Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 341Question →

An organization is planning a Google Cloud Virtual Private Cloud (VPC) design for a multi-region enterprise workload. The deployment requires Google Kubernetes Engine (GKE) clusters in `us-central1` and `europe-west1`, and the entire cloud footprint must connect to an on-premises network via Cloud VPN. Which TWO subnet and network planning decisions should the architect implement to ensure seamless connectivity without IP routing conflicts?

Select all that apply

Show answer & explanation

Answer: Create a custom-mode VPC network to manually define primary and secondary subnet IP ranges for each region.; Allocate dedicated, non-overlapping secondary IP ranges within each subnet for GKE Pod and Service IP address assignments.

Answer

Create a custom-mode VPC network to manually define primary and secondary subnet IP ranges for each region, and allocate dedicated, non-overlapping secondary IP ranges within each subnet for GKE Pod and Service IP address assignments.
Enterprise hybrid architectures connecting GCP to on-premises environments via Cloud VPN require custom-mode VPC networks to maintain strict control over IP allocation and prevent overlap. Furthermore, GKE VPC-native clusters require secondary IP ranges within subnets to handle Pod and Service IP addressing without conflicting with on-premises routing tables.

Step-by-Step Solution

1
Evaluate network creation mode requirements for enterprise hybrid environments.
Select custom-mode VPC because auto-mode uses predefined CIDRs within 10.128.0.0/910.128.0.0/9 that often overlap with corporate on-premises networks.
Custom-mode VPC allows strict specification of subnet CIDR blocks to prevent IP collision across hybrid Cloud VPN tunnels.
2
Plan IP address allocations for Kubernetes cluster workloads.
Assign dedicated secondary IP ranges for GKE Pods and Services in each regional subnet.
VPC-native GKE clusters rely on secondary IP ranges for Pod and Service networking, which must be routable and non-overlapping across the network.

Key Concept

Planning custom-mode VPC networks and secondary IP ranges for multi-region GKE hybrid deployments
Estimated Time:2m 0s
Question 342Question →

An enterprise DevOps team needs to provision access for an automated deployment service account. The service account must be capable of creating, updating, and managing Google Cloud Pub/Sub topics and subscriptions within a staging project, but must not be granted permissions to modify IAM policies or access unrelated services. To follow Google Cloud security best practices and the principle of least privilege, which IAM configuration approach should you choose?

Show answer & explanation

Answer: Grant the predefined Pub/Sub Admin role (roles/pubsub.admin) to the service account at the staging project level.

Answer

Grant the predefined Pub/Sub Admin role (roles/pubsub.admin) to the service account at the staging project level.
Granting the predefined Pub/Sub Admin role (roles/pubsub.admin) directly at the staging project level gives the service account full management permissions for Pub/Sub topics and subscriptions while preventing access to unrelated GCP services or project IAM settings, perfectly fulfilling the principle of least privilege.

Step-by-Step Solution

1
Analyze the operational requirements
The service account needs administrative access restricted specifically to Cloud Pub/Sub resources in a single staging project.
Identifying the target service and scope is essential for selecting the minimal set of required permissions.
2
Evaluate role types against Google Cloud security best practices
Predefined roles (such as roles/pubsub.admin) isolate permissions to the relevant service, whereas Primitive roles (Owner, Editor, Viewer) grant excessively broad project-wide access.
Google Cloud mandates using predefined or custom roles instead of primitive roles to adhere to the principle of least privilege.
3
Evaluate resource hierarchy placement
Granting the role directly on the target staging project scope grants access to that project only without exposing other projects in the parent folder.
IAM permissions inherit downward and cannot be revoked at lower levels in the GCP resource hierarchy.

Key Concept

Managing IAM Roles and Resource Access Permissions
Estimated Time:2m 0s
Question 343Question →

An enterprise DevOps team is planning compute resources on Google Cloud for two distinct application components. Component 1 consists of a specialized network proxy service that requires custom Linux kernel module modifications. Component 2 consists of multiple stateless REST API microservices packaged in standard Docker containers, where the team wants to eliminate cluster node management overhead. Which compute architecture should the team select to fulfill these requirements?

Show answer & explanation

Answer: Deploy Component 1 on Compute Engine virtual machine instances and Component 2 on Google Kubernetes Engine (GKE) Autopilot clusters.

Answer

Deploy Component 1 on Compute Engine virtual machine instances and Component 2 on Google Kubernetes Engine (GKE) Autopilot clusters.
Compute Engine provides full access to the underlying virtual machine operating system, allowing administrators to load custom kernel modules. GKE Autopilot manages cluster infrastructure and node scaling automatically, eliminating node management overhead for standard containerized microservices.

Step-by-Step Solution

1
Analyze OS and kernel customization requirements for Component 1.
Identify that custom Linux kernel modifications require full infrastructure control provided by Compute Engine VMs, as managed container platforms prohibit host kernel changes.
Managed services like GKE Autopilot, Cloud Run, and Cloud Functions abstract away the underlying host OS and kernel.
2
Analyze operational overhead requirements for Component 2.
Select GKE Autopilot for standard containerized microservices to eliminate node provisioning, auto-scaling, and OS patch management.
GKE Autopilot handles node management automatically, aligning with the goal of reducing operational maintenance.

Key Concept

Selecting GCP Compute Services Based on OS Customization Needs and Operational Overhead
Question 344Question →

A cloud operations team is setting up a new administrative management host to manage workloads on a newly provisioned Google Kubernetes Engine (GKE) cluster named `billing-cluster` in region `us-east4`. Arrange the following administrative and operational commands in the exact sequence required to authenticate, establish cluster context, verify cluster connectivity, and deploy a manifest named `billing-deployment.yaml`.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with authenticating the gcloud CLI, followed by executing `gcloud container clusters get-credentials` to generate the local kubeconfig context, running `kubectl get nodes` to verify control plane connectivity, executing `kubectl apply -f billing-deployment.yaml` to apply the workload configuration, and concluding with `kubectl get pods` to confirm successful workload execution.
Deploying workloads to GKE from a new environment requires establishing Cloud IAM identity first, generating cluster connection entries in `kubeconfig` via `gcloud container clusters get-credentials`, testing cluster control plane responsiveness via `kubectl get nodes`, declaring resources via `kubectl apply`, and finally verifying pod runtime status with `kubectl get pods`.

Step-by-Step Solution

1
Authenticate identity with Google Cloud APIs
Active credentials are established for gcloud CLI operations
Google Cloud authentication must precede requesting cluster endpoint certificates.
2
Fetch cluster endpoint and credential info via `gcloud container clusters get-credentials`
Local `~/.kube/config` file is populated with cluster context and auth parameters
`kubectl` relies on `kubeconfig` settings populated by `gcloud container clusters get-credentials` to locate and authenticate against the GKE API server.
3
Validate cluster node reachability with `kubectl get nodes`
Confirmation that the GKE control plane responds and cluster nodes report `Ready` state
Testing API connectivity prior to deployment isolates authentication or network issues from manifest configuration errors.
4
Deploy workload manifest using `kubectl apply -f billing-deployment.yaml`
Kubernetes objects defined in the manifest are created or updated on the cluster
`kubectl apply` sends the desired state declaration to the GKE control plane.
5
Monitor container status with `kubectl get pods`
Verification that pods transition from `ContainerCreating` to `Running` state
Post-deployment inspection ensures image pull, scheduling, and health check steps complete successfully.

Key Concept

Sequential lifecycle management for GKE cluster access and workload deployment
Question 345Question →

A digital asset management platform needs to deploy an image resizing service on Google Cloud. The service requires a custom-compiled C++ graphic library dependency, processes incoming HTTP POST requests with payloads up to 20 MB, and must handle multiple concurrent requests per container instance to reduce operational cost. The solution must scale to zero instances when idle. Which Google Cloud compute option should you recommend?

Show answer & explanation

Answer: Cloud Run, because it allows packaging custom system binaries into container images and supports multi-concurrency per instance.

Answer

Cloud Run, because it allows packaging custom system binaries into container images and supports multi-concurrency per instance.
The correct choice highlights Cloud Run's ability to run custom container images containing any compiled binaries (such as C++ graphics libraries) while serving multiple concurrent HTTP requests per instance, making it both technically compatible and cost-efficient.

Step-by-Step Solution

1
Analyze the operational requirements: custom C++ binary dependencies, stateless HTTP workload, multi-concurrency per instance, and scaling to zero.
Identified that custom system libraries require custom container packaging.
Standard managed runtime environments in Cloud Functions do not allow arbitrary C++ library installations outside standard package managers.
2
Evaluate Cloud Run capabilities against requirements.
Cloud Run supports custom Docker/OCI container images (allowing custom C++ compilation) and configurable container concurrency (processing up to 80+ concurrent requests per instance).
Cloud Run combines serverless scaling-to-zero with the flexibility of custom container images and efficient request concurrency.

Key Concept

Evaluating serverless compute options based on runtime customization, binary dependencies, and concurrency model.
Question 346Question →

An enterprise organization maintains a custom-mode Virtual Private Cloud (VPC) network connected to an on-premises data center (172.16.0.0/20172.16.0.0/20) via Cloud VPN. A subnet in the us−east1us-east1 region is currently configured with the following parameters:

- Primary IP range: 172.16.20.0/24172.16.20.0/24 (used for Compute Engine virtual machines)
- Secondary IP range: 172.16.22.0/24172.16.22.0/24 (used for Google Kubernetes Engine pod IP allocation)

Due to rapid growth, the engineering team must expand the primary IP address range of this subnet to support at least 500 Compute Engine instances. The update must be executed without replacing the subnet or causing downtime, while ensuring zero IP overlap with the existing secondary range or the on-premises network. Which primary IP address range configuration should be applied to the subnet?

Show answer & explanation

Answer: Expand the primary IP range to 172.16.20.0/23172.16.20.0/23

Answer

Expand the primary IP range to 172.16.20.0/23172.16.20.0/23
Expanding the primary range to 172.16.20.0/23172.16.20.0/23 provides 512 total IP addresses (507 usable), satisfying the requirement for 500 instances. It starts on a valid /23/23 network boundary, fully encompasses the original 172.16.20.0/24172.16.20.0/24 primary range, and ends at 172.16.21.255172.16.21.255. This leaves the secondary range (172.16.22.0/24172.16.22.0/24) completely unencumbered and avoids collision with the on-premises CIDR block (172.16.0.0/20172.16.0.0/20).

Step-by-Step Solution

1
Determine required IP capacity and prefix length
To support at least 500 VM instances, a /23/23 subnet mask is required (512 total addresses, 507 usable by GCP after accounting for 5 reserved addresses).
A /24/24 subnet provides 256 addresses (251 usable), which is insufficient for 500 instances.
2
Analyze valid CIDR boundary alignment and primary range inclusion rules
GCP primary subnet expansion requires the new CIDR range to contain the existing primary CIDR (172.16.20.0/24172.16.20.0/24). A /23/23 block containing 172.16.20.0/24172.16.20.0/24 must start on a /23/23 boundary (172.16.20.0/23172.16.20.0/23, spanning 172.16.20.0−172.16.21.255172.16.20.0 - 172.16.21.255).
Subnet ranges must be contiguous and align with standard netmask boundaries.
3
Verify non-overlap with secondary ranges and hybrid connectivity routes
The range 172.16.20.0/23172.16.20.0/23 (172.16.20.0−172.16.21.255172.16.20.0 - 172.16.21.255) does not intersect with the secondary range 172.16.22.0/24172.16.22.0/24 (172.16.22.0−172.16.22.255172.16.22.0 - 172.16.22.255) or the on-premises network 172.16.0.0/20172.16.0.0/20 (172.16.0.0−172.16.15.255172.16.0.0 - 172.16.15.255).
GCP prevents expanding subnets into ranges that overlap with existing secondary IP ranges or peered/VPN routes.

Key Concept

Planning primary subnet CIDR expansion in GCP Custom VPCs while respecting CIDR boundary alignment, secondary IP range isolation, and hybrid network non-overlap constraints.
Estimated Time:2m 0s
Question 347Question →

An enterprise telemetry engineering team is designing a scalable batch data processing pipeline on Google Cloud. The workload requires custom Linux kernel parameters (`sysctl` settings) on the underlying cluster nodes to handle high network socket churn. The batch processing jobs are fully fault-tolerant and can recover gracefully from node terminations. Additionally, a cloud engineer needs to configure a new administrator workstation to manage workloads on this newly provisioned cluster. Which deployment and configuration strategy satisfies all requirements while following Google Cloud best practices?

Show answer & explanation

Answer: Deploy a GKE Standard cluster containing a Spot VM node pool configured with custom `sysctl` node settings, fetch cluster credentials using `gcloud container clusters get-credentials <cluster-name>`, and execute `kubectl apply -f deployment.yaml`.

Answer

Deploy a GKE Standard cluster containing a Spot VM node pool configured with custom `sysctl` node settings, fetch cluster credentials using `gcloud container clusters get-credentials <cluster-name>`, and execute `kubectl apply -f deployment.yaml`.
The correct strategy leverages GKE Standard to allow custom node kernel modifications (`sysctl`), uses Spot VM node pools to minimize compute cost for fault-tolerant batch jobs, and uses `gcloud container clusters get-credentials` to generate the necessary `kubeconfig` credentials for workstation `kubectl` access.

Step-by-Step Solution

1
Evaluate operational mode requirements (Autopilot vs. Standard)
GKE Standard must be selected because GKE Autopilot restricts node-level administration, preventing custom Linux kernel `sysctl` parameters.
Autopilot manages the node infrastructure and locks down system kernel modifications for security and reliability.
2
Determine appropriate node pool compute pricing model
Select a Spot VM node pool for the GKE Standard cluster.
Batch processing jobs are fault-tolerant, making them ideal candidates for Spot VMs to reduce compute expenses by up to 60-91%.
3
Configure local administration workstation authentication
Execute `gcloud container clusters get-credentials <cluster-name> --zone <zone>`.
This command fetches cluster API endpoints and OAuth authentication tokens, updating `$HOME/.kube/config` so `kubectl` can authenticate against the control plane.
4
Deploy workload to the cluster
Execute `kubectl apply -f deployment.yaml` successfully.
With valid `kubeconfig` context pointing to a cluster that supports custom node kernel settings, the deployment manifest applies cleanly.

Key Concept

GKE Cluster Mode Selection, Spot Node Pool Usage, and Kubeconfig Context Generation
Question 348Question →

A cloud engineer is provisioning block storage for a batch-processing application running on a Compute Engine virtual machine. The application requires a low-cost disk primarily used for sequential read and write operations on large files where high IOPS per gigabyte is not required. Which Google Cloud storage option best meets these requirements?

Show answer & explanation

Answer: Standard Persistent Disk (pd-standard)

Answer

Standard Persistent Disk (pd-standard) is the correct choice because it offers low-cost HDD-based block storage suitable for sequential IO workloads on Compute Engine virtual machines.
Standard Persistent Disk (pd-standard) is backed by hard disk drives (HDD) and offers the most economical block storage option for Compute Engine instances handling sequential read/write operations and batch workloads.

Step-by-Step Solution

1
Identify the storage tier requirement
The application requires durable block storage attached to a Compute Engine VM.
Block storage is needed for direct file system access on Compute Engine instances.
2
Evaluate performance and cost constraints
Standard Persistent Disk (pd-standard) provides the lowest cost per GB among persistent disks for sequential IO workloads without requiring high random IOPS performance.
HDD-backed standard persistent disks prioritize cost efficiency for sequential throughput over high-cost SSD performance.

Key Concept

Compute Engine Persistent Disk Types and Block Storage Planning
Question 349Question →

A cloud engineering team is provisioning a new node pool in an existing GKE Standard cluster specifically to execute fault-tolerant, stateless batch processing jobs. The team needs to minimize compute costs for these workloads while ensuring nodes can be preempted if Google Cloud requires the capacity. Which configuration should they select when creating the node pool?

Show answer & explanation

Answer: Enable Spot VMs on the new node pool.

Answer

Enabling Spot VMs on the new node pool is the Google-recommended approach for running cost-effective, fault-tolerant batch workloads in GKE.
Enabling Spot VMs on a GKE node pool allows stateless and interruption-tolerant workloads to run on spare compute capacity at a steep discount, achieving maximum cost savings for batch processing.

Step-by-Step Solution

1
Analyze workload requirements
The workload consists of stateless, fault-tolerant batch processing tasks capable of handling instance termination.
Fault-tolerant batch jobs do not require guaranteed VM availability.
2
Identify cost optimization features in GKE node pools
Spot VMs provide significant discounts (up to 60-91% off standard pricing) in exchange for potential preemption.
Google Cloud permits Spot VMs to be reclaimed when capacity is needed elsewhere, making them optimal for batch processing.

Key Concept

GKE Spot VM Node Pools for Batch Processing
Question 350Question →

A cloud engineer is designing a custom-mode Virtual Private Cloud (VPC) network in Google Cloud that will be connected to an on-premises data center using Cloud VPN. Which design requirement must be met when allocating primary IP address ranges for the subnets?

Show answer & explanation

Answer: The primary IP address ranges of the subnets must not overlap with the IP address ranges used in the on-premises network.

Answer

The primary IP address ranges of the subnets must not overlap with the IP address ranges used in the on-premises network.
When connecting a Google Cloud VPC to an on-premises network via Cloud VPN or Cloud Interconnect, all subnet IP address ranges must be unique and non-overlapping. Overlapping CIDRs lead to routing conflicts where network packets cannot be properly forwarded.

Step-by-Step Solution

1
Analyze hybrid network connectivity requirements
Identify that Cloud VPN establishes Layer 3 connectivity between Google Cloud VPC subnets and on-premises networks.
Traffic routing between VPCs and local networks requires unambiguous IP destination routes.
2
Evaluate IP address planning rules for Google Cloud VPC subnets
Ensure non-overlapping CIDR blocks are chosen across all connected environments.
Overlapping CIDR blocks create routing ambiguities, preventing packets from reaching their destination.

Key Concept

VPC Subnet IP Address Allocation and Non-Overlapping CIDR Requirements
Question 351Question →

An enterprise is planning to migrate a continuous log processing pipeline to Google Cloud and must estimate monthly operational expenses using the Google Cloud Pricing Calculator. The requirements specify running ten e2-standard-4 Compute Engine virtual machine instances 24/7 for telemetry processing, storing 50 TB of compliance log archives that are accessed only once every six months, and transferring 5 TB of data outbound to an on-premises data center every month. How should the cloud engineer configure the parameters in the Google Cloud Pricing Calculator to ensure the most accurate and cost-effective estimate?

Show answer & explanation

Answer: Specify ten e2-standard-4 Compute Engine instances with a 1-year or 3-year Committed Use Discount (CUD), set the Storage class for log archives to Coldline Storage, and enter 5 TB under Network Internet Egress.

Answer

Configure ten e2-standard-4 Compute Engine instances with a 1-year or 3-year Committed Use Discount (CUD), set the log archive storage class to Coldline Storage, and include 5 TB under Network Internet Egress.
For continuous 24/7 VM workloads, selecting Committed Use Discounts (CUDs) provides maximum savings. Storing 50 TB of archive logs accessed bi-annually matches Coldline Storage lifecycle characteristics, and outbound traffic to an on-premises facility represents billable Internet Egress that must be explicitly included in the pricing calculator.

Step-by-Step Solution

1
Analyze Compute Engine discount models for 24/7 continuous workloads.
Committed Use Discounts (CUDs) offer significantly higher savings (up to 57%) compared to Sustained Use Discounts (SUDs) or standard on-demand pricing for predictable 24/7 workloads.
Since the workload runs non-stop 24/7, committing to 1-year or 3-year resource usage yields maximum cost savings, whereas Spot VMs are unsuitable due to preemption risk.
2
Select the appropriate Cloud Storage class based on access frequency.
Coldline Storage is optimal for data accessed roughly once every 90 to 180 days (such as bi-annual compliance audits).
Coldline Storage minimizes monthly GB storage cost while maintaining lower retrieval penalties than Archive Storage for bi-annual access.
3
Include external network egress traffic in the Pricing Calculator.
5 TB of monthly data transferred outbound from GCP to an on-premises location must be explicitly added to the Network Internet Egress pricing section.
Inbound data transfer is free in Google Cloud, but outbound data transfer over the internet to external destinations incurs standard internet egress charges.

Key Concept

Estimating GCP Costs with the Pricing Calculator
Question 352Question →

A financial technology firm is planning a Google Cloud Storage strategy for transaction verification logs to comply with industry regulations. The data lifecycle and access pattern requirements are defined as follows:

- Days 1 to 30: Newly generated logs are queried multiple times per day by real-time automated fraud detection systems.
- Days 31 to 365: Logs are accessed approximately once per month by compliance officers during scheduled financial reconciliation audits.
- Day 366 onwards: Logs are kept strictly for regulatory compliance for an additional 6 years, with an anticipated read frequency of less than once per year.

Which Cloud Storage lifecycle management configuration minimizes total cost of ownership (storage fees plus retrieval charges) while avoiding retrieval penalty costs?

Show answer & explanation

Answer: Set the default storage class to Standard. Add a lifecycle rule to transition objects to Nearline storage after 30 days, and a second lifecycle rule to transition objects to Archive storage after 365 days.

Answer

Set the default storage class to Standard, configure a lifecycle rule to transition objects to Nearline storage after 30 days, and configure a second lifecycle rule to transition objects to Archive storage after 365 days.
The correct strategy starts with Standard storage to support intensive daily fraud detection reads without data retrieval fees. At 30 days, transitioning to Nearline storage matches the monthly audit access pattern, as Nearline is optimized for data accessed at most once per month (30-day minimum storage commitment). Finally, moving to Archive storage after 365 days minimizes long-term storage fees for 6-year regulatory compliance where reads occur less than once per year.

Step-by-Step Solution

1
Analyze the access pattern for Days 1–30
High-frequency daily access by automated fraud models requires Standard Storage, which has zero retrieval fees and no minimum retention duration.
Choosing Nearline, Coldline, or Archive for initial ingest would incur per-GB data retrieval fees every time logs are queried daily.
2
Analyze the access pattern for Days 31–365
Monthly access (once every ~30 days) maps precisely to Nearline Storage, which is designed for data accessed less than once a month and carries a 30-day minimum storage duration.
Transitioning to Coldline (designed for 90-day access cycles) would cause higher per-GB retrieval fee charges during the monthly audits.
3
Analyze the access pattern for Day 366 onwards
Access frequency of less than once per year maps directly to Archive Storage, providing the lowest monthly storage rate for 6-year regulatory compliance retention.
Archive storage offers maximum cost efficiency for long-term cold retention where access is rare.

Key Concept

Selecting Cloud Storage Classes and Lifecycle Rules based on Access Patterns and Minimum Storage Durations
Estimated Time:2m 0s
Question 353Question →

Your organization requires a junior cloud administrator to manage IAM policy bindings for users on a specific project and inspect predefined and custom role definitions. The administrator must not be granted permissions to modify project resources, create custom roles, or manage project billing. Which TWO predefined IAM roles should you grant to the junior administrator on the project to adhere to the principle of least privilege? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Project IAM Admin (roles/resourcemanager.projectIamAdmin); Role Viewer (roles/iam.roleViewer)

Answer

Grant the Project IAM Admin (roles/resourcemanager.projectIamAdmin) role to manage project-level IAM policy bindings and the Role Viewer (roles/iam.roleViewer) role to inspect predefined and custom role definitions.
To satisfy least privilege requirements, administrative responsibilities must be scoped using specific predefined roles. The Project IAM Admin role allows managing project-level IAM policy bindings, and the Role Viewer role allows inspecting role definitions. Combined, these roles grant the exact permissions required without exposing project resources or billing settings.

Step-by-Step Solution

1
Analyze the access requirements for the junior cloud administrator.
The user needs to manage IAM access control bindings on a project and inspect role definitions, but must not modify compute/storage resources, create custom roles, or manage billing.
Least privilege requires choosing the standard predefined roles that match exact task boundaries.
2
Select the appropriate role for managing policy bindings.
Project IAM Admin (roles/resourcemanager.projectIamAdmin) grants permissions to get and set IAM policies at the project level without granting underlying resource access.
Predefined roles should always be selected over broad primitive roles like Editor or Owner.
3
Select the appropriate role for viewing role definitions.
Role Viewer (roles/iam.roleViewer) grants read-only access to custom and predefined role metadata across IAM.
This fulfills the inspection requirement without allowing custom role creation or modification.

Key Concept

Selecting granular predefined IAM roles for managing project access policies and inspecting role definitions based on the principle of least privilege.
Question 354Question →

A developer needs to deploy a batch processing workload consisting of stateless, fault-tolerant jobs to an existing Google Kubernetes Engine (GKE) Standard cluster. The primary operational objective is to minimize compute costs for these batch tasks without risking the stability of critical system workloads running on the cluster. Which node pool configuration strategy should the developer implement?

Show answer & explanation

Answer: Create a dedicated node pool with Spot VMs enabled, apply a taint to the node pool, and configure the batch deployment manifests with matching tolerations.

Answer

Create a dedicated node pool with Spot VMs enabled, apply a taint to the node pool, and configure the batch deployment manifests with matching tolerations.
Stateless, fault-tolerant batch workloads are ideal candidates for GKE Spot VM node pools due to significant cost savings. Creating a dedicated node pool with taints ensures that default or non-fault-tolerant system workloads are not placed on preemptible nodes, while adding matching tolerations to the batch workload allows Kubernetes to schedule those specific pods onto the Spot nodes.

Step-by-Step Solution

1
Identify workload characteristics and requirements
Workloads are stateless, batch-oriented, and fault-tolerant, making them ideal candidates for Spot VMs.
Spot VMs offer steep discounts but can be reclaimed by GCP at any time with short notice.
2
Isolate fault-tolerant workloads from core cluster workloads
Provision a new dedicated node pool using Spot VMs rather than modifying default system node pools.
Core cluster system pods require guaranteed availability and should not run on preemptible instances.
3
Configure scheduling constraints using taints and tolerations
Taint the Spot node pool and add corresponding tolerations to the batch deployment specs.
Taints ensure that only pods specifically configured to tolerate preemptible nodes are scheduled onto the Spot node pool.

Key Concept

Configuring Spot VM Node Pools with Taints and Tolerations in GKE
Question 355Question →

A central cloud administrator needs to authorize a lead developer to provision new Google Cloud projects restricted exclusively within a specific folder named "Mobile-Apps" and link those newly created projects to the corporate Billing Account. Adhering to the principle of least privilege, which of the following IAM role assignments are required to accomplish this setup? (Select TWO correct answers.)

Select all that apply

Show answer & explanation

Answer: Grant the lead developer the Project Creator role (roles/resourcemanager.projectCreator) on the Mobile-Apps folder.; Grant the lead developer the Billing Account User role (roles/billing.user) on the corporate Billing Account.

Answer

Assign the Project Creator role on the target folder (Mobile-Apps) and the Billing Account User role on the corporate Billing Account.
To allow creating projects restricted strictly inside a folder and linking them to billing under least privilege, two specific roles are required: the Project Creator role on the specific destination folder and the Billing Account User role directly on the Billing Account.

Step-by-Step Solution

1
Determine folder-level project creation permissions
Identify that assigning Project Creator bound to the specific folder scopes project creation rights to that container.
Granting project creation rights at the target folder level ensures project creation is restricted strictly within that folder while enforcing least privilege.
2
Determine billing linking requirements
Identify that the Billing Account User role must be assigned directly on the target Billing Account.
Linking any newly created project to a billing account requires authorization granted on the billing account resource itself.

Key Concept

Folder-level scoped project creation and billing account IAM binding for least-privilege administrative delegation.
Question 356Question →

An organization is designing its Compute Engine architecture for a new IoT telemetry processing system. The architecture consists of two primary components:

1. A stateful PostgreSQL database instance that requires exactly 6 vCPUs and 45 GB of memory, running continuously 24/7 without interruption.
2. A stateless worker fleet that processes incoming message batches in parallel, where individual task interruptions are acceptable and automatically retried by an upstream queue.

Which TWO deployment strategies should the cloud engineer choose to meet these requirements while optimizing compute costs? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision a custom machine type with 6 vCPUs and 45 GB of RAM for the stateful database instance.; Deploy Spot VM instances for the stateless batch processing worker fleet.

Answer

The cloud engineer should provision a custom machine type (6 vCPUs, 45 GB memory) for the persistent PostgreSQL database and deploy Spot VMs for the fault-tolerant, stateless batch worker fleet.
For the stateful database instance requiring a non-standard 6 vCPU / 45 GB RAM ratio, creating a custom machine type ensures exact resource allocation without paying for unused capacity in larger predefined sizes. For the stateless batch worker fleet, using Spot VMs provides maximum cost efficiency because the workload is designed to tolerate instance preemption and task retries.

Step-by-Step Solution

1
Analyze resource requirements for the stateful database
The requirement (6 vCPUs, 45 GB RAM) does not match standard n2-standard ratios (1:4). Using a custom machine type avoids paying for excess vCPUs or RAM.
Custom machine types allow exact provisioning of vCPUs and RAM for specific compute profiles.
2
Evaluate fault tolerance for the worker fleet
The worker fleet is stateless and upstream queues retry interrupted jobs. Spot VMs are ideal for this workload.
Spot VMs provide large discounts (60-90%) for fault-tolerant batch processing.

Key Concept

Selecting optimal Compute Engine machine types and instance lifecycles based on workload statefulness and custom resource ratios.
Question 357Question →

A system administrator needs to accommodate 1,000 additional virtual machines within an existing custom-mode VPC primary subnet located in the `us-west1` region. The current subnet uses the primary IP CIDR block 10.50.4.0/2410.50.4.0/24. The company's on-premises network uses 10.50.0.0/2210.50.0.0/22, so any new address space must not overlap with on-premises routes. Which action should the administrator take to expand the subnet capacity without causing downtime or IP space collisions?

Show answer & explanation

Answer: Expand the primary IP range of the existing subnet to 10.50.4.0/2210.50.4.0/22 using the Google Cloud CLI.

Answer

Expand the primary IP range of the existing subnet to 10.50.4.0/2210.50.4.0/22 using the Google Cloud CLI.
Expanding the primary range to 10.50.4.0/2210.50.4.0/22 decreases the prefix length from `/24` to `/22`, provides over 1,000 usable IP addresses, fully encompasses the original 10.50.4.0/2410.50.4.0/24 range, and avoids overlapping with the on-premises range 10.50.0.0/2210.50.0.0/22.

Step-by-Step Solution

1
Analyze capacity requirements and subnet expansion rules in GCP.
To support 1,000 VMs, a subnet mask of at least `/22` (providing 210−4=10202^{10} - 4 = 1020 usable IPs) is required. GCP allows expanding primary subnet ranges without downtime, provided the prefix length decreases (e.g., from `/24` to `/22`) and the new range fully contains the existing range.
GCP subnet primary ranges can only be expanded, never shrunk, and the original range must remain within the boundary of the new CIDR block.
2
Evaluate the CIDR boundary for 10.50.4.0/2210.50.4.0/22.
The range 10.50.4.0/2210.50.4.0/22 spans IP addresses 10.50.4.010.50.4.0 through 10.50.7.25510.50.7.255. This fully encompasses the existing 10.50.4.0/2410.50.4.0/24 range (10.50.4.010.50.4.0 – 10.50.4.25510.50.4.255).
This maintains continuity for existing workloads and provides 1,024 total IP addresses.
3
Verify collision avoidance with on-premises networks.
The on-premises network uses 10.50.0.0/2210.50.0.0/22 (10.50.0.010.50.0.0 – 10.50.3.25510.50.3.255). The new GCP subnet range 10.50.4.0/2210.50.4.0/22 (10.50.4.010.50.4.0 – 10.50.7.25510.50.7.255) is completely disjoint from the on-premises range.
Prevents routing ambiguity across hybrid Cloud VPN or Interconnect connections.

Key Concept

VPC Subnet Primary CIDR Expansion Rules
Question 358Question →

A software architect needs to enable an environment engineer to link a newly provisioned Google Cloud project to the organization's central Cloud Billing Account. Following the principle of least privilege, which combination of IAM roles must be granted to the engineer?

Show answer & explanation

Answer: Project Billing Manager (roles/billing.projectManager) on the target project, and Billing Account User (roles/billing.user) on the Cloud Billing Account

Answer

The correct role combination is Project Billing Manager on the target project and Billing Account User on the Cloud Billing Account.
Linking a project to a Cloud Billing Account requires permissions on both resources: Project Billing Manager (roles/billing.projectManager) grants resourcemanager.projects.createBillingAssignment on the project, while Billing Account User (roles/billing.user) grants billing.resourceAssociations.create on the billing account. This fulfills least-privilege security requirements.

Step-by-Step Solution

1
Identify the project-level permission requirement
Linking a project requires the resourcemanager.projects.createBillingAssignment permission on the project, provided by Project Billing Manager (roles/billing.projectManager) or Project Owner.
The user must have permission to modify billing configuration for that specific project.
2
Identify the billing account-level permission requirement
Linking to a billing account requires the billing.resourceAssociations.create permission on the billing account, provided by Billing Account User (roles/billing.user).
The user must be authorized to attach resource costs to the specified billing account.
3
Apply the principle of least privilege
Combining Project Billing Manager on the project with Billing Account User on the billing account provides the minimal viable access.
This avoids granting full Project Owner or Billing Account Administrator permissions.

Key Concept

Linking Google Cloud projects to a billing account requires dual permissions: Project Billing Manager on the project and Billing Account User on the billing account.
Question 359Question →

A cloud architecture team is planning the deployment of two distinct serverless components on Google Cloud:

Component 1: A stateless REST API packaged as a custom Docker container image that must handle multiple concurrent HTTP requests per instance to optimize resource efficiency.
Component 2: A lightweight, event-driven Python background script that executes strictly whenever a new file is uploaded to a specific Cloud Storage bucket.

Which two architecture choices correctly align with Google Cloud best practices for these serverless workloads?

Select all that apply

Show answer & explanation

Answer: Deploy Component 1 to Cloud Run, because Cloud Run supports custom container images and allows a single instance to handle multiple concurrent requests.; Deploy Component 2 to Cloud Functions using a Cloud Storage event trigger to execute the Python script upon object creation.

Answer

Deploy Component 1 to Cloud Run because it natively supports custom Docker containers and multi-concurrency, and deploy Component 2 to Cloud Functions using a Cloud Storage trigger for lightweight event-driven execution.
The decision to deploy the containerized REST API to Cloud Run correctly matches Cloud Run's native support for custom container images and concurrent HTTP request processing. The decision to deploy the Python file handler to Cloud Functions correctly utilizes Cloud Functions' native integration with Cloud Storage event triggers.

Step-by-Step Solution

1
Analyze requirements for Component 1
Component 1 is a stateless REST API packaged as a custom Docker container requiring multi-concurrency per instance.
Cloud Run is the optimal Google Cloud serverless compute platform for containerized applications that handle concurrent HTTP requests.
2
Analyze requirements for Component 2
Component 2 is a simple Python script triggered by file creation in Cloud Storage.
Cloud Functions is designed for simple, event-driven code execution in response to infrastructure events like Cloud Storage bucket uploads.

Key Concept

Differentiating between Cloud Run (container-native, HTTP multi-concurrency) and Cloud Functions (event-driven code snippets) when planning serverless architectures.
Question 360Question →

A financial technology company is planning its Google Cloud infrastructure for two distinct containerized workloads:

1. A stateless transaction routing microservice that requires zero node-management overhead and must automatically scale rapidly during unexpected traffic spikes.
2. A legacy batch calculation engine that requires custom node-level kernel tuning (`sysctl` parameters) and runs non-critical, fault-tolerant data processing tasks.

The platform engineering team needs to optimize operational efficiency and minimize compute costs while adhering to all system constraints. Which TWO architectural decisions should the team implement?

Select all that apply

Show answer & explanation

Answer: Provision a dedicated GKE Autopilot cluster for the stateless transaction routing microservice to eliminate node provisioning and infrastructure management overhead.; Provision a dedicated GKE Standard cluster with a Spot VM node pool for the legacy batch calculation engine to allow custom sysctl kernel configurations and minimize compute costs.

Answer

The correct architectural decisions are: 1) Deploying the stateless transaction routing microservice on a GKE Autopilot cluster to eliminate node management, and 2) Deploying the legacy batch calculation engine on a GKE Standard cluster with Spot VMs to allow custom sysctl kernel settings while minimizing compute costs.
GKE Autopilot provides a fully managed environment where Google handles node provisioning and management, making it optimal for stateless microservices that require low operational overhead. GKE Standard is necessary for workloads that require node-level customizations such as custom sysctl kernel settings. Provisioning a GKE Standard node pool with Spot VMs for fault-tolerant batch workloads optimizes compute costs significantly.

Step-by-Step Solution

1
Analyze the requirements for the stateless transaction routing microservice.
The microservice needs zero node-management overhead and fast autoscaling.
GKE Autopilot fully manages node provisioning, scaling, and maintenance, making it the ideal operational choice for stateless workloads requiring low overhead.
2
Analyze the requirements for the legacy batch calculation engine.
The workload requires custom node-level sysctl kernel tuning and is fault-tolerant.
Custom node kernel parameters require GKE Standard because Autopilot restricts system-level OS modifications. Because the workload is fault-tolerant, utilizing Spot VMs minimizes compute costs.
3
Evaluate why combining these workloads in a single GKE Autopilot or Standard configuration fails constraints.
Autopilot blocks custom node sysctl settings, and Spot VMs are unsafe for critical transaction routing services.
A multi-cluster approach isolates node-level OS requirements while matching cost and availability profiles to each workload.

Key Concept

Selecting between GKE Autopilot and GKE Standard cluster architectures based on operational boundaries (custom node OS/kernel configurations) and workload tolerance (Spot VMs vs. high availability).
Estimated Time:2m 0s
PreviousPage 18 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin