Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 561Question →

An enterprise automotive company is provisioning a dedicated Google Cloud project for an IoT telemetry processing pipeline. The cloud governance team must authorize a DevOps engineer to link this newly created project to the corporate Cloud Billing Account. The organization strictly enforces the principle of least privilege, ensuring the engineer cannot modify billing account payment settings or manage unrelated resources across the organization. Which of the following IAM roles must be assigned to the DevOps engineer to enable project linking? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Billing Account User (roles/billing.user) on the target Cloud Billing Account; Project Billing Manager (roles/billing.projectManager) on the target Google Cloud project

Answer

Linking a Google Cloud project to a billing account requires permissions on both the billing account and the project. Following least privilege, the engineer must be assigned the Billing Account User role on the billing account and the Project Billing Manager role on the project.
Linking a project to a billing account is a dual-authorization action. The user must hold the Billing Account User role on the billing account to consume its funds, and the Project Billing Manager role on the project to manage its billing attachment. Both roles adhere strictly to the principle of least privilege.

Step-by-Step Solution

1
Determine the required billing account permission
Identified that linking requires billing.resourceAssociations.create on the billing account.
Assigning Billing Account User (roles/billing.user) grants this permission without giving administrative control over financial settings.
2
Determine the required project-level permission
Identified that linking requires resourcemanager.projects.createBillingAssignment on the project.
Assigning Project Billing Manager (roles/billing.projectManager) grants this specific project-level capability without assigning broad primitive Owner privileges.

Key Concept

Two-ended IAM permission requirement for linking projects to Cloud Billing Accounts using least-privilege predefined roles.
Question 562Question →

An enterprise media organization is planning a Google Kubernetes Engine (GKE) cluster architecture to host an internal microservices platform. The architecture must satisfy two specific infrastructure requirements:

1. The cluster control plane management API must be accessible exclusively from the organization's on-premises administrative network CIDR block (10.200.0.0/1610.200.0.0/16) via Cloud VPN, blocking all public internet access to the control plane.
2. Cluster worker nodes must be provisioned without public IP addresses, yet workloads must maintain outbound internet connectivity to pull external container images and transmit telemetry.

Which TWO architectural configurations should the team include in their GKE cluster plan? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Private Cluster mode with a private control plane endpoint, and configure Master Authorized Networks specifying 10.200.0.0/1610.200.0.0/16.; Provision Cloud NAT within the VPC network region hosting the private cluster subnets.

Answer

To satisfy both enterprise security requirements, the architecture team must enable a Private Cluster with a private control plane endpoint restricted via Master Authorized Networks to the on-premises CIDR block (10.200.0.0/16), and deploy Cloud NAT within the VPC network to provide outbound internet connectivity for private nodes.
Configuring a private GKE cluster with a private control plane endpoint and Master Authorized Networks limits API access to the specified on-premises network range (10.200.0.0/16). Additionally, provisioning Cloud NAT in the VPC provides private cluster nodes with outbound internet egress capabilities required for pulling external images without granting them public IP addresses.

Step-by-Step Solution

1
Analyze control plane access requirements
Disabling public endpoint access and enabling private endpoint with Master Authorized Networks for 10.200.0.0/16 locks down API access exclusively to the internal management network.
Master Authorized Networks restricts access to the GKE control plane endpoint to specified IP ranges, ensuring secure management over Cloud VPN.
2
Analyze node networking and outbound internet access requirements
Nodes provisioned in a private GKE cluster receive only internal IP addresses. To access external internet resources without exposing nodes to inbound traffic, Cloud NAT is required.
Cloud NAT performs Network Address Translation for private subnet instances, granting egress internet access without assigning public IP addresses to nodes.

Key Concept

Private GKE Cluster Topology, Control Plane Master Authorized Networks, and Cloud NAT Egress Architecture
Question 563Question →

A backend team has built a stateless container image for a web microservice and pushed it to Artifact Registry at `us-docker.pkg.dev/my-project/apps/inventory-api:v1`. They want to quickly deploy this containerized application to Google Cloud Run and ensure it accepts public HTTP requests without requiring user authentication. Which `gcloud` command should they execute?

Show answer & explanation

Answer: gcloud run deploy inventory-api --image=us-docker.pkg.dev/my-project/apps/inventory-api:v1 --allow-unauthenticated

Answer

Execute `gcloud run deploy inventory-api --image=us-docker.pkg.dev/my-project/apps/inventory-api:v1 --allow-unauthenticated`.
To deploy a container image to Cloud Run and allow public access, run `gcloud run deploy` specifying the image location with `--image` and setting the `--allow-unauthenticated` flag.

Step-by-Step Solution

1
Identify the target deployment platform for container images
Cloud Run is designed to run arbitrary stateless container images stored in Container Registry or Artifact Registry.
Cloud Run consumes container images directly, whereas Cloud Functions primary workflow deploys code snippets.
2
Determine the gcloud command for initial service deployment
Use `gcloud run deploy <service-name>` along with the `--image` flag pointing to the Artifact Registry URI.
This command creates a new service and initial revision in Cloud Run.
3
Apply access control flag for public HTTP access
Pass the `--allow-unauthenticated` flag during deployment.
This flag grants the `roles/run.invoker` permission to `allUsers`, allowing unauthenticated public invocations.

Key Concept

Deploying Serverless Applications with Cloud Run
Question 564Question →

A cloud engineer needs to deploy a Compute Engine virtual machine instance named `prod-db` to host a continuous, non-interruptible database workload in the `us-central1-f` zone. Which `gcloud` command correctly provisions this virtual machine?

Show answer & explanation

Answer: gcloud compute instances create prod-db --zone=us-central1-f

Answer

gcloud compute instances create prod-db --zone=us-central1-f
The command 'gcloud compute instances create prod-db --zone=us-central1-f' uses the correct resource hierarchy ('gcloud compute instances create'), specifies the correct instance name, and uses the correct zonal flag ('--zone') required for deploying standard Compute Engine VMs.

Step-by-Step Solution

1
Identify the correct gcloud CLI resource group for Compute Engine instances
The correct command prefix is 'gcloud compute instances create'.
Compute Engine VM instances are managed under the 'instances' resource command group.
2
Determine the required zone flag and provisioning model
Use '--zone=us-central1-f' without preemptible flags.
Compute Engine instances are zonal resources, and non-interruptible workloads must not use preemptible or Spot VM configurations.

Key Concept

Deploying Compute Engine Virtual Machines via gcloud CLI
Estimated Time:45s
Question 565Question →

An enterprise architecture team is designing the network foundation in Google Cloud for a workload that will expand across multiple regions and connect to on-premises data centers via Cloud Interconnect. The team needs to establish IP address management (IPAM) guidelines for the Virtual Private Cloud (VPC) topology to avoid IP space conflicts and ensure explicit control over regional subnet creation. Which TWO architectural decisions should the team implement during the VPC network and subnet planning phase? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create the Virtual Private Cloud (VPC) network in Custom mode rather than Auto mode.; Allocate non-overlapping primary IPv4 CIDR blocks across all GCP subnets and connected on-premises networks.

Answer

The team should create the VPC network in Custom mode and allocate non-overlapping primary IPv4 CIDR blocks across all GCP subnets and connected networks.
Creating the VPC network in Custom mode gives network administrators full control to define subnets only in chosen regions using custom IPv4 ranges. Allocating non-overlapping primary IPv4 CIDR blocks across all cloud subnets and on-premises environments ensures clean routing table generation and avoids IP collision issues over Cloud Interconnect.

Step-by-Step Solution

1
Evaluate VPC creation mode requirements for enterprise hybrid connectivity.
Auto mode creates default subnets in all regions using predictable IP blocks (10.128.0.0/9), creating a high risk of IP overlap with existing enterprise networks. Custom mode provides complete control to define only necessary subnets with designated CIDR ranges.
Enterprise hybrid architectures demand custom subnet boundary planning to prevent address collisions across VPN and Interconnect tunnels.
2
Determine primary IPv4 address space allocation rules across regions and hybrid connections.
Primary CIDR ranges within a single VPC network must be distinct per subnet and must not overlap with remote networks linked via hybrid connectivity.
Overlapping CIDR blocks block route propagation and break bi-directional packet routing between GCP and external endpoints.

Key Concept

Planning Custom Mode VPC Networks and Non-Overlapping Subnet Addressing
Estimated Time:1m 30s
Question 566Question →

A cloud administrator needs to deploy a horizontally scalable, multi-region relational database using the Google Cloud CLI. Which command should be executed to create a new Cloud Spanner instance named 'prod-db' configured with 3 nodes in the 'nam-eur-asia1' multi-region configuration?

Show answer & explanation

Answer: gcloud spanner instances create prod-db --config=nam-eur-asia1 --nodes=3 --description="Production Database"

Answer

Execute 'gcloud spanner instances create prod-db --config=nam-eur-asia1 --nodes=3 --description="Production Database"'.
The command specifying 'gcloud spanner instances create' with the parameters '--config=nam-eur-asia1' and '--nodes=3' correctly provisions a Cloud Spanner instance with the multi-region configuration and node capacity specified in the deployment requirement.

Step-by-Step Solution

1
Identify the managed database service required for horizontal scaling and multi-region relational requirements.
Select Cloud Spanner as the target service.
Cloud Spanner is Google Cloud's fully managed enterprise-grade, horizontally scalable, multi-region relational database.
2
Identify the correct gcloud CLI flags for creating a Cloud Spanner instance.
Use 'gcloud spanner instances create' with parameters '--config' for location/regional profile and '--nodes' for instance compute capacity.
The '--config' parameter defines the deployment region or multi-region setup (e.g., nam-eur-asia1), while '--nodes' allocates processing nodes.

Key Concept

Deploying Cloud Spanner Instances using the Google Cloud CLI
Question 567Question →

A software developer on your team needs to create and manage Cloud Pub/Sub topics and subscriptions within a development project. The developer must not have access to modify project IAM permissions or create resources in other Google Cloud services. Following Google Cloud's principle of least privilege, which IAM role should you grant to the developer?

Show answer & explanation

Answer: Pub/Sub Editor (roles/pubsub.editor)

Answer

Granting the Pub/Sub Editor (roles/pubsub.editor) role at the project level provides the required permissions to create and manage Cloud Pub/Sub topics and subscriptions while enforcing least privilege.
The Pub/Sub Editor (roles/pubsub.editor) role grants full access to create, modify, and delete Cloud Pub/Sub topics and subscriptions without granting administrative control over project IAM policies or other Google Cloud services.

Step-by-Step Solution

1
Identify the specific Google Cloud service requirements.
The developer only requires access to manage Cloud Pub/Sub topics and subscriptions.
Permissions should be restricted specifically to the target service and actions.
2
Evaluate role types for least-privilege enforcement.
Select a predefined role specifically tailored to Cloud Pub/Sub.
Primitive roles like Editor grant excessive privileges across nearly all project services.
3
Select the correct resource binding level.
Bind the role at the specific project level.
Granting roles higher up in the resource hierarchy (such as Folder or Organization level) causes unwanted permission inheritance across all child projects.

Key Concept

Applying Least Privilege with Predefined Roles
Question 568Question →

A cloud engineer is deploying a Cloud Storage bucket named `audit-vault-2026` in the `us-east1` region to hold long-term regulatory compliance logs. Security policies mandate that per-object ACLs must be completely disabled by enforcing Uniform Bucket-Level Access upon creation. Furthermore, all files uploaded to this bucket must default to the `ARCHIVE` storage class to minimize storage expenditure. Which command should the engineer run to deploy the bucket according to Google-recommended best practices?

Show answer & explanation

Answer: gcloud storage buckets create gs://audit-vault-2026 --location=us-east1 --default-storage-class=ARCHIVE --uniform-bucket-level-access

Answer

The command 'gcloud storage buckets create gs://audit-vault-2026 --location=us-east1 --default-storage-class=ARCHIVE --uniform-bucket-level-access' correctly creates the storage bucket with all required security and storage class configurations.
The correct command utilizes 'gcloud storage buckets create' along with the '--location=us-east1', '--default-storage-class=ARCHIVE', and '--uniform-bucket-level-access' flags. This fulfills all requirements in a single operation adhering to current Google Cloud standards.

Step-by-Step Solution

1
Identify the primary CLI tool standard for GCP deployment tasks.
Google Cloud recommends using the modern 'gcloud storage' CLI component for managing Cloud Storage resources.
The 'gcloud storage' CLI replaces legacy 'gsutil' commands and provides unified syntax under gcloud.
2
Select the appropriate flags for region, storage class, and access model.
Use '--location=us-east1' for placement, '--default-storage-class=ARCHIVE' for cost-optimized archive storage, and '--uniform-bucket-level-access' to disable per-object ACLs.
Enforcing uniform bucket-level access unifies security under IAM policies, fulfilling compliance and security directives.

Key Concept

Deploying Cloud Storage Buckets using gcloud storage CLI
Estimated Time:2m 0s
Question 569Question →

A solutions architect is configuring cost estimates in the Google Cloud Pricing Calculator for a hybrid enterprise application. The architecture consists of long-running database servers, batch worker nodes running fault-tolerant tasks, and long-term application logs. Which of the following recommendations correctly describe how to model these components accurately in the Pricing Calculator? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Apply Committed Use Discounts (CUDs) for the backend database servers to reflect guaranteed baseline workload savings over a 1-year or 3-year commitment term.; Calculate Cloud Storage estimates by factoring in data retrieval costs and network egress alongside raw storage volume based on expected log access patterns.

Answer

The correct recommendations are to apply Committed Use Discounts (CUDs) for predictable backend database instances and to factor in data retrieval and egress fees alongside raw storage volume for Cloud Storage estimates.
Applying Committed Use Discounts (CUDs) is appropriate for steady-state workloads such as database instances to accurately reflect 1-year or 3-year term savings. Additionally, Cloud Storage pricing calculations must account for data retrieval and network egress charges in addition to raw capacity.

Step-by-Step Solution

1
Identify compute discounting rules in the Pricing Calculator
Database servers run continuously and qualify for Committed Use Discounts (CUDs) for 1-year or 3-year commitments. Spot VMs are priced at a fixed discounted rate and cannot combine with Sustained Use Discounts (SUDs).
Understanding which discount mechanisms apply to baseline versus transient workloads is essential for accurate calculator inputs.
2
Analyze storage tiering and operational cost factors
Cloud Storage pricing depends on storage class, data retrieval fees, operation counts, and network egress. Archive storage is designed for data accessed less than once a year; accessing it daily incurs heavy retrieval penalties.
Total cost of ownership for storage involves operational and network traffic costs in addition to raw gigabyte-month rates.

Key Concept

Accurate GCP cost estimation using the Google Cloud Pricing Calculator requires matching steady-state compute workloads with Committed Use Discounts and considering operational data retrieval/egress fees alongside storage class tiers.
Question 570Question →

Match each Google Cloud enterprise workload requirement on the left with the database or persistent block storage service on the right that best satisfies the technical constraints with minimal operational overhead.

Click a left item, then click its matching right item

Items

A high-throughput, low-latency NoSQL data store requiring single-digit millisecond latency for real-time time-series IoT ingestion at petabyte scale.
A globally distributed transactional relational database requiring full ACID compliance, horizontal scaling across multi-region deployments, and up to 99.999% availability.
An ephemeral, ultra-high IOPS storage volume providing sub-millisecond latency attached physically to the hypervisor host for temporary processing and scratch space.
A fully managed regional relational database engine (MySQL, PostgreSQL, or SQL Server) supporting standard OLTP applications with automated backups and cross-zone High Availability (HA).

Matches

Show answer & explanation

Answer

High-throughput petabyte IoT time-series maps to Cloud Bigtable. Globally distributed ACID relational database maps to Cloud Spanner. Ephemeral ultra-high IOPS sub-millisecond scratch space maps to Local SSD. Managed regional MySQL/PostgreSQL with HA maps to Cloud SQL.
Each requirement directly aligns with GCP's database and storage classification guidelines: Cloud Bigtable for high-throughput NoSQL time-series; Cloud Spanner for globally scalable ACID relational data; Local SSD for non-persistent, physically attached high-IOPS scratch disks; and Cloud SQL for standard managed regional relational databases.

Step-by-Step Solution

1
Analyze the scale, latency, and data structure requirements for the IoT time-series workload.
Identified wide-column NoSQL at petabyte scale with single-digit millisecond latency requirement.
Cloud Bigtable is the optimal GCP native service designed specifically for high-volume NoSQL and time-series streaming workloads.
2
Evaluate the database needs for global multi-region transactional consistency.
Identified global ACID compliance and multi-region horizontal scaling.
Cloud Spanner uniquely combines relational database ACID semantics with horizontal global scaling and 99.999% availability.
3
Differentiate ephemeral scratch storage performance requirements from persistent disks.
Identified host-attached temporary storage with sub-millisecond latency.
Local SSD provides the required IOPS and sub-millisecond latency for ephemeral scratch storage.
4
Determine the service for regional standard relational database engines.
Identified managed regional MySQL/PostgreSQL/SQL Server with automatic failover.
Cloud SQL manages standard relational database engines regionally with built-in automated backups and HA.

Key Concept

Matching workload storage and relational requirements to appropriate Google Cloud database engines and persistent disk options.
Estimated Time:2m 0s
Question 571Question →

An operations engineer is deploying a stateless backend microservice to Google Cloud Run using the gcloud command-line interface. The service must accept incoming asynchronous HTTP calls from an authenticated client application while adhering to Google Cloud security and container environment standards. Which of the following configuration steps are required to ensure successful deployment and invocation of this Cloud Run service? (Select TWO options.)

Select all that apply

Show answer & explanation

Answer: Configure the containerized application to listen on the HTTP port specified by the PORT environment variable, which defaults to 8080.; Grant the predefined Cloud Run Invoker role (roles/run.invoker) to the service account or identity making requests to the service.

Answer

To successfully deploy and enable authenticated access to a Cloud Run service, the application must listen on the port injected by the PORT environment variable (default 8080), and the calling principal must be granted the Cloud Run Invoker role (roles/run.invoker).
Cloud Run requires containers to listen for HTTP requests on the port specified by the PORT environment variable (default 8080). Additionally, private Cloud Run services require callers to hold the predefined Cloud Run Invoker role (roles/run.invoker) to authenticate requests.

Step-by-Step Solution

1
Configure container port binding
The web container listens on process.env.PORT or port 8080.
Cloud Run routes ingress traffic to the container port defined by the PORT environment variable (defaulting to 8080).
2
Configure access control IAM policies
The invoking principal gains execution permission via the Cloud Run Invoker role.
By default, Cloud Run services require IAM authentication, which is controlled by assigning roles/run.invoker to calling identities.

Key Concept

Cloud Run Container Port Contract and IAM Invoker Permissions
Question 572Question →

A cloud administrator is tasked with setting up a highly compliant log storage architecture on Google Cloud using modern `gcloud storage` CLI utilities. The solution requires creating a bucket with uniform bucket-level access enabled, setting a 365-day retention policy, defining and attaching a lifecycle policy to automatically transition objects to ARCHIVE storage after 90 days, and finally populating the bucket with historical log files. In what exact sequential order should the administrator perform these operations?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: first, create the bucket with Uniform Bucket-Level Access; second, set the 365-day retention policy on the bucket; third, construct the local lifecycle JSON file; fourth, attach the lifecycle JSON file to the bucket using gcloud storage buckets update; and fifth, copy the historical log files into the bucket.
The deployment sequence follows proper dependency order: creating the Cloud Storage bucket resource with Uniform Bucket-Level Access, configuring bucket-level compliance retention settings, drafting the local lifecycle configuration JSON file, updating the bucket to apply the lifecycle configuration file, and finally copying log files into the configured bucket.

Step-by-Step Solution

1
Execute `gcloud storage buckets create` with `--uniform-bucket-level-access`.
The destination bucket is provisioned with uniform IAM access control enforcement.
Resource creation must precede configuration modifications or data population.
2
Execute `gcloud storage buckets update` with `--retention-period=365d`.
The bucket retention governance policy is established.
Configuring compliance retention settings prior to populating objects ensures all stored data is bound by the policy from the moment of ingestion.
3
Draft the local `lifecycle.json` file defining an age-based condition (90 days) and `SetStorageClass` action (`ARCHIVE`).
A valid local lifecycle definition document is created.
The lifecycle rule document must exist locally before it can be referenced in a `gcloud` update command.
4
Execute `gcloud storage buckets update` with `--lifecycle-file=lifecycle.json`.
The lifecycle policy is bound to the Cloud Storage bucket.
Attaching the policy activates automated object transition rules on the bucket.
5
Execute `gcloud storage cp` to transfer the local log files into the bucket path.
Objects are securely written into the fully configured and governed bucket.
Object upload is the final deployment step.

Key Concept

Deploying and configuring Google Cloud Storage buckets requires establishing underlying bucket resources and security policies prior to deploying lifecycle rules and ingesting data via modern `gcloud storage` CLI commands.
Question 573Question →

A developer is deploying a stateless containerized web application to Google Cloud Run using the gcloud CLI. The application must be publicly accessible over HTTP without requiring authentication. Which TWO configuration steps or practices must be implemented to ensure the deployment succeeds and is publicly accessible? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Pass the --allow-unauthenticated flag during deployment (or grant the Cloud Run Invoker role to allUsers) to permit public access.; Ensure the containerized application listens for incoming HTTP requests on the port specified by the PORT environment variable.

Answer

To successfully deploy a public Cloud Run service, you must allow unauthenticated invocations by passing the --allow-unauthenticated flag (or granting roles/run.invoker to allUsers) and ensure the containerized web app listens on the port defined by the PORT environment variable.
Deploying a public Cloud Run service requires fulfilling both the container contract and IAM ingress settings: the application must listen on the port injected via the PORT environment variable (default 8080), and unauthenticated access must be enabled either with the --allow-unauthenticated deployment flag or by assigning the Cloud Run Invoker role (roles/run.invoker) to allUsers.

Step-by-Step Solution

1
Configure the application code and Dockerfile for Cloud Run runtime requirements.
The application listens on the port specified by the PORT environment variable (default 8080).
Cloud Run automatically routes container traffic to the port defined by the PORT environment variable injected into the container environment.
2
Execute the deployment command with appropriate IAM access flags.
The service is deployed with IAM policies granting invocation privileges to unauthenticated requests.
Cloud Run services default to private (authenticated only). Specifying --allow-unauthenticated binds the roles/run.invoker role to allUsers.

Key Concept

Cloud Run Container Contract and Public Access IAM Binding
Question 574Question →

A system administrator needs to provision a Compute Engine virtual machine instance using the Google Cloud CLI (`gcloud`). The VM must execute a local multi-line initialization script on startup and perform read-only operations against a Cloud Storage bucket using a custom service account following the principle of least privilege. In what chronological sequence must the administrator perform the steps to configure and launch this virtual machine?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Create the dedicated user-managed service account, 2) Grant the Storage Object Viewer role to the service account, 3) Write and save the initialization shell script locally, and 4) Run `gcloud compute instances create` referencing the service account, `cloud-platform` scope, and `--metadata-from-file=startup-script=init.sh`.
Provisioning a secure Compute Engine instance follows a logical dependency chain: identity creation, permission assignment, local asset preparation, and finally resource instantiation. The service account must exist before IAM roles can be granted to it. The IAM permissions must be bound before the VM boots and attempts to perform storage actions. The startup script file must be saved on the administrator's client machine before `gcloud` can read its contents via `--metadata-from-file`. Finally, launching the instance attaches the service account identity and uploads the local script content into instance metadata.

Step-by-Step Solution

1
Create the custom service account identity.
Establishes a user-managed service account resource in IAM.
Compute Engine instances requiring specific access patterns should use custom service accounts rather than the Default Compute Engine Service Account.
2
Assign the least-privilege IAM role to the service account.
Binds `roles/storage.objectViewer` to the service account identity for the target storage bucket.
IAM permissions must be configured on the service account so that requests made from the instance succeed upon startup.
3
Author the startup script locally.
Creates a local file containing bash setup directives.
When passing local file content to instance metadata via `--metadata-from-file`, the file must already exist on the local file system.
4
Issue the `gcloud compute instances create` command with appropriate flags.
Provisions the Compute Engine VM with attached identity, proper API scopes, and startup script metadata.
Best practice for custom service accounts is to assign the `https://www.googleapis.com/auth/cloud-platform` scope and manage actual access control entirely through IAM roles.

Key Concept

Compute Engine VM Provisioning with Custom Service Accounts and Metadata Startup Scripts
Question 575Question →

A smart grid utility ingests high-frequency meter telemetry into a Google Cloud Storage bucket. Analytics pipelines continuously process and query this data for the first 30 days. Between day 31 and day 365, data is accessed less than once per quarter for periodic compliance reporting. After 365 days, the data is no longer required and must be removed. Which Object Lifecycle Management configuration minimizes total cost while fulfilling these operational requirements?

Show answer & explanation

Answer: Ingest objects into Standard storage, add a lifecycle rule to transition objects to Coldline storage after 30 days, and add a lifecycle rule to delete objects after 365 days.

Answer

Ingest objects into Standard storage, add a lifecycle rule to transition objects to Coldline storage after 30 days, and add a lifecycle rule to delete objects after 365 days.
The correct option correctly pairs Standard storage for initial active queries with Coldline storage for infrequent quarterly compliance reviews starting at day 31, while ensuring cost elimination after 365 days via automated deletion.

Step-by-Step Solution

1
Analyze access frequency for the first 30 days.
Standard storage is appropriate because the data is queried continuously, avoiding retrieval fees associated with colder classes.
Standard storage has higher monthly storage costs per GB but zero retrieval charges, making it optimal for active workloads.
2
Analyze access frequency between day 31 and day 365.
Coldline storage is appropriate because the data is accessed less than once per quarter and meets the 90-day minimum storage duration requirement.
Coldline offers significantly lower storage costs than Nearline and Standard, matching the quarterly access frequency.
3
Determine end-of-life actions after 365 days.
An automated Delete action set for 365 days removes unneeded data.
Explicit deletion prevents ongoing storage fees for data that is no longer required.

Key Concept

Selecting Cloud Storage classes based on access frequency, retention periods, and configuring Object Lifecycle Management rules.
Question 576Question →

A financial technology company is planning the networking architecture on Google Cloud for two distinct backend services running on Compute Engine instances:

1. External edge sensors transmit non-HTTP raw TCP traffic over the internet and require the backend instances to inspect the original client IP address directly.
2. Internal microservices execute high-throughput RPC operations over TCP between instances located in the same Virtual Private Cloud (VPC) network.

Which TWO load balancing solutions should the cloud engineer select to satisfy these architecture requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy an External Passthrough Network Load Balancer for the external edge sensor traffic.; Deploy an Internal Passthrough Network Load Balancer for the internal RPC microservice traffic.

Answer

Select the External Passthrough Network Load Balancer for external raw TCP traffic requiring client IP preservation, and select the Internal Passthrough Network Load Balancer for internal high-throughput TCP RPC traffic within the VPC network.
For external non-HTTP raw TCP traffic that requires preserving client source IP addresses, an External Passthrough Network Load Balancer is the correct Layer 4 choice because packets are routed directly to backend instances without proxy termination. For internal TCP-based RPC traffic between instances in the same VPC, an Internal Passthrough Network Load Balancer delivers low-latency, high-throughput private Layer 4 load balancing.

Step-by-Step Solution

1
Analyze the protocol and client IP requirements for the external workload.
The external workload uses non-HTTP raw TCP traffic and requires client source IP preservation.
Proxy load balancers (like External Application or SSL Proxy Load Balancers) terminate TCP connections and substitute source IPs unless HTTP headers or PROXY protocol are supported. An External Passthrough Network Load Balancer directly routes packets to backends while preserving original IP headers.
2
Analyze the networking boundary and protocol requirements for the internal workload.
The internal workload requires low-latency, high-throughput RPC over TCP between Compute Engine instances inside the VPC.
An Internal Passthrough Network Load Balancer provides private, regional Layer 4 load balancing natively within GCP VPC networks.
3
Verify service compatibility for Cloud CDN and L7 proxies against the requirements.
Reject options utilizing Layer 7 proxies or Cloud CDN for non-HTTP raw TCP and internal Layer 4 traffic.
Cloud CDN and Application Load Balancers operate strictly at Layer 7 (HTTP/HTTPS).

Key Concept

GCP Network Load Balancer Selection Matrix based on Layer 4 vs Layer 7, Public vs Internal scope, and client IP preservation.
Question 577Question →

A DevOps team manages a Cloud Storage bucket named `financial-reports-repository` that receives daily transaction exports. To comply with cost optimization guidelines, all objects in the bucket must automatically transition to Nearline storage after 30 days of creation. A cloud engineer has authored a local JSON lifecycle configuration file named `lifecycle-policy.json`. Which command should the engineer execute to apply this lifecycle policy to the existing bucket?

Show answer & explanation

Answer: gcloud storage buckets update gs://financial-reports-repository --lifecycle-file=lifecycle-policy.json

Answer

To configure a lifecycle policy on an existing Google Cloud Storage bucket using current Google Cloud CLI best practices, run `gcloud storage buckets update gs://[BUCKET_NAME] --lifecycle-file=[FILENAME]`.
Applying a lifecycle configuration file to an existing Cloud Storage bucket requires using `gcloud storage buckets update` paired with the `--lifecycle-file` flag. This correctly updates the bucket-level metadata according to Google Cloud CLI standards.

Step-by-Step Solution

1
Identify the proper Google Cloud CLI surface for Cloud Storage management.
The current standard CLI interface is `gcloud storage` rather than legacy `gsutil` utilities.
Google Cloud recommends `gcloud storage` for performance and integration consistency across GCP management tasks.
2
Select the correct resource target and operation subcommand.
The target is an existing bucket, so the resource group is `buckets` and the action is `update`.
Lifecycle rules are bucket-level configurations and cannot be assigned per object or created on pre-existing buckets with creation flags.
3
Attach the lifecycle rule file using the appropriate flag.
Pass `--lifecycle-file=lifecycle-policy.json` to the update command.
The `--lifecycle-file` flag reads the local JSON rules file and updates the bucket's lifecycle metadata.

Key Concept

Applying Cloud Storage bucket lifecycle configurations via `gcloud storage`
Question 578Question →

A lead developer at a logistics firm needs to administer workloads on a newly deployed Google Kubernetes Engine (GKE) Autopilot cluster named `logistics-tracking-prod` in the `europe-west1` region. Although the developer has authenticated to Google Cloud via `gcloud auth login`, running `kubectl get pods` fails with an error indicating that the connection to `localhost:8080` was refused. Which `gcloud` command must the developer execute to update local cluster credentials and enable `kubectl` management?

Show answer & explanation

Answer: gcloud container clusters get-credentials logistics-tracking-prod --region europe-west1

Answer

Execute `gcloud container clusters get-credentials logistics-tracking-prod --region europe-west1` to write cluster credentials and endpoint details into the local `kubeconfig` file.
Running the command `gcloud container clusters get-credentials logistics-tracking-prod --region europe-west1` fetches the endpoint details and security credentials for the GKE cluster and writes them into the local user's `kubeconfig` file, allowing `kubectl` commands to correctly locate and authenticate with the remote control plane.

Step-by-Step Solution

1
Identify the cause of the `localhost:8080` connection failure
The `kubectl` CLI utility defaults to `localhost:8080` when no valid cluster context is configured in `~/.kube/config`.
Authenticating with `gcloud auth login` establishes GCP user credentials but does not automatically populate Kubernetes cluster endpoints in `kubeconfig`.
2
Fetch the GKE cluster credentials using the `gcloud container` component
Running `gcloud container clusters get-credentials logistics-tracking-prod --region europe-west1` retrieves cluster keys and API endpoint information.
This populates the local `kubeconfig` entry and updates the active `kubectl` context to target the GKE cluster in `europe-west1`.
3
Verify cluster connectivity
`kubectl get pods` successfully sends requests to the GKE control plane API server.
The local client now contains valid tokens and the server URL needed for Kubernetes API communication.

Key Concept

Configuring local kubectl context for GKE clusters using gcloud get-credentials
Estimated Time:1m 30s
Question 579Question →

A cloud engineer needs to deploy a new custom Virtual Private Cloud (VPC) network, provision a regional subnet, and enforce ingress traffic security for a specific web server instance using network tags. Arrange the following deployment steps in the correct order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order is to first create the custom-mode VPC network, then provision the regional subnet with an IP range, followed by creating the target-tagged ingress firewall rule in the VPC, and finally assigning the network tag to the Compute Engine VM instance.
In Google Cloud networking, resource creation follows a strict parent-to-child structural dependency. The custom VPC network must be created first because subnets and firewall rules are child resources of the VPC. The regional subnet defines the IP space, while the firewall rule defines access controls within that network. Finally, attaching the network tag to the virtual machine enables the matching firewall rule for that instance.

Step-by-Step Solution

1
Create the custom VPC network container
An empty custom VPC network is established without default automatic subnets.
Google Cloud infrastructure resources such as subnets and firewall rules depend on a parent VPC network object.
2
Create a regional subnet with a CIDR range
A explicit IP address block is allocated in a specific region within the custom VPC network.
Compute instances require a subnet within a specific region to allocate internal IP addresses.
3
Define a firewall rule targeting a specific network tag
The VPC network registers an ingress filtering rule configured to allow traffic for instances carrying the target tag.
Firewall rules belong to the VPC network level and must be defined before instance tag matching takes effect.
4
Assign the network tag to the target VM instance
The firewall rule dynamically applies ingress filtering to the virtual machine instance.
Network tags on Compute Engine instances trigger matching VPC firewall rules.

Key Concept

Provisioning Custom VPC Networks, Subnets, and Tag-Based Firewall Rules
Estimated Time:1m 0s
Question 580Question →

A cloud engineer at a smart precision agriculture startup needs to delegate project billing administration to a newly hired team lead. The team lead must be able to link newly created Google Cloud projects to the company's central Billing Account and unlink projects when necessary, following the principle of least privilege. The team lead should not have permission to modify billing account payment methods or manage overall billing account access. Which combination of Identity and Access Management (IAM) roles provides the minimum necessary permissions?

Show answer & explanation

Answer: Billing Account User role on the Billing Account and Project Billing Manager role on the target projects

Answer

Granting the Billing Account User role on the Billing Account combined with the Project Billing Manager role on the target projects provides the exact minimum required permissions.
Linking a Google Cloud project to a Billing Account requires permissions on both sides of the relationship. On the Billing Account side, the Billing Account User role allows an identity to associate projects with that billing account. On the Project side, the Project Billing Manager role allows an identity to link or unlink the project from a billing account. This combination satisfies the requirement under the principle of least privilege.

Step-by-Step Solution

1
Identify the permissions needed on the Billing Account
The user requires permission to associate projects with the central billing account, which is granted by the Billing Account User role (roles/billing.user).
Linking a project requires explicit authorization on the billing account side.
2
Identify the permissions needed on the Project level
The user requires permission to attach or detach billing on the specific projects, which is granted by the Project Billing Manager role (roles/resourcemanager.projectBillingManager).
Modifying project billing state requires billing permissions on the project resource itself.
3
Evaluate against the principle of least privilege
Combining roles/billing.user on the Billing Account and roles/resourcemanager.projectBillingManager on the projects grants sufficient privilege without administrative access to payment settings or general project resource management.
Predefined targeted roles should always be preferred over primitive roles (Owner/Editor) or administrative roles.

Key Concept

Two-Sided Permission Requirement for Project Billing Association
PreviousPage 29 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin