target GCP project ID, fetching the GKE cluster credentials to populate kubeconfig, applying the Kubernetes manifest file, and finally checking the pod execution status.
To interact with a GKE cluster from a command line environment, the administrator must first configure the active GCP project context and fetch the cluster credentials into the local `kubeconfig` file using `gcloud container clusters get-credentials`. Once authentication context is established, `kubectl apply` creates the workload resources, followed by `kubectl get pods` to verify pod startup.

Step-by-Step Solution

1
Configure the GCP project context
The local `gcloud` CLI environment targets the correct Google Cloud project.
Ensures cluster credentials queries target the project where the GKE cluster resides.
2
Generate kubeconfig authentication entries
Local `kubeconfig` file is updated with cluster endpoints and authentication tokens.
`kubectl` requires valid cluster context and credentials to authenticate calls to the GKE control plane.
3
Apply the Deployment manifest
The GKE control plane schedules and provisions the requested Deployment and Pod objects.
Instantiates the workload resources defined in the configuration file onto cluster worker nodes.
4
Inspect Pod execution status
The current lifecycle state (such as `Running` or `CrashLoopBackOff`) of the workload pods is displayed.
Confirms whether the containerized application started successfully without configuration or image retrieval errors.

Key Concept

GKE Cluster Credential Setup and Workload Deployment Workflow
Question 337Question →

An enterprise cloud operations engineer is tasked with linking a newly created Google Cloud project named `analytics-prod-data` to the company's central Cloud Billing account (`01A2B3-4C5D6E-7F8901`). Organization policy mandates strict adherence to the principle of least privilege using predefined IAM roles. Which combination of roles must be assigned to the engineer to enable project billing link management?

Show answer & explanation

Answer: Project Billing Manager (`roles/billing.projectManager`) on the project and Billing Account User (`roles/billing.user`) on the Cloud Billing account

Answer

The engineer must be assigned the Project Billing Manager role (`roles/billing.projectManager`) on the project (or parent folder/organization) and the Billing Account User role (`roles/billing.user`) on the Cloud Billing account.
To link a Google Cloud project to a Cloud Billing account, two distinct permissions are required: `resourcemanager.projects.createBillingAssignment` on the target project and `billing.resourceAssociations.create` on the Cloud Billing account. The predefined role `roles/billing.projectManager` supplies the project permission, while `roles/billing.user` grants the billing account permission. Combining these two predefined roles satisfies the requirement with minimum necessary permissions.

Step-by-Step Solution

1
Identify project-side permission requirements
The user needs the `resourcemanager.projects.createBillingAssignment` permission on the project to modify its billing link.
Google Cloud requires explicit authorization on the project resource to attach or detach billing.
2
Identify billing-account-side permission requirements
The user needs the `billing.resourceAssociations.create` permission on the target Cloud Billing account.
Authorization on the billing account resource ensures that unauthorized users cannot link projects to incur costs on an account.
3
Map required permissions to predefined IAM roles enforcing least privilege
The combination of `roles/billing.projectManager` on the project and `roles/billing.user` on the Cloud Billing account provides both required permissions without excess privileges.
Primitive roles like Owner or broad roles like Billing Account Administrator grant excess capabilities, violating organizational least-privilege policies.

Key Concept

Dual-sided IAM permission requirements for Cloud Billing project linking
Estimated Time:2m 0s
Question 338Question →

A cloud administrator is creating a custom-mode Virtual Private Cloud (VPC) network in Google Cloud to support a new internal application. The environment must be configured with an explicitly defined regional subnet and basic ingress firewall rules. In what sequence should the administrator perform these VPC configuration tasks?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with creating the custom-mode VPC network container, followed by provisioning a regional subnet with a specific CIDR range inside that network, and finally configuring firewall rules to control traffic to the subnet.
When configuring networking in Google Cloud using custom mode, you must first initialize the parent VPC network shell without auto-subnets. Next, you explicitly define regional subnets with custom primary IP ranges under that network. Finally, you attach firewall rules to the VPC network to manage traffic access.

Step-by-Step Solution

1
Provision the custom VPC network
A VPC network without auto-generated subnets is established
Custom mode prevents Google Cloud from automatically creating subnets in every region, requiring manual definition.
2
Provision the regional subnet
A specific subnet with a defined primary IP range is created within the VPC
A parent VPC network must exist in order to contain and define subnets.
3
Configure network firewall rules
Traffic rules are applied to the VPC network to secure subnet instances
Firewall rules require an existing network context to evaluate and filter inbound or outbound traffic.

Key Concept

Custom-mode VPC Creation Sequence
Question 339Question →

A lead financial operations manager at a digital publishing firm needs to authorize an environment manager to link an existing unlinked project, `media-archival-service`, to the enterprise Cloud Billing Account while adhering strictly to the principle of least privilege. Which TWO IAM roles should be granted to the environment manager?

Select all that apply

Show answer & explanation

Answer: Billing Account User (`roles/billing.user`) on the Cloud Billing Account; Project Billing Manager (`roles/billing.projectManager`) on the project

Answer

The user must be granted the Billing Account User role on the Cloud Billing Account and the Project Billing Manager role on the target project.
Linking an existing project to a Cloud Billing Account requires the `resourcemanager.projects.createBillingAssignment` permission on both resources. The Billing Account User (`roles/billing.user`) role supplies this permission for the billing account, and the Project Billing Manager (`roles/billing.projectManager`) role supplies this permission for the project, adhering strictly to least privilege.

Step-by-Step Solution

1
Identify the permission required to link a project to a Cloud Billing Account
The `resourcemanager.projects.createBillingAssignment` permission is required on both the project and the billing account.
Google Cloud authorization controls require permission on both the target resource (project) and the paying entity (billing account).
2
Select the least-privilege predefined role for the Cloud Billing Account
Billing Account User (`roles/billing.user`) provides the necessary permission on the billing account.
Billing Account Administrator grants unnecessary extra permissions such as managing payment profiles and billing permissions.
3
Select the least-privilege predefined role for the Cloud Project
Project Billing Manager (`roles/billing.projectManager`) provides the necessary permission on the project.
Project Owner grants full control over all project resources and IAM policies, violating least privilege.

Key Concept

Configuring least privilege permissions on both billing accounts and projects for billing association
Question 340Question →

An organization's platform team needs to create and manage new Google Cloud projects restricted entirely within a designated folder named 'Data Analytics Sandbox'. The platform team must also link any newly created projects to the corporate billing account. Which set of IAM role assignments meets these requirements following the principle of least privilege?

Show answer & explanation

Answer: Grant Project Creator (roles/resourcemanager.projectCreator) on the 'Data Analytics Sandbox' folder, and Billing Account User (roles/billing.user) on the corporate billing account.

Answer

Grant Project Creator (roles/resourcemanager.projectCreator) on the 'Data Analytics Sandbox' folder, and Billing Account User (roles/billing.user) on the corporate billing account.
Granting Project Creator directly on the target folder restricts project creation to that container, while granting Billing Account User on the billing account provides the explicit authority required to link new projects to corporate billing, perfectly satisfying least privilege.

Step-by-Step Solution

1
Determine project creation scope requirements.
To restrict project creation to a specific folder, grant roles/resourcemanager.projectCreator on that specific folder resource rather than the Organization level.
IAM permissions inherit downward, so folder-scoped assignment limits project creation strictly to that folder.
2
Determine billing account association permissions.
To associate newly created projects with a billing account, assign roles/billing.user on the target billing account resource.
Project creation and billing account linking require distinct permissions; project creators need Billing Account User rights on the billing account itself.

Key Concept

Folder-level IAM delegation and Billing Account linking permissions
Estimated Time:1m 30s
PreviousPage 17 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin