Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 521Question →

Your organization is deploying a fault-tolerant batch processing workload on Google Cloud Compute Engine. The operational requirements state that the Virtual Machine (VM) instance must be provisioned using the lowest possible compute cost model, execute an automated initialization script stored in a Cloud Storage bucket at gs://company-scripts-bucket/init.sh upon booting, and run under the identity of a pre-created custom IAM service account named [email protected] with the standard cloud-platform scope. Which gcloud command correctly provisions this VM instance with all required configurations?

Show answer & explanation

Answer: gcloud compute instances create batch-worker-vm --zone=us-central1-a --provisioning-model=SPOT --service-account=batch-worker@app-project.iam.gserviceaccount.com --scopes=cloud-platform --metadata=startup-script-url=gs://company-scripts-bucket/init.sh

Answer

The command that uses --provisioning-model=SPOT, --service-account=batch-worker@app-project.iam.gserviceaccount.com, --scopes=cloud-platform, and --metadata=startup-script-url=gs://company-scripts-bucket/init.sh correctly meets all deployment requirements.
The command specifying --provisioning-model=SPOT configures the VM as a Spot instance for maximum cost savings on fault-tolerant tasks. The --service-account flag attaches the custom service account email, --scopes=cloud-platform grants full Cloud API access managed by IAM, and --metadata=startup-script-url=gs://... instructs Compute Engine to retrieve and run the script from Cloud Storage at boot time.

Step-by-Step Solution

1
Identify the cost requirement for fault-tolerant batch workloads.
Spot VMs (--provisioning-model=SPOT) provide up to 60-91% discounts compared to standard VMs and are ideal for batch jobs.
Fault-tolerant workloads can withstand VM preemption, making Spot instances the most cost-effective option.
2
Identify the proper gcloud flags for IAM service account assignment.
Use --service-account to set the identity and --scopes=cloud-platform to delegate scope management to IAM roles.
The --scopes flag defines OAuth scopes for the instance, while --service-account specifies the service account email.
3
Identify the correct metadata key for Cloud Storage startup scripts.
Use --metadata=startup-script-url=gs://... to point to a script stored in Cloud Storage.
The key startup-script is reserved for inline bash commands/scripts, whereas startup-script-url fetches the file directly from a Cloud Storage bucket URI.

Key Concept

Compute Engine VM Provisioning with gcloud CLI, Custom Metadata, Service Accounts, and Spot VMs
Question 522Question →

A cloud finance specialist is configuring an estimate in the Google Cloud Pricing Calculator for a batch data transformation job running on standard N2 Compute Engine virtual machines. The workload operates predictably for 12 hours every day throughout a 30-day month (360 total hours). When reviewing the baseline cost breakdown, how does the Google Cloud Pricing Calculator apply Sustained Use Discounts (SUDs) to this workload configuration?

Show answer & explanation

Answer: Sustained Use Discounts are applied incrementally because the instances run for more than 25% of the billing month (182.5 hours), though at a lower effective discount percentage than if they ran continuously 24/7.

Answer

Sustained Use Discounts are applied incrementally because the instances run for more than 25% of the billing month (182.5 hours), though at a lower effective discount percentage than if they ran continuously 24/7.
In Google Cloud Compute Engine pricing, Sustained Use Discounts (SUDs) automatically apply to supported machine families (such as N1 and N2) when an instance runs for more than 25% of a billing month (182.5 hours out of 730 average hours). Running a VM for 12 hours daily (360 hours/month) exceeds the 25% threshold, so the Pricing Calculator factors in a tiered incremental discount. However, because the instance is not running continuously all month, the blended discount percentage is smaller than the maximum discount applied to 24/7 instances.

Step-by-Step Solution

1
Determine total monthly operational hours
12 hours/day * 30 days = 360 hours per month.
SUD calculations in GCP pricing depend on the percentage of the standard 730-hour billing month used.
2
Evaluate Sustained Use Discount threshold eligibility
360 hours represents approximately 49.3% of the month, exceeding the 25% (182.5 hours) minimum threshold.
Compute Engine automatically applies SUDs to supported machine types (like N2) operating beyond 25% of the month.
3
Assess calculator discount application behavior
The pricing calculator applies a partial/incremental discount rate for 49.3% usage, which is lower than the maximum discount rate reached at 100% usage (730 hours).
SUD pricing scales non-linearly across four usage tiers (25%, 50%, 75%, 100%).

Key Concept

Compute Engine Sustained Use Discount (SUD) mechanics in the GCP Pricing Calculator
Question 523Question →

A software development team is deploying a batch processing workload that can tolerate unexpected interruptions and resume from saved checkpoints. The team wants to reduce operational costs as much as possible for these fault-tolerant jobs. Which Compute Engine provisioning model should they select when deploying these virtual machines?

Show answer & explanation

Answer: Spot virtual machines

Answer

Spot virtual machines
Spot virtual machines use excess Compute Engine capacity and are available at heavy discounts off standard pricing. Because the workload is batch-oriented and checkpointed to withstand unexpected interruptions, Spot VMs fulfill the requirement of minimizing compute costs.

Step-by-Step Solution

1
Analyze the workload requirements
The workload is batch processing, checkpointed, fault-tolerant, and prioritizes cost reduction.
Understanding workload characteristics determines the optimal VM provisioning model.
2
Evaluate Compute Engine provisioning options against cost and fault tolerance
Spot VMs provide significant discounts in exchange for Google's ability to preempt the instance when resources are needed elsewhere.
Batch workloads that tolerate sudden shutdowns are the primary target use case for Spot VMs.

Key Concept

Selecting Spot/Preemptible VMs for Fault-Tolerant Compute Workloads
Question 524Question →

An enterprise SaaS platform generates automated database backup archives every night. Engineering teams require high-speed, immediate access to these backup files during the first 30 days to support rapid point-in-time recovery during software release cycles. After 30 days, access is rarely needed (less than once per year), but compliance regulations dictate that all backup files must be retained for 3 years and remain immediately accessible within milliseconds if requested during an audit. Which Cloud Storage configuration meets these requirements while minimizing total cost?

Show answer & explanation

Answer: Set the bucket's default storage class to Standard, and configure an Object Lifecycle Management rule to transition objects to Archive storage 30 days after creation.

Answer

Set the bucket's default storage class to Standard, and configure an Object Lifecycle Management rule to transition objects to Archive storage 30 days after creation.
The solution requiring Standard storage for the first 30 days followed by an Object Lifecycle Management transition to Archive storage optimally aligns with the workload profile. Standard storage avoids retrieval fees during frequent early recovery operations, while Archive storage provides the lowest cost tier for long-term retention beyond 30 days while ensuring millisecond latency when compliance audits occur.

Step-by-Step Solution

1
Analyze access frequency during the initial 30-day window.
Standard storage is appropriate because data is accessed frequently for potential point-in-time recoveries and has no minimum storage duration requirement.
Using cold storage tiers during active recovery periods would incur high retrieval fees.
2
Analyze access frequency and access time requirements after 30 days.
Data is accessed less than once a year but requires millisecond retrieval speeds for audits.
Archive storage offers the lowest cost per gigabyte for long-term retention while preserving millisecond access times.
3
Select the automation mechanism for storage class transition.
Configure Google Cloud Storage Object Lifecycle Management with an `Age` condition of 30 days and a `SetStorageClass` action targeting `ARCHIVE`.
Object Lifecycle Management automates transitions seamlessly without application code changes or manual intervention.

Key Concept

Selecting Cloud Storage classes based on access patterns and configuring Object Lifecycle Management to automate cost-effective storage transitions.
Question 525Question →

A platform engineering team needs to deploy a high-throughput, fault-tolerant batch processing application to Google Kubernetes Engine (GKE). The application requires custom sysctl kernel parameter tuning and must run on cost-optimized compute resources. Which TWO configuration choices and administrative steps must the team implement to successfully deploy and manage this workload?

Select all that apply

Show answer & explanation

Answer: Provision a GKE Standard cluster node pool utilizing Spot VMs and configure the custom sysctl parameters within the pod or node configuration.; Run 'gcloud container clusters get-credentials' to update the local kubeconfig file with endpoint and authentication context before executing kubectl deployment commands.

Answer

The correct requirements are provisioning a GKE Standard cluster using Spot VMs for custom sysctl support, and running 'gcloud container clusters get-credentials' to configure local kubeconfig authentication.
GKE Standard cluster node pools provide full control over node configurations, allowing custom sysctl kernel settings as well as Spot VM provisioning for cost efficiency on stateless batch workloads. To manage workloads via kubectl, executing 'gcloud container clusters get-credentials' fetches cluster endpoint details and updates the local kubeconfig context required for control plane API authorization.

Step-by-Step Solution

1
Determine the appropriate GKE cluster mode and node pool configuration.
GKE Standard is selected because custom sysctl kernel parameter modifications require node-level flexibility not available in GKE Autopilot. Spot VMs are specified to meet cost-optimization requirements for batch tasks.
GKE Autopilot enforces strict security constraints and does not permit custom OS kernel configurations.
2
Configure management workstation authentication for cluster deployment.
Executing 'gcloud container clusters get-credentials [CLUSTER_NAME]' writes endpoint details and access tokens into ~/.kube/config.
kubectl requires valid kubeconfig credentials to authenticate and communicate with the GKE control plane.

Key Concept

GKE Standard operational flexibility and kubeconfig authentication workflows.
Question 526Question →

A cloud engineer is configuring a Google Cloud Storage bucket named `media-assets-prod` for a streaming application. Security policies require that access control must be managed uniformly across all objects using Identity and Access Management (IAM) rather than individual object ACLs. Additionally, a service account named `[email protected]` must be granted permission to read objects stored in the bucket using modern `gcloud storage` CLI commands. Which TWO commands should the engineer execute to achieve this configuration? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: gcloud storage buckets update gs://media-assets-prod --uniform-bucket-level-access; gcloud storage buckets add-iam-policy-binding gs://media-assets-prod --member="serviceAccount:[email protected]" --role="roles/storage.objectViewer"

Answer

Enabling uniform bucket-level access via `gcloud storage buckets update gs://media-assets-prod --uniform-bucket-level-access` and granting read permissions with `gcloud storage buckets add-iam-policy-binding gs://media-assets-prod --member="serviceAccount:[email protected]" --role="roles/storage.objectViewer"` fulfills all security requirements.
To satisfy uniform access control and principle of least privilege, Uniform Bucket-Level Access must be enabled using `gcloud storage buckets update --uniform-bucket-level-access`, and object read access must be granted using the predefined `roles/storage.objectViewer` IAM role via `gcloud storage buckets add-iam-policy-binding`.

Step-by-Step Solution

1
Enable Uniform Bucket-Level Access on the Cloud Storage bucket
Disables Access Control Lists (ACLs) and forces IAM to handle permissions uniformly for all objects in the bucket.
Meets the security mandate of restricting access management strictly to IAM policies.
2
Bind the predefined IAM role `roles/storage.objectViewer` to the service account
Grants read access for objects inside `gs://media-assets-prod` without granting administrative access.
Adheres to the principle of least privilege for CDN read operations.

Key Concept

Deploying and configuring Cloud Storage buckets with Uniform Bucket-Level Access and IAM roles using gcloud storage CLI.
Question 527Question →

A senior DevOps engineer is managing a stateless containerized web service deployed on Google Cloud Run in the us-central1 region. The existing service named order-processor currently has all production traffic (100%) routed to revision order-processor-v1. To conduct a canary deployment of a newly built container image, the engineer successfully deploys the new code without shifting live traffic by running gcloud run deploy order-processor --image=gcr.io/corp-apps/order-processor:v2 --region=us-central1 --no-traffic. This deployment generates a new revision named order-processor-v2. The engineer now needs to safely route exactly 20% of incoming live HTTP requests to order-processor-v2 while maintaining the remaining 80% on order-processor-v1. Which gcloud command should the engineer execute to achieve this traffic distribution?

Show answer & explanation

Answer: Execute gcloud run services update-traffic order-processor --region=us-central1 --to-revisions=order-processor-v2=20.

Answer

Execute gcloud run services update-traffic order-processor --region=us-central1 --to-revisions=order-processor-v2=20.
The command gcloud run services update-traffic order-processor --region=us-central1 --to-revisions=order-processor-v2=20 is the official GCP CLI method to update traffic assignments. When targeting a single revision with a partial percentage (such as 20%), Cloud Run allocates that percentage to the new revision while preserving the remaining proportion (80%) on the previously serving revision.

Step-by-Step Solution

1
Identify the current state of Cloud Run revisions.
Revision order-processor-v1 holds 100% traffic, and revision order-processor-v2 is deployed with 0% traffic using --no-traffic.
Deploying with --no-traffic provisions a new revision without shifting live production requests.
2
Select the correct gcloud command tool for Cloud Run traffic allocation.
The gcloud run services update-traffic command is designed specifically to modify traffic splitting percentages across revisions.
Deploying code updates and managing operational traffic splits are separate actions in the Cloud Run CLI lifecycle.
3
Apply the target revision percentage flag.
Specifying --to-revisions=order-processor-v2=20 assigns 20% to order-processor-v2 and automatically maintains the remaining 80% on order-processor-v1.
Cloud Run automatically scales down remaining unspecified baseline traffic to balance total allocation to 100%.

Key Concept

Cloud Run Revision Traffic Splitting and Canary Deployments
Question 528Question →

A cloud security administrator at a global freight logistics company needs to authorize a DevOps engineer to link a newly provisioned project, `logistics-telematics-prod`, to the enterprise central Cloud Billing Account (`01A2B3-4C5D6E-7F8990`). The task must adhere strictly to Google Cloud least-privilege guidelines. Place the administrative authorization and CLI execution steps in the correct sequential order required to successfully perform this billing link.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins by granting the Billing Account User role on the central Cloud Billing Account resource, followed by granting the Project Billing Manager role on the target project resource, authenticating to the gcloud CLI with the engineer's credentials, and finally executing the gcloud billing projects link command.
Linking a Google Cloud project to a Cloud Billing Account requires permissions on both the billing account resource and the project resource. Under least-privilege principles, the user needs Billing Account User (roles/billing.user) on the billing account and Project Billing Manager (roles/resourcemanager.projectBillingManager) on the project. Once both roles are assigned, authenticating and executing the gcloud billing projects link command completes the process.

Step-by-Step Solution

1
Assign Billing Account IAM role
The engineer gains resourcemanager.projects.createBillingAssignment permission on the billing account resource.
To attach any project to a billing account, the user must be a Billing Account User on that billing account.
2
Assign Project IAM role
The engineer gains billing modification privileges on the target project resource.
The Project Billing Manager predefined role provides least-privilege access to link or unlink billing on the target project.
3
Authenticate CLI environment
The gcloud CLI session is authenticated with the authorized engineer account.
CLI commands run under the active authenticated identity's privileges.
4
Execute billing link command
The project logistics-telematics-prod is linked to billing account 01A2B3-4C5D6E-7F8990.
The command completes the association between the target project and the billing account.

Key Concept

Least-privilege IAM configuration for linking projects to Cloud Billing Accounts
Question 529Question →

A cloud network administrator is planning to expand the primary IPv4 address range of an existing subnet within a custom-mode Virtual Private Cloud (VPC) network in Google Cloud to support newly required virtual machine instances. Arrange the following steps in the correct chronological order required to safely plan and execute this subnet expansion.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence to expand a VPC primary subnet range is: 1) Audit existing network routes and IP ranges for unallocated space, 2) Calculate valid expanded CIDR boundaries using a smaller netmask, 3) Execute the gcloud compute networks subnets expand-ip-range command, and 4) Confirm the updated configuration and update IPAM records.
Safely expanding a primary VPC subnet CIDR range requires evaluating unallocated IP space across all connected networks first, calculating valid CIDR netmask boundaries, running the gcloud compute networks subnets expand-ip-range command, and updating IP address documentation upon completion.

Step-by-Step Solution

1
Audit current IP allocations
Verified contiguous unallocated IP block availability without conflicts.
Prevents IP overlap issues across local subnets, peered VPCs, and hybrid on-premises routes.
2
Determine expanded CIDR prefix length
Calculated a valid expanded netmask retaining the original network address start.
GCP rules mandate that primary range expansion must expand existing range boundaries without shifting the starting range address illegally.
3
Issue the subnet expansion command
The subnet CIDR block is enlarged in-place without instance downtime.
The expand-ip-range command modifies subnet primary ranges dynamically without re-creating resources.
4
Verify and document changes
Updated subnet metadata validated in GCP and IPAM documentation updated.
Ensures accurate tracking of organizational IP space for future network expansion plans.

Key Concept

Subnet IP Range Expansion Planning and Execution
Question 530Question →

A developer has packaged a microservice into a container image named `gcr.io/my-project/order-service:v1` and needs to deploy it as a fully managed serverless application on Google Cloud. The application must be deployed to the `us-central1` region and allow public unauthenticated HTTP requests. Which `gcloud` command should be used to accomplish this deployment?

Show answer & explanation

Answer: gcloud run deploy order-service --image gcr.io/my-project/order-service:v1 --region us-central1 --allow-unauthenticated

Answer

The command `gcloud run deploy order-service --image gcr.io/my-project/order-service:v1 --region us-central1 --allow-unauthenticated` correctly deploys the container image to Cloud Run with public unauthenticated HTTP access.
To deploy a container image to Cloud Run, the `gcloud run deploy` command is used specifying the service name, the `--image` location, the `--region`, and the `--allow-unauthenticated` flag to allow public HTTP requests.

Step-by-Step Solution

1
Identify the appropriate serverless compute product for container images
Cloud Run is the managed GCP platform for executing stateless container images listening on HTTP requests.
Cloud Run natively accepts pre-built container images from Google Container Registry (GCR) or Artifact Registry.
2
Formulate the correct gcloud CLI command and mandatory flags
Use `gcloud run deploy` with `--image`, `--region`, and `--allow-unauthenticated`.
The `--allow-unauthenticated` flag grants the `roles/run.invoker` permission to `allUsers`, enabling public access.

Key Concept

Deploying containerized applications to Cloud Run via gcloud CLI
Estimated Time:45s
Question 531Question →

A cloud security administrator needs to deploy a new Google Cloud Storage bucket named `gs://secure-partner-intake-data` in the `us-central1` region. Corporate security compliance mandates two strict technical controls upon resource deployment: all uploaded objects must be automatically encrypted using an existing Customer-Managed Encryption Key (CMEK) path (`projects/corp-sec-kms/locations/global/keyRings/finance-kr/cryptoKeys/intake-key`), and Uniform Bucket-Level Access must be enabled immediately to prevent object-level ACL assignments. Which single `gcloud` command correctly provisions this bucket meeting all compliance requirements?

Show answer & explanation

Answer: gcloud storage buckets create gs://secure-partner-intake-data --location=us-central1 --default-key=projects/corp-sec-kms/locations/global/keyRings/finance-kr/cryptoKeys/intake-key --uniform-bucket-level-access

Answer

The correct command is `gcloud storage buckets create gs://secure-partner-intake-data --location=us-central1 --default-key=projects/corp-sec-kms/locations/global/keyRings/finance-kr/cryptoKeys/intake-key --uniform-bucket-level-access`.
The command starting with `gcloud storage buckets create` correctly uses `--location=us-central1` for region placement, `--default-key` to specify the Cloud KMS key for CMEK encryption of incoming objects, and `--uniform-bucket-level-access` to enforce uniform IAM policy evaluation across all objects in the bucket.

Step-by-Step Solution

1
Identify the primary CLI component for Google Cloud Storage management.
The current standard command component is `gcloud storage buckets create`.
Google Cloud CLI `gcloud storage` subcommands supersede legacy tools and provide unified management for buckets and objects.
2
Select the proper flag for Customer-Managed Encryption Keys (CMEK).
The correct flag is `--default-key=` followed by the fully qualified Cloud KMS key resource ID.
This ensures all new objects uploaded to the bucket are encrypted with the specified KMS key automatically.
3
Specify uniform access control during bucket creation.
Include the `--uniform-bucket-level-access` flag in the creation command.
Enabling Uniform Bucket-Level Access disables ACLs and unifies permission management exclusively through Cloud IAM roles.

Key Concept

Deploying Cloud Storage Buckets with CMEK Encryption and Uniform Bucket-Level Access via gcloud CLI
Question 532Question →

An administrator is deploying a new Cloud SQL database instance using the Google Cloud CLI. Which parameter must be specified in the gcloud command to set the database engine version to MySQL 8.0?

Show answer & explanation

Answer: --database-version=MYSQL_8_0

Answer

The correct parameter to specify the database engine version during Cloud SQL deployment is `--database-version=MYSQL_8_0`.
When executing `gcloud sql instances create`, the `--database-version` flag specifies the database engine type and major version (such as `MYSQL_8_0`, `POSTGRES_15`, etc.).

Step-by-Step Solution

1
Identify the requirement for provisioning a Cloud SQL instance with a specific database engine version.
Recognize that the gcloud CLI tool uses explicit flags to configure instance parameters.
When executing `gcloud sql instances create INSTANCE_NAME`, configuration settings such as database engine, tier, and region are controlled via specific command flags.
2
Evaluate the flags provided in the choices against official gcloud CLI syntax.
Determine that `--database-version` is the valid flag for setting engine versions such as `MYSQL_8_0`, `POSTGRES_14`, or `SQLSERVER_2019_STANDARD`.
Other flags like `--engine-type` or `--db-kind` do not exist in the Google Cloud SDK for Cloud SQL instance creation.

Key Concept

Configuring Cloud SQL Engine Versions via gcloud CLI
Estimated Time:45s
Question 533Question →

A cloud engineer needs to create a new Google Cloud Storage bucket named `customer-backups-us-central1` located in the `us-central1` region using the modern `gcloud` CLI. The bucket must be configured with a default storage class of `NEARLINE` for storing monthly database backups. Which command should the engineer execute to fulfill these requirements?

Show answer & explanation

Answer: gcloud storage buckets create gs://customer-backups-us-central1 --location=us-central1 --default-storage-class=NEARLINE

Answer

The command 'gcloud storage buckets create gs://customer-backups-us-central1 --location=us-central1 --default-storage-class=NEARLINE' correctly creates the bucket with the required location and storage class using modern gcloud storage syntax.
The correct command utilizes 'gcloud storage buckets create' followed by the bucket URI 'gs://customer-backups-us-central1', specifying '--location=us-central1' for the location and '--default-storage-class=NEARLINE' to set the default storage class for created objects.

Step-by-Step Solution

1
Identify the required CLI tool suite
Selected the modern 'gcloud storage buckets create' command structure over legacy gsutil commands
Google Cloud recommends using the gcloud storage component for bucket and object operations
2
Specify the required bucket location
Passed '--location=us-central1'
The --location flag sets the geographic region for the newly deployed Cloud Storage bucket
3
Configure default object storage class
Passed '--default-storage-class=NEARLINE'
The --default-storage-class flag ensures all newly uploaded objects inherit Nearline storage properties unless explicitly overridden

Key Concept

Deploying Cloud Storage buckets using the gcloud CLI with location and storage class configurations.
Question 534Question →

An organization is migrating a mixed application portfolio to Google Cloud and needs to model monthly infrastructure expenses accurately using the Google Cloud Pricing Calculator. The architecture consists of:
1. A continuous, non-interruptible web production cluster operating 24 hours a day, 7 days a week.
2. An asynchronous, fault-tolerant batch data transformation processing workload that runs for 4 hours each night.
3. Long-term compliance archive data that is retained indefinitely and accessed less than once per year.

Which of the following configuration options and pricing assumptions should be selected in the Google Cloud Pricing Calculator to model the lowest accurate monthly cost for this architecture? (Select TWO choices.)

Select all that apply

Show answer & explanation

Answer: Apply Committed Use Discounts (CUDs) of 1-year or 3-years to the 24/7 web production Compute Engine instances.; Specify Spot Virtual Machines (VMs) for the nightly 4-hour batch processing pipeline instances.

Answer

The correct selections are applying Committed Use Discounts (CUDs) for the 24/7 web production instances and configuring Spot Virtual Machines for the nightly 4-hour fault-tolerant batch processing workload.
Applying Committed Use Discounts to uninterrupted 24/7 workloads ensures maximum predictable cost savings without sacrificing availability. Utilizing Spot VMs for fault-tolerant, short-lived batch jobs takes advantage of discounted compute rates specifically intended for preemptible tasks.

Step-by-Step Solution

1
Analyze the 24/7 continuous web production workload requirements.
Since the workload runs non-stop and cannot be interrupted, Committed Use Discounts (CUDs) provide guaranteed cost savings over standard baseline pricing without availability risk.
Spot VMs are unsuitable for non-interruptible web applications because they can be preempted.
2
Evaluate the 4-hour nightly batch processing workload.
Because the pipeline is fault-tolerant and stateless, configuring Spot VMs yields up to 90% savings for short-duration batch computing in the pricing calculator.
Fault-tolerant jobs can resume or restart if preempted, maximizing cost efficiency.
3
Determine the appropriate Cloud Storage class for compliance archive data.
Archive storage offers the lowest at-rest cost per gigabyte per month for long-term data accessed less than once per year.
Standard storage carries significantly higher monthly storage capacity pricing.

Key Concept

Selecting appropriate cost optimization inputs (CUDs, Spot VMs, and Storage Classes) based on workload availability and lifecycle requirements in the GCP Pricing Calculator.
Estimated Time:2m 30s
Question 535Question →

A cloud administrator uses the Google Cloud Pricing Calculator to estimate monthly operational expenses for a custom Compute Engine instance running continuously for 730 hours in a billing month. The instance is configured with 44 vCPUs (billed at $0.04\$0.04 per vCPU-hour) and 16 GB16\text{ GB} of RAM (billed at $0.005\$0.005 per GB-hour). Because the workload runs non-stop, Google Cloud automatically applies a Sustained Use Discount (SUD) of 20%20\% to the combined vCPU and memory compute charges. What is the net estimated monthly compute cost in USD for this instance?

Show answer & explanation

Answer: 140.16

Answer

The net estimated monthly compute cost for the instance is $140.16.
The base vCPU cost is 4×730×0.04=116.804 \times 730 \times 0.04 = 116.80 USD and the base memory cost is 16×730×0.005=58.4016 \times 730 \times 0.005 = 58.40 USD, yielding an un-discounted compute subtotal of 175.20175.20 USD. Applying the 20%20\% Sustained Use Discount to the full compute subtotal gives a net cost of 175.20×0.80=140.16175.20 \times 0.80 = 140.16 USD.

Step-by-Step Solution

1
Calculate un-discounted vCPU cost
$116.80
Multiply 4 vCPUs by 730 hours and the vCPU hourly rate of $0.04.
2
Calculate un-discounted memory cost
$58.40
Multiply 16 GB of RAM by 730 hours and the memory hourly rate of $0.005.
3
Sum total un-discounted compute costs
$175.20
Combine vCPU charges (116.80)andmemorycharges(116.80) and memory charges ( 58.40).
4
Apply Sustained Use Discount (SUD)
$140.16
Multiply total compute charges by 0.80 to factor in the 20% automated discount for sustained execution.

Key Concept

Estimating monthly Compute Engine costs incorporating automatic Sustained Use Discounts (SUD) for vCPU and RAM usage.
Estimated Time:1m 30s
Question 536Question →

A cloud engineer is configuring an automated script using the Google Cloud CLI (gcloud) to provision worker virtual machines on Compute Engine for batch data processing. The deployment must fulfill three strict technical requirements:
1. The VM instances must be provisioned as Spot VMs to optimize infrastructure cost.
2. The instances must execute a startup script stored in a Cloud Storage bucket at gs://prod-initializer-bucket/setup.sh upon initial boot.
3. The instances must be configured with a user-managed service account named [email protected] without relying on legacy default compute service account permissions.

Which TWO gcloud compute instances create flag options must be included in the command to correctly satisfy these requirements?

Select all that apply

Show answer & explanation

Answer: --provisioning-model=SPOT --instance-termination-action=STOP; --metadata=startup-script-url=gs://prod-initializer-bucket/setup.sh

Answer

The correct options are the flags configuring '--provisioning-model=SPOT --instance-termination-action=STOP' and '--metadata=startup-script-url=gs://prod-initializer-bucket/setup.sh'.
Provisioning Spot VMs via the gcloud CLI requires setting '--provisioning-model=SPOT' alongside an instance termination action such as '--instance-termination-action=STOP'. Furthermore, executing a remote startup script hosted in Google Cloud Storage requires specifying the metadata key 'startup-script-url' within the metadata flag ('--metadata=startup-script-url=gs://...'). Together, these options fulfill the deployment requirements correctly.

Step-by-Step Solution

1
Identify the proper gcloud CLI flag for provisioning Spot VM capacity.
The current standard flag syntax for Spot instances is '--provisioning-model=SPOT', accompanied by a termination action such as '--instance-termination-action=STOP' or 'DELETE'.
Legacy preemptible VMs used '--preemptible', but '--provisioning-model=SPOT' is the current model for Spot VM creation on Compute Engine.
2
Determine the correct gcloud metadata parameter for referencing a Cloud Storage startup script.
Passing a remote script URL requires using key-value pair formatting under metadata: '--metadata=startup-script-url=gs://bucket/script.sh'.
Direct flags like '--startup-script' are invalid syntax in gcloud compute instances create when referencing Cloud Storage bucket paths.
3
Evaluate and eliminate incorrect flag combinations.
Passing IAM role identifiers into the '--scopes' parameter causes a CLI syntax error because scopes accept URI endpoints, not IAM roles. Additionally, setting host maintenance to MIGRATE conflicts with Spot VM operational constraints.
IAM permissions must be granted to the attached service account separately via IAM policies, while Spot instances require host termination on maintenance.

Key Concept

Compute Engine gcloud CLI Provisioning and Configuration Flags
Estimated Time:2m 0s
Question 537Question →

A fintech company is setting up a new Google Cloud project named `payment-clearing-dev` for a team of external contractors. A cloud administrator needs to grant an external contractor the minimum necessary IAM permissions required to link this newly created project to the company's central Cloud Billing Account. The contractor should not have administrative control over the billing account or overall ownership of the project. Following Google Cloud least-privilege best practices, which configuration of roles should be granted to the contractor?

Show answer & explanation

Answer: Grant the Billing Account User role (roles/billing.user) on the Cloud Billing Account, and grant the Project Billing Manager role (roles/billing.projectManager) on the project.

Answer

Grant the Billing Account User role (roles/billing.user) on the Cloud Billing Account, and grant the Project Billing Manager role (roles/billing.projectManager) on the project.
Linking a Google Cloud project to a billing account requires two distinct sets of permissions: `roles/billing.user` granted on the Cloud Billing Account (which grants permission to attach projects to that billing account) and `roles/billing.projectManager` granted on the target Project (which permits attaching a billing account to that project). This combination enforces the principle of least privilege.

Step-by-Step Solution

1
Identify the permissions required on the Cloud Billing Account side.
The user needs the `billing.resourceAssociations.create` permission on the billing account, which is included in the predefined `roles/billing.user` (Billing Account User) role.
Linking a project to a billing account requires authorization from the billing account to attach new projects to it.
2
Identify the permissions required on the GCP Project side.
The user needs the `resourcemanager.projects.createBillingAssignment` permission on the target project, which is provided by the predefined `roles/billing.projectManager` (Project Billing Manager) role.
The project itself must permit changing its associated billing account.
3
Apply the principle of least privilege.
Combining `roles/billing.user` on the billing account with `roles/billing.projectManager` on the project satisfies both requirements without over-granting administrative permissions like Billing Administrator or Project Owner.
Minimizes security risk while fulfilling procedural requirements.

Key Concept

Two-Sided IAM Permissions for Project Billing Linkage
Question 538Question →

A video streaming platform is implementing an automated ingest workflow in Google Cloud. A DevOps engineer needs to create a new Cloud Storage bucket named `media-raw-uploads-2026` in the `us-central1` region using modern `gcloud storage` CLI tools. The bucket design mandates two strict compliance and operational rules: all access permissions must be managed strictly at the bucket level rather than per-object ACLs, and all uploaded raw video files must automatically transition to Coldline storage 30 days after creation to manage storage expenditure. The lifecycle configuration policy has already been saved locally in a file named `lifecycle.json`. Which TWO commands should the engineer run to provision this bucket according to Google-recommended best practices?

Select all that apply

Show answer & explanation

Answer: gcloud storage buckets create gs://media-raw-uploads-2026 --location=us-central1 --uniform-bucket-level-access; gcloud storage buckets update gs://media-raw-uploads-2026 --lifecycle-file=lifecycle.json

Answer

The correct commands are executing 'gcloud storage buckets create gs://media-raw-uploads-2026 --location=us-central1 --uniform-bucket-level-access' to deploy the bucket with uniform access controls, and running 'gcloud storage buckets update gs://media-raw-uploads-2026 --lifecycle-file=lifecycle.json' to apply the 30-day storage class transition lifecycle policy.
To fulfill the requirements using Google-recommended practices, the bucket must be created using modern 'gcloud storage' CLI tools with the '--uniform-bucket-level-access' flag to ensure IAM handles access at the bucket level. To automate the 30-day transition to Coldline without penalizing immediate ingest access, the lifecycle policy file must be attached via 'gcloud storage buckets update --lifecycle-file=lifecycle.json'.

Step-by-Step Solution

1
Provision the bucket using modern gcloud storage CLI with required location and uniform bucket-level access enabled.
Bucket gs://media-raw-uploads-2026 is created with Uniform Bucket-Level Access enforced, disabling individual object ACLs.
Uniform Bucket-Level Access fulfills the requirement of managing permissions strictly at the bucket level via IAM.
2
Apply the object lifecycle management configuration to the bucket using the gcloud storage update command.
The bucket receives the lifecycle policy defined in lifecycle.json.
Objects uploaded to the bucket will automatically transition to Coldline storage after 30 days without changing the bucket's default storage class.

Key Concept

Deploying Cloud Storage buckets and configuring lifecycle policies using the modern gcloud storage CLI.
Question 539Question →

A DevOps team has provisioned a new regional Google Kubernetes Engine (GKE) cluster named `app-prod-cluster` in the `us-central1` region. A cloud engineer attempts to deploy an application manifest to the cluster by running `kubectl apply -f deployment.yaml` on their workstation, but receives the error: `The connection to the server localhost:8080 was refused`. Which command must the engineer execute to resolve this error?

Show answer & explanation

Answer: gcloud container clusters get-credentials app-prod-cluster --region us-central1

Answer

Execute `gcloud container clusters get-credentials app-prod-cluster --region us-central1` to retrieve the cluster's endpoint and authentication data into the local kubeconfig file.
Executing `gcloud container clusters get-credentials` retrieves the API endpoint and authentication credentials for the specified cluster and updates the local `~/.kube/config` configuration file. This allows `kubectl` to successfully discover and authenticate against the GKE control plane.

Step-by-Step Solution

1
Diagnose the cause of the kubectl connection failure
The error `connection to the server localhost:8080 was refused` indicates that `kubectl` does not have a configured cluster context in `~/.kube/config` and is falling back to the default localhost address.
Before `kubectl` can communicate with a GKE control plane, it requires the cluster's API endpoint IP and certificate authority authority data.
2
Retrieve GKE cluster credentials using the Cloud SDK
Running `gcloud container clusters get-credentials app-prod-cluster --region us-central1` downloads the necessary context and updates `~/.kube/config`.
This command connects to the GKE control plane, generates auth entries, and sets the current-context to the target cluster.

Key Concept

Configuring kubectl cluster context with gcloud container clusters get-credentials
Question 540Question →

A system administrator needs to configure a fresh workstation to manage workloads on an existing Google Kubernetes Engine (GKE) Standard cluster named `analytics-prod` located in the `us-central1` region. The administrator has already installed the Google Cloud SDK (`gcloud`) and `kubectl`, and has authenticated using `gcloud auth login`. The application requires applying a Kubernetes deployment manifest named `app-deploy.yaml` and using a dedicated node pool optimized for high-reliability background processing without unexpected node preemption. Which of the following steps are required to achieve this deployment successfully? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Run `gcloud container clusters get-credentials analytics-prod --region us-central1` to retrieve cluster credentials and update the local `kubeconfig` context.; Execute `kubectl apply -f app-deploy.yaml` to deploy the application resources to the cluster once cluster credentials are configured.

Answer

To successfully deploy the workload, the administrator must fetch the cluster credentials using `gcloud container clusters get-credentials analytics-prod --region us-central1` and then deploy the manifest using `kubectl apply -f app-deploy.yaml`.
The correct steps involve first fetching the cluster credentials into the local kubeconfig file using `gcloud container clusters get-credentials analytics-prod --region us-central1`, and second using `kubectl apply -f app-deploy.yaml` to deploy the declared resources to the GKE cluster.

Step-by-Step Solution

1
Fetch GKE Cluster Kubeconfig Credentials
The local `~/.kube/config` file is populated with the endpoint address, CA certificate, and authentication token for `analytics-prod`.
Before `kubectl` can issue commands to a GKE cluster, local kubeconfig credentials must be generated by the `gcloud container clusters get-credentials` command.
2
Deploy Workload Manifest using kubectl
The Kubernetes API server accepts `app-deploy.yaml` and schedules the pods onto available cluster nodes.
Applying the manifest creates or updates the deployment object defined in the YAML file on the authenticated cluster context.

Key Concept

Configuring kubectl authentication for GKE clusters via gcloud and executing workload deployments.
PreviousPage 27 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin