Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 441Question →

A digital publishing platform hosts a library of newly released e-books and promotional media assets in Google Cloud Storage. E-books are accessed frequently during the first 30 days of release and infrequently thereafter, but must be retained for multi-year compliance audits. Promotional media assets have completely unpredictable access patterns throughout the year. The engineering team wants to minimize storage costs without incurring unnecessary access penalties or operational management overhead. Which TWO storage planning decisions should the team implement?

Select all that apply

Show answer & explanation

Answer: Configure an Object Lifecycle Management rule on the e-book bucket to transition objects from Standard storage to Nearline storage 30 days after creation.; Enable Autoclass on the promotional media assets bucket to dynamically move objects between access tiers based on real-time access patterns.

Answer

The team should configure an Object Lifecycle Management rule to transition e-books from Standard to Nearline storage after 30 days of creation, and enable Autoclass on the bucket hosting promotional media assets.
Transitioning e-books to Nearline storage after 30 days matches the lifecycle transition where access drops to less than once per month, fulfilling Nearline's 30-day minimum storage duration without retrieval penalties. Enabling Autoclass on the bucket with unpredictable access automatically optimizes storage fees across access tiers without management overhead or retrieval fee surcharges.

Step-by-Step Solution

1
Analyze the access pattern for e-books
High frequency during the first 30 days, low frequency (less than once per month) after 30 days.
Standard storage is appropriate for active use during the first month. Transitioning to Nearline storage after 30 days aligns with Nearline's 30-day minimum storage duration and lower storage cost.
2
Analyze the access pattern for promotional media assets
Access pattern is unpredictable across the year.
Google Cloud Storage Autoclass automatically transitions objects between access tiers based on usage patterns, eliminating manual lifecycle management and avoiding retrieval fees for unpredictable workloads.
3
Evaluate incorrect tiering strategies
Archive or early Coldline transitions incur heavy retrieval penalties and minimum storage duration charges.
Coldline requires a 90-day minimum duration, and Archive requires 365 days; reading frequently accessed objects from these tiers generates high data retrieval fees.

Key Concept

Selecting Cloud Storage classes and lifecycle rules based on access frequency, minimum storage duration, and retrieval cost profiles.
Question 442Question →

A cloud administrator is tasked with deploying an updated application deployment manifest (`deployment.yaml`) to an existing Google Kubernetes Engine (GKE) cluster from a new administrative workstation. Which TWO actions must the administrator perform to authenticate their environment and deploy the workload successfully? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Execute `gcloud container clusters get-credentials CLUSTER_NAME --zone ZONE` to retrieve cluster endpoint and authentication credentials into kubeconfig.; Execute `kubectl apply -f deployment.yaml` to submit the workload configuration to the Kubernetes API server.

Answer

The correct actions are to retrieve the cluster credentials using `gcloud container clusters get-credentials` and then apply the manifest using `kubectl apply -f deployment.yaml`.
To manage and deploy workloads to GKE, an administrator must first populate local kubeconfig credentials using `gcloud container clusters get-credentials`. Once authenticated, standard Kubernetes commands like `kubectl apply -f deployment.yaml` are used to apply workload configurations.

Step-by-Step Solution

1
Authenticate kubectl with the GKE cluster
Local kubeconfig file is updated with cluster API server endpoint and security tokens.
kubectl requires active credentials and context settings to communicate with the GKE control plane.
2
Deploy the workload manifest
Kubernetes API processes deployment.yaml and updates cluster resources.
`kubectl apply` creates or modifies cluster resources declared in declarative YAML files.

Key Concept

GKE Cluster Credential Retrieval and Workload Deployment
Question 443Question →

Your organization maintains a Google Cloud environment where projects are grouped under a dedicated folder named Production. A third-party security analyst must review IAM policy bindings, resource configurations, and custom roles across all projects within the Production folder. The analyst must NOT be allowed to view underlying resource data (such as reading Cloud Storage object contents or database records) nor make any configuration changes. Which IAM role assignment fulfills this requirement while adhering strictly to the principle of least privilege?

Show answer & explanation

Answer: Grant the Security Reviewer role (roles/iam.securityReviewer) on the Production folder.

Answer

Granting the Security Reviewer role (roles/iam.securityReviewer) at the Production folder level grants the analyst read-only access to inspect IAM policies and configurations for all child projects via resource hierarchy inheritance, without exposing underlying application data or granting edit rights.
Assigning the Security Reviewer role (roles/iam.securityReviewer) at the Production folder level provides read-only access to IAM policies, roles, and project configurations across all child projects via resource hierarchy inheritance, while explicitly withholding access to view sensitive underlying data.

Step-by-Step Solution

1
Analyze the access requirement
The analyst requires read-only access to IAM policies and project resource metadata across multiple projects in the Production folder, but must not access actual resource data or alter permissions.
Security best practices demand enforcing least privilege tailored to metadata inspection.
2
Evaluate role types (Primitive vs. Predefined)
The primitive Viewer role permits viewing resource data contents, whereas the predefined Security Reviewer role (roles/iam.securityReviewer) restricts access to security configurations and metadata.
Google Cloud recommends using predefined roles over primitive roles to restrict data access.
3
Determine appropriate resource hierarchy placement
Binding the role at the Production folder level allows all current and future projects under that folder to inherit the policy binding automatically.
Folder-level assignment leverages GCP resource hierarchy inheritance cleanly without requiring per-project configuration.

Key Concept

Selecting predefined IAM roles over primitive roles and leveraging folder-level resource hierarchy inheritance for security auditing.
Question 444Question →

A cloud engineer is preparing to integrate a Google Cloud environment with an on-premises network via Cloud VPN. The current GCP deployment uses an auto-mode Virtual Private Cloud (VPC) network. To prevent future IP CIDR collisions with on-premises subnets and gain control over subnet creation, the engineer must convert the auto-mode VPC to a custom-mode VPC and provision a new subnet in a new region. What is the correct sequence of steps to execute this migration safely?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with auditing existing network IP space for conflicts, followed by converting the VPC network from auto to custom mode, then planning a unique non-overlapping CIDR block for the target region, and finally creating the new custom subnet.
To safely transition a GCP VPC for hybrid connectivity, an engineer must first audit existing IP allocations against on-premises routes to identify potential conflicts. Next, the VPC network mode must be converted from auto to custom mode, which retains existing subnets while granting administrative control over future subnet creation. After conversion, the engineer plans a distinct, non-overlapping CIDR block for the new region, and finally provisions the new custom subnet using that range.

Step-by-Step Solution

1
Audit current IP address space against on-premises routes.
Identified any potential IP collisions before modifying VPC architecture.
Existing subnets must be validated first so active traffic is not disrupted when establishing hybrid connectivity.
2
Convert the VPC network from auto mode to custom mode.
The VPC network is switched to custom mode, preserving existing subnets while disabling automatic subnet creation in new regions.
Auto-mode VPCs automatically create subnets with fixed /20 CIDR blocks in every region, which often overlap with enterprise networks.
3
Plan a non-overlapping IP range for the new region.
A specific, non-colliding CIDR block is allocated for the target expansion region.
Custom-mode VPCs require explicit IP range planning to support scalable hybrid networking.
4
Provision the custom subnet using the planned CIDR block.
The new custom subnet is created and ready to host workloads in the specified region.
Subnets can only be custom created after the VPC network mode has been updated to custom.

Key Concept

Converting Auto-Mode VPC to Custom-Mode VPC for Hybrid Network Planning
Question 445Question →

Your company is deploying a new web application on Google Cloud. You need to configure network components to serve public static web assets with edge caching and resolve internal service hostnames privately within your Virtual Private Cloud (VPC) network. Which two Google Cloud networking services should you include in your design? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Cloud CDN integrated with a Global External HTTP(S) Load Balancer; Cloud DNS private managed zone linked to the VPC network

Answer

The architecture should use Cloud CDN integrated with a Global External HTTP(S) Load Balancer for public static asset caching, and a Cloud DNS private managed zone linked to the VPC network for private internal hostname resolution.
Cloud CDN works alongside Global External HTTP(S) Load Balancers to store cached web responses close to end users, reducing latency and backend server load. To handle internal hostname resolution inside a VPC without public exposure, Cloud DNS private managed zones allow custom DNS records to be queried exclusively by authorized internal resources.

Step-by-Step Solution

1
Identify the public caching requirement for web content
Cloud CDN requires an HTTP(S) Load Balancer (Global External) to serve cached static assets to internet clients.
Cloud CDN caches content at Google edge locations for external HTTP(S) traffic.
2
Identify the internal DNS resolution requirement
A Cloud DNS private managed zone provides private domain name resolution for VMs inside the VPC.
Private DNS zones restrict hostname resolution visibility exclusively to authorized VPC networks.

Key Concept

Selecting Cloud CDN for edge caching and Cloud DNS private zones for VPC internal name resolution
Question 446Question →

A healthcare enterprise is designing a network architecture on Google Cloud to receive high-throughput medical imaging telemetry transmitted via a non-HTTP raw TCP protocol from external hospital networks across the public internet. The solution must terminate TLS/SSL encryption at the load balancing tier, support Server Name Indication (SNI) to route requests to appropriate backend Compute Engine instance groups, and scale across multiple regions. Which Google Cloud load balancer architecture should be planned to satisfy these requirements?

Show answer & explanation

Answer: Global External Proxy Network Load Balancer configured with a Target SSL Proxy frontend

Answer

Global External Proxy Network Load Balancer configured with a Target SSL Proxy frontend
The Global External Proxy Network Load Balancer utilizing a Target SSL Proxy is specifically designed for non-HTTP TCP traffic that requires TLS offloading at the Google edge. It supports Server Name Indication (SNI), enabling multiple SSL certificates on a single IP address, and can route traffic to backend instance groups across multiple Google Cloud regions.

Step-by-Step Solution

1
Analyze protocol requirements
Workload uses non-HTTP raw TCP protocol.
Layer 7 HTTP(S) Application Load Balancers are eliminated because they strictly enforce HTTP compliance.
2
Analyze TLS offloading and SNI requirements
Load balancer must terminate TLS and inspect SNI host headers.
Passthrough network load balancers do not terminate TLS/SSL at the load balancer tier.
3
Analyze scope and client accessibility
Clients are external networks over the internet requiring multi-region backend scalability.
A Global External Proxy Network Load Balancer with a Target SSL Proxy meets all criteria: raw TCP, global reach, SSL termination, and SNI routing.

Key Concept

Selecting GCP Load Balancers Based on Protocol, SSL Offloading, and Traffic Scope
Estimated Time:2m 0s
Question 447Question →

A cloud engineer must configure an existing Google Cloud Storage bucket named `analytics-raw-data-prod` to meet strict compliance guidelines. The bucket must prevent object deletion or modification for 90 days after creation and enforce uniform IAM access control across all objects by disabling individual object ACLs. Which TWO `gcloud` CLI commands should the cloud engineer execute to complete this configuration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: gcloud storage buckets update gs://analytics-raw-data-prod --retention-period=90d; gcloud storage buckets update gs://analytics-raw-data-prod --enable-uniform-bucket-level-access

Answer

The correct commands are executing `gcloud storage buckets update gs://analytics-raw-data-prod --retention-period=90d` to set the 90-day bucket retention policy, and executing `gcloud storage buckets update gs://analytics-raw-data-prod --enable-uniform-bucket-level-access` to enforce uniform bucket-level access controls.
To satisfy compliance requirements on a Cloud Storage bucket, retention policies and uniform bucket-level access must both be applied at the bucket resource level using the modern `gcloud storage buckets update` command with `--retention-period=90d` and `--enable-uniform-bucket-level-access` flags.

Step-by-Step Solution

1
Configure the bucket-level retention policy using Google Cloud CLI
Applied a 90-day retention policy to prevent deletion/overwriting of objects
Bucket retention policies must be set at the bucket resource level using `--retention-period=90d`.
2
Enforce uniform IAM access control across the bucket
Disabled legacy per-object ACLs in favor of unified IAM policies
Uniform bucket-level access is configured at the bucket level using `--enable-uniform-bucket-level-access`.

Key Concept

Cloud Storage Bucket Configuration (Retention Policies & Access Controls via gcloud CLI)
Question 448Question →

A cloud security administrator at a healthcare software firm needs to enable a lead developer to provision a new isolated Google Cloud project named `hc-analytics-prod` and associate it with the company's central Cloud Billing account under the principle of least privilege. What is the correct sequence of administrative and operational steps required to grant permissions and complete the project billing configuration?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order begins with granting the Project Creator role at the folder/organization level, followed by granting the Billing Account User role on the billing account, then creating the GCP project via CLI, and finally linking the project to the billing account.
Establishing a new project and linking it to billing under least privilege requires granting `roles/resourcemanager.projectCreator` on the parent folder/org and `roles/billing.user` on the Cloud Billing account prior to creating the project (`gcloud projects create`) and linking it (`gcloud billing projects link`).

Step-by-Step Solution

1
Assign the Project Creator (`roles/resourcemanager.projectCreator`) role on the parent Folder or Organization resource.
The target identity gains permission to invoke `resourcemanager.projects.create`.
Permissions must be configured prior to executing CLI provisioning commands.
2
Assign the Billing Account User (`roles/billing.user`) role on the target Cloud Billing account.
The target identity receives `billing.resourceAssociations.create` authority on the billing resource.
Linking a project to a billing account requires authorization on the billing account itself, enforcing least privilege over broader administrative roles like Billing Account Administrator.
3
Run `gcloud projects create hc-analytics-prod`.
The GCP project `hc-analytics-prod` is created, automatically assigning project management rights to the creator.
The project resource must exist before a billing association can be established.
4
Run `gcloud billing projects link hc-analytics-prod --billing-account=ACCOUNT_ID`.
The project is successfully linked to the Cloud Billing account.
This final command links the created project resource with the authorized billing account.

Key Concept

Least-Privilege Billing Account and Project Creation Workflow
Question 449Question →

A DevOps team is preparing to launch a fault-tolerant, stateless event-processing workload on Google Kubernetes Engine (GKE). To minimize cloud infrastructure spend and eliminate node management overhead, the architecture must leverage fully managed cluster infrastructure with compute capacity suited for interruptible batch workloads. However, when an engineer attempts to deploy the application manifest from a newly provisioned admin terminal using kubectl, the command fails with a context error indicating that the cluster endpoint cannot be resolved. Which combination of actions resolves the authentication context issue and aligns with Google-recommended deployment practices for this workload?

Show answer & explanation

Answer: Execute gcloud container clusters get-credentials [CLUSTER_NAME] --region [REGION] to update the local kubeconfig configuration, and deploy the workload to a GKE Autopilot cluster specifying Spot pods in the workload manifest.

Answer

Execute gcloud container clusters get-credentials to populate local kubeconfig credentials, and deploy the stateless, fault-tolerant workload to a GKE Autopilot cluster using Spot pods.
The option specifying gcloud container clusters get-credentials together with GKE Autopilot and Spot pods correctly satisfies all requirements. Fetching credentials via get-credentials updates the local kubeconfig file with valid endpoint details and authentication tokens required for kubectl commands. GKE Autopilot removes all node management overhead, and leveraging Spot pods provides maximum cost optimization for stateless, fault-tolerant batch workloads.

Step-by-Step Solution

1
Identify the proper gcloud command to authenticate kubectl with GKE control planes.
Running 'gcloud container clusters get-credentials [CLUSTER_NAME] --region [REGION]' populates/updates ~/.kube/config with cluster endpoints and auth tokens.
kubectl relies on local kubeconfig configuration entries generated by gcloud to communicate securely with the Kubernetes API server.
2
Evaluate cluster operational mode requirements.
Select GKE Autopilot mode to eliminate node provisioning, scaling, and OS maintenance overhead.
GKE Autopilot fully manages the underlying node infrastructure according to Google security and operational best practices.
3
Select compute instance pricing model for fault-tolerant batch workloads.
Configure Spot pods within GKE Autopilot.
Spot capacity offers up to 60-90% discount compared to standard pricing, ideal for stateless workloads that tolerate unexpected pod preemptions.

Key Concept

GKE cluster credential acquisition via gcloud and selecting GKE Autopilot Spot workloads for cost-optimized serverless Kubernetes operation.
Estimated Time:2m 0s
Question 450Question →

A lead data architect is deploying a large-scale real-time telemetry processing pipeline in a Google Cloud project. The workload requires expanding compute capacity by 200 N2 series virtual CPUs in the `us-east4` region. During initial automated provisioning, the deployment fails because the requested capacity exceeds the region's current resource threshold. What action should the architect take to resolve this provisioning failure using standard Google Cloud procedures?

Show answer & explanation

Answer: Navigate to the Quotas page in the Google Cloud Console, select the N2 CPUs quota for the target region, and submit an increase request.

Answer

Submit a formal quota increase request for N2 CPUs in the specified region via the Cloud Console Quotas interface.
The standard procedure for managing resource constraints in Google Cloud is to request a quota increase through the IAM & Admin Quotas section of the Cloud Console (or via Cloud API/CLI). This allows Google Cloud to review the request and raise the project's regional resource limit.

Step-by-Step Solution

1
Identify the cause of the provisioning failure.
The requested compute capacity exceeds the project's regional quota limit for N2 CPUs.
GCP enforces regional quotas on compute resources to prevent unexpected resource exhaustion and manage infrastructure allocation.
2
Determine the appropriate administrative workflow to increase the limit.
Open the IAM & Admin > Quotas page in the Google Cloud Console, locate the N2 CPUs limit for `us-east4`, and submit a quota increase request.
Official quota adjustments must be reviewed and approved by Google Cloud quota systems or support teams.

Key Concept

Requesting GCP regional resource quota increases
Question 451Question →

A renewable energy company collects high-frequency sensor telemetry from thousands of wind turbines. The raw telemetry data is continuously written to Google Cloud Storage and queried frequently by operational dashboards for the first 14 days. After 14 days, the data is rarely accessed, but company compliance requires retaining all sensor data for 3 years before deletion. To minimize overall storage and retrieval costs while satisfying operational needs, how should you configure the Cloud Storage bucket?

Show answer & explanation

Answer: Set the bucket's default storage class to Standard, and configure an Object Lifecycle Management rule to transition objects to Coldline storage 14 days after creation.

Answer

Configure the bucket's default storage class as Standard and use Object Lifecycle Management to transition objects to Coldline storage 14 days after creation.
Starting with Standard storage ensures that frequent queries during the first 14 days do not incur retrieval charges. Setting an Object Lifecycle Management transition to Coldline storage after 14 days minimizes long-term storage costs for data that is rarely accessed, satisfying the 3-year compliance requirement at optimal cost.

Step-by-Step Solution

1
Analyze access frequency during the initial intake period.
The first 14 days require high-frequency access for operational dashboards, making Standard storage the optimal choice because it has no retrieval fees.
Choosing a colder class during active access results in excessive data retrieval charges.
2
Analyze data access and retention requirements after 14 days.
After 14 days, data access drops significantly, but objects must be kept for 3 years. Coldline storage provides a low monthly storage rate for data accessed less than once a month.
Transitioning from Standard to Coldline optimizes monthly storage expenses while meeting the 90-day minimum storage duration requirement of Coldline.
3
Select the automated lifecycle management rule.
Create an Object Lifecycle Management policy with the action 'SetStorageClass' to 'COLDLINE' conditioned on 'Age: 14 days'.
Automating lifecycle transitions prevents manual administrative overhead and ensures cost efficiency.

Key Concept

Selecting Cloud Storage classes and Object Lifecycle Management rules based on data access patterns and retrieval cost considerations.
Question 452Question →

A solutions architect is creating a comprehensive monthly cost model using the Google Cloud Pricing Calculator for an enterprise hybrid deployment. The planned workload consists of a stateful transactional database cluster operating continuously 24/7 on Compute Engine virtual machines, as well as a high-frequency real-time analytics pipeline that continuously reads and writes user telemetry data to Cloud Storage. Which TWO configuration parameters or cost estimation strategies should the architect include in the Google Cloud Pricing Calculator to ensure an accurate, optimal cost model? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Apply Committed Use Discounts (CUDs) or Sustained Use Discounts (SUDs) to the continuously running 24/7 Compute Engine database virtual machines.; Include associated persistent disk storage capacity, snapshot storage, and projected network egress traffic alongside VM instance core pricing.

Answer

The accurate estimation requires applying Committed Use Discounts (CUDs) or Sustained Use Discounts (SUDs) to 24/7 database virtual machines, and explicitly adding persistent disk capacity, snapshot storage, and egress network bandwidth to the pricing calculator.
Applying Committed Use Discounts (CUDs) or Sustained Use Discounts (SUDs) reflects realistic pricing for 24/7 database instances. In addition, persistent disk storage, snapshots, and network egress bandwidth are separate line items in Google Cloud billing that must be explicitly specified in the pricing calculator alongside compute VM configurations.

Step-by-Step Solution

1
Analyze database compute availability requirements and discount eligibility.
Since the transactional database runs 24/7, it qualifies for Sustained Use Discounts (SUDs) or Committed Use Discounts (CUDs). Spot VMs are unviable due to preemption risks on stateful workloads.
Committed and sustained use discounts provide substantial cost savings for predictable, non-preemptible workloads.
2
Identify all billable components tied to Compute Engine instances beyond CPU and RAM.
Persistent disks (PD-Standard, PD-SSD), disk snapshot storage, and outbound network egress generate separate charges.
The pricing calculator evaluates compute nodes separately from storage and network traffic; omitting storage or egress yields under-budgeted estimates.
3
Evaluate storage class access patterns for the telemetry data pipeline.
High-frequency, real-time analytics data must use Standard Storage class to avoid data retrieval penalties associated with Coldline or Archive classes.
Infrequent access classes carry high per-GB retrieval fees that outweigh storage savings when accessed continuously.

Key Concept

Accurate GCP cost modeling requires pairing appropriate compute discount models (CUD/SUD) with stateful workloads, factoring in non-compute resources (disks, egress), and selecting storage classes based on access frequency.
Question 453Question →

An administrator needs to configure Workload Identity on a Google Kubernetes Engine (GKE) cluster to allow a pod to access Cloud Storage without downloading service account keys. Arrange the steps in the correct operational sequence from first to last to complete this configuration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Create the Google Service Account (GSA) in IAM and grant required IAM roles. 2) Create the Kubernetes Service Account (KSA) in the GKE namespace. 3) Add the roles/iam.workloadIdentityUser IAM binding on the GSA for the KSA principal. 4) Annotate the KSA with the GSA email address. 5) Deploy the application workload specifying the KSA in the pod specification.
To securely grant GKE workloads access to GCP services via Workload Identity without exportable keys, you must first establish the GCP IAM identity (GSA), create the cluster identity (KSA), bind the KSA to the GSA using the `roles/iam.workloadIdentityUser` IAM role, annotate the KSA with the GSA email, and finally deploy the workload referencing the KSA in its pod specification.

Step-by-Step Solution

1
Provision the IAM Google Service Account
A GSA identity with specific GCP resource access permissions is created.
GCP resource permissions (such as Storage Object Viewer) must be attached to a Google Cloud IAM identity.
2
Provision the Kubernetes Service Account in GKE
A KSA identity is registered inside the cluster's target namespace.
Pods running inside GKE authenticate internally using Kubernetes Service Accounts.
3
Configure the IAM Workload Identity User policy binding
The GSA authorizes the GKE Workload Identity member principal `serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]` to impersonate it.
IAM must explicitly permit the specific cluster KSA principal to assume the identity of the GSA.
4
Annotate the KSA with the GSA email address
The metadata annotation `iam.gke.io/gcp-service-account` is added to the KSA.
The GKE metadata server reads this annotation to map token requests from pods using this KSA to the correct GSA.
5
Deploy the workload referencing the KSA
Pods run with the KSA specified under `spec.template.spec.serviceAccountName` and obtain short-lived OAuth 2.0 access tokens.
The workload specification links pod execution to the configured identity mapping.

Key Concept

Configuring Workload Identity in Google Kubernetes Engine
Question 454Question →

A financial services company is building a high-volume transaction system on Google Cloud. The core workload requires a fully managed, globally scalable relational database that guarantees multi-region ACID compliance and supports standard SQL queries. Simultaneously, a data-processing microservice running on Compute Engine needs high-throughput temporary block storage for ephemeral scratch data, requiring maximum IOPS where data survival across instance termination is unnecessary. Which combination of Google Cloud database and block storage solutions should be selected?

Show answer & explanation

Answer: Cloud Spanner for the core transaction database, and Local SSD for the ephemeral scratch storage

Answer

Cloud Spanner for the core transaction database, and Local SSD for the ephemeral scratch storage
The requirement calls for a globally scalable relational database with multi-region ACID compliance and standard SQL support, which specifically maps to Cloud Spanner. For the Compute Engine microservice requiring maximum IOPS ephemeral block storage where data does not need to persist after VM termination, Local SSD is the recommended solution as it is physically attached to the server host.

Step-by-Step Solution

1
Analyze database requirements for the core transaction workload.
Identified requirements for a fully managed relational database with standard SQL support, multi-region ACID transactions, and horizontal scaling.
Cloud Spanner is Google Cloud's only fully managed relational database that provides global scale, multi-region ACID compliance, and horizontal write scalability.
2
Analyze block storage requirements for the Compute Engine microservice.
Identified requirements for maximum IOPS, microsecond/sub-millisecond latency, ephemeral scratch space, and no need for persistence across instance termination.
Local SSDs are physically attached to the host running the VM instance, offering high IOPS and ultra-low latency ideal for temporary scratch disk space.
3
Evaluate the architectural combination against Google Cloud best practices.
Combining Cloud Spanner with Local SSD satisfies both requirements with minimal operational overhead.
This combination directly fulfills all throughput, consistency, scale, and performance criteria without over-provisioning network storage.

Key Concept

Selecting managed database and persistent storage options based on transaction consistency, geographic scope, and IOPS requirements
Question 455Question →

A cloud engineer is configuring detailed daily Cloud Billing data exports to BigQuery for an enterprise billing account. The target dataset `billing_export_daily` has already been created in a central project named `corp-finance-analytics`. During configuration within the Cloud Console, the engineer encounters a permission denied error when saving the export settings. What minimum IAM permissions must be granted to the engineer to successfully complete the billing export configuration?

Show answer & explanation

Answer: Billing Account Costs Manager (or Billing Account Administrator) on the Cloud Billing account, and BigQuery Data Editor (or BigQuery Admin) on the target project or dataset.

Answer

Granting Billing Account Costs Manager (or Billing Account Administrator) on the Cloud Billing account and BigQuery Data Editor (or BigQuery Admin) on the target project or dataset.
Configuring a BigQuery billing export spans two distinct administrative boundaries. The user setting up the export must hold the Billing Account Costs Manager or Billing Account Administrator role on the Cloud Billing account, and additionally must have dataset edit rights (such as BigQuery Data Editor or BigQuery Admin) on the destination project hosting the BigQuery dataset.

Step-by-Step Solution

1
Analyze billing account role requirements.
Configuring Cloud Billing exports modifies billing settings, requiring Billing Account Costs Manager or Billing Account Administrator permissions on the billing account.
Read-only roles like Billing Account Viewer cannot authorize export sinks.
2
Analyze BigQuery destination project role requirements.
The configuration persona must have rights to list and write data to the target dataset, requiring BigQuery Data Editor or BigQuery Admin on the destination dataset/project.
Cloud Billing needs to establish dataset connections and schemas in the destination project.
3
Combine dual-boundary IAM role requirements.
The engineer requires explicit role assignments on both the Cloud Billing resource and the target GCP project resource.
Google Cloud separates IAM boundaries between billing accounts and project-level resources.

Key Concept

Dual IAM Role Requirements for Cloud Billing BigQuery Exports
Question 456Question →

A healthcare organization is planning its Google Compute Engine architecture for two distinct workloads: a core patient search indexing engine that requires continuous uninterrupted availability and fixed memory capacity, and a nightly batch job that processes large volumes of anonymized medical images in parallel with stateless, fault-tolerant tasks. The organization wants to optimize compute infrastructure costs while maintaining strict availability requirements for critical operations. Which compute provisioning strategy should the cloud engineer recommend?

Show answer & explanation

Answer: Provision standard or memory-optimized Compute Engine instances with Committed Use Discounts (CUDs) for the core search indexing engine, and use Spot VMs managed by an instance group for the nightly batch processing pipeline.

Answer

Provision standard or memory-optimized Compute Engine instances with Committed Use Discounts for the uninterrupted core search indexing engine, and leverage Spot VMs for the fault-tolerant nightly batch processing pipeline.
The correct strategy pairs baseline, continuous workloads with Committed Use Discounts (CUDs) to guarantee availability and reduce costs, while using Spot VMs for stateless batch processing to maximize savings on interruptible workloads.

Step-by-Step Solution

1
Analyze workload 1 requirements
The core patient search indexing engine requires 24/7 continuous uptime and predictable capacity.
Baseline stateful or critical workloads with predictable usage benefit most from Committed Use Discounts (1-year or 3-year commitments).
2
Analyze workload 2 requirements
The nightly medical image processing pipeline is stateless, highly parallelizable, and fault-tolerant.
Stateless batch processing that can withstand instance preemptions is the ideal candidate for Spot VMs, reducing compute costs by up to 60-91%.
3
Match provisioning strategies to workload characteristics
Combining Committed Use Discounts for baseline VM instances with Spot VMs for batch workloads optimizes total cost of ownership without violating availability SLAs.
Ensures high availability for critical services while taking advantage of deep discounts for interruptible workloads.

Key Concept

Selecting compute machine types and discount models (CUDs vs. Spot VMs) based on workload interruptibility and availability requirements.
Estimated Time:1m 30s
Question 457Question →

A DevOps engineer has created a new Google Kubernetes Engine (GKE) cluster named `app-cluster` in the `us-west1-a` zone. Before deploying workloads using `kubectl`, the engineer must configure local command-line credentials for this cluster. Which command should the engineer execute to populate the local `kubeconfig` file?

Show answer & explanation

Answer: gcloud container clusters get-credentials app-cluster --zone us-west1-a

Answer

The command `gcloud container clusters get-credentials app-cluster --zone us-west1-a` is correct because it downloads the cluster endpoint and authentication credentials required by `kubectl` to interact with the GKE cluster.
Executing `gcloud container clusters get-credentials app-cluster --zone us-west1-a` retrieves the cluster endpoint and authentication credentials from Google Cloud and updates the local `kubeconfig` file, allowing `kubectl` commands to target the specified cluster.

Step-by-Step Solution

1
Identify the CLI tool responsible for managing GKE cluster authentication contexts.
Recognize that `gcloud container clusters` is used for GKE cluster lifecycle and credential tasks.
Before `kubectl` can communicate with a GKE cluster control plane, a valid context must exist in `~/.kube/config`.
2
Select the sub-command specifically designated for downloading cluster credentials.
Identify `get-credentials` along with the mandatory cluster name and zone flag.
Executing `gcloud container clusters get-credentials` writes the necessary certificate authority and auth token configuration into the local `kubeconfig`.

Key Concept

Fetching GKE cluster authentication credentials for kubectl configuration
Question 458Question →

A cloud engineer needs to update an existing Google Cloud Storage bucket named `analytics-raw-data-logs` so that any new objects uploaded to the bucket are assigned the Nearline storage class by default. Which Google Cloud CLI command should the engineer run to accomplish this task?

Show answer & explanation

Answer: gcloud storage buckets update gs://analytics-raw-data-logs --default-storage-class=nearline

Answer

The command `gcloud storage buckets update gs://analytics-raw-data-logs --default-storage-class=nearline` correctly configures the default storage class of an existing bucket.
The command `gcloud storage buckets update gs://analytics-raw-data-logs --default-storage-class=nearline` uses the correct `gcloud storage` syntax to modify an existing bucket and set its default storage class to Nearline.

Step-by-Step Solution

1
Identify the CLI tool standard
Google Cloud recommends using `gcloud storage` for Cloud Storage management.
The `gcloud storage` CLI provides unified resource management syntax for Cloud Storage resources.
2
Determine the resource operation
Since the bucket already exists, use `gcloud storage buckets update` rather than `create`.
Modifying existing bucket properties requires an update command.
3
Specify the configuration flag
Pass `--default-storage-class=nearline` with the target bucket URI `gs://analytics-raw-data-logs`.
This sets the default storage class applied to future object uploads within the bucket.

Key Concept

Configuring Cloud Storage Bucket Default Storage Class via gcloud CLI
Question 459Question →

An e-commerce enterprise is architecting a Google Kubernetes Engine (GKE) environment to process core transactional events and inventory updates. The system must meet three strict architectural requirements:
1. High availability: The control plane and worker workloads must withstand a complete single-zone outage without service disruption.
2. Zero node management overhead: The infrastructure team must not manage, patch, or configure underlying Compute Engine virtual machine instances or node pools.
3. Automatic scaling: Compute resources must dynamically scale down when demand drops to eliminate unnecessary costs.

Which GKE cluster architecture configuration best satisfies all these requirements?

Show answer & explanation

Answer: Deploy a Regional GKE Autopilot cluster distributed across multiple availability zones.

Answer

Deploying a Regional GKE Autopilot cluster distributed across multiple availability zones satisfies high availability, zero node management overhead, and automated resource scaling.
A Regional GKE Autopilot cluster provides a multi-zonal control plane for fault tolerance against zonal outages, while fully managing node lifecycle, OS patching, and automatic infrastructure scaling to eliminate operational overhead.

Step-by-Step Solution

1
Analyze high availability requirements
A regional cluster control plane is replicated across multiple zones, preventing control plane downtime during a single-zone failure, unlike a zonal cluster.
Zonal clusters host the master control plane in a single zone, creating a single point of failure.
2
Evaluate operational management boundaries
GKE Autopilot manages the underlying node infrastructure, OS patching, and node provisioning automatically.
GKE Standard leaves node maintenance, OS upgrades, and node pool configuration to the administrator.
3
Verify autoscaling capabilities
Autopilot dynamically provisions and scales resource capacity based on pod resource requests without manual node pool sizing.
Workload resource requirements are met seamlessly while optimizing operational expenditures.

Key Concept

GKE Autopilot vs. Standard Operational Boundaries and Regional vs. Zonal High Availability Planning
Question 460Question →

A system administrator needs to configure internal load balancing for backend virtual machine instances communicating over raw TCP within the same Google Cloud VPC network and region. The solution must preserve the client source IP addresses and avoid SSL offloading overhead. Which Google Cloud load balancer service should be planned for this architecture?

Show answer & explanation

Answer: Internal Passthrough Network Load Balancer

Answer

Internal Passthrough Network Load Balancer is the correct load balancer choice for internal Layer 4 TCP traffic requiring client source IP preservation within a VPC region.
The Internal Passthrough Network Load Balancer is a regional Layer 4 load balancer that distributes internal TCP/UDP traffic among Compute Engine instances. Because it is a passthrough load balancer, it routes traffic directly to backends without terminating connections, preserving the client source IP address.

Step-by-Step Solution

1
Analyze traffic scope and direction requirements.
Traffic is internal within the same VPC network and region.
Internal traffic requires an internal load balancing solution rather than an external public-facing endpoint.
2
Identify the protocol and OSI layer required by the workload.
Workload uses raw TCP (Layer 4) and requires client source IP preservation.
Layer 4 passthrough network load balancers do not terminate TCP connections or act as Layer 7 proxies, allowing client source IP preservation.
3
Select the matching Google Cloud Load Balancer product.
Internal Passthrough Network Load Balancer fulfills all internal regional Layer 4 requirements.
It is built on Andromeda network virtualization and efficiently routes internal TCP traffic directly to backend Compute Engine VMs.

Key Concept

Selecting GCP Load Balancers based on traffic scope (internal vs external) and protocol layer (L4 passthrough vs L7 proxy).
PreviousPage 23 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin