Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 481Question →

A fintech organization is designing a Google Kubernetes Engine (GKE) architecture to run two distinct workloads in a single production environment:
1. A high-throughput, latency-sensitive payment routing service requiring custom Linux kernel parameters (`sysctl` settings) and dedicated node CPU/memory reservations.
2. An asynchronous financial model simulation batch workload that handles transient, fault-tolerant calculation jobs with minimal cost.

Which two cluster design choices should the cloud engineer implement to meet these technical and financial requirements?

Select all that apply

Show answer & explanation

Answer: Provision a GKE Standard cluster to enable custom Linux kernel sysctl configurations on node pools.; Configure a dedicated node pool utilizing Spot VMs for the asynchronous financial model simulation batch workload.

Answer

Select a GKE Standard cluster to support custom sysctl kernel configurations and use a dedicated Spot VM node pool for the fault-tolerant batch simulation workload.
Choosing GKE Standard fulfills the strict requirement for custom sysctl kernel configurations, which Autopilot prevents. Utilizing Spot VMs for the batch simulation workload satisfies the cost optimization requirement while ensuring compute preemption does not risk data integrity, as the job is fault-tolerant.

Step-by-Step Solution

1
Analyze the operational requirements for the payment routing service
Identified the need for custom Linux sysctl parameters and node-level control
GKE Autopilot manages node configuration entirely and restricts custom sysctl modifications. Therefore, a GKE Standard cluster is mandatory for custom kernel parameters.
2
Analyze the workload characteristics and cost constraints for the simulation workload
Identified that the simulation workload is asynchronous, stateless, and fault-tolerant
Spot VMs offer steep discounts for workloads that can withstand compute preemption without data loss.

Key Concept

Selecting between GKE Standard and Autopilot based on node customization needs, and leveraging Spot VMs for fault-tolerant workloads.
Question 482Question →

A cloud engineer is deploying a new Google Cloud Storage bucket named `gs://finance-reports-archival` to store sensitive audit documents. The requirements mandate creating the bucket in the `us-central1` region, enforcing uniform bucket-level access to prevent object-level ACL overrides, applying a lifecycle management configuration from a local file named `policy.json` to transition items to Coldline storage, and finally populating the bucket with local files from `./reports/`. What is the correct sequential order of `gcloud storage` administrative steps to complete this deployment?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with provisioning the bucket resource, configuring security controls (uniform bucket-level access), applying lifecycle rules from the configuration file, and finally copying local object files into the bucket.
The correct deployment sequence follows standard infrastructure lifecycle practices: provision the storage container (`gcloud storage buckets create`), apply security controls (`--uniform-bucket-level-access`), configure management rules (`--lifecycle-file`), and then perform data ingestion (`gcloud storage cp`).

Step-by-Step Solution

1
Provision the bucket
Bucket `gs://finance-reports-archival` is created in `us-central1`.
You cannot update configuration settings or upload data to a bucket that does not yet exist.
2
Configure security controls
Uniform bucket-level access is enabled, disabling legacy object ACLs.
Configuring security boundaries prior to data ingestion ensures objects uploaded later strictly inherit IAM access policies.
3
Apply object lifecycle management
The bucket updates its lifecycle metadata using `policy.json`.
Applying the lifecycle rule prior to data upload guarantees that incoming objects are managed by the storage class transition rules immediately upon upload.
4
Ingest objects into the bucket
Local report files are copied to `gs://finance-reports-archival/`.
Data transfer occurs as the final step after target storage resources and policies are fully initialized.

Key Concept

Cloud Storage Deployment Lifecycle & Ordering
Question 483Question →

A DevOps automation engineer at a satellite imaging startup is configuring a custom CI/CD service account. The service account needs to automatically link newly provisioned isolated Google Cloud projects to the company's central Cloud Billing account. Following Google Cloud least-privilege security best practices, which TWO predefined IAM roles must be granted to the service account?

Select all that apply

Show answer & explanation

Answer: Billing Account User (roles/billing.user) on the Cloud Billing account; Project Billing Manager (roles/billing.projectManager) on the target project

Answer

To link a Google Cloud project to a Cloud Billing account following least privilege, the identity requires Billing Account User (roles/billing.user) on the billing account and Project Billing Manager (roles/billing.projectManager) on the target project.
Linking a project to a Cloud Billing account requires permissions on both sides of the relationship. On the billing account side, Billing Account User (roles/billing.user) grants permission to bind projects to the account. On the project side, Project Billing Manager (roles/billing.projectManager) grants permission to attach or detach billing accounts for that specific project. Together, these two predefined roles enforce least privilege.

Step-by-Step Solution

1
Determine the billing account level permission required for linking.
Identified Billing Account User (roles/billing.user) as the least-privileged predefined role on the Cloud Billing account.
Linking requires permission to use the billing account without requiring administrative control over billing settings or access management.
2
Determine the project level permission required for linking.
Identified Project Billing Manager (roles/billing.projectManager) as the least-privileged predefined role on the target project.
Linking requires permission on the resource being linked to attach billing services, without needing full resource control.

Key Concept

Dual-permission requirement for project billing account linking under least privilege
Question 484Question →

An enterprise infrastructure team needs to grant an automated backup service account the permission to create, delete, and manage Compute Engine persistent disk snapshots within a specific project named `prod-data-01`. To adhere to security policy, the service account must not have permissions to modify compute instances, view instance metadata, or access network configurations. Following Google Cloud recommended security best practices, which IAM role assignment should you configure for the service account?

Show answer & explanation

Answer: Grant Compute Storage Admin (roles/compute.storageAdmin) on the project prod-data-01

Answer

Grant the predefined Compute Storage Admin role (roles/compute.storageAdmin) resource-scoped at the project level.
The Compute Storage Admin (roles/compute.storageAdmin) role grants full control over persistent disks, images, and snapshots without permitting actions on virtual machine instances, networks, or other GCP services. Applying this at project scope satisfies all functional requirements while strictly maintaining least privilege.

Step-by-Step Solution

1
Analyze the operational requirements
The target identity requires managing disk snapshots while lacking permissions for instance management and networking.
Security guidelines mandate adhering to the principle of least privilege.
2
Evaluate role granularity and scope
Primitive roles like Editor or high-level broad roles like Compute Admin grant excess permissions. Compute Storage Admin narrowly restricts privileges to disks, images, and snapshots.
Predefined roles tailored to specific resource subsets avoid over-privileging.
3
Select resource hierarchy level for policy binding
Bind the role at the target project level (`prod-data-01`).
Granting permissions at the organization level causes unwanted inheritance across all subordinate projects.

Key Concept

Applying Least Privilege via Predefined IAM Roles at Project Scope
Question 485Question →

A company is planning a Virtual Private Cloud (VPC) network in Google Cloud to host a multi-tenant Google Kubernetes Engine (GKE) cluster environment. The cloud network will connect directly to an existing on-premises data center using the IPv4 CIDR range 172.16.0.0/12172.16.0.0/12. The design requires dedicated primary IP ranges for node instances and secondary IP ranges for Pods and Services, with the ability to expand subnet capacity in the future without network disruption.

Which TWO network planning practices should the cloud architect follow to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision the VPC network in custom mode to explicitly manage subnets and ensure primary and secondary IP ranges do not overlap with 172.16.0.0/12172.16.0.0/12.; Reserve contiguous, unallocated IP address space adjacent to each primary subnet CIDR block to allow seamless subnet expansion in the future.

Answer

The network architect should provision the VPC network in custom mode with non-overlapping ranges relative to the on-premises network, and reserve contiguous adjacent IP address space next to each primary subnet block to facilitate future CIDR expansion.
Custom-mode VPC networks provide complete control over IP range planning, ensuring that primary and secondary ranges do not conflict with connected on-premises networks (such as 172.16.0.0/12172.16.0.0/12). Additionally, reserving contiguous IP space next to existing subnets allows administrators to expand subnet primary ranges in-place without causing CIDR overlap errors.

Step-by-Step Solution

1
Analyze VPC mode requirements for enterprise hybrid integration.
Auto-mode VPCs allocate fixed subnets in 10.128.0.0/910.128.0.0/9 across all GCP regions, which can lead to IP conflicts and lack custom secondary range management. Custom-mode VPC must be selected.
Custom-mode VPCs provide full control over subnet creation, regional deployment, and non-overlapping IP assignment.
2
Evaluate subnet expansion requirements and constraints.
Expanding a primary subnet range in GCP requires modifying the netmask to a broader contiguous prefix (e.g., from /24/24 to /23/23).
If adjacent IP addresses are already assigned to another subnet, in-place CIDR expansion will fail due to overlapping range errors.

Key Concept

VPC Subnet Planning and Expansion Rules
Question 486Question →

A financial analytics company is preparing to launch a low-latency transaction processing workload on Google Kubernetes Engine (GKE). The application requires custom Linux kernel sysctl parameters (such as modifying `net.core.somaxconn`) on the underlying node OS to support high network throughput, and it requires guaranteed host stability without node preemptions. Additionally, an engineer on a new management workstation must configure local `kubectl` access to interact with the cluster and deploy the workload manifest. Which combination of cluster mode configuration and operational commands correctly satisfies these requirements according to Google Cloud recommended practices?

Show answer & explanation

Answer: Deploy a GKE Standard cluster with a dedicated standard (non-Spot) node pool configured with custom sysctls, execute `gcloud container clusters get-credentials` to update the local kubeconfig context, and deploy the workload using `kubectl apply`.

Answer

The application must be deployed on a GKE Standard cluster utilizing a dedicated standard node pool configured with custom sysctls, followed by executing `gcloud container clusters get-credentials` to configure `kubectl` access.
Deploying a GKE Standard cluster with a standard node pool allows explicit configuration of node OS sysctl parameters while guaranteeing non-preemptible execution. Executing `gcloud container clusters get-credentials` generates the necessary authentication context in the local kubeconfig file, enabling `kubectl` to successfully deploy workloads to the cluster.

Step-by-Step Solution

1
Evaluate cluster mode requirements based on node OS customization and workload characteristics.
GKE Autopilot locks down node OS modifications, so custom sysctl kernel parameter tuning requires GKE Standard mode.
GKE Autopilot enforces strict node management boundaries that prevent custom sysctls or custom node OS configurations.
2
Evaluate node pool type based on workload interruption tolerance.
A standard persistent node pool must be selected instead of a Spot node pool.
Spot instances can be reclaimed dynamically by Google Cloud at any time, violating the guaranteed non-preemptible requirement for latency-critical processing.
3
Determine the correct CLI command to establish local `kubectl` authentication credentials.
Execute `gcloud container clusters get-credentials [CLUSTER_NAME] --zone [ZONE] --project [PROJECT_ID]`.
This command fetches the API endpoint, cluster CA certificate, and OAuth tokens, writing them into `~/.kube/config` so `kubectl` can communicate with the GKE control plane.

Key Concept

GKE Cluster Modes and Kubeconfig Management
Estimated Time:2m 0s
Question 487Question →

An enterprise organization is deploying an internal data processing engine on Google Compute Engine that requires 4 vCPUs and 26 GB of RAM for a continuous, steady-state workload. Standard predefined machine types offer either 4 vCPUs with 16 GB of memory or 8 vCPUs with 32 GB of memory. The workload is non-fault-tolerant and cannot risk abrupt termination. Which Compute Engine machine type strategy should you select to meet these resource requirements with the lowest operational cost?

Show answer & explanation

Answer: Provision a custom machine type configured with 4 vCPUs and 26 GB of RAM.

Answer

Provision a custom machine type configured with 4 vCPUs and 26 GB of RAM.
Google Compute Engine allows administrators to create custom machine types tailored to specific vCPU and memory needs. When workload specifications fall between standard predefined shapes, configuring a custom machine type prevents paying for unused compute cores while ensuring full memory requirements are met.

Step-by-Step Solution

1
Analyze workload resource requirements and constraints.
The workload requires 4 vCPUs, 26 GB memory, continuous uptime, and zero tolerance for preemption.
This rules out Spot VMs due to termination risk and serverless options like Cloud Functions due to execution time and memory limits.
2
Evaluate predefined vs. custom machine types.
Predefined standard types (like 4 vCPU / 16 GB or 8 vCPU / 32 GB) force either under-provisioning memory or paying for 4 extra unneeded vCPUs.
Compute Engine allows creating custom machine types where vCPUs and memory ratios can be independently customized.
3
Select the most cost-effective compute configuration.
Custom machine type with 4 vCPUs and 26 GB RAM directly meets all workload requirements at minimal cost.
Right-sizing compute resources avoids wasted expenditure on unutilized hardware.

Key Concept

Compute Engine Custom Machine Types
Estimated Time:1m 15s
Question 488Question →

A cloud engineer needs to deploy a containerized web application to a Google Kubernetes Engine (GKE) cluster from a local management workstation. In what order should the engineer execute the following commands to authenticate, configure cluster access, deploy the workload, and verify the deployment status?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is: 1) Authenticate using `gcloud auth login`, 2) Update kubeconfig context using `gcloud container clusters get-credentials`, 3) Create resources using `kubectl apply -f deployment.yaml`, and 4) Confirm pod readiness using `kubectl rollout status deployment/web-app`.
The correct operational lifecycle requires authenticating identity first (`gcloud auth login`), retrieving the target GKE cluster endpoint and credentials to populate kubeconfig (`gcloud container clusters get-credentials`), applying the Kubernetes manifest (`kubectl apply`), and finally validating that the pods have successfully rolled out (`kubectl rollout status`).

Step-by-Step Solution

1
Authenticate user credentials with Google Cloud.
User session is authenticated for gcloud CLI operations.
Accessing Google Cloud APIs and retrieving cluster metadata requires prior authentication.
2
Generate cluster entry in kubeconfig using `gcloud container clusters get-credentials`.
Local kubectl client is configured with the GKE cluster control plane endpoint and auth token.
kubectl requires local kubeconfig context to communicate with the GKE control plane.
3
Submit workload manifest using `kubectl apply -f deployment.yaml`.
Deployment object and underlying Pod specifications are registered with the Kubernetes API server.
Workload specifications must be applied to the targeted cluster.
4
Verify deployment status using `kubectl rollout status deployment/web-app`.
Confirmation that all requested pod replicas are running and ready.
Verification ensures the newly applied deployment specification has successfully completed its rollout.

Key Concept

GKE Cluster Credential Retrieval and Workload Deployment Lifecycle
Estimated Time:1m 30s
Question 489Question →

A lead developer needs permission to create new Google Cloud projects inside a dedicated folder named `Engineering-Dev`. Additionally, the developer must be able to associate these newly created projects with the organization's central billing account.

Which combination of IAM roles assigned with least privilege allows the developer to fulfill both requirements?

Show answer & explanation

Answer: roles/resourcemanager.projectCreator on the Engineering-Dev folder and roles/billing.user on the central billing account.

Answer

Grant roles/resourcemanager.projectCreator on the Engineering-Dev folder and roles/billing.user on the central billing account.
To create projects inside a specific folder, `roles/resourcemanager.projectCreator` must be bound to that folder. To link newly created projects to an existing billing account, the user must also hold `roles/billing.user` on the Billing Account resource. This combination minimizes access while fulfilling both administrative tasks.

Step-by-Step Solution

1
Determine the required permission for creating projects within a specific scope.
The role roles/resourcemanager.projectCreator granted on the Engineering-Dev folder allows creation of projects within that folder only.
IAM permissions inherit down the resource hierarchy. Applying the role at the folder level limits project creation scope according to least privilege.
2
Determine the required permission for linking projects to a central billing account.
The role roles/billing.user granted directly on the Billing Account resource provides permission to link projects to that billing account.
Linking a project to a billing account requires permissions on both the project (or project creation rights) and the target billing account.

Key Concept

Resource Hierarchy IAM Scoping and Billing Account Linking Permissions
Question 490Question →

A cloud network team is planning to expand the primary IP range of an existing production subnet in a custom-mode Google Cloud Virtual Private Cloud (VPC) network from 10.200.1.0/2410.200.1.0/24 to 10.200.0.0/2310.200.0.0/23 to accommodate a higher volume of compute instances. To ensure zero service downtime and avoid IP address space collisions, what is the correct chronological sequence of operational steps the team should follow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with auditing existing routing tables and peered network ranges for IP collisions, followed by confirming that the new prefix (10.200.0.0/2310.200.0.0/23) mathematically encompasses the existing primary range (10.200.1.0/2410.200.1.0/24). Next, the network engineer executes the non-disruptive `gcloud compute networks subnets expand-ip-range` command with `--prefix-length=23`. Finally, post-expansion verification validates active workload connectivity and new instance IP allocation.
Expanding a primary IP range in a Google Cloud custom-mode VPC subnet requires a systematic approach. First, pre-expansion checks must verify that the target expanded block (10.200.0.0/2310.200.0.0/23) does not overlap with any static routes, Cloud Routers, or peered networks. Second, the target CIDR must be verified to mathematically encompass the current range (10.200.1.0/2410.200.1.0/24) by decreasing the prefix length (from /24/24 to /23/23). Third, the expansion command `gcloud compute networks subnets expand-ip-range` is run specifying `--prefix-length=23`. Finally, post-deployment testing validates continuous operational status and allocation to new VM instances.

Step-by-Step Solution

1
Audit routing tables and peered network ranges.
Identified that 10.200.0.0/2310.200.0.0/23 is completely unassigned across all connected environments.
Prevents routing table conflicts and peering non-overlap violations before modifying the live subnet configuration.
2
Verify mathematical prefix containment.
Confirmed that 10.200.0.0/2310.200.0.0/23 spans 10.200.0.010.200.0.0 to 10.200.1.25510.200.1.255, strictly containing the current range of 10.200.1.0/2410.200.1.0/24 (10.200.1.010.200.1.0 - 10.200.1.25510.200.1.255).
Google Cloud VPC subnet expansion rules mandate that primary ranges can only be expanded to a larger contiguous CIDR block (smaller prefix mask length) encompassing the original range.
3
Run the gcloud CLI subnet expansion command.
The VPC primary subnet range updates online without requiring instance reboots or dropping active connections.
Applying changes via `gcloud compute networks subnets expand-ip-range --prefix-length=23` executes the live configuration update.
4
Perform post-expansion connectivity and allocation validation.
Existing instances maintain active network sessions and newly deployed VMs correctly pull addresses from the 10.200.0.0/2410.200.0.0/24 pool.
Ensures the expanded address range is active and functioning as expected.

Key Concept

VPC Subnet Primary CIDR Range Expansion Rules and Procedure
Question 491Question →

An organization requires strict automated cost controls for its cloud workloads. The finance team specifies that if actual spending in a designated development project reaches 100% of its 5,000monthlybudget,runningvirtualmachineinstancesmustbeimmediatelystoppedtopreventfurthercostaccumulation.ThecloudadministratorcreatesaCloudBillingbudgetwitha5,000 monthly budget, running virtual machine instances must be immediately stopped to prevent further cost accumulation. The cloud administrator creates a Cloud Billing budget with a 5,000 threshold. Which implementation approach should the administrator select to accomplish this automated remediation?

Show answer & explanation

Answer: Link the Cloud Billing budget to a Cloud Pub/Sub topic, and write a Cloud Function subscribed to that topic that calls the Compute Engine API to stop active VM instances.

Answer

Connect the Cloud Billing budget to a Cloud Pub/Sub topic and deploy a Cloud Function subscribed to that topic to programmatically stop the running instances using the Compute Engine API.
The correct response identifies that Cloud Billing budget alerts do not shut down resources natively. Publishing budget notifications to a Cloud Pub/Sub topic enables custom code (such as a Cloud Function) to receive the event payload, evaluate the spend threshold, and call the Compute Engine API to stop active VM instances.

Step-by-Step Solution

1
Understand the scope of GCP Billing Budget alert notifications.
Recognize that standard budget alerts only send informational messages and do not perform automated resource termination out of the box.
GCP separates billing notification delivery from resource lifecycle management.
2
Configure programmatic notifications.
Publish budget notifications to a Cloud Pub/Sub topic linked to the billing budget.
Pub/Sub provides an event-driven channel that receives budget notification payloads when threshold percentages are breached.
3
Implement automated remediation logic.
Create a Cloud Function (or Cloud Run service) triggered by the Pub/Sub topic to parse the cost payload and issue stop requests to Compute Engine VMs.
Custom code executing via Cloud Functions can interact with GCP APIs to enforce resource capping and budget compliance.

Key Concept

Cloud Billing budgets send alert messages but do not natively modify or shut down cloud resources; programmatic enforcement requires Cloud Pub/Sub integration with serverless logic.
Question 492Question →

A cloud administrator recently created a new Google Kubernetes Engine (GKE) cluster named `analytics-cluster` in the `us-east1` region. When attempting to run `kubectl get pods` from their local workstation terminal, the command fails because `kubectl` is not configured to communicate with the cluster. Which command must the administrator execute to fetch the cluster credentials and automatically update their local `kubeconfig` file?

Show answer & explanation

Answer: gcloud container clusters get-credentials analytics-cluster --region us-east1

Answer

The command 'gcloud container clusters get-credentials analytics-cluster --region us-east1' is correct because it populates the local kubeconfig file with the necessary API endpoint and authentication credentials required by kubectl.
Executing 'gcloud container clusters get-credentials' retrieves the API endpoint and authentication tokens for the cluster and updates the local kubeconfig configuration file, allowing kubectl commands to succeed.

Step-by-Step Solution

1
Identify the requirement to connect a local kubectl client to an existing GKE cluster.
Recognize that kubectl requires valid API credentials and context entries in the local kubeconfig file.
Creating a cluster in GKE does not automatically configure remote developer workstations.
2
Select the correct gcloud CLI command for fetching Kubernetes credentials.
Use 'gcloud container clusters get-credentials' specifying the cluster name and region/zone.
This command generates the certificate/token entries and sets the current context for kubectl.

Key Concept

Fetching GKE cluster credentials for kubectl management
Estimated Time:45s
Question 493Question →

A media monitoring organization ingests daily video streams into a Google Cloud Storage bucket. Internal news editors frequently access and edit these video files multiple times per day during the first 30 days after ingestion. After 30 days, access drops significantly, but the files must be preserved for one year to comply with broadcasting regulations. Which Cloud Storage configuration strategy minimizes total costs while meeting these access patterns?

Show answer & explanation

Answer: Set the default storage class of the bucket to Standard Storage, and create an Object Lifecycle Management rule to transition objects to Coldline Storage after 30 days.

Answer

The optimal strategy is to store new video files in Standard Storage and use Object Lifecycle Management to transition them to Coldline Storage after 30 days.
Using Standard Storage for the first 30 days ensures zero retrieval fees during the high-frequency editing phase. Transitioning objects to Coldline Storage after 30 days via Object Lifecycle Management reduces the monthly storage cost for the remainder of the required one-year retention period when data access is infrequent.

Step-by-Step Solution

1
Analyze access frequency during the initial 30-day phase.
High access frequency requires Standard Storage to prevent data retrieval fees.
Coldline and Archive classes charge per-GB retrieval fees which make them expensive for active datasets.
2
Analyze access frequency after the initial 30-day phase.
Low access frequency for the remainder of the 1-year retention period favors Coldline or Archive storage.
Coldline Storage offers significantly lower monthly per-gigabyte storage rates for data accessed less than once a month.
3
Configure automation for class transitions.
An Object Lifecycle Management rule automates the transition from Standard to Coldline at 30 days without manual intervention.
Lifecycle rules seamlessly manage object class transitions based on object age criteria.

Key Concept

Cloud Storage Class Selection & Lifecycle Management
Question 494Question →

You need to deploy a new Compute Engine virtual machine instance named 'web-server' in the zone 'us-central1-a' using the Google Cloud CLI. Which gcloud command should you run?

Show answer & explanation

Answer: gcloud compute instances create web-server --zone=us-central1-a

Answer

The command 'gcloud compute instances create web-server --zone=us-central1-a' correctly deploys the VM instance to the specified zone.
To create a Compute Engine instance using the Google Cloud CLI, the command must target the 'gcloud compute instances create' resource path and pass the target zone using the '--zone' flag.

Step-by-Step Solution

1
Identify the gcloud command group for managing Compute Engine instances.
The correct command group is 'gcloud compute instances'.
Compute Engine resources fall under the 'compute' command group in gcloud CLI.
2
Specify the creation action and resource name.
Append 'create web-server'.
The 'create' subcommand provisions a new VM instance with the specified name.
3
Specify the target zonal location flag.
Append '--zone=us-central1-a'.
Compute Engine VM instances are zonal resources and require the '--zone' flag rather than '--region'.

Key Concept

Deploying Compute Engine Virtual Machines via gcloud CLI syntax
Question 495Question →

A cloud engineer is creating a new Cloud SQL for MySQL instance. To ensure the database is accessible to internal workloads in the Virtual Private Cloud (VPC) while preventing all direct access from the public internet, which network configuration should be applied during deployment?

Show answer & explanation

Answer: Enable Private IP connectivity and associate the instance with the target VPC network.

Answer

Enable Private IP connectivity and associate the instance with the target VPC network.
Enabling Private IP assigns a private IP address from the designated VPC network to the Cloud SQL instance, ensuring traffic remains private within Google Cloud without internet exposure.

Step-by-Step Solution

1
Analyze the network isolation requirement.
The requirement specifies allowing internal VPC communication while blocking public internet exposure.
Direct public exposure creates unnecessary security risk for internal database workloads.
2
Select the secure deployment option for Cloud SQL.
Configuring Private IP attaches the managed database to the internal VPC network.
Private Services Access isolates database traffic from external routing.

Key Concept

Configuring Private IP for Managed Database Instances
Question 496Question →

An organization is deploying infrastructure on Google Kubernetes Engine (GKE) in region us-central1 to support two distinct applications. The first application consists of fault-tolerant, stateless batch-processing jobs that can tolerate node interruptions. The second application is a legacy security monitoring daemon that requires direct access to host kernel modules and privileged Linux capabilities on the underlying nodes. Additionally, an administrator needs to configure their local workstation to manage workloads on this new cluster named 'analytics-cluster' using kubectl. Which TWO actions or configuration choices should the administrator implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Deploy a GKE Standard cluster containing a dedicated Spot VM node pool for the stateless batch jobs, while hosting the security daemon on nodes with privileged execution enabled.; Execute `gcloud container clusters get-credentials analytics-cluster --region us-central1` on the workstation to fetch cluster endpoint and authentication details into kubeconfig.

Answer

The correct choices are deploying a GKE Standard cluster with a Spot VM node pool for fault-tolerant jobs and privileged node support, and executing `gcloud container clusters get-credentials analytics-cluster --region us-central1` to configure workstation authentication for kubectl.
Deploying a GKE Standard cluster with a Spot VM node pool satisfies both requirements: Spot VMs minimize costs for stateless, fault-tolerant batch jobs, while Standard mode permits running privileged pods that access underlying node kernel modules. Running `gcloud container clusters get-credentials` correctly populates the local kubeconfig file with the cluster endpoint and authentication tokens required for kubectl operation.

Step-by-Step Solution

1
Evaluate workload architectural requirements against GKE cluster modes.
Identified that the host-kernel security daemon requires GKE Standard mode because GKE Autopilot blocks privileged pods and custom host kernel access.
GKE Autopilot is fully managed and enforces strict security boundaries that prohibit elevated node permissions.
2
Select compute optimization strategies for stateless batch processing.
Configured a Spot VM node pool within the GKE Standard cluster.
Spot VMs provide significant cost discounts suitable for fault-tolerant batch workloads that can handle node preemptions.
3
Determine the proper workstation command to configure kubectl cluster credentials.
Identified `gcloud container clusters get-credentials analytics-cluster --region us-central1` as the correct credential retrieval method.
This command retrieves cluster certificate authority data and auth tokens, updating the local kubeconfig file so kubectl can communicate with the cluster master.

Key Concept

GKE Cluster Modes & Workstation Kubeconfig Management
Question 497Question →

A DevOps engineer is preparing to deploy an updated microservice manifest file (`deployment.yaml`) to an existing GKE cluster named `prod-cluster` located in region `us-central1`. When attempting to run `kubectl apply -f deployment.yaml` from a newly provisioned management terminal, the command fails because `kubectl` is not configured to communicate with the cluster's control plane endpoint. Which command sequence should the engineer execute to successfully authenticate `kubectl` and deploy the workload?

Show answer & explanation

Answer: Execute `gcloud container clusters get-credentials prod-cluster --region us-central1`, and then execute `kubectl apply -f deployment.yaml`.

Answer

Execute `gcloud container clusters get-credentials prod-cluster --region us-central1` to populate the local kubeconfig context, followed by `kubectl apply -f deployment.yaml`.
To interact with a GKE cluster via `kubectl`, the client must have an active context in the local kubeconfig file containing the control plane API server address and authorization credentials. Running `gcloud container clusters get-credentials prod-cluster --region us-central1` retrieves this data from Google Cloud and updates the local `.kube/config` file, enabling `kubectl apply` to succeed.

Step-by-Step Solution

1
Fetch the cluster credentials and endpoint data using the gcloud CLI.
The local `$HOME/.kube/config` file is created or updated with the necessary API server endpoint, cluster CA certificate, and authentication token provider for `prod-cluster` in `us-central1`.
Before `kubectl` can route requests to a GKE cluster, its local context must be populated with authentication details.
2
Apply the Kubernetes deployment manifest file via `kubectl`.
The Kubernetes API server accepts the manifest and creates or updates the deployment resource in the cluster.
With an active `kubectl` context pointing to the GKE cluster control plane, deployment commands succeed.

Key Concept

Configuring kubectl authentication context using gcloud container clusters get-credentials
Question 498Question →

A cloud engineer is using the Google Cloud Pricing Calculator to estimate the monthly cost of a data processing cluster. The cluster consists of 10 `n2-standard-4` Compute Engine instances running continuously for a 730-hour month at a base rate of 0.20perhourperinstance.Theworkloadutilizesa3−yearCommittedUseDiscount(CUD)offeringa550.20 per hour per instance. The workload utilizes a 3-year Committed Use Discount (CUD) offering a 55% discount on compute instance pricing. Each instance is attached to a 200 GB Standard Persistent Disk billed at 0.04 per GB per month. Additionally, the cluster transfers 500 GB of egress data to the internet per month, where the first 10 GB is free of charge and subsequent egress is billed at $0.12 per GB. What is the net estimated total monthly cost in USD for this architecture?

Show answer & explanation

Answer: 795.8

Answer

The net estimated total monthly cost is $795.80.
To determine the net monthly cost, each GCP component must be calculated individually based on pricing rules: Compute Engine VMs equal 10×730 hours×$0.20=$1,460.0010 \times 730 \text{ hours} \times \$0.20 = \$1,460.00 base cost, reduced by 55%55\% via CUD to $657.00\$657.00. Storage cost for 10×200 GB=2,000 GB10 \times 200\text{ GB} = 2,000\text{ GB} at $0.04/GB\$0.04/\text{GB} is $80.00\$80.00. Internet egress cost for (500−10) GB=490 GB(500 - 10)\text{ GB} = 490\text{ GB} at $0.12/GB\$0.12/\text{GB} is $58.80\$58.80. Summing these three components yields $657.00+$80.00+$58.80=$795.80\$657.00 + \$80.00 + \$58.80 = \$795.80.

Step-by-Step Solution

1
Calculate the discounted Compute Engine VM cost
$657.00
Base VM cost is 10 instances * 730 hours * 0.20/hr=0.20/hr = 1,460.00. Applying the 55% Committed Use Discount gives 1,460.00∗(1−0.55)=1,460.00 * (1 - 0.55) = 657.00.
2
Calculate the Standard Persistent Disk cost
$80.00
10 instances attached to 200 GB disks equal 2,000 GB total storage. 2,000 GB * 0.04/GB=0.04/GB = 80.00. Persistent disk storage is not eligible for Compute CUDs.
3
Calculate the net Internet egress cost
$58.80
The total egress of 500 GB minus the 10 GB monthly free tier leaves 490 billable GB. 490 GB * 0.12/GB=0.12/GB = 58.80.
4
Sum all monthly cost components
$795.80
Total cost = 657.00(Compute)+657.00 (Compute) + 80.00 (Storage) + 58.80(NetworkEgress)=58.80 (Network Egress) = 795.80.

Key Concept

Calculating GCP net monthly infrastructure cost taking into account Compute CUD scope, persistent storage pricing, and internet egress free tier allowances.
Question 499Question →

A cloud engineer must securely deploy an internal application on a new Compute Engine virtual machine without a public IP address. The deployment requires a custom service account with minimal access to a Cloud Storage bucket, an automated boot installation via a startup script that retrieves dependencies from the internet, and post-deployment validation. How should the engineer sequence these administrative tasks to ensure successful provisioning?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence requires creating the custom service account with IAM permissions first, establishing Cloud NAT for private outbound egress second, executing the `gcloud compute instances create` command with private IP flags third, and validating the startup script execution using Identity-Aware Proxy SSH tunneling fourth.
Proper deployment dependency ordering dictates that prerequisites must be established before provisioning. First, the IAM service account with Cloud Storage permissions must be created so it can be assigned to the instance. Second, Cloud NAT must be established on the VPC router so that a VM without a public IP can access external repositories during startup. Third, the instance is provisioned using `gcloud compute instances create` with `--service-account`, `--no-address`, and `--metadata-from-file startup-script=...`. Finally, post-deployment inspection requires connecting via Identity-Aware Proxy (IAP) SSH because the VM lacks an external IP address.

Step-by-Step Solution

1
Identity & Access Preparation
The custom service account is created and bound to the required Cloud Storage role.
The service account must exist in GCP IAM prior to referencing it in the Compute Engine deployment command.
2
Egress Network Architecture
Cloud NAT is provisioned on the VPC subnet router.
Instances provisioned without public IP addresses (`--no-address`) require Cloud NAT to fetch external software packages during startup script execution.
3
Instance Provisioning
The Compute Engine VM is created and begins booting.
The `gcloud compute instances create` command binds the network, IAM service account, metadata startup script, and private IP configuration together.
4
Post-Deployment Verification
The engineer connects via IAP SSH and confirms startup execution logs.
Without a public IP address, traditional SSH fails; IAP TCP forwarding provides secure administrative access to inspect boot logs.

Key Concept

Secure Private VM Deployment, Service Account Scoping, Cloud NAT Egress, and IAP Tunneling
Question 500Question →

For a multi-tier enterprise architecture migration to Google Cloud, evaluate the data access patterns and performance requirements of each workload component below. Match each requirement to the most appropriate and cost-effective Google Cloud database service or block storage configuration.

Click a left item, then click its matching right item

Items

A mobile client backend needing scalable hierarchical document storage, real-time live synchronization, offline data handling, and ACID transaction support across multiple collections.
An IoT streaming engine requiring single-digit millisecond latency for massive throughput writes and key-range scans across petabytes of time-series metric data.
A batch log aggregation VM performing high-volume sequential disk write operations where cost per gigabyte and sustained sequential throughput are prioritized over high random IOPS.
A cluster of web server Compute Engine VMs requiring high-performance shared block storage mounted simultaneously to all instances in read-only mode to access static application binary data.

Matches

Show answer & explanation

Answer

The correct pairings match mobile document sync requirements to Firestore in Native mode, high-throughput IoT time-series data to Cloud Bigtable, sequential batch logging to Standard Persistent Disk (pd-standard), and multi-instance shared read-only block storage to SSD Persistent Disk (pd-ssd) in ReadOnly attachment mode.
Firestore in Native mode provides flexible, hierarchical document storage with built-in client SDK offline sync and multi-document transactions. Cloud Bigtable delivers ultra-low latency write throughput for petabyte-scale time-series and IoT metrics. Standard Persistent Disk (pd-standard) minimizes costs for sequential disk operations like log aggregation. SSD Persistent Disk (pd-ssd) supports concurrent multi-VM attachment when accessed strictly in ReadOnly mode.

Step-by-Step Solution

1
Analyze document model, mobile client sync, offline support, and multi-collection ACID requirement.
Identifies Firestore in Native mode as the tailored database option for mobile backends requiring document synchronization.
Cloud SQL and Cloud Spanner are relational DBs, while Bigtable lacks mobile client synchronization SDKs and offline capabilities.
2
Analyze high-throughput, low-latency, petabyte-scale write and key-scan pattern for IoT metrics.
Identifies Cloud Bigtable as the optimal wide-column NoSQL service.
Cloud Bigtable scales seamlessly to petabytes and is specifically optimized for high-write time-series and key-range queries.
3
Analyze sequential write workload prioritized by cost per GB over random IOPS.
Identifies Standard Persistent Disk (pd-standard) as the correct block storage type.
HDD-backed standard disks offer the lowest cost per GB for sequential access workloads such as batch log ingestion.
4
Analyze requirement for high-performance block storage attached to multiple VMs simultaneously.
Identifies SSD Persistent Disk (pd-ssd) configured in ReadOnly mode.
Persistent Disks can be attached to multiple Compute Engine instances simultaneously only when attached in ReadOnly mode.

Key Concept

Selecting GCP Database and Persistent Disk types based on access patterns, scaling needs, latency SLA, and multi-attach capabilities.
Estimated Time:2m 0s
PreviousPage 25 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin