Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 601Question →

You need to deploy a Global External Application Load Balancer in Google Cloud using gcloud commands to serve a web application. What is the correct sequence of steps to configure the load balancer components from the back end to the front end?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct deployment sequence from back end to front end is: 1) Create the instance group containing backend VMs, 2) Create a health check and backend service referencing the instance group, 3) Create a URL map referencing the backend service, and 4) Create the target proxy and global forwarding rule for frontend traffic entry.
Google Cloud HTTP(S) load balancers require a bottom-up deployment dependency order. First, backend instances must be grouped into an instance group. Second, a health check and backend service must be created. Third, a URL map is created to route traffic to the backend service. Finally, a target HTTP proxy and global forwarding rule are created to provide the external IP frontend.

Step-by-Step Solution

1
Provision backend Compute Engine instances and group them into an Instance Group.
Backend compute capacity is established.
Traffic destinations must exist prior to configuring load balancing routing components.
2
Create an HTTP health check and define a backend service linking the health check and instance group.
Backend service is ready to handle health verification and traffic routing.
Backend services manage health probes and balancing algorithms for target instance groups.
3
Create a URL map specifying the default backend service.
Routing configuration mapping requests to backend services is created.
Target proxies require a URL map to determine where incoming HTTP requests should be routed.
4
Create a target HTTP proxy referencing the URL map and attach a global forwarding rule.
Frontend configuration is complete and listening for external requests.
The forwarding rule receives external IP traffic and hands it off to the target proxy, completing the chain.

Key Concept

Global External Application Load Balancer Architecture and Dependency Order
Question 602Question →

An enterprise security architecture team requires all Compute Engine VM instances provisioned for a mission-critical web backend to use fine-grained IAM authorization. The instances must run under a custom IAM service account named `[email protected]` with restricted Cloud Pub/Sub permissions, and they must automatically run a bootstrapping script located at a private Cloud Storage path (`gs://config-bucket-prod/startup.sh`) during initialization. Which `gcloud` CLI command correctly creates an instance template meeting these security and operational requirements?

Show answer & explanation

Answer: gcloud compute instance-templates create backend-template --service-account=backend-service-sa@prod-proj.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/cloud-platform --metadata=startup-script-url=gs://config-bucket-prod/startup.sh

Answer

The command specifying `--service-account=backend-service-sa@prod-proj.iam.gserviceaccount.com`, `--scopes=https://www.googleapis.com/auth/cloud-platform`, and `--metadata=startup-script-url=gs://config-bucket-prod/startup.sh` correctly provisions the instance template according to Google Cloud security and CLI best practices.
The command configuring `--service-account` with the custom identity, setting the scope to `cloud-platform`, and defining `--metadata=startup-script-url=gs://...` follows all Google Cloud recommended practices. Setting the access scope to `cloud-platform` allows IAM roles attached to the custom service account to grant fine-grained permissions without being restricted by legacy OAuth access scope boundaries, while `startup-script-url` ensures Compute Engine correctly fetches the initialization script from Cloud Storage.

Step-by-Step Solution

1
Identify the service account configuration requirement
Using `--service-account` attaches the custom IAM service account to enforce least privilege, paired with the standard `https://www.googleapis.com/auth/cloud-platform` scope so IAM permissions dictate actual API access.
Relying on the default Compute Engine service account grants overly broad Editor roles, while scoping to `cloud-platform` delegates all authorization decisions to IAM policies on the custom service account.
2
Identify the correct metadata key for remote startup scripts
The `startup-script-url` metadata key must be used when referencing a Cloud Storage bucket location (`gs://...`).
The standard `startup-script` key is designated for direct inline bash scripts, whereas `startup-script-url` fetches and executes scripts stored in remote Cloud Storage buckets.
3
Evaluate workload suitability for VM provisioning models
Standard provisioning must be used rather than Spot/Preemptible VMs.
Mission-critical web application backends require uninterrupted availability, making Spot VMs (which can be terminated by Compute Engine at any time) inappropriate.

Key Concept

Configuring Compute Engine Instance Templates with custom IAM Service Accounts and Startup Script URIs via gcloud CLI
Question 603Question →

A cloud engineer needs to launch a Compute Engine VM instance named `app-server` into a custom Virtual Private Cloud subnet named `backend-subnet`. Which `gcloud compute instances create` command flag must be used to place the VM directly into this target subnet?

Show answer & explanation

Answer: --subnet=backend-subnet

Answer

Use the `--subnet=backend-subnet` flag with `gcloud compute instances create` to deploy the virtual machine into a specific VPC subnet.
The `--subnet` flag in `gcloud compute instances create` specifies the subnetwork to which the primary network interface of the new VM instance should be attached.

Step-by-Step Solution

1
Identify the target resource requirement from the prompt.
The requirement specifies deploying a Compute Engine VM into a custom VPC subnet named `backend-subnet`.
When creating virtual machines in non-default VPC networks, the network interface must be explicitly bound to the intended subnet.
2
Evaluate the Google Cloud CLI (`gcloud compute instances create`) flag syntax.
The standard flag to specify a subnetwork for the instance is `--subnet` (or `--subnet=SUBNET_NAME`).
Using correct command-line flags ensures the instance network interface attaches to the specified subnet during creation.

Key Concept

Compute Engine VM Networking Flags in gcloud CLI
Question 604Question →

You are deploying a Global External HTTP Load Balancer using the gcloud CLI to distribute web application traffic across Compute Engine instance groups in multiple regions. Place the deployment steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of deployment steps is: 1) Create a global HTTP health check, 2) Create a global backend service and attach the health check and instance groups, 3) Create a URL map referencing the backend service, 4) Create a target HTTP proxy pointing to the URL map, and 5) Create a global forwarding rule pointing to the target HTTP proxy.
In GCP, load balancer components rely on direct dependency references. You must first create the health monitoring mechanism (health check) and backend pool configuration (backend service), followed by request routing logic (URL map), HTTP protocol processing (target HTTP proxy), and finally the public network listener (global forwarding rule).

Step-by-Step Solution

1
Create the Health Check
A global health check resource is created.
Backend services require a valid health check reference upon creation to monitor backend pool health.
2
Create the Backend Service and add Backends
The global backend service is provisioned with attached Compute Engine managed instance groups.
Backend services aggregate instances and define traffic distribution policies.
3
Create the URL Map
A URL map object is created specifying the default backend service.
URL maps route HTTP requests to specific backend services based on path rules.
4
Create the Target HTTP Proxy
A target proxy resource is provisioned linking to the URL map.
The target proxy evaluates incoming HTTP headers against the URL map rules.
5
Create the Global Forwarding Rule
An external IP and port listener are configured as the load balancer frontend.
The forwarding rule routes incoming client traffic on the frontend IP address to the target proxy.

Key Concept

Deploying a Global External HTTP Load Balancer in Google Cloud follows a bottom-up dependency hierarchy: Health Check → Backend Service → URL Map → Target Proxy → Global Forwarding Rule.
Question 605Question →

An architect is using the Google Cloud Pricing Calculator to project the monthly operational expense for a reporting server hosted on Compute Engine. The workload requires a single custom VM running 730730 hours per month with a base un-discounted rate of $0.20\$0.20 per hour. The organization purchases a 1-year Committed Use Discount (CUD) for this compute instance, which grants a 37%37\% discount on the instance compute costs. Additionally, the instance uses 250 GB250\text{ GB} of Standard Persistent Disk storage priced at $0.04\$0.04 per GB per month, and generates 500 GB500\text{ GB} of internet egress data per month priced at $0.12\$0.12 per GB. What is the total estimated monthly cost in USD for this workload using the Pricing Calculator?

Show answer & explanation

Answer: 161.98

Answer

The total estimated monthly cost for the workload using the Pricing Calculator is $161.98.
The correct total monthly estimate is 161.98.Computecostswithoutdiscountsequal730hours∗161.98. Compute costs without discounts equal 730 hours * 0.20 = 146.00.Applyingthe37146.00. Applying the 37% Committed Use Discount reduces compute costs to 146.00 * 0.63 = 91.98.Adding91.98. Adding 10.00 for Persistent Disk storage (250 GB * 0.04)and0.04) and 60.00 for network egress (500 GB * 0.12)yields0.12) yields 161.98.

Step-by-Step Solution

1
Calculate un-discounted monthly VM compute cost
730 hours * 0.20/hour=0.20/hour = 146.00
Compute Engine base cost is determined by multiplying total monthly running hours by the hourly rate.
2
Apply 1-year Committed Use Discount (CUD) to compute cost
146.00∗(1−0.37)=146.00 * (1 - 0.37) = 91.98
CUDs apply a percentage discount exclusively to baseline compute resource usage.
3
Calculate Standard Persistent Disk storage cost
250 GB * 0.04/GB=0.04/GB = 10.00
Storage pricing is flat per GB-month and does not receive CUD compute discounts.
4
Calculate network egress cost
500 GB * 0.12/GB=0.12/GB = 60.00
Egress data transfer is billed per GB based on destination rates.
5
Calculate total monthly cost estimate
91.98+91.98 + 10.00 + 60.00=60.00 = 161.98
The final monthly cost in the Pricing Calculator aggregates discounted compute costs with non-discounted storage and network fees.

Key Concept

Estimating GCP Costs with Committed Use Discounts, Storage, and Egress in the Pricing Calculator
Estimated Time:1m 30s
Question 606Question →

A healthcare telemetry pipeline requires a new Cloud Storage bucket named `patient-telemetry-us-central1-2026` in the `us-central1` region to ingest real-time patient monitoring logs. Security governance dictates that Uniform Bucket-Level Access (UBLA) must be enforced to manage access strictly via IAM roles. Additionally, data management policies require transitioning objects to Nearline storage after 30 days and deleting them after 365 days using an automated configuration file (`lifecycle.json`). Which command sequence using Google Cloud's primary CLI tool correctly accomplishes this deployment according to Google Cloud best practices?

Show answer & explanation

Answer: Execute `gcloud storage buckets create gs://patient-telemetry-us-central1-2026 --location=us-central1 --uniform-bucket-level-access` and then apply the rules with `gcloud storage buckets update gs://patient-telemetry-us-central1-2026 --lifecycle-file=lifecycle.json`.

Answer

Execute `gcloud storage buckets create gs://patient-telemetry-us-central1-2026 --location=us-central1 --uniform-bucket-level-access` and then apply the rules with `gcloud storage buckets update gs://patient-telemetry-us-central1-2026 --lifecycle-file=lifecycle.json`.
The correct approach uses `gcloud storage buckets create` with the `--uniform-bucket-level-access` flag to enforce IAM-only access control, and follows up with `gcloud storage buckets update --lifecycle-file` to attach the JSON lifecycle policy document. This follows current Google Cloud CLI best practices.

Step-by-Step Solution

1
Create the bucket with UBLA enabled using `gcloud storage`
Bucket `gs://patient-telemetry-us-central1-2026` is created in `us-central1` with Uniform Bucket-Level Access enforced.
Google Cloud recommends using the `gcloud storage` CLI surface over legacy `gsutil`. The `--uniform-bucket-level-access` flag disables ACLs and unifies access management under IAM.
2
Update the bucket's lifecycle policy
The configuration in `lifecycle.json` is attached to the bucket.
The `gcloud storage buckets update` command with `--lifecycle-file` applies automated object state transitions (Standard to Nearline after 30 days and deletion after 365 days).

Key Concept

Deploying Cloud Storage buckets with Uniform Bucket-Level Access and applying lifecycle management using gcloud storage CLI.
Question 607Question →

An enterprise organization is planning a Google Cloud Virtual Private Cloud (VPC) network architecture to connect an on-premises data center using the IPv4 range 10.100.0.0/1610.100.0.0/16 to GCP via Cloud VPN. The cloud deployment will span two regions (`us-central1` and `europe-west1`) and will host Google Kubernetes Engine (GKE) clusters. Which TWO network design practices should the cloud engineer follow to prevent IP address collisions and maintain flexible network expansion? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a Custom mode VPC network instead of an Auto mode VPC network to manually define non-overlapping subnet CIDR blocks.; Ensure secondary IP ranges allocated for GKE pods and services do not overlap with any on-premises CIDR ranges.

Answer

The cloud engineer must create a Custom mode VPC network to explicitly control subnet allocation and ensure that GKE secondary IP ranges do not overlap with on-premises CIDRs.
The correct responses identify key VPC planning requirements for hybrid enterprise networks. Using Custom mode VPC networks ensures that subnets are only created where needed with user-defined CIDR blocks, preventing automated creation of overlapping ranges. Additionally, accounting for GKE secondary IP ranges (used for Pods and Services) is necessary because these IP ranges must remain unique across both the GCP VPC and connected on-premises networks to avoid routing collisions.

Step-by-Step Solution

1
Evaluate VPC mode selection for hybrid enterprise deployment
Auto mode VPCs automatically provision subnets across all regions using predefined ranges, which increases collision risk with on-premises CIDRs. Custom mode allows precise IP planning.
Enterprise hybrid setups require strict management of IP address space to prevent route advertisement collisions over Cloud VPN.
2
Analyze GKE network requirements for secondary IP ranges
GKE VPC-native clusters require secondary IPv4 ranges for Pods and Services. These ranges are routable within the network.
If secondary IP ranges overlap with on-premises IP space, hybrid traffic to/from on-premises systems or pods will fail due to conflicting routes.

Key Concept

VPC Network Planning and Hybrid Subnet Allocation
Question 608Question →

An organization is preparing to migrate an enterprise application stack to Google Cloud and needs to model monthly infrastructure expenses using the Google Cloud Pricing Calculator. The target architecture includes a continuous 24/7 web application backend with predictable resource demand, along with a separate stateless batch data processing job that is fault-tolerant. Which of the following configuration options in the Pricing Calculator should be selected to accurately model valid cost-reduction strategies for these workloads? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Apply Committed Use Discounts (CUDs) for the steady-state 24/7 application backend virtual machines.; Model the stateless, fault-tolerant batch processing compute instances as Spot VMs.

Answer

The correct selections are applying Committed Use Discounts for the steady-state 24/7 backend virtual machines and modeling the stateless fault-tolerant batch processing instances as Spot VMs.
Applying Committed Use Discounts (CUDs) for predictable 24/7 compute capacity provides significant cost reductions on baseline infrastructure. Additionally, leveraging Spot VMs for stateless, fault-tolerant batch workloads drastically reduces compute pricing because the workload can recover if instances are preempted by Google Cloud.

Step-by-Step Solution

1
Analyze steady-state compute requirements for continuous 24/7 workloads.
Identified that steady-state compute running continuously is eligible for 1-year or 3-year Committed Use Discounts in the Pricing Calculator.
CUDs lower hourly compute costs significantly for predictable, baseline resource commitments.
2
Analyze batch processing requirements for fault-tolerant workloads.
Identified that stateless, fault-tolerant workloads can utilize Spot VMs in the Pricing Calculator.
Spot VMs offer substantial cost savings for workloads capable of handling instance interruptions.
3
Evaluate storage and container management options against cost trade-offs.
Rejected Coldline storage for active daily data and GKE Standard for zero-node management requirements.
High retrieval fees penalty applies to Coldline when frequently accessed, and GKE Standard retains node management responsibility.

Key Concept

Pricing Calculator Discount Modeling (CUDs and Spot VMs)
Estimated Time:1m 30s
Question 609Question →

An organization manages several Google Cloud projects linked to a single central Cloud Billing account. To perform historical spend analysis using SQL, the lead engineer creates a dedicated project named `corp-billing-analytics` intended to host the billing dataset. The engineer needs to configure a detailed daily Cloud Billing export to BigQuery while following the principle of least privilege.

Which configuration strategy correctly enables the Cloud Billing export to the target dataset?

Show answer & explanation

Answer: Enable the BigQuery API in `corp-billing-analytics`, create a dataset in `corp-billing-analytics`, and ensure the configuring user holds both the Billing Account Costs Manager role on the Cloud Billing account and BigQuery Data Editor access on the destination project/dataset.

Answer

Enable the BigQuery API in `corp-billing-analytics`, create a dataset in `corp-billing-analytics`, and ensure the configuring user holds both the Billing Account Costs Manager role on the Cloud Billing account and BigQuery Data Editor access on the destination project/dataset.
The correct strategy requires enabling the BigQuery API within the destination project `corp-billing-analytics` and creating a target dataset. Because Cloud Billing export spans both the billing account and the target project, the user setting up the export must hold a billing role (Billing Account Costs Manager or Billing Account Administrator) on the billing account, and dataset write access (BigQuery Data Editor or Admin) in the destination project.

Step-by-Step Solution

1
Identify API and dataset hosting requirements
The BigQuery API must be enabled inside the destination project `corp-billing-analytics`, and a BigQuery dataset must be created to receive the export records.
Cloud Billing export streams daily cost estimates directly into a user-specified BigQuery dataset within a target project.
2
Determine IAM permissions across both resource boundaries
The engineer requires Billing Account Costs Manager (or Billing Account Administrator) on the billing account, as well as BigQuery Data Editor (or BigQuery Admin) on the target project/dataset.
Setting up exports crosses two IAM permission domains: reading billing metadata from the Cloud Billing Account and writing tables into the BigQuery dataset.

Key Concept

Cloud Billing BigQuery Export Requirements and Dual-Boundary IAM Permissions
Question 610Question →

An IoT enterprise is designing a Google Cloud network architecture for a global fleet of connected sensors. The architecture has two primary requirements:
1. Ingest high-volume, non-HTTP raw TCP telemetry traffic from public internet clients globally, terminating TLS encryption at the Google network edge before forwarding traffic to Compute Engine backends.
2. Provide private domain name resolution for administrative microservices communicating between two peered Virtual Private Cloud (VPC) networks without exposing record sets to the public internet.

Which TWO configurations should the cloud architecture team implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy a Global External Proxy Network Load Balancer to terminate incoming TLS sessions at the edge and proxy the raw TCP connection to backend Compute Engine instances.; Create a Cloud DNS Private Zone associated with the primary VPC network and add the peered VPC network to the zone's authorized networks list.

Answer

The team must deploy a Global External Proxy Network Load Balancer for terminating edge TLS on raw non-HTTP TCP telemetry, and create a Cloud DNS Private Zone authorized for both peered VPC networks.
Deploying a Global External Proxy Network Load Balancer fulfills the necessity for edge-terminated TLS on non-HTTP raw TCP streams. Simultaneously, creating a Cloud DNS Private Zone and authorizing both peered VPC networks grants microservices secure, internal-only name resolution without exposing infrastructure details publicly.

Step-by-Step Solution

1
Evaluate load balancing requirements for non-HTTP raw TCP traffic with edge TLS termination.
Identify that Layer 7 HTTP(S) load balancers are unsuitable for non-HTTP traffic, requiring a Layer 4 Global External Proxy Network Load Balancer (or SSL Proxy Load Balancer) to offload TLS at Google edge locations.
Proxy network load balancers enable raw TCP proxying with optional TLS termination at the edge, whereas HTTP(S) load balancers require HTTP/HTTPS protocol formatting.
2
Evaluate internal domain resolution requirements across peered VPC networks.
Create a Cloud DNS Private Zone assigned to the primary VPC and explicitly authorize the peered VPC network to query the zone.
Cloud DNS Private Zones isolate DNS resolution within specified VPC networks so that internal records are completely invisible to external internet DNS queries.

Key Concept

Matching Google Cloud load balancer types to application layer protocols (L4 proxy vs L7 HTTP) and implementing Cloud DNS Private Zones for cross-VPC internal resolution.
Question 611Question →

A media production company ingests raw high-definition footage into Google Cloud Storage for daily video editing. Editors frequently read and modify the video files during the first 30 days after ingestion. Between day 31 and day 365, the footage is accessed infrequently (typically once per quarter) for producing retrospective highlight reels, but must remain available immediately with millisecond latency when requested. After 365 days, the footage is no longer required and should be permanently removed. Which Cloud Storage lifecycle configuration minimizes total costs while satisfying these operational access requirements?

Show answer & explanation

Answer: Create a bucket with the default storage class set to Standard. Configure an Object Lifecycle Management rule to transition objects to Coldline storage after 30 days, and a second rule to delete objects after 365 days.

Answer

Create a bucket with the default storage class set to Standard. Configure an Object Lifecycle Management rule to transition objects to Coldline storage after 30 days, and a second rule to delete objects after 365 days.
Starting with Standard storage ensures zero retrieval charges during the intensive 30-day editing period. Coldline storage ideal for quarterly access patterns (once every 90 days), offering low storage costs while maintaining immediate millisecond access latency. Deleting after 365 days automates resource cleanup.

Step-by-Step Solution

1
Analyze initial data access frequency
Files are accessed frequently for 30 days, requiring Standard storage class to avoid data retrieval charges.
Nearline, Coldline, and Archive classes charge retrieval fees per gigabyte, making them expensive for frequently accessed active workloads.
2
Evaluate secondary access frequency and SLAs
Files accessed once per quarter after 30 days fit Coldline storage parameters.
Coldline storage is optimized for data accessed at most once every 90 days (quarterly) while still providing immediate millisecond access without retrieval delays.
3
Define lifecycle retention limits
Configure a deletion rule for objects reaching 365 days of age.
Automating object deletion after 1 year prevents paying unnecessary ongoing storage fees for unneeded video rushes.

Key Concept

Google Cloud Storage class selection and Object Lifecycle Management cost optimization based on access frequency and retrieval fees
Question 612Question →

An operations engineer requires permissions to restart and reset existing Compute Engine instances in a staging project after automated tests complete. The engineer must not be allowed to create new VM instances, delete persistent disks, or modify Virtual Private Cloud (VPC) network configurations. Which IAM role assignment complies with Google Cloud's principle of least privilege?

Show answer & explanation

Answer: Grant the Compute Operator (roles/compute.operator) role to the engineer at the project level.

Answer

Granting the Compute Operator (roles/compute.operator) role at the project level provides the precise permissions needed to reboot and reset VM instances while withholding instance creation, deletion, and networking administrative privileges.
The Compute Operator (roles/compute.operator) role grants permission to manage the state of Compute Engine instances (such as starting, stopping, and resetting them) without allowing users to create new instances, delete persistent disks, or reconfigure networking resources. This aligns directly with the principle of least privilege.

Step-by-Step Solution

1
Analyze the operational requirements
The target role must allow state management (start, stop, reset) of Compute Engine VMs but prohibit creation or deletion of infrastructure.
Least privilege requires granting only the minimum set of permissions necessary to perform specified tasks.
2
Evaluate role scope and access control types
Primitive roles (Editor) and full admin roles (Compute Admin) provide unnecessary permissions such as creating VMs, modifying network settings, or deleting disks.
Google Cloud best practices dictate choosing targeted predefined roles over broad primitive or administrative roles.
3
Select the correct predefined IAM role
The Compute Operator role (roles/compute.operator) is designed specifically for VM instance operational management without infrastructure provisioning rights.
This role satisfies all operational constraints while adhering strictly to Google Cloud security recommendations.

Key Concept

Selecting predefined IAM roles to enforce least privilege for Compute Engine lifecycle management
Estimated Time:1m 30s
Question 613Question →

A network administrator needs to expand the primary IPv4 address range of an existing custom-mode VPC subnet in Google Cloud from 10.1.0.0/2410.1.0.0/24 to 10.1.0.0/2310.1.0.0/23 without creating IP conflicts or interrupting active virtual machines. In what chronological order should the administrator execute the following steps to ensure a successful and non-disruptive range expansion?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with auditing adjacent networks for IP overlaps (10.1.0.0/2310.1.0.0/23), confirming that the requested CIDR expansion fully encloses the existing subnet range with a smaller netmask prefix, running the gcloud compute networks subnets expand-ip-range command, and finally verifying the updated subnet CIDR configuration.
Expanding a primary IPv4 range in GCP requires verifying non-overlapping address space across interconnected networks before making changes, confirming that the new prefix encloses the old range (e.g., expanding from /24/24 to /23/23), executing the gcloud compute networks subnets expand-ip-range command, and verifying the change upon completion.

Step-by-Step Solution

1
Audit connected networks for IP conflicts
Ensures 10.1.0.0/2310.1.0.0/23 is completely clear across on-premises and peered networks.
Expanding a subnet into an already used range will cause routing issues and break VPC peering or hybrid interconnects.
2
Validate subnet mask enclosing constraints
Confirms the expansion adheres to GCP VPC subnet expansion constraints.
Google Cloud VPC subnets can only be expanded to a larger range (smaller prefix length) that encloses the original range.
3
Execute the expansion command using gcloud CLI
Modifies the subnet configuration non-disruptively in GCP.
The expand-ip-range command performs an in-place range expansion without requiring VM re-creation.
4
Verify updated subnet properties
Confirms successful expansion to 10.1.0.0/2310.1.0.0/23.
Post-implementation validation guarantees that the network resource state matches expected architecture requirements.

Key Concept

Subnet IP range expansion procedures and constraints in GCP Custom Mode VPCs
Question 614Question →

An engineer wants to deploy a new microservice to Google Cloud Run directly from source code using the gcloud CLI. Arrange the following steps in the correct chronological sequence required to execute this deployment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for deploying a Cloud Run service from source code is: 1) Enable Cloud Run and Cloud Build APIs, 2) Set the active GCP project context using `gcloud config set project`, 3) Run `gcloud run deploy SERVICE_NAME --source .` from the source root, and 4) Select the region and configure access permissions.
The correct deployment sequence starts with enabling the necessary service APIs (Cloud Run and Cloud Build). Next, the developer sets the target active project using `gcloud config set project`. Then, running `gcloud run deploy --source .` builds the container image and initiates deployment. Finally, configuring the deployment region and ingress permissions completes the service initialization.

Step-by-Step Solution

1
Enable required APIs
Cloud Run and Cloud Build services are active and ready to accept calls.
Deploying from source requires Cloud Build to build the container image and Cloud Run to host it.
2
Configure gcloud project property
The CLI is targeted at the intended GCP project.
Prevents deploying resources into an incorrect default project.
3
Initiate source-based deployment
Source code upload and container build pipeline are triggered.
The `--source .` flag instructs Cloud Run to use Cloud Build automatically.
4
Configure deployment options
Service is deployed to the chosen region with desired authentication settings.
Final runtime parameters are set to establish endpoint accessibility.

Key Concept

Deploying Cloud Run Services from Source Code using gcloud CLI
Question 615Question →

A financial analytics company needs to configure an existing Cloud Storage bucket named `fin-transactions-cold-2026` located in `europe-west3` to hold archived transaction logs for compliance. The compliance policy mandates that objects must be locked for a retention duration of 7 years (220,752,000220,752,000 seconds) and per-object Access Control Lists (ACLs) must be completely disabled to enforce unified Access Control through IAM roles across the bucket. Which `gcloud storage` command correctly applies both the 7-year retention policy and enforces uniform bucket-level access?

Show answer & explanation

Answer: gcloud storage buckets update gs://fin-transactions-cold-2026 --retention-period=220752000s --uniform-bucket-level-access

Answer

The command 'gcloud storage buckets update gs://fin-transactions-cold-2026 --retention-period=220752000s --uniform-bucket-level-access' correctly configures both compliance locking and bucket-level security controls.
The correct command utilizes `gcloud storage buckets update` to simultaneously configure the retention period (220,752,000220,752,000 seconds, corresponding to 7 years) and enable `--uniform-bucket-level-access`. This enforces compliance locking and ensures object access is governed strictly by IAM roles rather than legacy object ACLs.

Step-by-Step Solution

1
Identify the target resource and configuration scope
The target is an existing Cloud Storage bucket requiring bucket-level policy flags rather than object-level edits.
Retention policies and access control boundaries (Uniform Bucket-Level Access) are defined at the bucket resource layer.
2
Determine the correct CLI utility and flag parameter for object retention
Use `--retention-period=220752000s` with `gcloud storage buckets update`.
Google Cloud CLI requires retention durations to be specified using standard duration suffixes (such as seconds 's').
3
Determine the correct flag parameter for disabling ACLs
Include `--uniform-bucket-level-access` in the update command.
Enabling Uniform Bucket-Level Access disables per-object ACLs and ensures IAM policies exclusively manage permissions.

Key Concept

Cloud Storage Bucket Configuration and Security Policies via gcloud storage CLI
Estimated Time:2m 0s
Question 616Question →

A financial startup wants to enforce programmatic cost control for a non-critical development project. If the monthly project expenses cross $5,000, running Compute Engine virtual machine instances in that project must be automatically shut down to prevent unexpected charges. Which Google Cloud solution correctly satisfies this operational requirement?

Show answer & explanation

Answer: Configure a Cloud Billing budget threshold rule, publish programmatic notifications to a Cloud Pub/Sub topic, and deploy a Cloud Function subscribed to that topic that calls the Compute Engine API to stop running instances.

Answer

Configure a Cloud Billing budget threshold rule, publish programmatic notifications to a Cloud Pub/Sub topic, and deploy a Cloud Function subscribed to that topic that calls the Compute Engine API to stop running instances.
Google Cloud Billing budget alerts do not restrict or stop resource usage by default. To enforce automated actions (such as stopping Compute Engine VM instances when cost thresholds are breached), you must configure the budget to send programmatic notifications to a Cloud Pub/Sub topic and use a serverless component (like Cloud Functions or Cloud Run) to parse the notification and invoke the Compute Engine API to stop instances.

Step-by-Step Solution

1
Create a budget and define threshold rules in Cloud Billing.
A budget alert is generated whenever project expenditures reach the specified percentage or fixed amount ($5,000).
Budgets track current spending against defined cost ceilings.
2
Link the budget to a Cloud Pub/Sub topic under programmatic notification settings.
Billing notification payloads are published to the specified Pub/Sub topic upon reaching threshold events.
Pub/Sub allows downstream serverless components to receive billing alert events automatically.
3
Create a Cloud Function triggered by the Pub/Sub topic to execute the Compute Engine API instance stopping code.
Running instances in the target project are programmatically stopped when the budget threshold message is processed.
Billing alerts are purely informative and require custom code/serverless functions to enforce automated resource capping.

Key Concept

Cloud Billing Budgets and Automated Remediation via Pub/Sub
Question 617Question →

A cloud engineering team is designing the storage architecture for two microservices deployed on Google Cloud Compute Engine:

1. An Event Analytics service requiring sub-10 millisecond latency for massive write-heavy time-series and key-value data ingestion.
2. An Order Processing service requiring a relational schema, full ACID transaction support, standard SQL querying, and regional high availability.

Which TWO database configurations should the team select to meet these requirements while adhering to Google Cloud best practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Cloud Bigtable for the Event Analytics service to handle high-throughput NoSQL key-value and time-series data.; Deploy Cloud SQL with regional High Availability (HA) enabled for the Order Processing service.

Answer

The team should deploy Cloud Bigtable for the Event Analytics service to manage high-throughput time-series data, and deploy Cloud SQL with regional High Availability for the Order Processing service to satisfy relational ACID transaction requirements.
Cloud Bigtable is ideal for high-throughput NoSQL time-series data with low latency, fulfilling the Event Analytics requirement. Cloud SQL with High Availability (HA) provides a managed relational database supporting ACID transactions and regional automatic failover, fulfilling the Order Processing requirement.

Step-by-Step Solution

1
Analyze the workload requirements for the Event Analytics service.
The workload requires sub-10ms latency and high-throughput write capabilities for time-series and key-value data.
Cloud Bigtable is Google Cloud's managed NoSQL database specifically engineered for high-volume time-series and key-value analytical data.
2
Analyze the workload requirements for the Order Processing service.
The workload requires a relational DB engine, ACID compliance, standard SQL, and regional redundancy.
Cloud SQL offers fully managed relational databases with built-in regional HA options featuring automatic primary to standby failover across zones.
3
Evaluate and eliminate incorrect database and compute choices.
Cloud Bigtable lacks relational SQL join features, and Spot VMs with Local SSD risk immediate data loss upon instance preemption.
Persistent relational workloads require durable storage options and non-preemptible VM instances or managed services.

Key Concept

Selecting GCP Database and Block Storage Solutions Based on Access Patterns and Availability Needs
Question 618Question →

A company runs a stateless web application on a Google Kubernetes Engine (GKE) Standard cluster. During peak traffic hours, incoming requests cause high CPU utilization, requiring more Pod instances. However, when additional Pods are created, several remain stuck in a Pending status because the current worker nodes have exhausted their CPU and memory capacity. Which configuration strategy should the cloud engineer implement to automatically handle scaling for both the workload Pods and the underlying cluster node capacity?

Show answer & explanation

Answer: Configure a Horizontal Pod Autoscaler (HPA) for the deployment to adjust Pod replicas based on CPU utilization, and enable Cluster Autoscaler on the GKE cluster to automatically add nodes when Pods are unschedulable.

Answer

Configure a Horizontal Pod Autoscaler (HPA) for the deployment to adjust Pod replicas based on CPU utilization, and enable Cluster Autoscaler on the GKE cluster to automatically add nodes when Pods are unschedulable.
To resolve pending Pods caused by insufficient node capacity during traffic spikes, Google Cloud recommends combining Horizontal Pod Autoscaler (HPA) for workload Pod replica scaling with GKE Cluster Autoscaler for node infrastructure scaling. HPA reacts to resource utilization by increasing Pod counts, and Cluster Autoscaler detects Pending Pods to add new compute nodes to the node pool.

Step-by-Step Solution

1
Identify workload scaling requirements
Determine that increasing traffic requires dynamic scaling of Pod replicas based on resource metrics like CPU utilization.
Horizontal Pod Autoscaler (HPA) is the standard Kubernetes resource designed to scale Pod counts automatically.
2
Identify infrastructure capacity requirements
Determine that pending Pods indicate a shortage of allocatable node CPU/memory capacity.
Cluster Autoscaler detects unschedulable Pods in a Pending state and automatically provisions additional compute nodes in the GKE node pool.
3
Combine workload and infrastructure autoscaling mechanisms
Pairing HPA with Cluster Autoscaler creates a complete auto-scaling pipeline from application demand to GKE worker nodes.
HPA scales out Pods when load increases, and Cluster Autoscaler expands node capacity if those Pods cannot fit on existing nodes.

Key Concept

GKE Workload and Cluster Autoscaling Mechanisms
Question 619Question →

Your organization is hosting a backend microservice on Compute Engine instances within a Virtual Private Cloud (VPC) network. The microservice communicates over raw TCP traffic on port 8080 and requires internal regional traffic distribution without SSL offloading or layer 7 path routing features. Which load balancer should you deploy?

Show answer & explanation

Answer: Regional Internal Network Passthrough Load Balancer

Answer

The Regional Internal Network Passthrough Load Balancer is the correct choice because it provides internal Layer 4 TCP load balancing within a GCP region.
The Regional Internal Network Passthrough Load Balancer is designed specifically for internal VPC workloads operating at Layer 4 (TCP/UDP) within a single region. It efficiently balances TCP traffic without proxy overhead.

Step-by-Step Solution

1
Identify the network scope requirement
Traffic must remain private inside the VPC within a single region (Internal regional scope).
Internal workloads should not use external load balancers.
2
Determine the protocol layer
The application uses raw TCP on port 8080 without requiring HTTP path routing or SSL offloading.
Layer 4 passthrough balancing is sufficient and optimal for raw TCP applications.
3
Select the matching GCP load balancer product
Choose a Regional Internal Network Passthrough Load Balancer.
It natively supports internal regional TCP traffic distribution.

Key Concept

Selecting GCP Load Balancers based on traffic direction (Internal vs External) and network layer (Layer 4 TCP vs Layer 7 HTTP/HTTPS).
Question 620Question →

A gaming studio's DevOps team is provisioning a new Google Cloud Storage bucket named `game-patch-assets-global` in the `us-central1` region using the modern `gcloud storage` CLI tool. The bucket will store high-volume patch updates for client distribution. The team must enforce centralized IAM access permissions across all objects while disabling legacy per-object Access Control Lists (ACLs). Additionally, they need to ensure that patch files older than 30 days automatically transition from Standard to Nearline storage to minimize ongoing storage fees. Which TWO commands or configuration steps must the team execute to fulfill these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Execute `gcloud storage buckets create gs://game-patch-assets-global --location=us-central1 --uniform-bucket-level-access` to create the bucket with unified IAM access control enabled.; Execute `gcloud storage buckets update gs://game-patch-assets-global --lifecycle-file=lifecycle.json` with a configuration specifying an `Age` condition of 30 days and a `SetStorageClass` action of `NEARLINE`.

Answer

The team must provision the bucket using `gcloud storage buckets create gs://game-patch-assets-global --location=us-central1 --uniform-bucket-level-access` and update the bucket's lifecycle policy using `gcloud storage buckets update gs://game-patch-assets-global --lifecycle-file=lifecycle.json` containing an Age condition of 30 days and a SetStorageClass action of NEARLINE.
Provisioning the Cloud Storage bucket with `gcloud storage buckets create` along with the `--uniform-bucket-level-access` flag enforces unified IAM permissions and disables object ACLs. Updating the bucket with `gcloud storage buckets update --lifecycle-file=lifecycle.json` successfully attaches the lifecycle condition to transition 30-day-old objects from Standard to Nearline storage class.

Step-by-Step Solution

1
Identify the required access control model and CLI utility.
The requirement mandates using `gcloud storage` CLI and disabling per-object ACLs in favor of centralized IAM. This requires passing the `--uniform-bucket-level-access` flag during bucket creation.
Uniform Bucket-Level Access unifies permission management under Google Cloud IAM and turns off ACL evaluation.
2
Identify the cost optimization lifecycle configuration mechanism.
To transition objects older than 30 days to Nearline storage, a JSON lifecycle rule file defining `action: { "type": "SetStorageClass", "storageClass": "NEARLINE" }` and `condition: { "age": 30 }` must be applied.
`gcloud storage buckets update` accepts `--lifecycle-file` to apply object lifecycle management specifications.

Key Concept

Deploying Cloud Storage buckets with Uniform Bucket-Level Access and applying Object Lifecycle Management rules using gcloud storage CLI.
PreviousPage 31 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin