Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 621Question →

A system administrator has deployed a private Cloud DNS zone named services.internal in a host Google Cloud Virtual Private Cloud (VPC) network named vpc-production. A separate analytics workload runs in another VPC network named vpc-analytics within the same organization. Compute Engine instances located in vpc-analytics are currently unable to resolve domain names ending in .services.internal. You need to enable domain name resolution for instances in vpc-analytics while minimizing infrastructure complexity and avoiding unnecessary DNS peering overhead. Which configuration step must be performed to meet this requirement?

Show answer & explanation

Answer: Update the existing services.internal private DNS zone configuration in Cloud DNS to add vpc-analytics to the list of authorized VPC networks.

Answer

Update the existing services.internal private DNS zone configuration in Cloud DNS to add vpc-analytics to the list of authorized VPC networks.
In Google Cloud DNS, a private DNS zone can be made accessible to multiple VPC networks by adding those networks to the zone's authorized networks list. Once authorized, instances in vpc-analytics can resolve hostnames in services.internal directly through their local metadata DNS server.

Step-by-Step Solution

1
Identify the requirement for cross-VPC private DNS resolution
Determine that instances in vpc-analytics need to resolve records managed by the private DNS zone hosted in vpc-production.
Cloud DNS private zones are restricted by default to only the VPC networks explicitly authorized during or after creation.
2
Evaluate GCP Cloud DNS multi-VPC binding capabilities
Confirm that a single private Cloud DNS zone can be authorized for multiple VPC networks across the same organization.
Direct authorization allows all VMs in the authorized VPCs to query the private zone via their local metadata server (169.254.169.254) without additional DNS forwarding or peering configurations.
3
Select the optimal configuration modification
Add vpc-analytics to the authorized networks list of the services.internal private zone.
This is the standard, simplest, and most efficient method to grant cross-VPC DNS resolution access.

Key Concept

Cloud DNS Private Zone Authorized Networks
Question 622Question →

A cloud engineer is configuring Virtual Private Cloud (VPC) networks and firewall rules for a project in Google Cloud. Which of the following statements regarding VPC subnet management and firewall rule evaluation order are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The primary IP address range of a custom mode subnet can be expanded without recreating existing virtual machine instances.; Firewall rules with lower numerical priority values (such as priority 100) take precedence and are evaluated before rules with higher numerical priority values (such as priority 1000).

Answer

The primary IP address range of a custom mode subnet can be expanded without recreating existing virtual machine instances, and firewall rules with lower numerical priority values take precedence over higher numerical priority values.
Expanding the primary CIDR range of a custom mode subnet in Google Cloud can be done online without affecting existing virtual machines. Additionally, VPC firewall rules are evaluated by priority in ascending numerical order, meaning lower numbers (e.g., 100) are evaluated first and take precedence over higher numbers (e.g., 1000).

Step-by-Step Solution

1
Evaluate custom subnet expansion capabilities in GCP VPC networks.
Confirmed that expanding custom subnet primary IP ranges is a supported non-disruptive operation.
Subnet expansion allows seamless IP space growth without requiring virtual machine downtime or re-creation.
2
Evaluate VPC firewall rule priority mechanisms.
Confirmed that lower numerical integers (e.g., 100) are processed before higher numerical integers (e.g., 1000).
GCP evaluates firewall rules in ascending numerical order, stopping at the first matching rule.

Key Concept

Custom subnet CIDR expansion and VPC firewall rule priority precedence
Question 623Question →

An operations team needs to configure local administration and cost-optimized infrastructure for a newly created Google Kubernetes Engine (GKE) cluster named `analytics-prod-cluster` in zone `us-east1-b`. The cluster will run administrative workloads alongside fault-tolerant, stateless batch worker processes. Which TWO actions should the team perform to properly configure local cluster access and optimize node execution costs for the batch processes?

Select all that apply

Show answer & explanation

Answer: Run `gcloud container clusters get-credentials analytics-prod-cluster --zone us-east1-b` to populate the local kubeconfig file with endpoint and authentication context.; Provision a dedicated node pool configured with Spot VMs to host the fault-tolerant, stateless batch workloads.

Answer

To configure administrative access and optimize node costs, the team must run `gcloud container clusters get-credentials analytics-prod-cluster --zone us-east1-b` to set up kubeconfig context and provision a Spot VM node pool for fault-tolerant, stateless batch workloads.
To manage a GKE cluster with kubectl, the administrator must first fetch cluster authentication credentials and update the local kubeconfig context using `gcloud container clusters get-credentials`. For cost optimization, GKE allows deploying node pools composed of Spot VMs, which provide substantial cost reductions for stateless, batch, or fault-tolerant workloads that can tolerate unexpected instance termination.

Step-by-Step Solution

1
Configure workstation authentication for cluster management
Local kubeconfig file is populated with cluster API endpoints and credentials
kubectl requires explicit cluster context and authentication parameters, which are retrieved via the `gcloud container clusters get-credentials` command.
2
Select the optimal GKE node pool configuration for stateless batch jobs
A Spot VM node pool is deployed to run batch workloads cost-effectively
Spot VMs offer significant cost savings for stateless workloads that can recover gracefully from node preemptions.

Key Concept

GKE Cluster Credential Management and Spot VM Node Pool Workload Placement

Alternative Method

For automated CI/CD pipelines, cluster credentials can be fetched non-interactively using Service Account keys or Workload Identity before executing kubectl commands.
Estimated Time:2m 0s
Question 624Question →

An IoT fleet management platform uploads vehicle diagnostic logs to a Google Cloud Storage bucket. The engineering team inspects these log files frequently during the first 30 days to resolve operational anomalies. Between day 31 and day 90, logs are queried occasionally (less than once per month) for performance reporting. Beyond 90 days, logs are rarely accessed (less than once a quarter) but must be retained for 3 years for compliance, requiring immediate millisecond access when queried. Which TWO Object Lifecycle Management rule actions should you configure to minimize total cost of ownership while satisfying access requirements?

Select all that apply

Show answer & explanation

Answer: Set a lifecycle rule to transition objects from Standard to Nearline storage class after 30 days.; Set a lifecycle rule to transition objects from Nearline to Coldline storage class after 90 days.

Answer

The optimal configuration transitions objects from Standard to Nearline storage after 30 days, and subsequently from Nearline to Coldline storage after 90 days.
Transitioning to Nearline after 30 days aligns with the 30-day minimum storage duration and monthly access pattern. Moving data to Coldline after 90 days aligns with the quarterly access rate and 90-day minimum storage requirement, ensuring low at-rest storage costs without incurring unnecessary retrieval penalties.

Step-by-Step Solution

1
Analyze the active usage window (Days 1–30)
Keep data in Standard storage during the first 30 days because frequent access will not incur data retrieval charges.
Coldline and Nearline storage classes charge data retrieval fees for frequent access.
2
Analyze the medium-term access window (Days 31–90)
Transition to Nearline storage class after 30 days.
Nearline is cost-optimized for data accessed at most once a month and has a 30-day minimum storage duration.
3
Analyze the long-term compliance retention window (Day 91+)
Transition to Coldline storage class after 90 days.
Coldline is optimized for data accessed at most once per quarter (90 days) and provides millisecond access latency required for unexpected compliance audits.

Key Concept

Cloud Storage Class Lifecycle Tiering & Cost Optimization
Estimated Time:1m 30s
Question 625Question →

A cloud engineer is estimating monthly infrastructure expenses using the Google Cloud Pricing Calculator for a data ingestion pipeline. The workload consists of a fleet of stateless, fault-tolerant virtual machines that run short batch jobs whenever new data files arrive, and the jobs can automatically resume if an instance is terminated. Which configuration choice in the Pricing Calculator provides the most accurate and cost-effective estimate for these batch processing instances?

Show answer & explanation

Answer: Model the instances as Spot Virtual Machines (VMs) to reflect discounted hourly pricing for fault-tolerant workloads.

Answer

Model the virtual machines as Spot VMs in the pricing calculator, as they offer substantial discounts for workloads that are stateless and fault-tolerant.
Spot VMs are excess Compute Engine capacity available at steep discounts compared to standard pricing. Because the scenario specifies that the batch workload is stateless, fault-tolerant, and capable of resuming after termination, choosing Spot VMs in the Google Cloud Pricing Calculator yields the most accurate and cost-effective cost estimate.

Step-by-Step Solution

1
Analyze the workload characteristics
The workload is stateless, fault-tolerant, runs in short batch spikes, and can tolerate instance terminations.
Understanding workload tolerance dictates which GCP cost-reduction models (Spot VMs vs CUDs) are appropriate.
2
Evaluate pricing calculator options against workload requirements
Spot VMs (or Preemptible VMs) provide deep discounts specifically designed for fault-tolerant jobs that do not require continuous uptime guarantees.
Committed Use Discounts require continuous baseline commitments, whereas Spot VMs cater to batch/intermittent workloads.
3
Select the optimal configuration in the pricing calculator
Selecting Spot VM pricing accurately models the reduced compute cost for the batch processing fleet.
This yields the most realistic and cost-optimized monthly estimate for the specified architecture.

Key Concept

Cost estimation for fault-tolerant compute workloads using Spot VMs in the Google Cloud Pricing Calculator
Estimated Time:1m 30s
Question 626Question →

A financial services company is planning the Google Cloud networking architecture for a high-frequency telemetry service deployed on Compute Engine instances across two subnets in the us-central1 region. The service receives internal traffic originating from on-premises systems connected via Cloud Interconnect. The application uses a proprietary non-HTTP TCP protocol and strictly requires that backend instances receive the original client source IP address intact for security auditing. Which Google Cloud load balancer should you select to meet these technical requirements?

Show answer & explanation

Answer: Internal Passthrough Network Load Balancer

Answer

Internal Passthrough Network Load Balancer
The Internal Passthrough Network Load Balancer is a regional Layer 4 load balancer that handles internal TCP/UDP traffic within Google Cloud or connected on-premises networks via Cloud Interconnect. Because it is non-proxied (passthrough), it preserves the client's original source IP address in the packet header and supports non-HTTP TCP traffic.

Step-by-Step Solution

1
Analyze traffic scope and origin.
Traffic comes from on-premises over Cloud Interconnect into the internal VPC network, requiring an internal load balancer.
External load balancers require public IP frontends and are designed for internet-facing traffic.
2
Analyze protocol requirements.
Workload uses a proprietary non-HTTP TCP protocol, requiring a Layer 4 (L4) load balancer.
Layer 7 (L7) Application Load Balancers only support HTTP, HTTPS, HTTP/2, and gRPC protocols.
3
Analyze IP preservation requirements.
Backend instances require direct access to original client source IP addresses.
Passthrough load balancers route packets directly to backend instances without proxying or translating client source IP addresses.

Key Concept

Selecting GCP Load Balancers based on Traffic Scope (Internal vs External), OSI Layer (L4 Passthrough vs L7 Proxy), and Client IP Preservation
Estimated Time:2m 0s
Question 627Question →

An enterprise team is designing a custom-mode Virtual Private Cloud (VPC) network in Google Cloud that connects to an on-premises network via Cloud VPN. The on-premises network uses the IPv4 CIDR block 10.20.0.0/1610.20.0.0/16. The team has already configured a primary subnet in `us-east1` using 10.10.1.0/2410.10.1.0/24. They now need to plan a new primary subnet range for `us-west1` that must accommodate at least 10001000 Compute Engine instances while preventing any IP address space collisions with existing GCP subnets or on-premises networks. Which IPv4 CIDR block should the team allocate for the `us-west1` subnet?

Show answer & explanation

Answer: 10.10.4.0/2210.10.4.0/22

Answer

Allocating 10.10.4.0/2210.10.4.0/22 fulfills the capacity requirement of at least 10001000 instances without overlapping existing GCP subnets or on-premises networks.
The CIDR block 10.10.4.0/2210.10.4.0/22 provides 10241024 total IP addresses (10191019 usable), which easily accommodates 10001000 instances. Furthermore, its address range (10.10.4.010.10.4.0 through 10.10.7.25510.10.7.255) avoids any overlap with the existing 10.10.1.0/2410.10.1.0/24 subnet in `us-east1` and the 10.20.0.0/1610.20.0.0/16 on-premises network.

Step-by-Step Solution

1
Determine the minimum required CIDR block size for 10001000 instances.
A /24/24 subnet provides 256256 addresses, whereas a /22/22 subnet provides 20=10242^0 = 1024 addresses, meeting the requirement of at least 10001000 instances.
Google Cloud reserves 44 IP addresses per subnet (55 total unusable for arbitrary host assignment), making a /22/22 range necessary to host 10001000 VMs.
2
Identify existing reserved CIDR blocks to avoid IP overlap.
`us-east1` uses 10.10.1.0/2410.10.1.0/24 (10.10.1.010.10.1.0 - 10.10.1.25510.10.1.255) and on-premises uses 10.20.0.0/1610.20.0.0/16 (10.20.0.010.20.0.0 - 10.20.255.25510.20.255.255).
Subnet ranges within a VPC and across VPN-connected hybrid networks must be completely non-overlapping.
3
Evaluate the valid CIDR range options for non-overlapping boundaries.
The range 10.10.4.0/2210.10.4.0/22 spans 10.10.4.010.10.4.0 to 10.10.7.25510.10.7.255, which is entirely contiguous and clear of both 10.10.1.0/2410.10.1.0/24 and 10.20.0.0/1610.20.0.0/16.
It maintains non-overlapping primary IP addresses while fulfilling capacity limits.

Key Concept

VPC Subnet IP Address Planning and Overlap Avoidance
Question 628Question →

A cloud engineer needs to add a new role binding for a service account in a Google Cloud project by modifying the project's IAM policy via the gcloud CLI using a local policy file. Place the operational steps in the correct sequence to complete this procedure.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: Export the existing policy to a local file, edit the local file with the new binding, apply the updated policy back to the project, and verify the changes.
Updating an IAM policy via local files follows a get-edit-set pattern. Exporting the policy first prevents dropping existing access controls, editing adds the new access, setting the policy updates GCP, and verification confirms success.

Step-by-Step Solution

1
Export the current project IAM policy
A local file named `policy.json` containing current bindings is generated.
You must obtain the existing policy structure first to avoid overwriting or dropping existing bindings.
2
Modify the local policy file
The `policy.json` file now contains the newly required role and principal target.
Editing the file locally allows precise changes to the JSON structure before committing policy updates.
3
Set the updated project IAM policy
The project IAM policy in GCP is replaced with the contents of `policy.json`.
The command `gcloud projects set-iam-policy` updates the remote resource hierarchy access rules.
4
Verify the policy modification
Confirmation that the new role binding is active.
Post-deployment audit verifies that the desired least-privilege binding is present.

Key Concept

IAM policy update workflow via declarative gcloud files
Estimated Time:1m 30s
Question 629Question →

Your organization operates a proprietary non-HTTP software service listening on custom TCP port 8443 across Compute Engine virtual machines deployed in multiple Google Cloud regions. You must expose this service to external Internet clients while terminating SSL/TLS encryption at the Google Cloud network edge prior to passing unencrypted TCP traffic to your backend instances. Which Google Cloud load balancer configuration should you deploy?

Show answer & explanation

Answer: Deploy a Global External Proxy Network Load Balancer (TCP Proxy) with SSL offloading configured on the target proxy.

Answer

Deploy a Global External Proxy Network Load Balancer (TCP Proxy) configured for SSL offloading at the edge target proxy.
The Global External Proxy Network Load Balancer (SSL Proxy / TCP Proxy) is specifically designed to route external non-HTTP TCP traffic across global regions while terminating SSL/TLS sessions at the Google Cloud infrastructure edge before delivering unencrypted TCP packets to backend virtual machine instances.

Step-by-Step Solution

1
Analyze client traffic requirements and protocol scope
Identified that client traffic is incoming from external Internet connections using custom non-HTTP TCP protocol on port 8443.
Traffic source (external) and layer requirement (Layer 4 non-HTTP TCP) dictate selecting an external Layer 4 proxy or passthrough balancer.
2
Evaluate SSL/TLS offloading requirement
TLS must be terminated at the Google Cloud network edge rather than on backend Compute Engine instances.
Passthrough network load balancers cannot terminate SSL/TLS at the edge, whereas Proxy Network Load Balancers (TCP/SSL Proxy) terminate TLS at the edge and proxy the underlying connection.
3
Select the matching Google Cloud load balancing product
Choose Global External Proxy Network Load Balancer (TCP Proxy / SSL Proxy).
It fulfills all criteria: external global reach, non-HTTP TCP traffic support, multi-region backend distribution, and SSL termination at the edge proxy.

Key Concept

Selecting GCP Load Balancer Types based on Protocol Layer and TLS Offloading
Question 630Question →

A cloud administrator needs to automate object lifecycle management on an existing Google Cloud Storage bucket to transition objects older than 30 days to Nearline storage. Arrange the operational steps in the correct sequence to define, apply, and verify the lifecycle policy using the modern `gcloud storage` CLI tool.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: First, create the local JSON lifecycle policy file specifying the action and age conditions. Second, deploy the policy file to the target bucket using `gcloud storage buckets update --lifecycle-file`. Third, verify the applied policy using `gcloud storage buckets describe`. Fourth, test write operations on the bucket by uploading a test file with `gcloud storage cp`.
The operational workflow for deploying Cloud Storage bucket lifecycle rules follows standard cloud infrastructure configuration steps: policy definition in a local manifest, execution of the updating CLI command to sync changes to GCP, metadata verification to ensure the deployment succeeded, and functional validation through an object upload test.

Step-by-Step Solution

1
Draft the lifecycle JSON configuration file
A local file named `lifecycle.json` containing the transition rule definition is created.
The `gcloud storage` CLI requires lifecycle policies to be supplied via a structured JSON document.
2
Deploy the policy file to Google Cloud Storage
The command `gcloud storage buckets update gs://[BUCKET_NAME] --lifecycle-file=lifecycle.json` applies the lifecycle rule to the cloud resource.
Bucket configuration updates must be committed to the GCP control plane before they can take effect.
3
Verify active lifecycle rules on the bucket
Executing `gcloud storage buckets describe` displays the active lifecycle object within the bucket metadata.
Verification confirms that the configuration was parsed and accepted by Cloud Storage without formatting errors.
4
Perform post-deployment operation testing
Running `gcloud storage cp` successfully uploads an object to the configured bucket.
Testing ensures bucket access controls and object write pathways remain functional after updating bucket metadata.

Key Concept

Configuring Cloud Storage Object Lifecycle Policies using gcloud storage CLI
Question 631Question →

An enterprise application hosted on Compute Engine backend instance groups in both `us-central1` and `europe-west1` requires HTTP/HTTPS traffic routing, SSL termination, and path-based URL mapping for global internet traffic. Additionally, corporate users on an on-premises network connected via Cloud Interconnect must resolve the application domain `app.example.com` to internal VPC endpoints, whereas external internet users must resolve `app.example.com` to the public-facing entry point. Which combination of load balancing and Cloud DNS configurations correctly implements this split-horizon architecture?

Show answer & explanation

Answer: Deploy a Global External Application Load Balancer configured with a global static IP address, frontend SSL certificate, and URL map. Configure a Cloud DNS public zone for app.example.com containing an A record pointing to the global public IP address. Create a Cloud DNS private zone for app.example.com authorized for the VPC network containing A records pointing to internal backend endpoints, and enable a Cloud DNS inbound server policy on the VPC network for on-premises resolution.

Answer

Deploy a Global External Application Load Balancer with a public static IP address, a Cloud DNS public zone pointing to the public IP for internet clients, a Cloud DNS private zone bound to the VPC for internal endpoints, and a Cloud DNS inbound server policy to allow on-premises systems to resolve the private DNS zone over Cloud Interconnect.
The correct solution uses a Global External Application Load Balancer to satisfy the Layer 7 HTTP/HTTPS features (path-based routing, SSL termination, multi-region backends). To achieve split-horizon DNS, internet clients use a Cloud DNS public zone resolving to the load balancer's external IP address, while on-premises users query the Cloud DNS private zone via a Cloud DNS Inbound Server Policy over Cloud Interconnect to receive internal IP addresses.

Step-by-Step Solution

1
Evaluate the traffic and protocol requirements for external web clients.
Select a Global External Application Load Balancer to provide Layer 7 HTTP/HTTPS traffic management, SSL offloading, and URL path-based routing across multiple regions (`us-central1` and `europe-west1`).
Layer 4 network load balancers cannot perform HTTP URL path matching or global SSL proxy termination for external web workloads.
2
Configure public DNS resolution for external internet clients.
Create an A record in a Cloud DNS public zone pointing `app.example.com` to the Global External Application Load Balancer's public IP address.
Public internet clients must resolve the domain to the public IP address of the Global External Load Balancer.
3
Configure private DNS resolution and split-horizon access for corporate on-premises clients.
Create a Cloud DNS private zone for `app.example.com` attached to the VPC network with internal IP A records, and create an Inbound DNS Server Policy on the VPC network.
The Cloud DNS private zone overrides public DNS inside the VPC, while the inbound DNS policy creates entry-point IP addresses in the VPC that on-premises DNS forwarders can query over Cloud Interconnect.

Key Concept

Deploying Global External Application Load Balancers alongside Cloud DNS split-horizon private zones and inbound server policies for hybrid cloud environments.
Question 632Question →

A cloud engineering team needs to configure a standard daily Cloud Billing data export into BigQuery for central cost governance and multi-project SQL analysis. Which of the following operational requirements and configuration steps must be fulfilled to successfully enable this export? (Select TWO correct answers.)

Select all that apply

Show answer & explanation

Answer: Create a destination BigQuery dataset, ensuring that the user configuring the export holds sufficient IAM permissions on both the Cloud Billing account and the target project dataset.; Enable the BigQuery API within the target Google Cloud project that hosts the destination dataset.

Answer

To configure a standard Cloud Billing export to BigQuery, you must create a target BigQuery dataset with the required IAM roles on both the billing account and the target dataset, and ensure the BigQuery API is enabled in the host project.
Configuring a BigQuery billing export requires creating a destination dataset in a project with the BigQuery API enabled, as well as having appropriate IAM roles on both the billing account and the destination dataset. Project permissions alone do not grant rights on the billing account.

Step-by-Step Solution

1
Identify IAM role requirements across billing and project boundaries
Confirm that the user configuring the export has the Billing Account Administrator or Billing Account Costs Manager role on the billing account and BigQuery Data Editor (or owner) permissions on the target dataset project.
Permissions do not automatically cross over between project resources and billing account resources.
2
Prepare the BigQuery environment in the target project
Ensure the BigQuery API is enabled in the destination project and create the destination dataset in a supported location.
The Cloud Billing service requires an active BigQuery API and an existing dataset to stream cost export tables.

Key Concept

Configuring Cloud Billing BigQuery Exports requires distinct IAM permissions on both the Cloud Billing Account and the target BigQuery dataset project, as well as enabling the BigQuery API.
Question 633Question →

A cloud administrator needs to provision a new Compute Engine virtual machine named `web-server-01` using the Google Cloud CLI (`gcloud`). The instance must be configured with the `e2-standard-4` machine type. Which command flag must be included in the `gcloud compute instances create` command to specify this machine configuration?

Show answer & explanation

Answer: --machine-type=e2-standard-4

Answer

The correct option is `--machine-type=e2-standard-4` because `--machine-type` is the mandatory Google Cloud CLI flag for setting the virtual machine configuration specs during creation.
The `--machine-type` flag is the exact gcloud parameter designed to select predefined compute shapes (e.g., `e2-standard-4`) or custom machine specifications during instance creation.

Step-by-Step Solution

1
Identify the required Google Cloud CLI command for provisioning virtual machines.
The command family is `gcloud compute instances create [INSTANCE_NAME]`.
This is the core gcloud command for creating Compute Engine VMs.
2
Select the correct flag to specify the hardware instance size.
Use the `--machine-type` flag followed by the desired machine type name.
Google Cloud CLI requires `--machine-type` to designate predefined or custom compute shapes.

Key Concept

Compute Engine VM Provisioning via gcloud CLI
Question 634Question →

You are deploying a regional Internal Application Load Balancer in a Google Cloud VPC network to distribute HTTP traffic across Compute Engine backend instances. Which TWO networking prerequisites or configurations are required for the load balancer to operate properly? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a proxy-only subnet in the region where the load balancer is being deployed.; Configure ingress firewall rules to allow traffic from the proxy-only subnet CIDR range to the backend instances.

Answer

Creating a proxy-only subnet in the deployment region and configuring ingress firewall rules to permit traffic from the proxy-only subnet range to the backend instances are required.
Regional Internal Application Load Balancers deploy Envoy proxies that operate inside a dedicated proxy-only subnet in the region. In addition, ingress firewall rules must be created to allow traffic from the proxy-only subnet IP address range to reach the application ports on the backend VM instances.

Step-by-Step Solution

1
Identify regional internal load balancing architecture requirements
Recognize that Envoy-based regional internal load balancers require a dedicated proxy-only subnet in the specified region.
Envoy proxies reside inside the proxy-only subnet to receive requests and dispatch them to backend instances.
2
Configure network security for proxy traffic
Define ingress firewall rules permitting connections from the proxy-only subnet IP range to the backend ports.
Firewalls block ingress by default, so connections coming from the load balancer's proxy instances must be explicitly allowed.

Key Concept

Internal Application Load Balancer Deployment Requirements
Question 635Question →

A lead cloud engineer is deploying a new Google Cloud Storage bucket to archive monthly financial transaction audit records in the europe-west3 region. The security and operational requirements specify that:
1. Objects uploaded to the bucket must default to the Nearline storage class.
2. Access control must be enforced strictly via IAM policies by disabling per-object Access Control Lists (ACLs).
3. Any public access to objects within the bucket must be prevented at the bucket level.

Which command should the engineer execute to deploy this bucket according to Google Cloud recommended best practices?

Show answer & explanation

Answer: gcloud storage buckets create gs://fin-audit-archive-euwest3 --location=europe-west3 --default-storage-class=nearline --uniform-bucket-level-access --public-access-prevention

Answer

The command 'gcloud storage buckets create gs://fin-audit-archive-euwest3 --location=europe-west3 --default-storage-class=nearline --uniform-bucket-level-access --public-access-prevention' fulfills all requirements using modern Google Cloud CLI syntax.
The correct option utilizes the standard 'gcloud storage buckets create' command with proper flag parameters: '--location=europe-west3' sets the bucket location, '--default-storage-class=nearline' sets the default storage class for new objects, '--uniform-bucket-level-access' enforces IAM-only permissions by disabling per-object ACLs, and '--public-access-prevention' prevents public data exposure at the bucket level.

Step-by-Step Solution

1
Identify the recommended Google Cloud CLI tool for Cloud Storage management.
Google Cloud recommends using 'gcloud storage buckets create' over legacy 'gsutil mb'.
The gcloud storage CLI provides optimized performance and standardized flag formatting across GCP services.
2
Map operational requirements to the correct gcloud storage flags.
Location: '--location=europe-west3'; Storage Class: '--default-storage-class=nearline'; Disable ACLs: '--uniform-bucket-level-access'; Block Internet Public Access: '--public-access-prevention'.
Uniform bucket-level access disables legacy object ACLs in favor of IAM, and public access prevention enforces bucket-wide restriction on public data sharing.
3
Select the option matching all correct flags without non-existent or invalid parameter names.
The option specifying '--location=europe-west3 --default-storage-class=nearline --uniform-bucket-level-access --public-access-prevention' is selected.
It complies fully with syntax and architectural requirements.

Key Concept

Cloud Storage Bucket Deployment via gcloud storage CLI
Question 636Question →

An enterprise architecture team is setting up a new Google Kubernetes Engine (GKE) environment to host two distinct workloads: a stateful, non-fault-tolerant database proxy service that requires uninterrupted availability, and a set of stateless background batch processing workers that can easily tolerate sudden instance terminations. The team also requires all workloads to securely access Google Cloud APIs like Cloud Storage without creating or downloading long-lived service account JSON keys. Which deployment architecture and configuration strategy should the team implement to satisfy these requirements?

Show answer & explanation

Answer: Deploy a GKE Standard cluster with two node pools: a standard node pool with regular Compute Engine VMs for the stateful proxy service, and a separate node pool configured with Spot VMs for the batch workers. Enable Workload Identity on the cluster and bind Kubernetes Service Accounts to IAM Service Accounts.

Answer

Deploy a GKE Standard cluster with a standard node pool of regular VMs for the stateful proxy service and a Spot VM node pool for batch workers, while enabling Workload Identity for keyless Google Cloud IAM authentication.
The solution properly separates node pool characteristics based on workload fault tolerance (regular VMs for stateful proxy vs Spot VMs for batch processing) and enforces Workload Identity for keyless, secure GCP service access.

Step-by-Step Solution

1
Analyze workload availability requirements
Stateful, non-fault-tolerant services must run on regular (on-demand) VM node pools to prevent sudden eviction. Batch processing jobs can run on Spot VM node pools to optimize costs.
Spot VMs can be reclaimed by Google Cloud at any time with a 30-second termination notice, making them unsuitable for critical non-fault-tolerant services.
2
Select security authentication mechanism
Enable Workload Identity on the cluster and map Kubernetes Service Accounts (KSAs) to IAM Service Accounts (ISAs).
Workload Identity eliminates the need to generate, export, or manage long-lived service account JSON keys.
3
Select cluster configuration mode
Provision a GKE Standard cluster with dedicated node pools matching each workload profile.
Explicit node pool management allows fine-grained control over underlying node VM types (Spot vs Regular).

Key Concept

GKE Workload Identity and Node Pool Selection Strategy
Question 637Question →

An application deployed on a Google Kubernetes Engine (GKE) cluster experiences fluctuating user traffic throughout the day. You need to ensure that the number of Pod replicas automatically increases or decreases based on CPU utilization metrics. Which Kubernetes object should you configure?

Show answer & explanation

Answer: Horizontal Pod Autoscaler (HPA)

Answer

Configure a Horizontal Pod Autoscaler (HPA) to scale the number of Pod replicas based on CPU utilization.
The Horizontal Pod Autoscaler (HPA) is the standard Kubernetes resource designed to scale the number of Pod replicas in a deployment, replica set, or stateful set based on resource metrics like CPU utilization.

Step-by-Step Solution

1
Identify the scaling requirement.
The goal is to scale workload Pod replicas automatically in response to CPU metrics.
Application workload demand varies at the Pod level, requiring dynamic replica management.
2
Select the appropriate GKE/Kubernetes component.
Horizontal Pod Autoscaler (HPA) target deployment and CPU metric thresholds are configured.
HPA monitors resource usage of Pods and adjusts the replica count within specified minimum and maximum bounds.

Key Concept

Managing Workload Scaling with Horizontal Pod Autoscaler vs Node-level Cluster Autoscaler in GKE
Estimated Time:45s
Question 638Question →

A cloud engineer is tasked with deploying and configuring an enterprise audit logging Cloud Storage bucket in `us-west1` for compliance tracking. The bucket must enforce Uniform Bucket-Level Access, have Object Versioning enabled, apply a lifecycle management policy defined in `policy.json`, and finally receive an initial baseline audit log file. In what chronological sequence must the engineer execute the following operational steps to correctly establish and populate the solution?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: first create the bucket with Uniform Bucket-Level Access (`item_1`), then enable Object Versioning (`item_2`), followed by applying the lifecycle policy file (`item_3`), and finally uploading the baseline audit log object (`item_4`).
The correct operational sequence follows GCP infrastructure deployment best practices: 1) Instantiate the Cloud Storage bucket with specified security settings (`--uniform-bucket-level-access`), 2) Enable Object Versioning to protect data state, 3) Apply object lifecycle policies (`--lifecycle-file`) to manage long-term object state, and 4) Upload the initial object payload (`gcloud storage cp`).

Step-by-Step Solution

1
Identify the foundational resource creation step.
Determine that creating the bucket resource using `gcloud storage buckets create` must be executed first.
Google Cloud Storage resources must exist prior to updating their metadata configurations or uploading files.
2
Determine the sequence of bucket feature enablement prior to policy enforcement.
Enable Object Versioning using `gcloud storage buckets update --versioning`.
Setting bucket feature flags before applying complex policies ensures all subsequent actions respect object history settings.
3
Apply governance and automated object transition rules.
Attach the lifecycle policy file using `gcloud storage buckets update --lifecycle-file=policy.json`.
Bucket configuration parameters and automated lifecycle rules must be active before ingesting production or baseline objects.
4
Perform the data ingestion step.
Upload the target file into the bucket using `gcloud storage cp`.
Uploading data is the final operational step once all target bucket access controls and configuration policies are active.

Key Concept

Deploying and configuring Cloud Storage buckets and objects requires a strict operational dependency order: resource creation with access parameters, metadata and lifecycle policy configuration, and finally object ingestion.
Question 639Question →

A logistics enterprise is architecting a new Google Kubernetes Engine (GKE) cluster to handle real-time fleet telemetry processing. The cluster architecture must satisfy two specific operational requirements:
1. Eliminate manual infrastructure maintenance, such as node provisioning, OS patching, and node pool management overhead.
2. Enable pod workloads to securely access Google Cloud services (Cloud Storage and BigQuery) without managing or storing long-lived service account key credentials.

Which two architectural configurations should you choose to fulfill these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision the cluster using GKE Autopilot mode to delegate node management, OS patching, and infrastructure scaling to Google Cloud.; Enable Workload Identity on the GKE cluster to associate Kubernetes Service Accounts with IAM Service Accounts for keyless authentication to Google Cloud APIs.

Answer

The correct choices are provisioning the cluster using GKE Autopilot mode and configuring Workload Identity for keyless GCP authentication.
Deploying in GKE Autopilot mode delegates all node provisioning, maintenance, and cluster infrastructure management to Google Cloud. Additionally, enabling Workload Identity allows Kubernetes workloads to assume IAM roles securely without embedding long-lived JSON credentials in the cluster.

Step-by-Step Solution

1
Analyze the operational management requirement.
Selecting GKE Autopilot eliminates manual node management, OS patching, and capacity planning by fully managing worker nodes.
GKE Autopilot abstracts node management away from the user, fulfilling the zero-node-overhead constraint.
2
Analyze the GCP security and authentication requirement.
Enabling Workload Identity allows pods to authenticate to GCP APIs via Kubernetes Service Account mappings.
Workload Identity eliminates the need for long-lived service account JSON keys.

Key Concept

Planning GKE Autopilot and Workload Identity Architectures
Question 640Question →

When configuring ingress firewall rules in a Google Cloud Virtual Private Cloud (VPC) network, multiple rules may match incoming network traffic. How does Google Cloud determine which firewall rule takes precedence when two matching rules conflict?

Show answer & explanation

Answer: The rule with the lower numerical priority value takes precedence and is evaluated first.

Answer

The rule with the lower numerical priority value takes precedence and is evaluated first.
In Google Cloud VPC, firewall rule priority is an integer from 0 to 65535. Rules with lower numerical priority values are evaluated first. Once a rule matches traffic, lower priority (higher numbered) rules are not evaluated.

Step-by-Step Solution

1
Identify the mechanism GCP uses to resolve conflicting VPC firewall rules.
GCP relies on an integer priority value assigned to each rule, ranging from 0 to 65535.
When network traffic matches multiple rules, GCP processes rules in ascending order of their priority numbers.
2
Determine which numerical priority value indicates higher precedence.
Lower numbers (e.g., 100) are evaluated before higher numbers (e.g., 1000). Priority 0 is the highest possible priority.
The rule with the lower priority integer is applied first; once a matching rule is applied, further evaluation stops for that connection.

Key Concept

GCP VPC Firewall Rule Priority Precedence
Estimated Time:45s
PreviousPage 32 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin