Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 501Question →

A solutions developer needs to upload a large database export named `db_archive.tar.gz` to an existing Google Cloud Storage bucket named `corp-database-backups`. The bucket currently uses the Standard storage class by default for newly uploaded objects. However, to minimize immediate storage costs for this specific file, the developer must ensure that `db_archive.tar.gz` is assigned the Coldline storage class directly during the upload process, without changing the default storage class configuration of the bucket itself. Which Google Cloud CLI command should the developer execute to achieve this?

Show answer & explanation

Answer: gcloud storage cp db_archive.tar.gz gs://corp-database-backups/ --storage-class=COLDLINE

Answer

Execute the command: gcloud storage cp db_archive.tar.gz gs://corp-database-backups/ --storage-class=COLDLINE
The correct command uses `gcloud storage cp` accompanied by the `--storage-class=COLDLINE` parameter. This uploads the specific file to the target Google Cloud Storage bucket and assigns it the Coldline storage class upon creation, leaving the bucket's default storage class setting untouched for other uploads.

Step-by-Step Solution

1
Identify the required CLI tool and operation type
Google Cloud CLI (`gcloud storage`) is standard for object copying and upload operations.
Uploading a file from local storage to a Cloud Storage URI requires an object copy (`cp`) operation.
2
Determine how to apply per-object storage class during upload
Use the `--storage-class=COLDLINE` flag on the `gcloud storage cp` command.
Passing `--storage-class` during the upload overrides the bucket default specifically for the object being uploaded.
3
Verify bucket default settings remain intact
No bucket update command (`gcloud storage buckets update`) is executed.
Updating bucket properties would affect all future uploads, which violates the requirement to preserve the bucket's existing default storage class.

Key Concept

Per-Object Storage Class Specification during Upload using gcloud storage CLI
Question 502Question →

A digital publishing platform is planning its Google Kubernetes Engine (GKE) cluster architecture to support two core backend workloads in a single environment:

1. A real-time content rendering engine that requires custom sysctl kernel parameter modifications on the node host operating system to optimize socket buffers.
2. A background image thumbnail generation pipeline that processes asynchronous worker queues, where individual jobs are stateless, idempotent, and can be safely re-queued if interrupted.

The engineering team wants to satisfy both workload requirements while maximizing cost efficiency and avoiding unsupportable configurations. Which GKE cluster architecture and node pool strategy should the team implement?

Show answer & explanation

Answer: Provision a GKE Standard cluster. Configure a dedicated node pool with custom Linux sysctl configuration parameters applied to the underlying node configuration for the content rendering workload, and configure a secondary node pool leveraging Spot VMs for the thumbnail generation pipeline.

Answer

Provision a GKE Standard cluster with a custom sysctl-configured node pool for rendering and a Spot VM node pool for background processing.
The option specifying GKE Standard with two targeted node pools is correct because GKE Standard is mandatory when custom Linux sysctl kernel settings must be configured on cluster nodes. Furthermore, leveraging Spot VMs for the stateless, idempotent image processing workload delivers maximum cost savings without compromising the availability of the real-time rendering service.

Step-by-Step Solution

1
Analyze host OS kernel custom parameter requirements
GKE Autopilot locks down node OS settings and disallows custom kernel sysctl parameters; GKE Standard is required.
When workloads demand low-level Linux kernel modifications on the node, GKE Standard provides direct control over node pool configuration.
2
Analyze fault tolerance and cost requirements for background processing
Spot VMs are ideal for stateless, idempotent worker queues.
Spot VMs offer significant compute cost savings (up to 80%) for workloads that can tolerate node preemptions without causing data loss.
3
Synthesize the optimal cluster architecture
A GKE Standard cluster with two specialized node pools fulfills all constraints.
Combining a custom-configured Standard node pool for sensitive workloads and a Spot VM node pool for batch processing balances operational capability with cost optimization.

Key Concept

GKE Autopilot vs. Standard Operational Boundaries & Node Pool Selection
Estimated Time:2m 0s
Question 503Question →

A cloud administrator needs to create a custom disk image from an existing Compute Engine VM instance and deploy a new VM instance using that image. What is the correct sequence of steps to complete this workflow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: Stop the source Compute Engine VM instance to ensure disk consistency, create a custom disk image from the source instance's root persistent disk using `gcloud compute images create`, provision a new Compute Engine VM instance specifying the custom image as the boot disk using `gcloud compute instances create --image`, and verify that the new Compute Engine VM instance reaches the RUNNING status.
The workflow follows standard Google Cloud Compute Engine deployment practices: first, stopping the source VM ensures data integrity; second, creating the custom image packages the operating system and installed software; third, creating a new instance from that image provisions the VM; fourth, checking the status ensures the instance has started properly.

Step-by-Step Solution

1
Stop the source VM instance
Disk writes cease, leaving the persistent disk in a consistent state.
Capturing an image from an active VM can result in corrupted or incomplete snapshot data.
2
Create the custom image
A custom image artifact is stored in the project's image registry.
Compute Engine instances cannot boot directly from another VM's live disk without creating an image or disk clone first.
3
Deploy the new VM instance
A new Compute Engine VM is instantiated with a boot disk initialized from the custom image.
Specifying the `--image` flag during instance creation provisions the new VM with the pre-configured operating system and applications.
4
Verify operational status
The instance status transitions to RUNNING.
Validating the instance status confirms that initialization succeeded.

Key Concept

Custom Image Creation and VM Provisioning Workflow
Question 504Question →

An enterprise site reliability engineering (SRE) team is scaling out a high-throughput data processing cluster in region `asia-east1`. While attempting to provision additional Compute Engine instances, deployments fail because the project has reached its regional N2 CPU quota limit. Which TWO actions must the team perform to properly inspect and request an increase for this quota?

Select all that apply

Show answer & explanation

Answer: Submit a formal quota increase request for the N2 CPUs metric in region `asia-east1` via the Google Cloud Console Quotas section or Cloud Quotas API.; Verify that the requesting user holds an IAM role with explicit quota editing privileges, such as Quota Administrator (`roles/servicemanagement.quotaAdmin`).

Answer

The team must submit a formal quota increase request for the regional N2 CPU metric via the Google Cloud Console Quotas UI or API, and ensure that the account performing the request possesses an appropriate IAM role with quota management permissions such as Quota Administrator (`roles/servicemanagement.quotaAdmin`).
To raise a Google Cloud resource quota, an administrator must navigate to the Quotas interface (or use the Cloud Quotas API) to select the specific metric and region, and then submit a formal increase request. Additionally, the user performing this request must have sufficient permissions, which are provided by roles like Quota Administrator (`roles/servicemanagement.quotaAdmin`).

Step-by-Step Solution

1
Identify the constrained resource metric and region
Determine that N2 CPUs in region `asia-east1` have reached maximum permitted allocation.
Quota adjustments must specify exact regional limits and target metrics.
2
Confirm IAM permissions for quota adjustments
Verify that the identity executing the request has `roles/servicemanagement.quotaAdmin` or equivalent privileges.
Requesting quota increases requires IAM authorization at the project level.
3
Submit the quota increase request
Navigate to the Quotas interface in Cloud Console, select the N2 CPUs metric for `asia-east1`, and request the desired limit.
Google Cloud evaluates and approves quota requests through formal submission workflows.

Key Concept

GCP Resource Quota Request Workflow and IAM Roles
Question 505Question →

An organization is planning a network expansion inside a custom-mode Virtual Private Cloud (VPC) network in Google Cloud. An existing application subnet in region us-central1 uses the primary CIDR range 192.168.4.0/24192.168.4.0/24. Due to planned instance scaling, the subnet needs to support at least 400 internal IP addresses. A adjacent subnet in the same VPC is currently assigned 192.168.6.0/23192.168.6.0/23. Which CIDR range configuration should the cloud engineer select when expanding the primary range of the application subnet to avoid network overlap?

Show answer & explanation

Answer: 192.168.4.0/23192.168.4.0/23

Answer

The primary CIDR range should be expanded to 192.168.4.0/23192.168.4.0/23.
Expanding the subnet to 192.168.4.0/23192.168.4.0/23 increases available host addresses from 256 to 512 (192.168.4.0−192.168.5.255192.168.4.0 - 192.168.5.255). This strictly contains the original 192.168.4.0/24192.168.4.0/24 range and stops right before the adjacent 192.168.6.0/23192.168.6.0/23 subnet (192.168.6.0−192.168.7.255192.168.6.0 - 192.168.7.255), avoiding any CIDR overlap.

Step-by-Step Solution

1
Determine the required host capacity
Supporting 400 hosts requires a subnet block with at least 512 total addresses, which corresponds to a /23 prefix length (232−23=5122^{32-23} = 512).
A /24 subnet provides only 256 addresses, which is insufficient for 400 hosts.
2
Calculate the expanded IP range boundaries for 192.168.4.0/23192.168.4.0/23
The range spans from 192.168.4.0192.168.4.0 through 192.168.5.255192.168.5.255.
In GCP, subnet expansion must preserve the existing network starting address while decreasing the netmask prefix length.
3
Verify non-overlapping status with adjacent subnets
The adjacent subnet uses 192.168.6.0/23192.168.6.0/23 (192.168.6.0192.168.6.0 to 192.168.7.255192.168.7.255). The range 192.168.4.0/23192.168.4.0/23 ends at 192.168.5.255192.168.5.255, ensuring zero IP overlap.
VPC subnets within the same network cannot have overlapping primary IPv4 address ranges.

Key Concept

VPC Subnet Primary CIDR Range Expansion Rules and IP Non-Overlap Planning
Question 506Question →

You are deploying a custom containerized HTTP web application to Google Cloud Run using the gcloud command line interface. Which TWO configurations or actions are required to ensure the service deploys successfully and receives HTTP traffic? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the web application inside the container to listen on the port defined by the PORT environment variable.; Execute the gcloud run deploy command specifying the container image.

Answer

To successfully deploy and serve HTTP traffic on Cloud Run, the containerized application must listen on the port specified by the PORT environment variable, and the service must be deployed using the gcloud run deploy command.
Cloud Run injects the PORT environment variable into the container instance context (defaulting to 8080), which the web application must bind to for successful ingress traffic handling. Deploying the application is accomplished via the standard gcloud run deploy command.

Step-by-Step Solution

1
Ensure application code listens on the expected port variable
The application inside the container reads the PORT environment variable (default 8080) provided by the Cloud Run container runtime.
Cloud Run sends traffic to the port defined in the PORT environment variable and performs startup checks on it.
2
Deploy the container to Cloud Run using gcloud CLI
Run gcloud run deploy <service-name> --image <image-url> to create or update the Cloud Run service revision.
The gcloud run deploy command provisions the Cloud Run service and provisions an HTTP endpoint for incoming requests.

Key Concept

Cloud Run Port Binding & Deployment Syntax
Question 507Question →

A cloud engineering team needs to implement financial governance for a new Google Cloud enterprise landing zone. They have two primary objectives: first, export detailed daily resource-level billing data to a central BigQuery dataset for custom SQL analysis; second, enable programmatic event-driven remediation whenever a specific billing budget threshold is exceeded. Which TWO steps must be performed to meet these operational requirements?

Select all that apply

Show answer & explanation

Answer: Configure the Cloud Billing budget to publish programmatic notifications to a Cloud Pub/Sub topic, which triggers a Cloud Function or Cloud Run service to handle automated remediation.; Grant the engineer configuring the BigQuery billing export the Billing Account Costs Manager (or Billing Account Administrator) role on the Cloud Billing account and BigQuery Data Editor on the destination dataset.

Answer

To achieve both objectives, the team must configure the Cloud Billing budget to send programmatic notifications to a Cloud Pub/Sub topic (which feeds downstream serverless remediation) and grant the user setting up BigQuery export the required Billing Account roles alongside BigQuery Data Editor permissions.
The solution requires configuring programmatic notifications from the billing budget to a Pub/Sub topic to enable automated resource actions, and ensuring the engineer possesses the necessary permissions on both the billing account (Billing Account Costs Manager or Administrator) and the destination BigQuery dataset (BigQuery Data Editor).

Step-by-Step Solution

1
Configure programmatic budget alerting via Cloud Pub/Sub.
Budget threshold events publish messages to a designated Pub/Sub topic rather than relying on email notifications alone.
Google Cloud billing budgets only notify; automated resource shutdown requires Pub/Sub messages to trigger custom remediation logic.
2
Ensure correct IAM roles across both Billing Account and BigQuery project scopes.
The user gains permission to stream cost metrics from the billing account into the BigQuery dataset.
Creating a BigQuery billing export requires permissions spanning two separate resource scopes: the Cloud Billing account (Billing Account Costs Manager / Administrator) and the destination BigQuery dataset (BigQuery Data Editor).

Key Concept

Configuring Cloud Billing Budgets, Pub/Sub programmatic alerts, and BigQuery Export IAM requirements.
Question 508Question →

A cloud engineer needs to deploy a new Compute Engine virtual machine instance using the Google Cloud CLI. The deployment requires configuring custom startup scripts and instance metadata key-value pairs. Which of the following gcloud command flags can be validly used with 'gcloud compute instances create' to accomplish this? (Select TWO correct responses.)

Select all that apply

Show answer & explanation

Answer: --metadata-from-file; --metadata

Answer

The correct options are '--metadata-from-file' and '--metadata'.
When creating a Compute Engine VM instance using 'gcloud compute instances create', custom metadata key-value pairs are passed using the '--metadata' flag, and files (such as startup scripts) are passed into metadata using the '--metadata-from-file' flag.

Step-by-Step Solution

1
Identify the required parameters for attaching custom metadata and startup script files when creating a VM with gcloud.
Determine that metadata can be attached inline or read from a local file path.
Compute Engine uses instance metadata keys such as 'startup-script' or custom keys for configuration during initialization.
2
Evaluate the valid gcloud compute instances create flags.
Select '--metadata' for inline key-value pairs and '--metadata-from-file' for supplying script content from local files.
Both flags are standard parameters in the gcloud CLI tool for Compute Engine VM provisioning.

Key Concept

Deploying Compute Engine instances using gcloud CLI metadata flags
Question 509Question →

A cloud administrator at an online gaming company needs to enable a lead external game developer to link a newly provisioned Google Cloud project, `game-telemetry-prod`, to the organization's central Google Cloud Billing Account. The developer already possesses the Project Owner role (`roles/owner`) on `game-telemetry-prod`. Following the principle of least privilege, which IAM role should the administrator grant to the developer, and on which resource?

Show answer & explanation

Answer: Grant the Billing Account User role (`roles/billing.user`) on the central Billing Account.

Answer

Grant the Billing Account User role (`roles/billing.user`) on the central Billing Account.
Linking a Google Cloud project to a billing account requires two separate authorization rights: permission to manage billing on the project (`resourcemanager.projects.createBillingAssignment`) and permission to associate projects with the billing account (`billing.resourceAssociations.create`). Because the user already holds Project Owner permissions on the project, granting the Billing Account User role (`roles/billing.user`) on the central Billing Account supplies the missing billing account association permission with minimum necessary privilege.

Step-by-Step Solution

1
Identify the two required permissions for project-to-billing-account linking.
Linking a project requires `resourcemanager.projects.createBillingAssignment` on the project resource and `billing.resourceAssociations.create` on the billing account resource.
Google Cloud enforces explicit permission checks on both the target project and the target billing account to prevent unauthorized billing link changes.
2
Evaluate the permissions already held by the developer.
The developer is already a Project Owner (`roles/owner`) on `game-telemetry-prod`, which includes `resourcemanager.projects.createBillingAssignment`.
No additional project-level IAM roles are needed for the developer on `game-telemetry-prod`.
3
Select the minimal predefined role on the Billing Account.
`roles/billing.user` (Billing Account User) grants `billing.resourceAssociations.create` on the billing account without allowing administrative billing modifications.
Granting `roles/billing.user` on the Billing Account fulfills least-privilege administrative requirements.

Key Concept

Configuring Billing Accounts and Linking Projects
Question 510Question →

A CI/CD pipeline service account must be configured to build container images, store them in Google Cloud Artifact Registry, and deploy them to Cloud Run services within a dedicated staging project. To adhere strictly to the principle of least privilege without using primitive roles, which TWO predefined IAM roles should be granted to the service account on the project? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Artifact Registry Writer (roles/artifactregistry.writer); Cloud Run Developer (roles/run.developer)

Answer

To allow a automated service account to manage container artifacts and deploy Cloud Run applications under least privilege, grant Artifact Registry Writer (roles/artifactregistry.writer) and Cloud Run Developer (roles/run.developer) at the project level.
The correct options are Artifact Registry Writer (roles/artifactregistry.writer) and Cloud Run Developer (roles/run.developer). Artifact Registry Writer provides the exact permissions needed to build and push container images to repositories. Cloud Run Developer provides permissions to deploy and update Cloud Run services. Together, these predefined roles enforce the principle of least privilege at the project level.

Step-by-Step Solution

1
Identify artifact management requirements
Pushing container images requires write access to Artifact Registry repositories, satisfied specifically by roles/artifactregistry.writer.
This predefined role grants repository read/write access without granting administrative privileges over Artifact Registry resources.
2
Identify application deployment requirements
Creating and updating Cloud Run deployments requires service creation and revision management, satisfied specifically by roles/run.developer.
This predefined role allows deploying new revisions and services without full IAM or security policy modification capabilities.
3
Validate least-privilege scoping
Applying these two granular predefined roles directly at the target staging project ensures minimum permissions without broad primitive assignment or excessive resource hierarchy inheritance.
Google Cloud IAM best practices dictate using specific predefined roles over primitive roles (Editor/Owner) and scoping roles to the narrowest required resource level.

Key Concept

Applying least-privilege IAM access control using granular predefined roles for service workload deployments.
Estimated Time:2m 0s
Question 511Question →

A cloud engineer is tasked with deploying an application to a new Google Kubernetes Engine (GKE) cluster. The application must securely access Cloud Storage using Workload Identity instead of exported service account keys. The target Google Service Account (GSA) and its IAM permissions have already been created. In which chronological order should the engineer execute the steps below to set up the cluster, configure Workload Identity, and deploy the workload?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with provisioning the GKE cluster with Workload Identity enabled, fetching cluster credentials for kubectl, creating the Kubernetes Service Account (KSA), granting the IAM Workload Identity User role on the Google Service Account (GSA), and finally annotating the KSA and deploying the application manifest.
The proper deployment workflow requires creating infrastructure and establishing authentication boundaries before deploying application resources. First, provision the GKE cluster with Workload Identity enabled. Next, configure local cluster credentials with `gcloud container clusters get-credentials`. Third, create the Kubernetes Service Account (KSA) within the cluster. Fourth, bind the Google Service Account (GSA) to the KSA using `gcloud iam service-accounts add-iam-policy-binding` with `roles/iam.workloadIdentityUser`. Finally, annotate the KSA with the GSA email and deploy the workload manifest.

Step-by-Step Solution

1
Provision the GKE cluster with Workload Identity enabled
GKE cluster created with Workload Identity pool initialized
You cannot configure Workload Identity or deploy workloads until the cluster control plane and nodes exist with workload identity capabilities enabled.
2
Run gcloud container clusters get-credentials
Local kubeconfig updated with cluster endpoint and authentication tokens
kubectl commands require an active cluster context and valid authentication credentials to interact with the API server.
3
Create the Kubernetes Service Account (KSA)
KSA resource registered in the Kubernetes namespace
A KSA must exist in the cluster before IAM policy bindings or Kubernetes annotations can reference it.
4
Add IAM policy binding for Workload Identity
GSA configured to trust the specific KSA via roles/iam.workloadIdentityUser
Google Cloud IAM must explicitly permit the KSA member identity string (`serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]`) to impersonate the GSA.
5
Annotate KSA and deploy workload manifest
Pods deployed and automatically mapped to the target GSA identity
The annotation `iam.gke.io/gcp-service-account` instructs GKE's metadata server to inject GSA tokens into pod workload containers upon deployment.

Key Concept

Workload Identity Configuration Sequence for GKE
Question 512Question →

A biomedical research organisation ingests high-throughput genomic sequencing data into a Google Cloud Storage bucket. The raw data files are actively analyzed and queried daily for the first 30 days. After 30 days, access decreases significantly to occasional quarterly research reviews for the next 5 months. After 180 days from creation, the data is rarely accessed but must be retained for at least 7 years to satisfy compliance requirements. You need to design an automated cost-optimized storage strategy that maintains data availability while minimizing total cost of ownership. Which TWO management strategies should you combine? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define an Object Lifecycle Management rule with an action to transition objects to Nearline Storage when their age reaches 30 days.; Define an Object Lifecycle Management rule with an action to transition objects to Archive Storage when their age reaches 180 days.

Answer

The correct strategy combines transitioning objects to Nearline Storage after 30 days and transitioning objects to Archive Storage after 180 days using Object Lifecycle Management rules.
For data accessed daily during the first month, Standard storage avoids retrieval fees. After 30 days, transitioning to Nearline storage provides lower storage costs for occasional quarterly access. After 180 days, transitioning to Archive storage minimizes long-term holding costs for regulatory compliance over 7 years.

Step-by-Step Solution

1
Analyze access patterns and minimum storage duration requirements for each stage of the data lifecycle.
Days 0–30 requires frequent access (Standard class). Days 31–180 requires monthly/quarterly access (Nearline class, 30-day minimum). Day 181+ requires rare access for multi-year compliance (Archive class, 365-day minimum).
Matching access frequency and duration to the appropriate Cloud Storage class minimizes combined storage and retrieval costs.
2
Identify the proper Object Lifecycle Management rule conditions.
Use the 'Age' condition (measured in days since object creation) to trigger transitions at 30 days and 180 days.
Cloud Storage lifecycle rules support age-based rules to seamlessly automate transitions between Standard, Nearline, Coldline, and Archive storage tiers.

Key Concept

Cloud Storage Class Selection and Object Lifecycle Management
Question 513Question →

A Cloud Engineer needs to deploy a Cloud SQL for PostgreSQL instance with Private IP connectivity in an existing Virtual Private Cloud (VPC) network. Place the required steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of deployment steps is: 1) Allocate an IP address range in the VPC network for private services access, 2) Establish a private connection between the VPC network and Google Service Networking, 3) Create the Cloud SQL instance specifying the VPC network and disabling public IP.
Configuring Cloud SQL for private access requires preparing network infrastructure prior to instance creation. First, an IP allocation is reserved for Google services. Next, a private service connection (VPC Peering) is created between the user VPC and Google Service Networking. Finally, the Cloud SQL instance is provisioned specifying the target VPC network.

Step-by-Step Solution

1
Allocate IP address range
A named IP range is reserved within the target VPC network.
Google Cloud SQL Private IP requires a allocated IP CIDR block dedicated to Service Networking.
2
Create Private Connection (VPC Peering)
The VPC network is peered with Google Service Networking.
Cloud SQL instances run in a tenant VPC managed by Google, which must be connected to the user VPC via Private Services Access.
3
Provision Cloud SQL instance
Cloud SQL instance is deployed with a private IP address.
With the private connection configured, the database instance can be launched using the gcloud sql instances create command with the --network flag.

Key Concept

Deploying Cloud SQL with Private IP using Private Services Access and VPC Peering
Question 514Question →

An enterprise organization is establishing its Google Cloud resource hierarchy for a software engineering division. An Associate Cloud Engineer must grant team leads the capability to create new projects within a specific folder named Mobile-Development and link those newly created projects to the corporate Billing Account. Adhering to the principle of least privilege, which TWO IAM role assignments are required to fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Grant the team leads the Project Creator role (roles/resourcemanager.projectCreator) on the Mobile-Development folder.; Grant the team leads the Billing Account User role (roles/billing.user) on the corporate Billing Account.

Answer

Granting the Project Creator role on the Mobile-Development folder container and granting the Billing Account User role on the Billing Account resource.
To create new projects inside a targeted folder, principals require the Project Creator predefined role (roles/resourcemanager.projectCreator) bound at that folder node. Furthermore, linking any newly created project to a central billing account requires the Billing Account User role (roles/billing.user) on the billing account resource itself.

Step-by-Step Solution

1
Identify the required parent resource container permission for project creation.
The Project Creator role (roles/resourcemanager.projectCreator) must be granted on the Mobile-Development folder.
Creating a project requires permissions on the parent node in the GCP resource hierarchy where the project will reside.
2
Identify the necessary billing permission to associate new projects with billing.
The Billing Account User role (roles/billing.user) must be assigned on the central billing account.
Linking a project to a billing account requires explicit authorization on the billing account object itself.

Key Concept

Resource Hierarchy Project Creation and Billing Account Linking Permissions
Question 515Question →

A financial analytics company is designing the compute architecture on Google Compute Engine for two distinct backend services:

1. Batch Risk Simulation Engine: A highly fault-tolerant, stateless workload that processes data chunks independently and can handle sudden VM preemption without losing progress.
2. In-Memory Ledger Cache: A dedicated 24/7 database service that requires a custom ratio of 6 vCPUs and 45 GB of RAM to avoid paying for unused vCPUs.

Which TWO architectural decisions should the cloud engineer select to optimize both performance and cost for these workloads?

Select all that apply

Show answer & explanation

Answer: Provision Spot VMs (or Preemptible VMs) for the Batch Risk Simulation Engine to achieve significant cost savings.; Configure a Custom Machine Type with extended memory for the In-Memory Ledger Cache to match the exact vCPU and RAM requirements.

Answer

The correct decisions are to use Spot VMs for the fault-tolerant batch risk simulation engine and to configure a Custom Machine Type with extended memory for the 24/7 in-memory cache.
Selecting Spot VMs for the batch simulation engine takes advantage of discount pricing suitable for fault-tolerant workloads. Configuring a Custom Machine Type for the cache allows exact allocation of 6 vCPUs and 45 GB RAM without paying for unused capacity in standard predefined shapes.

Step-by-Step Solution

1
Analyze Workload 1 (Batch Risk Simulation Engine)
Identified as fault-tolerant, stateless, and batch-oriented.
Fault-tolerant batch jobs benefit from Spot VMs because preemption does not cause data loss, providing up to 60-91% cost savings.
2
Analyze Workload 2 (In-Memory Ledger Cache)
Identified as a continuous 24/7 stateful workload requiring non-standard core/RAM ratio (6 vCPUs, 45 GB RAM).
Custom machine types let you select exact vCPU counts and memory amounts, avoiding the cost of larger standard predefined tiers.
3
Evaluate Distractor Options
Eliminated using Spot VMs for stateful 24/7 caches and using Cloud Functions for heavy batch jobs.
Spot VMs risk unexpected downtime for databases/caches, and Cloud Functions has execution timeout and resource limits unsuited for heavy simulations.

Key Concept

Compute Engine Machine Type Selection and Spot VM Suitability
Estimated Time:1m 30s
Question 516Question →

An enterprise organization is migrating a core reporting system to Google Cloud Compute Engine. The system architecture has two distinct storage requirements:

1. A backend transactional database that requires full SQL ACID compliance, automated daily backups, high availability (HA) with regional failover across two zones, and a dataset size scaling up to 3 TB.
2. A temporary high-throughput scratch space for worker virtual machines (VMs) performing batch analytics sorting, which requires maximum IOPS and microsecond read/write latency, while tolerating complete data loss when the VM stops or restarts.

Which storage and database configuration should a cloud engineer select to meet these requirements with minimal operational overhead?

Show answer & explanation

Answer: Deploy Cloud SQL for PostgreSQL with a High Availability (regional) configuration for the transactional database, and attach Local SSDs to the worker Compute Engine VMs for scratch space.

Answer

Deploy Cloud SQL for PostgreSQL with a High Availability (regional) configuration for the transactional database, and attach Local SSDs to the worker Compute Engine VMs for scratch space.
Cloud SQL for PostgreSQL configured for High Availability delivers a fully managed relational database with cross-zone failover, automated backups, and full ACID compliance for datasets under 64 TB. Attaching Local SSDs to worker Compute Engine instances provides ultra-low microsecond latency and high IOPS performance directly attached to the host physical server, ideal for ephemeral scratch space that can tolerate data loss upon VM termination.

Step-by-Step Solution

1
Analyze the backend database requirements
Requirements call for a relational database with SQL ACID support, regional high availability, automated backups, and 3 TB capacity.
Cloud SQL supports PostgreSQL relational engines, up to 64 TB storage, automated maintenance/backups, and regional failover pairs across zones with minimal operational burden.
2
Analyze the worker VM scratch space requirements
Requirements call for maximum IOPS, microsecond latency block storage, with tolerance for disk loss on VM stop/restart.
Local SSD disks are physically attached to the server hosting the VM instance, delivering sub-millisecond latencies and high IOPS suitable for scratch disk usage.
3
Combine the optimal storage solutions
Pair Cloud SQL PostgreSQL (HA) with Local SSD block storage attached to the worker compute nodes.
This combination satisfies both functional criteria while optimizing for performance, operational simplicity, and cloud design best practices.

Key Concept

Selecting GCP Managed Databases and Block Storage Types based on Workload Characteristics
Estimated Time:2m 0s
Question 517Question →

A healthcare analytics provider is planning a Google Kubernetes Engine (GKE) cluster architecture for a new platform. The environment must support two distinct workloads with specific operational and financial requirements:

1. A high-throughput API gateway service that requires custom Linux kernel parameter modifications (`sysctl` tuning) on the underlying host nodes to optimize socket buffer sizes.
2. An asynchronous, batch processing pipeline that analyzes genomic sequences; this workload is stateless, fault-tolerant, can be interrupted at any time, and must minimize compute expenses.

Which TWO architectural decisions should the cloud engineer incorporate into the GKE design to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision a GKE Standard cluster for the API gateway service node pool to support custom OS node configuration and kernel parameter adjustments.; Create a dedicated GKE Standard node pool utilizing Spot Virtual Machines for the genomic batch processing workload to optimize compute costs.

Answer

The cloud engineer should select GKE Standard node pools for workloads requiring custom OS sysctl kernel parameter adjustments, and deploy stateless, fault-tolerant genomic batch processing workloads onto dedicated Spot VM node pools for maximum cost savings.
GKE Standard mode provides administrative access to cluster nodes, enabling custom daemonsets or node configuration files to alter kernel sysctl parameters for socket buffer optimization. Additionally, configuring Spot VMs for stateless batch processing delivers substantial cost savings while maintaining architectural resilience, because batch jobs can easily resume if nodes are preempted.

Step-by-Step Solution

1
Evaluate operational requirements for custom host kernel modifications
Identify that GKE Autopilot restricts node-level access and kernel configurations, making GKE Standard necessary for custom sysctl parameters.
GKE Standard retains node pool access and OS configuration capabilities required for low-level network and socket buffer tuning.
2
Evaluate workload fault tolerance for cost optimization options
Identify that stateless, interruptible batch workloads are ideal candidates for Spot VMs.
Spot VMs offer steep discounts for compute capacity in exchange for potential preemption, which aligns perfectly with fault-tolerant batch jobs.
3
Validate distractor architectural flaws
Reject GKE Autopilot for custom kernel configurations, reject Spot VMs for stateful databases, and reject HPA for scaling infrastructure nodes.
Ensures design choices adhere to GCP best practices regarding operational boundaries and autoscaling mechanisms.

Key Concept

GKE Cluster Mode Operational Boundaries and Node Pool Lifecycle Planning
Question 518Question →

A platform team is establishing deployment infrastructure for a multi-tenant application on Google Kubernetes Engine (GKE). The application consists of a persistent transactional database requiring guaranteed node availability and an asynchronous queue-processing worker service designed to handle sudden termination gracefully. Additionally, administrators need to execute `kubectl` commands from a new CI/CD build agent that has the `gcloud` CLI authenticated. Which deployment configuration and administrative setup correctly satisfies these workload requirements while maintaining cost efficiency and proper cluster connectivity?

Show answer & explanation

Answer: Provision a GKE Standard cluster with a standard node pool for the persistent database and a Spot node pool for the queue-processing workers, then execute `gcloud container clusters get-credentials` on the build agent before running `kubectl` commands.

Answer

Provision a GKE Standard cluster with a standard node pool for the persistent database and a Spot node pool for the queue-processing workers, then execute `gcloud container clusters get-credentials` on the build agent before running `kubectl` commands.
The correct strategy uses GKE Standard to separate stateful and fault-tolerant workloads into dedicated node pools (standard for persistent data, Spot for batch processing) to optimize cost without risking database stability. Additionally, `gcloud container clusters get-credentials` must be executed to fetch cluster API endpoints and write valid credentials to the kubeconfig file used by `kubectl`.

Step-by-Step Solution

1
Analyze workload availability and persistence requirements.
Database workloads need standard node pools to prevent node preemptions, while queue-processing workers can leverage Spot VM node pools for cost savings.
Spot instances can be reclaimed at any time, which risks database corruption or downtime for non-fault-tolerant stateful applications.
2
Evaluate cluster operational modes (Autopilot vs. Standard).
GKE Standard allows custom node pool definitions (standard vs. Spot) and hardware/kernel tuning, whereas GKE Autopilot abstracts node pool management.
Autopilot manages nodes automatically and limits custom node modifications or explicit node pool separation patterns required here.
3
Determine the proper cluster authentication procedure for CLI tools.
Run `gcloud container clusters get-credentials` with the cluster name and zone/region.
This command fetches cluster endpoint details and authentication tokens, writing them into the kubeconfig configuration file so `kubectl` can target the cluster.

Key Concept

GKE Node Pool Architecture and Cluster Credential Provisioning
Estimated Time:2m 0s
Question 519Question →

An enterprise organization uses Google Cloud resource hierarchy to manage access control. A cloud engineer is granted the Storage Admin role (roles/storage.admin) at a parent folder level containing multiple projects. A security administrator attempts to restrict this engineer's privileges on a specific sensitive Cloud Storage bucket located inside one of those child projects by granting the engineer the Storage Object Viewer role (roles/storage.objectViewer) directly on that individual bucket resource. What is the engineer's effective access level on the sensitive Cloud Storage bucket?

Show answer & explanation

Answer: Full administrative control over the bucket, because IAM policy inheritance is strictly additive down the resource hierarchy and lower-level role assignments cannot revoke or restrict inherited permissions.

Answer

The engineer retains full administrative control over the bucket because IAM permissions are unionized (additive) down the Google Cloud resource hierarchy.
In Google Cloud IAM, policy inheritance across the resource hierarchy (Organization > Folder > Project > Resource) is strictly additive. An identity receives the effective permissions of all roles granted at every level above the resource plus any roles granted directly on the resource itself. Because permissions cannot be revoked or overridden at lower levels using standard role bindings, the inherited Storage Admin role remains fully active on the bucket.

Step-by-Step Solution

1
Evaluate permission inheritance down the resource hierarchy.
Permissions granted at the folder level (roles/storage.admin) flow down to all child projects and child resources, including Cloud Storage buckets within those projects.
Google Cloud IAM follows a strict inheritance model where child resources inherit all permissions granted on parent nodes.
2
Evaluate the effect of adding a lower-level role assignment.
Assigning roles/storage.objectViewer on the bucket adds read permissions to the identity's policy union, but does not remove or restrict the storage.admin permissions inherited from the folder.
IAM policies are additive; there is no explicit deny mechanism built into standard role assignments that allows a narrower role at a lower level to override an inherited broader role.
3
Determine the effective permission set.
Effective permissions on the bucket equal the union of inherited folder permissions and resource permissions, granting full administrative access.
Effective access is calculated as the logical OR of all permissions granted across all levels of the resource hierarchy.

Key Concept

IAM Resource Hierarchy Policy Inheritance and Additive Permission Model
Estimated Time:2m 0s
Question 520Question →

An enterprise architecture team is configuring a custom-mode Virtual Private Cloud (VPC) network connected to two on-premises data centers via Cloud VPN.

The current network IP address allocations are:
- Data Center A on-premises range: 10.140.0.0/2110.140.0.0/21
- Data Center B on-premises range: 10.140.16.0/2010.140.16.0/20
- Existing GCP subnet primary range in `europe-west1`: 10.140.8.0/2210.140.8.0/22

To accommodate growing compute requirements without creating a new subnet, you must expand the primary IP address range of the `europe-west1` subnet to double its host address capacity. The expanded range must encompass the existing subnet without causing IP address overlap with either on-premises data center.

Which CIDR block must you specify for the expanded primary subnet range?

Show answer & explanation

Answer: 10.140.8.0/2110.140.8.0/21

Answer

The correct subnet expansion CIDR is 10.140.8.0/2110.140.8.0/21.
In Google Cloud VPC subnet design, expanding a primary IP range requires reducing the netmask prefix length (e.g., from /22/22 to /21/21) while ensuring the new block completely contains the existing range. The range 10.140.8.0/2110.140.8.0/21 encompasses all IPs from 10.140.8.010.140.8.0 through 10.140.15.25510.140.15.255, covering the original 10.140.8.0/2210.140.8.0/22 block (10.140.8.0−10.140.11.25510.140.8.0 - 10.140.11.255) without colliding with Data Center A (10.140.0.0/2110.140.0.0/21) or Data Center B (10.140.16.0/2010.140.16.0/20).

Step-by-Step Solution

1
Analyze the current GCP primary subnet range and address boundaries.
The existing subnet 10.140.8.0/2210.140.8.0/22 spans IP range 10.140.8.010.140.8.0 to 10.140.11.25510.140.11.255 (1,0241,024 addresses).
GCP rules mandate that any expanded subnet CIDR must fully encompass the current primary CIDR block.
2
Calculate the required prefix length to double host capacity.
Decreasing the prefix length by 1 bit (from /22/22 to /21/21) doubles the capacity to 2,0482,048 addresses.
A /21/21 block contains 211=2,0482^{11} = 2,048 addresses.
3
Determine valid /21/21 supernets that contain 10.140.8.0/2210.140.8.0/22.
The block 10.140.8.0/2110.140.8.0/21 spans 10.140.8.010.140.8.0 to 10.140.15.25510.140.15.255, which encompasses 10.140.8.0/2210.140.8.0/22.
Subnet boundaries for /21/21 prefixes align on multiples of 8 in the third octet.
4
Verify non-overlap constraints against on-premises environments.
10.140.8.0/2110.140.8.0/21 (10.140.8.0−10.140.15.25510.140.8.0 - 10.140.15.255) sits cleanly between Data Center A (10.140.0.0−10.140.7.25510.140.0.0 - 10.140.7.255) and Data Center B (10.140.16.0−10.140.31.25510.140.16.0 - 10.140.31.255).
Hybrid Cloud VPN connections require strictly non-overlapping IP address spaces across all connected environments.

Key Concept

VPC Subnet CIDR Range Expansion Rules and Hybrid Non-Overlap Requirements
Estimated Time:2m 0s
PreviousPage 26 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin