Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 401Question →

A company is migrating a two-tier enterprise application to Google Compute Engine. The workload consists of two main components:
1. A stateful transactional SQL database that runs continuously 24/7 and cannot tolerate unexpected shutdowns or interruptions.
2. A nightly data transformation batch process that runs for 2 hours, is fully fault-tolerant, and regularly saves state to checkpoint files.

Which TWO deployment strategies should the cloud engineer select to meet these operational requirements while maximizing cost effectiveness?

Select all that apply

Show answer & explanation

Answer: Purchase Committed Use Discounts (CUDs) for the compute resources allocated to the continuous 24/7 transactional database instance.; Provision Spot Virtual Machines (Spot VMs) for the fault-tolerant nightly data transformation batch processing job.

Answer

Purchasing Committed Use Discounts (CUDs) for the continuous 24/7 database instance and provisioning Spot VMs for the fault-tolerant nightly batch processing job.
Purchasing Committed Use Discounts (CUDs) for the continuous 24/7 database instance ensures stable, uninterrupted capacity at significantly reduced costs. Provisioning Spot VMs for the batch transformation job minimizes compute costs for fault-tolerant, checkpoint-enabled processing.

Step-by-Step Solution

1
Analyze the availability and runtime characteristics of the transactional SQL database.
The database runs continuously 24/7 and cannot tolerate unexpected interruptions. Therefore, baseline compute Committed Use Discounts (CUDs) offer maximum cost savings with guaranteed continuous capacity.
CUDs require a 1-year or 3-year term commitment, matching steady-state continuous production workloads.
2
Analyze the runtime characteristics of the nightly data transformation batch process.
The batch job runs for only 2 hours daily, is fault-tolerant, and supports checkpointing. Spot VMs are ideal because they offer up to 60-91% discounts compared to standard VM pricing.
Interruption of a batch instance does not cause data loss due to frequent checkpoint saving.

Key Concept

Planning Compute Engine Workloads: Aligning Committed Use Discounts (CUDs) with continuous baseline workloads and Spot VMs with fault-tolerant batch workloads.
Estimated Time:1m 30s
Question 402Question →

An engineering team is attempting to deploy a stateless microservice to a Google Kubernetes Engine (GKE) Autopilot cluster. The Kubernetes Deployment manifest includes a Pod specification that configures a `hostPath` volume to write cache files directly to the host node directory `/var/cache/app`. When the team executes `kubectl apply -f deployment.yaml`, the Kubernetes API server rejects the request. The team must deploy the application on GKE Autopilot using container best practices while adhering to Google Cloud security boundaries. Which change should the team make to resolve this deployment issue?

Show answer & explanation

Answer: Replace the `hostPath` volume with an `emptyDir` volume in the Pod specification to provide temporary storage without accessing the host filesystem.

Answer

Replace the hostPath volume with an emptyDir volume in the Pod specification to provide temporary storage without accessing the host filesystem.
In GKE Autopilot, Google manages the underlying nodes, security hardening, and host OS. To guarantee node integrity, Autopilot restricts privileged operations, including custom `hostPath` volume mounts. Replacing `hostPath` with an `emptyDir` volume provides the workload with scratch/cache storage isolated to the pod without breaking Autopilot security guardrails.

Step-by-Step Solution

1
Analyze the error cause on GKE Autopilot
GKE Autopilot manages node provisioning and security automatically. It enforces baseline pod security policies that prohibit mounting arbitrary host OS paths via `hostPath` volumes.
Host filesystem access undermines container isolation and managed node security.
2
Select a Kubernetes storage mechanism supported by GKE Autopilot
Using an `emptyDir` volume or a persistent volume claim (PVC) allocates storage dedicated to the pod lifetime or managed persistent disks.
An `emptyDir` volume satisfies the requirement for temporary cache storage while remaining fully compliant with Autopilot security boundaries.

Key Concept

GKE Autopilot Workload Security Constraints and Storage Mechanisms
Estimated Time:2m 0s
Question 403Question →

A cloud engineer needs to configure a local command-line environment and deploy a containerized application to an existing Google Kubernetes Engine (GKE) cluster. In what sequential order should the engineer execute these tasks from start to finish?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with setting the gcloud project context, fetching the GKE cluster credentials into kubeconfig, validating cluster access with kubectl cluster-info, and finally deploying the application manifest with kubectl apply.
The deployment process requires setting the project context first so gcloud references the correct project. Next, generating local credentials populates kubeconfig, establishing a valid context for kubectl. Validating connection via cluster-info verifies the setup. Finally, applying the manifest submits the workload definition to the GKE control plane.

Step-by-Step Solution

1
Set the active GCP project
The CLI is configured to target the correct project.
Before executing cluster operations, gcloud must point to the project hosting the GKE cluster.
2
Run gcloud container clusters get-credentials
Local kubeconfig is populated with API endpoint and auth token/certificates.
kubectl requires local credentials and control plane address to interact with GKE.
3
Execute kubectl cluster-info
Control plane health and endpoint details are displayed.
Validating connection prevents deployment errors caused by targeting an incorrect or unreachable cluster.
4
Run kubectl apply -f deployment.yaml
Workload resources (Pods, Deployments, Services) are created on the cluster.
Deployment manifests can only be successfully submitted once authentication and cluster context are established.

Key Concept

Configuring local CLI tools (gcloud and kubectl) to access and manage GKE clusters
Estimated Time:1m 30s
Question 404Question →

Your organization is planning the network architecture for internal application services on Google Cloud. You need to select appropriate Google Cloud load balancing solutions for two distinct internal traffic requirements: (1) internal HTTP/HTTPS microservices traffic requiring Layer 7 path-based routing, and (2) internal raw TCP database traffic between Compute Engine instances requiring high-performance Layer 4 load balancing. Which TWO load balancing options should you select to satisfy these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Use an Internal Application Load Balancer for the internal HTTP/HTTPS microservices traffic.; Use an Internal Passthrough Network Load Balancer for the internal raw TCP database traffic.

Answer

Select an Internal Application Load Balancer for the internal Layer 7 HTTP/HTTPS microservices traffic and an Internal Passthrough Network Load Balancer for the internal Layer 4 raw TCP database traffic.
Internal Application Load Balancers handle Layer 7 features such as path-based routing for private HTTP/HTTPS services. Internal Passthrough Network Load Balancers provide high-performance Layer 4 load balancing for internal non-HTTP TCP/UDP application traffic.

Step-by-Step Solution

1
Analyze protocol and layer requirements for microservices traffic
Microservices require internal Layer 7 HTTP/HTTPS path routing.
Internal Application Load Balancer is a regional Layer 7 proxy load balancer capable of routing internal HTTP/HTTPS requests by URL path.
2
Analyze protocol and layer requirements for database traffic
Database traffic requires internal Layer 4 raw TCP load balancing.
Internal Passthrough Network Load Balancer provides high-performance, non-proxied regional Layer 4 load balancing for internal TCP and UDP traffic.

Key Concept

Matching workload protocols (Layer 4 TCP vs Layer 7 HTTP) and scopes (Internal vs External) to GCP load balancer types
Estimated Time:45s
Question 405Question →

A cloud engineer needs to deploy a new Google Cloud Storage bucket to store confidential compliance reports. Security guidelines require that access permissions are enforced uniformly across all objects using IAM policies instead of per-object Access Control Lists (ACLs), and that data is encrypted using a Customer-Managed Encryption Key (CMEK). Which TWO configurations must the engineer apply to the Cloud Storage bucket to satisfy these requirements? (Select TWO choices.)

Select all that apply

Show answer & explanation

Answer: Enable Uniform Bucket-Level Access on the bucket.; Configure the bucket's default Cloud KMS key (--default-kms-key) with the CMEK resource path.

Answer

Enabling Uniform Bucket-Level Access and setting the bucket's default Cloud KMS key (--default-kms-key) fulfill the requirements for centralized IAM access control and Customer-Managed Encryption Keys.
Enabling Uniform Bucket-Level Access ensures that Cloud Storage uses Google Cloud IAM exclusively for access control, ignoring per-object ACLs. Setting the default KMS key ensures that all objects uploaded to the bucket are encrypted using the specified Customer-Managed Encryption Key (CMEK). Together, these two settings satisfy both security mandates.

Step-by-Step Solution

1
Enforce uniform IAM access management
Disables fine-grained object-level ACLs on the bucket.
Security policy requires using IAM policies exclusively for access control across all bucket objects.
2
Configure default encryption key settings
Applies the specified Cloud KMS key as the default encryption key for objects created in the bucket.
Security policy requires Customer-Managed Encryption Keys (CMEK) rather than Google-managed keys.

Key Concept

Configuring Cloud Storage access controls and CMEK encryption settings
Estimated Time:1m 0s
Question 406Question →

An Associate Cloud Engineer is investigating an unexpected permissions behavior within an enterprise Google Cloud environment. A developer reports that they are able to view and modify Compute Engine virtual machine instances inside a specific project named `Project-App-Prod`, despite having no direct IAM role assignments on that specific project. Which TWO configurations within the Google Cloud resource hierarchy explain how the developer obtained these permissions? (Select TWO)

Select all that apply

Show answer & explanation

Answer: The developer was granted an IAM role containing Compute Engine permissions at an ancestor folder or organization level in the resource hierarchy.; The developer is a member of a Google Group that has been assigned an IAM role with Compute Engine permissions on a parent folder containing the project.

Answer

The permissions are inherited because the developer either directly holds an IAM role on an ancestor folder/organization node, or belongs to a Google Group that holds an IAM role on an ancestor folder.
IAM permissions in Google Cloud are strictly additive and inherit downward through the resource hierarchy (Organization -> Folder -> Project -> Resource). A user acquires effective permissions on a project if an IAM role is granted to their user account or to a Google Group they belong to at any ancestor level (such as a parent folder or the organization node).

Step-by-Step Solution

1
Analyze how IAM permissions flow in the Google Cloud Resource Hierarchy.
Permissions in GCP follow an additive inheritance model: Organization -> Folder -> Project -> Resource.
Granting a role at a higher node automatically propagates those permissions to all descendant projects and resources.
2
Evaluate user identity bindings.
IAM roles can be assigned directly to individual user accounts or indirectly via Google Group memberships.
If a group holds a role on an ancestor folder, any member of that group inherits the effective permissions on child projects.

Key Concept

Google Cloud IAM Policy Inheritance and Resource Hierarchy
Estimated Time:1m 30s
Question 407Question →

An online video platform is designing its Google Compute Engine compute infrastructure for two distinct backend components:

1. Media Transcoding Fleet: A fault-tolerant, stateless batch processing workload that picks up jobs from a queue and can resume interrupted tasks without data corruption.
2. Primary User Database: A continuous, high-availability relational database running 24/7 with highly predictable vCPU and memory utilization.

Which TWO deployment strategies should you select to minimize compute costs while meeting the operational availability requirements of both workloads?

Select all that apply

Show answer & explanation

Answer: Provision Spot Virtual Machines (VMs) for the Media Transcoding Fleet.; Purchase Committed Use Discounts (CUDs) for the Primary User Database compute capacity.

Answer

Select Spot VMs for the stateless Media Transcoding Fleet to leverage steep pricing discounts for fault-tolerant jobs, and purchase Committed Use Discounts (CUDs) for the Primary User Database to secure cost savings for steady-state 24/7 compute usage.
The correct strategy leverages Spot Virtual Machines for the stateless media transcoding batch fleet because the job pipeline can easily recover from instance preemptions. Concurrently, purchasing Committed Use Discounts for the database guarantees lower pricing for steady, uninterrupted 24/7 compute consumption.

Step-by-Step Solution

1
Analyze the resiliency requirements of the Media Transcoding Fleet.
Identified as a stateless, fault-tolerant batch process capable of resuming upon interruption.
Fault-tolerant batch processing aligns directly with the operational characteristics of Spot VMs, which offer heavy discounts in exchange for potential preemption.
2
Analyze the baseline capacity requirements of the Primary User Database.
Identified as a continuous 24/7 mission-critical workload with predictable resource consumption.
Predictable 24/7 database workloads benefit most from Committed Use Discounts (CUDs), which guarantee discounted hourly compute rates for 1-year or 3-year commitments.
3
Evaluate invalid pricing and instance configuration anti-patterns.
Rejected using Spot VMs for stateful databases due to unpredictable preemption risk, and rejected combining Sustained Use Discounts with Committed Use Discounts because GCP pricing rules prevent stacking both discounts simultaneously.
Ensures architecture compliance with GCP best practices and financial estimation rules.

Key Concept

Selecting Compute Engine Purchasing Models Based on Workload Preemptibility and Usage Predictability
Question 408Question →

A lead cloud architect is using the Google Cloud Pricing Calculator to model monthly infrastructure costs for an enterprise telemetry platform. The design incorporates continuous 24/7 Compute Engine virtual machines for core data ingestion and transient Compute Engine Spot VMs for batch analytics processing. The engineering team requires an accurate cost estimate that properly accounts for Google Cloud billing discount mechanics. Which statement correctly describes how the Google Cloud Pricing Calculator applies discounts when estimating costs for these Compute Engine workloads?

Show answer & explanation

Answer: The calculator automatically applies Sustained Use Discounts (SUDs) to eligible continuously running standard Compute Engine instances based on monthly runtime, whereas Spot VMs receive separate deeply discounted fixed pricing and do not qualify for SUDs.

Answer

The Google Cloud Pricing Calculator automatically includes Sustained Use Discounts (SUDs) for eligible standard Compute Engine instances running continuously, while Spot VMs receive separate fixed discount pricing and are ineligible for SUDs.
The option stating that the calculator automatically applies Sustained Use Discounts to eligible continuous standard Compute Engine instances based on monthly runtime, while Spot VMs receive separate fixed discount pricing and do not qualify for SUDs, is correct. In Google Cloud, SUDs automatically kick in when standard VM instances run for more than 25% of a billing month. Spot VMs offer fixed upfront discounts for preemptible workloads and are explicitly excluded from receiving SUDs.

Step-by-Step Solution

1
Analyze Compute Engine discount types in Google Cloud billing.
Sustained Use Discounts (SUDs) automatically reduce the hourly rate for vCPU and memory on standard VM instances running more than 25% of a billing month.
SUDs require no prior commitment and are calculated automatically based on continuous monthly usage.
2
Evaluate Spot VM pricing mechanisms in the Google Cloud Pricing Calculator.
Spot VMs are priced at a fixed, deeply discounted rate (typically 60-90% off standard pricing) due to preemptibility.
Because Spot VMs already receive maximal discounting, they do not qualify for additional Sustained Use Discounts or Committed Use Discounts.
3
Distinguish Committed Use Discounts (CUDs) from Sustained Use Discounts (SUDs).
CUDs offer high savings but require selecting a explicit 1-year or 3-year commitment term in the calculator, whereas SUDs occur automatically.
Running a standard VM for 730 hours defaults to SUD application unless a formal CUD option is explicitly selected.

Key Concept

Sustained Use Discounts vs Spot VM Pricing in Cost Estimation
Question 409Question →

An organization wants to distribute external incoming HTTP and HTTPS web application traffic to Compute Engine virtual machine instances deployed across multiple Google Cloud regions. Which Google Cloud load balancer type should be deployed to meet this requirement?

Show answer & explanation

Answer: Global external Application Load Balancer

Answer

Global external Application Load Balancer
The Global external Application Load Balancer is designed specifically to handle Layer 7 HTTP and HTTPS traffic originating from external clients on the internet and distribute it to backend instances spanning multiple GCP regions using a single global Anycast IP address.

Step-by-Step Solution

1
Identify the protocol and client traffic boundary.
The requirement specifies external incoming web application traffic using HTTP and HTTPS (Layer 7).
Choosing between application (HTTP/HTTPS) load balancers and network (TCP/UDP) load balancers depends on the traffic protocol.
2
Determine the geographic scope of backend targets.
The Compute Engine instance backends are located across multiple Google Cloud regions.
Global load balancers provide cross-region failover and routing, whereas regional load balancers are restricted to backends within a single region.
3
Select the appropriate load balancer option.
Select the Global external Application Load Balancer.
It natively supports Layer 7 HTTP/HTTPS routing for external clients to multi-region backend instance groups.

Key Concept

Global External Application Load Balancing
Estimated Time:45s
Question 410Question →

A Cloud Engineer must deploy a secure Google Cloud Storage bucket named `fin-secure-records-2026` in the `us-central1` region to store sensitive financial documents. The deployment requires configuring Customer-Managed Encryption Keys (CMEK) using a pre-existing Cloud KMS key, enabling Object Versioning to retain historical file modifications, and populating the bucket with initial record files. What is the correct sequence of steps to configure and populate this Cloud Storage solution using the Google Cloud CLI?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins by granting the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role on the KMS key, followed by creating the bucket with the default CMEK key specified, updating the bucket to enable Object Versioning, and finally uploading the files using `gcloud storage cp`.
Configuring CMEK on a Google Cloud Storage bucket requires granting the Cloud Storage service account the `roles/cloudkms.cryptoKeyEncrypterDecrypter` role on the KMS key first. Next, the bucket is provisioned using `gcloud storage buckets create` with the `--default-encryption-key` parameter. Object Versioning is then enabled via `gcloud storage buckets update --versioning`. Finally, files are copied into the fully configured bucket using `gcloud storage cp`.

Step-by-Step Solution

1
Authorize the service account on the encryption key
Cloud Storage Service Agent gains permission to perform encryption/decryption operations with the Cloud KMS key.
If the service agent lacks the CryptoKey Encrypter/Decrypter role prior to bucket setup or object upload, default CMEK bucket operations will fail authorization checks.
2
Provision the Cloud Storage bucket with CMEK
The target bucket `gs://fin-secure-records-2026` is created in `us-central1` with default CMEK settings.
The bucket infrastructure must be created before applying post-creation feature updates or uploading data objects.
3
Enable Object Versioning on the bucket
Object Versioning is active for all future object writes and overwrites.
Enabling versioning after bucket creation ensures that all subsequent upload and modification operations retain version history.
4
Upload objects using `gcloud storage cp`
Files from `./records/*` are copied to `gs://fin-secure-records-2026/` and automatically encrypted with CMEK.
Object ingestion is performed last so that uploaded files inherit both default CMEK encryption and version protection.

Key Concept

Deploying Cloud Storage Buckets with CMEK, Object Versioning, and gcloud storage CLI
Estimated Time:1m 30s
Question 411Question →

A cloud network engineering team is planning to expand an existing primary subnet CIDR block within a custom-mode Virtual Private Cloud (VPC) network to accommodate business growth. The VPC network connects to on-premises data centers via Cloud VPN and is scheduled to establish a VPC Network Peering connection with a partner organization. What is the correct sequence of steps to properly plan, validate, and execute this primary subnet range expansion without causing network outages or IP address range conflicts?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct procedural order is: 1) Audit existing IP address allocations across local, hybrid, and peered environments; 2) Calculate the expanded CIDR prefix complying with bit boundary alignment; 3) Execute the non-disruptive subnet expansion operation in Google Cloud; 4) Update routing advertisements and firewall rules to accommodate the new host address space.
Subnet expansion in an enterprise GCP environment requires a structured progression: first, auditing all existing and planned connected networks (hybrid VPN and VPC Peering) prevents catastrophic IP address collisions. Second, determining a bit-boundary aligned expanded mask ensures compliance with GCP subnet rules. Third, expanding the subnet in GCP is performed as a non-disruptive live configuration update. Fourth, downstream security rules and Cloud Router BGP advertisements must be updated to ensure end-to-end connectivity across the new host range.

Step-by-Step Solution

1
Perform IP allocation audit across connected environments
Identified contiguous, unallocated IP blocks and confirmed zero overlap with hybrid VPN routes or planned VPC Network Peering CIDRs.
VPC Network Peering and Cloud VPN require completely disjoint IP ranges; attempting to expand a subnet into an already allocated or advertised range breaks routing and causes peering establishment failures.
2
Define valid expanded subnet CIDR notation
Calculated a valid expanded range (e.g., 10.10.0.0/2410.10.0.0/24 expanding to 10.10.0.0/2310.10.0.0/23) that encompasses the existing base address.
Google Cloud VPC primary subnets can only be expanded to a larger prefix length (smaller mask number) without changing the network starting address, ensuring bit-boundary alignment.
3
Apply subnet expansion in Google Cloud
The primary IP range of the active subnet is updated seamlessly while running Compute Engine virtual machines maintain active connections.
GCP supports online, zero-downtime subnet CIDR expansion without deleting resources or interrupting current workload IP bindings.
4
Synchronize network security and routing policies
Cloud Routers advertise the new netmask over BGP, and VPC firewall rules permit traffic across the expanded IP space.
Expanding the subnet definition in the VPC control plane does not automatically grant external or cross-premises access unless BGP routes and firewall filters encompass the extended block.

Key Concept

VPC Subnet Expansion & Non-Overlapping IP Planning
Estimated Time:2m 0s
Question 412Question →

A cloud operations team is preparing for a high-traffic seasonal event in a Google Cloud project. To support additional front-end load balancers, they anticipate exceeding their current regional quota for In-Use IP Addresses in the us-central1 region. An administrator needs to delegate authority to a site reliability engineer so they can monitor current quota utilization and submit quota increase requests through the Google Cloud Console while adhering to the principle of least privilege. Which IAM role should be assigned to the engineer?

Show answer & explanation

Answer: Quota Administrator (roles/servicemanagement.quotaAdmin)

Answer

The Quota Administrator role (roles/servicemanagement.quotaAdmin) should be granted because it provides the minimal required permissions to view usage and submit quota increase requests.
The correct option is Quota Administrator (roles/servicemanagement.quotaAdmin). In Google Cloud, managing and requesting quota changes is controlled by Service Management IAM permissions. The Quota Administrator role allows users to view quota limits, monitor current consumption, and request increases directly from the IAM & Admin > Quotas interface in the console while maintaining least-privilege security standards.

Step-by-Step Solution

1
Identify the operational requirement.
The engineer needs permissions to view resource quotas and submit quota increase requests in the Google Cloud Console.
Quota monitoring and adjustment requests require explicit service management quota administrative privileges.
2
Apply Google Cloud IAM security best practices.
Evaluate roles against the principle of least privilege.
Using predefined roles tailored to specific tasks prevents granting excessive administrative access to unrelated project resources or billing configurations.
3
Select the correct IAM role.
Choose Quota Administrator (roles/servicemanagement.quotaAdmin).
This predefined role contains permissions such as servicemanagement.quotas.update to manage and request quotas without granting broad service modification capabilities.

Key Concept

Delegating quota management permissions using the principle of least privilege
Question 413Question →

A central infrastructure operations team at a retail company needs to delegate authority to a DevOps engineer to link newly provisioned Google Cloud projects to the company's central Cloud Billing account. The solution must strictly follow the principle of least privilege by avoiding overly permissive or broad administrative access on both the billing account and the projects. Which TWO identity and access management (IAM) roles must be assigned to the DevOps engineer? (Select 2 answers)

Select all that apply

Show answer & explanation

Answer: Billing Account User (roles/billing.user) on the central Cloud Billing account; Project Billing Manager (roles/billing.projectManager) on the target Google Cloud project

Answer

To link a Google Cloud project to a Cloud Billing account under the principle of least privilege, two specific permissions across two separate resource levels are required: Billing Account User (roles/billing.user) granted on the Cloud Billing account, and Project Billing Manager (roles/billing.projectManager) granted on the target Google Cloud project.
Linking a project to a Cloud Billing account requires permissions on both the billing account and the project. On the billing account side, Billing Account User (roles/billing.user) grants the capability to associate projects with the billing account. On the project side, Project Billing Manager (roles/billing.projectManager) allows changing the billing account associated with the project. Together, these two roles fulfill the minimal privilege requirement.

Step-by-Step Solution

1
Identify the minimum required permission on the Cloud Billing account level.
The user requires the 'billing.resourceAssociations.create' permission on the billing account, which is provided by the Billing Account User role.
This permission allows linking projects to the specified billing account without granting administrative control over billing configurations or payment methods.
2
Identify the minimum required permission on the target Google Cloud project level.
The user requires the 'resourcemanager.projects.createBillingAssignment' permission on the project, which is provided by the Project Billing Manager role.
This permission permits modifying the project's billing association without requiring full Project Owner or Editor access.

Key Concept

Dual IAM Permission Model for Billing Account Project Linking
Question 414Question →

A digital publishing platform is planning its Google Compute Engine infrastructure for two distinct backend services:

1. A high-throughput, in-memory caching tier that requires high memory-to-vCPU ratios, operating 24/7 with a 99.99% uptime requirement.
2. A batch image-resizing pipeline that processes asynchronous worker queues, where individual instance preemptions can be retried automatically without data loss.

Which machine configuration and pricing strategy should the cloud engineer select to optimize compute costs while satisfying the SLA requirements?

Show answer & explanation

Answer: Provision high-memory machine family instances backed by Committed Use Discounts for the caching tier, and provision Spot VMs for the batch image-resizing pipeline.

Answer

Provision high-memory machine family instances backed by Committed Use Discounts for the caching tier, and provision Spot VMs for the batch image-resizing pipeline.
The correct strategy combines high-memory machine types with Committed Use Discounts for the 24/7 stateful caching service to guarantee availability and lower baseline costs, while leveraging Spot VMs for the fault-tolerant batch processing pipeline to maximize cost savings on interruptible tasks.

Step-by-Step Solution

1
Analyze workload characteristics for the caching tier.
Identified as a high-memory, 24/7 continuous production service requiring high availability.
Continuous workloads with high memory requirements benefit from high-memory machine families and Committed Use Discounts (1-year or 3-year) for maximum cost efficiency without sacrificing availability.
2
Analyze workload characteristics for the batch processing pipeline.
Identified as a stateless, fault-tolerant, queue-based batch processing service.
Fault-tolerant batch jobs that handle interruptions seamlessly are ideal candidates for Spot VMs, which offer up to 60-91% discounts compared to standard pricing.
3
Combine the machine family selection with the optimal pricing models.
High-memory instances with CUDs for cache tier + Spot VMs for batch rendering.
This combination minimizes total cost of ownership while fully meeting performance and SLA constraints.

Key Concept

Compute Engine Machine Type Selection & Discount Models (CUD vs. Spot VMs)
Question 415Question →

A system architect is using the Google Cloud Pricing Calculator to project monthly infrastructure expenses for a data pipeline operating in the `us-central1` region for a 3030-day month (720720 total hours).

The architecture consists of the following components:
- 88 identical Compute Engine instances with a baseline on-demand cost of $0.30\$0.30 per hour per instance.
- A 11-year Committed Use Discount (CUD) covering 66 of these instances, providing a 37%37\% discount off their on-demand rate.
- The remaining 22 instances run continuously on-demand and qualify for a Sustained Use Discount (SUD) of 20%20\% applied to their hourly rate.
- 500 GB500\text{ GB} of Standard Cloud Storage at $0.02\$0.02 per GB/month\text{GB/month}.
- 100 GB100\text{ GB} of internet data egress at $0.08\$0.08 per GB\text{GB}.

What is the total estimated monthly cost, in USD, for this infrastructure setup?

Show answer & explanation

Answer: 1180.08

Answer

The total estimated monthly cost is $1,180.08.
The total estimate of 1,180.08accuratelyaccountsfor6CUDinstancesdiscountedat371,180.08 accurately accounts for 6 CUD instances discounted at 37% ( 816.48), 2 SUD instances discounted at 20% (345.60),500GBofStandardCloudStorage(345.60), 500 GB of Standard Cloud Storage ( 10.00), and 100 GB of network egress ($8.00).

Step-by-Step Solution

1
Calculate the monthly cost for the Committed Use Discount (CUD) Compute Engine instances.
6 instances × (0.30×0.63)×720hours=0.30 × 0.63) × 720 hours = 816.48
Applying the 37% CUD discount reduces the hourly rate to $0.189 per instance.
2
Calculate the monthly cost for the Sustained Use Discount (SUD) Compute Engine instances.
2 instances × (0.30×0.80)×720hours=0.30 × 0.80) × 720 hours = 345.60
Applying the 20% SUD discount for 100% continuous monthly runtime reduces the hourly rate to $0.24 per instance.
3
Calculate the monthly Cloud Storage and Data Egress expenses.
Storage: 500 GB × 0.02=0.02 = 10.00; Egress: 100 GB × 0.08=0.08 = 8.00. Total auxiliary = $18.00
Storage and network egress rates apply per GB ingested and transferred out of the region.
4
Sum all compute, storage, and networking sub-totals.
816.48+816.48 + 345.60 + 10.00+10.00 + 8.00 = $1,180.08
Combines all resource components into the total monthly GCP bill estimate.

Key Concept

Estimating combined GCP infrastructure costs across Compute Engine CUD/SUD discounts, Cloud Storage, and Network Egress pricing tiers.
Estimated Time:2m 0s
Question 416Question →

An application development team is planning to host a stateless REST API on Google Cloud. The microservice is packaged as a Docker container that includes specialized Linux C libraries for image processing, and it must be configured to process up to 80 concurrent HTTP requests per instance to optimize resource utilization and lower costs. Which serverless compute option should the team select?

Show answer & explanation

Answer: Cloud Run

Answer

Cloud Run
Cloud Run is the recommended serverless platform for deploying stateless HTTP microservices packaged as custom container images. It natively supports arbitrary binaries and allows adjusting concurrency settings so multiple requests are served concurrently by a single container instance.

Step-by-Step Solution

1
Analyze workload requirements.
The microservice requires custom Docker containers (with C libraries), stateless HTTP execution, multi-concurrency (80 requests per instance), and zero infrastructure management.
Determining architectural boundaries for Google Cloud compute services.
2
Compare Cloud Run against alternative serverless and compute options.
Cloud Run supports any container image and configurable request concurrency. Cloud Functions source-based deployments do not natively support arbitrary custom containers with custom C libraries in standard runtimes, nor does 1st gen support concurrency.
Identifying the ideal fully managed serverless compute platform.

Key Concept

Selecting Cloud Run for containerized workloads requiring custom system binaries and request concurrency
Question 417Question →

An organization plans to host a public web application on Compute Engine instances that serves HTTP and HTTPS traffic to a global audience. They require a Google Cloud load balancing architecture that supports edge caching to speed up static asset delivery. Which Google Cloud load balancer should they choose?

Show answer & explanation

Answer: Global External Application Load Balancer with Cloud CDN enabled

Answer

Global External Application Load Balancer with Cloud CDN enabled
The Global External Application Load Balancer operates at Layer 7, providing HTTP/HTTPS proxying across regions and seamlessly integrating with Cloud CDN to cache static content at Google edge points of presence.

Step-by-Step Solution

1
Analyze protocol and client reachability requirements
The application requires serving HTTP/HTTPS traffic to a public global audience.
This necessitates an external Layer 7 (Application) load balancer configured for global availability.
2
Analyze static content caching requirements
Cloud CDN integration is required for caching static assets at Google edge network locations.
Cloud CDN integrates with HTTP(S) Application Load Balancers, not Layer 4 Passthrough load balancers.
3
Select the appropriate Google Cloud load balancing solution
The Global External Application Load Balancer fulfills both global L7 HTTP(S) routing and Cloud CDN caching requirements.
It provides a single global IP address, L7 proxy capabilities, and seamless Cloud CDN integration.

Key Concept

Selecting GCP Load Balancer types based on layer (L4 vs L7), scope (Global vs Regional), and Cloud CDN compatibility
Estimated Time:50s
Question 418Question →

A cloud administrator needs to create a new Google Cloud Storage bucket named `media-archive-2026` in the `us-central1` region using the Google Cloud CLI (`gcloud`). Which command should the administrator execute to deploy this bucket?

Show answer & explanation

Answer: gcloud storage buckets create gs://media-archive-2026 --location=us-central1

Answer

The command `gcloud storage buckets create gs://media-archive-2026 --location=us-central1` correctly deploys a new Cloud Storage bucket in the specified region.
The correct command uses `gcloud storage buckets create` along with the `gs://` URI scheme and the `--location` flag to specify the target region (`us-central1`).

Step-by-Step Solution

1
Identify the proper CLI surface for Google Cloud Storage management.
The `gcloud storage` surface is the modern standard CLI tool for managing Google Cloud Storage resources.
Cloud Storage operations use the `gcloud storage` command group rather than `gcloud compute`.
2
Determine the correct command and flags for creating a bucket.
The `buckets create` subcommand combined with the `gs://` bucket URI format and `--location` parameter provisions the resource in `us-central1`.
Cloud Storage buckets are regional/multi-regional resources, requiring `--location` rather than zonal parameters.

Key Concept

Deploying Cloud Storage Buckets using the Google Cloud CLI
Estimated Time:45s
Question 419Question →

A cloud engineer needs to establish a new Google Kubernetes Engine (GKE) environment and deploy a containerized microservice application from scratch using the Google Cloud CLI and `kubectl`. Arrange the following operational steps in the correct chronological sequence required to provision the infrastructure, configure local authentication context, deploy the workload, and verify successful deployment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with provisioning the GKE cluster using `gcloud container clusters create`, followed by fetching credentials into `kubeconfig` via `gcloud container clusters get-credentials`, verifying cluster control plane access using `kubectl get nodes`, applying the application manifest with `kubectl apply -f deployment.yaml`, and finally confirming workload health using `kubectl rollout status deployment/web-app`.
Deploying workloads to Google Kubernetes Engine follows a logical multi-step workflow. First, cluster infrastructure must be provisioned (`gcloud container clusters create`). Second, administrative authentication credentials must be written to the local workstation context (`gcloud container clusters get-credentials`). Third, connectivity to the Kubernetes API server must be validated (`kubectl get nodes`). Fourth, the application workload definition must be submitted (`kubectl apply -f`). Finally, workload availability must be confirmed by checking rollout progress (`kubectl rollout status`).

Step-by-Step Solution

1
Execute `gcloud container clusters create` with appropriate networking and node pool specifications.
GKE control plane and worker node pools are created in Google Cloud.
Infrastructure creation is the mandatory prerequisite before cluster operations can occur.
2
Run `gcloud container clusters get-credentials [CLUSTER_NAME] --zone [ZONE]`.
Local `~/.kube/config` file is populated with cluster API endpoints and authentication tokens.
`kubectl` relies on `kubeconfig` entries to direct commands to the correct Kubernetes control plane.
3
Execute `kubectl get nodes` to test cluster access.
A list of healthy GKE worker nodes and their statuses is returned in stdout.
Verifying connectivity prevents silent deployment failures caused by invalid authentication context.
4
Run `kubectl apply -f deployment.yaml` targeting the application manifest.
Kubernetes API server processes the specification and creates the Deployment resource.
Submitting the manifest initiates Pod scheduling and container creation across available cluster nodes.
5
Execute `kubectl rollout status deployment/web-app` to monitor deployment progress.
Command completes successfully when all replicas are running and ready.
Validating rollout completion confirms that image retrieval, volume mounts, and readiness probes succeeded.

Key Concept

GKE Workload Lifecycle and Command Sequence
Question 420Question →

An organization is planning to migrate several core workloads from an on-premises data center to Google Cloud. The on-premises network uses the private IP range 10.0.0.0/1610.0.0.0/16, and the cloud environment will connect to on-premises via a Cloud VPN gateway. The cloud network team needs to design a multi-region Google Cloud network strategy that prevents IP routing conflicts and allows flexible future subnet growth. Which TWO subnet design practices should the network team enforce during the planning stage?

Select all that apply

Show answer & explanation

Answer: Create a custom mode VPC network rather than relying on an auto mode VPC network.; Allocate custom primary CIDR ranges for each region that do not overlap with the 10.0.0.0/1610.0.0.0/16 on-premises network or with other subnets in the VPC.

Answer

The networking team must create a custom mode VPC network and allocate custom primary CIDR ranges for each region that do not overlap with the on-premises network or other cloud subnets.
Selecting a custom mode VPC allows network engineers to manually assign non-overlapping IP address ranges, avoiding the predefined IP blocks assigned by auto mode. Furthermore, ensuring that primary subnet CIDR blocks in all regions are disjoint from the on-premises network ensures packet routing across Cloud VPN functions correctly without IP collisions.

Step-by-Step Solution

1
Analyze VPC mode requirements for hybrid cloud planning.
Auto mode VPCs automatically generate subnets across a large set of default IP ranges (10.128.0.0/910.128.0.0/9), which often conflicts with enterprise networks. Custom mode VPCs give total control over IP range planning.
Choosing custom mode prevents automated IP assignment that could overlap with on-premises ranges.
2
Verify IP range uniqueness across hybrid network boundaries.
Subnet ranges in GCP must be disjoint from on-premises CIDR blocks (10.0.0.0/1610.0.0.0/16) to enable proper BGP or static routing across Cloud VPN.
Overlapping CIDR ranges break IP routing between Google Cloud and on-premises environments.

Key Concept

VPC Network Planning and Subnet IP Addressing in Hybrid Environments
Estimated Time:1m 30s
PreviousPage 21 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin