Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 61Question →

A cloud administrator needs to release a containerized application update to a Cloud Run service named `payment-gateway` running in `us-central1`. To perform a canary release, the new container revision `payment-gateway-v2` must first be deployed without receiving any production traffic so that internal testing can occur. Once validated, 10%10\% of live application traffic must be directed to `payment-gateway-v2` while retaining the remaining 90%90\% on the existing revision. Which sequence of `gcloud` CLI commands should the administrator execute to achieve this?

Show answer & explanation

Answer: Run `gcloud run deploy payment-gateway --image gcr.io/my-project/payment-gateway:v2 --no-traffic --region us-central1`, test the revision, and then run `gcloud run services update-traffic payment-gateway --to-revisions payment-gateway-v2=10 --region us-central1`.

Answer

Deploy the new revision using `gcloud run deploy payment-gateway --image gcr.io/my-project/payment-gateway:v2 --no-traffic --region us-central1`, validate the deployment, and then execute `gcloud run services update-traffic payment-gateway --to-revisions payment-gateway-v2=10 --region us-central1`.
The correct approach deploys the new container image to Cloud Run using `--no-traffic`, ensuring no live production traffic hits the revision until testing completes. Executing `gcloud run services update-traffic` with `--to-revisions payment-gateway-v2=10` explicitly shifts 10%10\% of traffic to the new revision while preserving the rest on the current active deployment.

Step-by-Step Solution

1
Deploy the new revision using the `--no-traffic` flag
The revision `payment-gateway-v2` is created and available via a unique URL, receiving 0%0\% of production service traffic.
Prevents live user traffic from hitting the unvalidated revision immediately upon deployment.
2
Perform internal testing on the revision-specific URL
Validation of the revision is completed in isolation.
Ensures the application operates correctly in the target runtime environment.
3
Update traffic distribution using `gcloud run services update-traffic`
The revision receives exactly 10%10\% of live traffic, and the remaining 90%90\% stays on the previous active revision.
Safely executes a canary rollout according to the operational requirements.

Key Concept

Managing Cloud Run revision traffic distribution using gcloud CLI traffic flags
Question 62Question →

A solutions architect is deploying an asynchronous background worker service to Google Cloud Run using the gcloud CLI. The microservice will receive event notifications pushed from a Cloud Pub/Sub topic. The deployment must meet two strict requirements: first, the service must be protected from public unauthenticated access so only the authorized Cloud Pub/Sub push subscription service account can invoke it; second, at least two instance replicas must be kept continuously provisioned to eliminate cold-start latency for urgent events. Which TWO configuration options or flags must be specified during deployment to achieve this operational setup?

Select all that apply

Show answer & explanation

Answer: Include the --no-allow-unauthenticated flag during gcloud run deploy to block public access and require IAM authentication.; Include the --min-instances=2 flag during gcloud run deploy to maintain a baseline of warm container instances.

Answer

The correct requirements are achieved by specifying the '--no-allow-unauthenticated' flag to enforce IAM invoker permissions and setting '--min-instances=2' to keep warm container instances active.
To secure Cloud Run services so that only authorized GCP components (like Pub/Sub push subscriptions with OIDC tokens) can invoke them, the deployment must enforce authentication using '--no-allow-unauthenticated'. To prevent cold starts and maintain low response latency, setting '--min-instances=2' keeps two container instances booted and ready in memory.

Step-by-Step Solution

1
Configure security settings for Cloud Run ingress
Using '--no-allow-unauthenticated' ensures that unauthenticated internet traffic is rejected with an HTTP 401/403 error, allowing only authenticated callers such as Pub/Sub push service accounts.
By default, services deployed via gcloud run deploy may prompt for public access or default to private depending on organization policies; explicitly passing '--no-allow-unauthenticated' guarantees private access.
2
Configure instance provisioning for latency optimization
Setting '--min-instances=2' guarantees 2 instances remain initialized even when there is zero active incoming traffic.
This eliminates cold starts for time-sensitive background events pushed by Cloud Pub/Sub.

Key Concept

Cloud Run deployment flags for IAM access control and minimum instance scaling
Estimated Time:1m 30s
Question 63Question →

A cloud engineer is deploying a custom-mode Virtual Private Cloud (VPC) network named `corp-vpc` for an enterprise environment. The requirements state that custom subnets must be created manually, and an ingress firewall rule named `allow-internal-admin` must allow SSH access (TCP port 22) exclusively to virtual machine instances carrying the target network tag `admin-node` from the internal IP subnet range `10.10.1.0/24`.

Which TWO `gcloud` commands or command options must be executed to meet these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Execute `gcloud compute networks create corp-vpc --subnet-mode=custom` to initialize the VPC network without automatic subnet creation.; Execute `gcloud compute firewall-rules create allow-internal-admin --network=corp-vpc --allow=tcp:22 --source-ranges=10.10.1.0/24 --target-tags=admin-node` to allow SSH ingress.

Answer

Creating the VPC network using the `--subnet-mode=custom` flag and defining the firewall rule using `--source-ranges=10.10.1.0/24` with `--target-tags=admin-node` fulfills both custom subnet and network filtering requirements.
To deploy a custom VPC network, `--subnet-mode=custom` must be passed during creation to prevent default subnets from being generated. For the ingress firewall rule, `--source-ranges` correctly specifies the allowed IP block `10.10.1.0/24`, and `--target-tags` restricts the destination to instances tagged with `admin-node`.

Step-by-Step Solution

1
Identify the VPC creation requirement
The network must be instantiated with `--subnet-mode=custom` so that subnets are not automatically created in every region.
Auto-mode networks create default regional subnets automatically, whereas custom mode allows manual subnet definition.
2
Identify the firewall parameter mapping for gcloud CLI
Map the IP CIDR `10.10.1.0/24` to `--source-ranges` and the network tag `admin-node` to `--target-tags`.
`--source-ranges` expects IP CIDR notations, while `--target-tags` applies the firewall rule to instances with matching network tags.
3
Evaluate firewall priority and rule parameters
Priority 65535 is the lowest precedence, and swapping tags with ranges results in command syntax/logical errors.
GCP evaluates lower priority numbers first (priority 0 to 65354 for user rules), so priority 65535 is reserved for default lowest-precedence rules.

Key Concept

Deployment of Custom VPC Networks and Ingress Firewall Rule Parameters in Google Cloud
Question 64Question →

A security audit highlights that a Compute Engine virtual machine running an automated nightly report generator is using the default Compute Engine service account with the primitive Editor role. To comply with security mandates and the principle of least privilege, you need to reconfigure the workload to use a dedicated user-managed service account that only has access to read Cloud Storage objects and write BigQuery datasets in the project. Which sequence of steps should you take?

Show answer & explanation

Answer: Create a user-managed service account, grant it the roles/storage.objectViewer and roles/bigquery.dataEditor roles at the project level, stop the VM instance, attach the new service account to the VM, and restart the instance.

Answer

Create a dedicated user-managed service account, grant it the predefined roles roles/storage.objectViewer and roles/bigquery.dataEditor at the project level, stop the VM instance, attach the custom service account to the VM, and restart the instance.
The solution follows Google Cloud security best practices by replacing the default service account with a custom user-managed service account, granting minimal predefined roles (roles/storage.objectViewer and roles/bigquery.dataEditor), and attaching the service account directly to the Compute Engine instance so the application uses automatic metadata credentials rather than exported long-lived JSON key files.

Step-by-Step Solution

1
Create a dedicated user-managed service account
A new service account identity is established specifically for the reporting workload.
Default service accounts should not be used for production workloads as they often default to overly permissive broad roles.
2
Bind predefined IAM roles to the service account at the project level
The service account gains roles/storage.objectViewer and roles/bigquery.dataEditor permissions.
Predefined roles satisfy the principle of least privilege by providing only the required Cloud Storage read and BigQuery dataset write capabilities.
3
Attach the user-managed service account to the VM instance without generating exportable keys
The VM automatically acquires credentials from the instance metadata service.
Attaching the service account directly eliminates the storage and management risks associated with long-lived JSON service account keys.

Key Concept

User-managed service accounts best practices and VM attachment
Question 65Question →

A financial technology company needs to host a continuous, mission-critical risk assessment service on Google Compute Engine. Benchmarking indicates that the application requires precisely 6 vCPUs and 45 GB of RAM. The service operates 24/7, requires constant resource availability, and cannot tolerate unexpected VM terminations or preemption. Which Compute Engine machine configuration strategy should you recommend to minimize monthly infrastructure costs while meeting these exact resource specifications?

Show answer & explanation

Answer: Provision a VM instance using a Custom Machine Type configured with 6 vCPUs and 45 GB of memory, and purchase a 1-year or 3-year Committed Use Discount for the required capacity.

Answer

Provisioning a VM instance using a Custom Machine Type configured with 6 vCPUs and 45 GB of memory combined with a Committed Use Discount.
Custom Machine Types allow tailored vCPU and memory configurations (6 vCPUs and 45 GB RAM) to match non-standard workload specifications without paying for unneeded hardware resources. Combining Custom Machine Types with Committed Use Discounts (CUDs) provides the highest cost optimization for steady, non-interruptible 24/7 production workloads.

Step-by-Step Solution

1
Analyze workload resource requirements and SLA requirements.
Workload needs non-standard core/memory ratio (6 vCPUs, 45 GB RAM) and continuous 24/7 availability with zero tolerance for preemption.
Standard machine families (e.g., n2-standard-8 with 8 vCPUs / 32 GB RAM or n2-standard-16 with 16 vCPUs / 64 GB RAM) either under-provision memory or over-provision vCPUs.
2
Select appropriate Compute Engine machine type tailoring mechanism.
Use Custom Machine Types to specify exact vCPU count (6) and memory capacity (45 GB).
Custom Machine Types eliminate waste by allowing tailored vCPU and RAM provisioning when workload ratios do not align with predefined types.
3
Apply the optimal Google Cloud pricing discount model for steady-state workloads.
Purchase Committed Use Discounts (CUDs) for the predictable 24/7 compute footprint.
Committed Use Discounts offer maximum guaranteed savings (up to 57-70%) for steady production capacity without risking workload preemption.

Key Concept

Compute Engine Custom Machine Types and Committed Use Discounts (CUDs)
Estimated Time:1m 30s
Question 66Question →

A cloud architect is configuring governance controls for a company's Google Cloud environment containing an Organization node, a 'Staging' folder, and multiple child projects. The security team needs to establish clear boundaries for resource configurations and access controls across the resource hierarchy. Which of the following statements correctly describe the behavior of Google Cloud Organization Policies and resource hierarchy constraints? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Organization Policy constraints configured at the 'Staging' folder level automatically evaluate and apply to all child projects inside that folder unless explicitly overridden at a lower level.; Organization Policies define configuration guardrails on resources regardless of who performs the action, whereas IAM roles determine which principals have permissions to perform operations.

Answer

The correct statements are that Organization Policy constraints set on a folder level automatically apply to all child projects unless explicitly overridden at a lower level, and that Organization Policies restrict resource configurations while IAM roles manage identity-based access permissions.
Organization Policy constraints set at a folder level automatically inherit down to child projects unless explicitly overridden at a lower node. Furthermore, Organization Policies establish guardrails on resources regardless of the user performing the action, whereas IAM roles manage identity-based permissions.

Step-by-Step Solution

1
Analyze how Organization Policies propagate through the GCP resource hierarchy.
Policies configured at higher levels (Organization or Folder) pass down to lower levels (Projects and resources) through hierarchical inheritance unless an explicit override is set.
Hierarchical inheritance is a fundamental design property of Google Cloud Organization Policies.
2
Differentiate between the roles of IAM and Organization Policies.
Organization Policies enforce guardrails on resource configurations (e.g., restricting public IPs or allowed VM locations), while IAM grants identities specific permissions to perform operations.
Understanding this distinction prevents mixing governance guardrails with access control configurations.
3
Evaluate the incorrect choices regarding role permissions and policy grants.
Primitive IAM Owner roles cannot bypass Organization Policy enforcement, and Organization Policies cannot be used to assign identity-level read permissions.
IAM permissions and Organization Policies operate independently; IAM roles do not override enforced organizational guardrails.

Key Concept

Organization Policy Hierarchical Inheritance and IAM Decoupling
Estimated Time:1m 30s
Question 67Question →

An operations team manages a fleet of non-critical development virtual machines on Compute Engine. To optimize monthly operational costs, the team needs to ensure these instances automatically shut down at 8:00 PM every weekday evening and automatically start back up at 7:00 AM every weekday morning. They require a solution that uses native Google Cloud capabilities with minimal management overhead. Which action should the team take?

Show answer & explanation

Answer: Create an Instance Schedule resource policy specifying the required start and stop times, and attach the policy to the Compute Engine instances.

Answer

Create an Instance Schedule resource policy specifying the required start and stop times, and attach the policy to the Compute Engine instances.
Creating an Instance Schedule resource policy is the native Google Cloud solution for automatically starting and stopping VM instances on a schedule. It requires no external infrastructure or custom scripts and meets the requirement for minimal management overhead.

Step-by-Step Solution

1
Identify the operational requirement for automated VM start/stop state changes.
Recognize that scheduled power management requires a recurring time-based policy mechanism.
Compute Engine provides built-in Resource Policies specifically designed for scheduling instance operations.
2
Define an Instance Schedule resource policy using gcloud or the Google Cloud Console.
A resource policy configured with CRON-like expressions or explicit start and stop schedules for weekdays.
Instance schedules natively handle starting and stopping instances at defined times without requiring external orchestrators.
3
Attach the Instance Schedule resource policy to the targeted Compute Engine VM instances.
The target virtual machines automatically adhere to the schedule, shutting down at 8:00 PM and starting at 7:00 AM on weekdays.
Attaching the policy applies the scheduling logic directly to the instance life cycle while adhering to Google best practices.

Key Concept

Compute Engine Instance Schedules and Resource Policies
Estimated Time:1m 30s
Question 68Question →

A cloud administrator is performing a resource cleanup in a Google Cloud project and identifies a Cloud KMS Key Ring containing unused CryptoKeys. The administrator attempts to permanently remove the Key Ring to clean up project resources, but discovers that the Google Cloud Console does not offer a delete action for Key Rings. Why does Google Cloud prevent the deletion of Cloud KMS Key Rings, and what is the recommended procedure to restrict further use of the cryptographic keys?

Show answer & explanation

Answer: Key Rings and CryptoKeys are immutable resources to preserve resource names and audit trails; the administrator should disable or destroy the individual CryptoKey versions to prevent usage.

Answer

Cloud KMS Key Rings and CryptoKeys are immutable resources designed to maintain audit integrity and unique resource identifiers. To prevent unauthorized or unintended usage of keys inside an unneeded Key Ring, administrators should disable or schedule destruction for all active key versions.
In Google Cloud KMS, Key Rings and CryptoKeys are immutable resources. They cannot be deleted once created in order to guarantee that resource names are never reused and audit records remain reliable over time. To prevent any further cryptographic operations, administrators must disable the key versions or schedule them for destruction.

Step-by-Step Solution

1
Identify Cloud KMS resource lifecycle constraints.
Recognize that Cloud KMS Key Rings and CryptoKeys cannot be deleted once created.
Immutability preserves resource naming conventions and cryptographic audit logs across GCP.
2
Determine the proper method to revoke cryptographic functionality.
Disable active CryptoKey versions or schedule key versions for destruction.
Disabling or destroying key versions prevents decryption and encryption operations without violating resource immutability.

Key Concept

Immutability of Cloud KMS Key Rings and CryptoKey management lifecycle
Question 69Question →

A cloud administrator is tasked with scaling a high-throughput event processing platform in Google Cloud Project `stream-data-prod`. The platform requires deploying additional Compute Engine virtual machines in the `us-central1` region. However, automated scripts fail with an error stating that the regional `In-Use IP addresses` quota limit has been reached. To enable the deployment while following Google Cloud best practices and the principle of least privilege, what action should be taken?

Show answer & explanation

Answer: Assign the Quota Administrator role (`roles/servicemanagement.quotaAdmin`) to the administrator, and submit a quota increase request for the `In-Use IP addresses` metric in `us-central1` through the Quotas page in the Google Cloud Console.

Answer

Assign the Quota Administrator role (`roles/servicemanagement.quotaAdmin`) to the administrator, and submit a quota increase request for the `In-Use IP addresses` metric in `us-central1` through the Quotas page in the Google Cloud Console.
To increase a GCP resource quota, an administrator must request a quota increase through the Google Cloud Console Quotas page. Following the principle of least privilege, the administrator should be assigned the predefined Quota Administrator role (`roles/servicemanagement.quotaAdmin`), which provides the necessary permissions without granting unnecessary administrative rights over other resources.

Step-by-Step Solution

1
Identify the root cause of the deployment failure
The failure stems from exceeding the regional ceiling for `In-Use IP addresses` in `us-central1`.
Google Cloud enforces hard regional limits on specific infrastructure metrics to ensure fair allocation and platform stability.
2
Determine the required IAM role adhering to least privilege
Select `roles/servicemanagement.quotaAdmin` (Quota Administrator).
This predefined role provides specific permissions (`serviceusage.quotas.update`) required to request quota increases without granting administrative access over other GCP resources.
3
Submit the request through official GCP administration tooling
Navigate to IAM & Admin > Quotas in the Google Cloud Console, select `In-Use IP addresses` for `us-central1`, click Edit Quotas, and submit the requested increase.
Formal quota requests are evaluated by Google Cloud automated systems or support to approve higher limits.

Key Concept

Managing and Requesting GCP Resource Quotas
Question 70Question →

A cloud engineering team needs to implement automated cost-management controls and detailed analytics for their organization's Google Cloud infrastructure. They want to receive programmatic triggers to automatically stop non-essential compute workloads when monthly spend reaches 90%90\% of the set budget, while also retaining granular daily cost data for custom SQL queries. Which of the following configuration steps must be performed to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Connect a Cloud Pub/Sub topic to the billing budget to receive threshold notification messages for automated execution.; Enable Cloud Billing export to a BigQuery dataset from the Billing section of the Google Cloud Console.

Answer

The required steps are: connecting a Cloud Pub/Sub topic to the billing budget to receive programmatic notifications, and enabling Cloud Billing export to a BigQuery dataset within the Billing section of the Google Cloud Console.
Attaching a Cloud Pub/Sub topic to a budget enables programmatic notifications, allowing serverless code like Cloud Functions to disable billing or stop workloads when thresholds are met. Additionally, setting up Cloud Billing export to BigQuery allows raw daily cost data to be stored and analyzed using standard SQL queries.

Step-by-Step Solution

1
Configure programmatic budget actions
Attach a Cloud Pub/Sub topic to the billing budget so budget threshold events are published as messages.
Google Cloud budgets only issue notifications by default. Programmatic actions (such as turning off resources) require Pub/Sub messages to trigger downstream automation like Cloud Functions.
2
Configure detailed cost analytics export
Navigate to the Cloud Billing console and configure detailed billing data export to a target BigQuery dataset.
BigQuery exports provide granular raw billing data for custom SQL analysis and reporting across the organization.

Key Concept

Budget programmatic notifications via Cloud Pub/Sub and Cloud Billing BigQuery export configuration.
Question 71Question →

A fintech company requires automated workload management to prevent cost overruns on their primary Google Cloud billing account. A cloud architect must ensure that when accrued spending reaches 100% of a defined monthly threshold, an existing Cloud Run microservice is invoked to disable non-critical development workloads, while standard email alerts continue reaching the operations team. Which configuration approach should the architect implement?

Show answer & explanation

Answer: Configure a Cloud Billing budget with the 100% threshold rule, link a Cloud Pub/Sub topic to the budget notifications, and configure a Push subscription on the topic targeting the Cloud Run microservice endpoint.

Answer

Configure a Cloud Billing budget with the 100% threshold rule, link a Cloud Pub/Sub topic to the budget notifications, and configure a Push subscription on the topic targeting the Cloud Run microservice endpoint.
Google Cloud Billing budgets send notifications when spend threshold rules are met. Standard alerts send emails, but automated actions require attaching a Cloud Pub/Sub topic to the budget. Pub/Sub receives JSON payloads describing current costs and budget limits, which can then trigger a subscriber such as Cloud Run to programmatically stop instances or disable billing.

Step-by-Step Solution

1
Analyze budget notification capabilities
Recognize that Cloud Billing budgets send alerts to billing admins via email by default, but require programmatic integration for automated actions.
Budgets do not shut down resources or execute webhooks natively.
2
Determine the programmatic notification path
Connect a Cloud Pub/Sub topic to the Cloud Billing budget threshold rule.
Cloud Billing publishes JSON event payloads to Pub/Sub whenever threshold percentages are crossed.
3
Configure the automation consumer
Create a Cloud Pub/Sub Push subscription configured with the Cloud Run service endpoint as its target.
This allows the Pub/Sub service to deliver the notification payload directly to Cloud Run to execute custom resource disabling logic.

Key Concept

Programmatic Billing Budget Notifications via Pub/Sub
Question 72Question →

An organization is using the Google Cloud Pricing Calculator to build a monthly cost estimate for an enterprise financial reporting architecture. The workload consists of 24/7 database virtual machines, hourly batch analytics running on Compute Engine Spot VMs, and audit log files stored in Standard Cloud Storage that transition to Coldline Storage after 30 days. Which two statements accurately describe how cost rules and discount mechanics should be accounted for in the pricing calculator? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Sustained Use Discounts (SUDs) are automatically calculated for eligible 24/7 Compute Engine instances, whereas Committed Use Discounts (CUDs) must be manually selected with a 1-year or 3-year commitment term.; Estimates for storage costs must factor in minimum storage duration fees if Coldline Storage objects are deleted, overwritten, or moved before 90 days.

Answer

The correct statements are that Sustained Use Discounts are automatically applied to eligible 24/7 instances while Committed Use Discounts require explicit contract selection, and that Coldline Storage incurs minimum duration penalties if data is removed or overwritten before 90 days.
Sustained Use Discounts are automatically applied by the Google Cloud Pricing Calculator to eligible vCPUs and memory running for more than 25% of a month, while Committed Use Discounts must be manually specified for 1-year or 3-year periods. Furthermore, Coldline Storage carries a minimum retention policy of 90 days; deleting or modifying data before this period results in early deletion fee charges.

Step-by-Step Solution

1
Evaluate Compute Engine discount mechanics in the GCP Pricing Calculator.
Sustained Use Discounts (SUDs) apply automatically for sustained usage on supported machine types, whereas Committed Use Discounts (CUDs) require selecting a 1-year or 3-year term commitment. Spot VMs receive fixed low pricing and cannot stack SUDs or CUDs.
Accurate cost modeling requires knowing which discounts are calculated automatically versus those requiring contractual selection or specific instance types.
2
Analyze Cloud Storage lifecycle transition pricing rules.
Coldline Storage has lower base storage costs per GB/month but incurs data retrieval fees per GB read and enforces a 90-day minimum storage duration commitment.
Moving objects to colder tiers reduces passive storage pricing but introduces retrieval costs and early deletion penalties if objects are accessed or removed within 90 days.

Key Concept

Estimating GCP Costs with the Pricing Calculator
Question 73Question →

A cloud architecture team is using the Google Cloud Pricing Calculator to estimate monthly expenses for a new enterprise analytical application. The planned architecture includes a Cloud SQL for PostgreSQL database configured with High Availability (HA) and a Cloud Pub/Sub message broker that ingests streaming telemetry from client applications across multiple geographic regions. Which TWO configuration options or cost parameters must be explicitly specified in the Google Cloud Pricing Calculator to produce an accurate monthly estimate?

Select all that apply

Show answer & explanation

Answer: The storage capacity and regional failover replication settings for the High Availability Cloud SQL instance; Network egress data transfer volumes generated when delivering messages across regional boundaries

Answer

Accurate cost estimation in the Google Cloud Pricing Calculator requires configuring the Cloud SQL High Availability storage and regional failover replication settings, as well as accounting for cross-region network egress data volumes generated by Cloud Pub/Sub telemetry stream delivery.
Configuring High Availability for Cloud SQL doubles the database instance and storage resource allocation due to active-standby zonal replication. Additionally, streaming data across GCP region boundaries incurs inter-region egress charges that must be calculated in the pricing calculator using estimated monthly data throughput.

Step-by-Step Solution

1
Analyze the Cloud SQL requirements for cost modeling in the pricing calculator
Identify that High Availability (HA) provisions both a primary and standby instance along with replicated storage, which must be selected in the calculator.
Cloud SQL HA configuration impacts both database compute instance costs and storage capacity pricing.
2
Analyze the networking and messaging components for hidden operational costs
Identify inter-region and internet egress data transfer requirements for Cloud Pub/Sub cross-region messaging.
Data transfer out of a GCP region is billed per gigabyte and must be explicitly estimated in the pricing calculator.
3
Evaluate and discard invalid pricing model assumptions
Reject automatic CUD application and Spot VM options for stateful database tiers.
CUDs require explicit term configuration in the tool, and Cloud SQL does not run on Spot/Preemptible VMs.

Key Concept

Multi-component GCP cost estimation involving managed database HA replication and cross-region egress networking parameters.
Estimated Time:1m 30s
Question 74Question →

An organization enforces a strict security directive prohibiting the creation and export of static service account JSON keys. A automated pipeline executing under a source service account `[email protected]` in Project-A must deploy compute resources into Project-B by impersonating a target service account `[email protected]`. Which two IAM configuration actions must be performed to enable this secure impersonation workflow following Google Cloud security best practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to [email protected] on the [email protected] service account resource.; Grant the target service account [email protected] the necessary compute deployment permissions within Project-B.

Answer

Granting the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to the source service account on the target service account resource, and granting the target service account the necessary resource deployment permissions within Project-B.
To establish keyless cross-project impersonation, the calling service account must be given the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) directly on the target service account resource. Additionally, the target service account must be assigned specific predefined IAM roles in the destination project so it can perform the intended deployment tasks upon being impersonated.

Step-by-Step Solution

1
Configure impersonation permissions on the target service account.
The source service account `[email protected]` is granted `roles/iam.serviceAccountTokenCreator` binding on `[email protected]`.
This permission allows the source service account to generate short-lived credentials for the target identity without needing private keys.
2
Configure deployment authorization in the destination project.
The target service account `[email protected]` receives predefined compute deployment roles in Project-B.
Operations executed via impersonation inherit the IAM permissions of the target service account inside the destination environment.

Key Concept

Service Account Impersonation requires granting the Service Account Token Creator role to the caller on the target service account resource.
Question 75Question →

A company runs a batch processing application on a Google Kubernetes Engine (GKE) Standard cluster. The workload processes fault-tolerant, stateless data jobs during overnight operations. The cloud engineering team wants to significantly reduce infrastructure costs while ensuring that node capacity automatically expands during peak processing demand and contracts when jobs complete. Which strategy should the cloud engineer implement to meet these requirements?

Show answer & explanation

Answer: Create a dedicated GKE node pool configured with Spot VMs and enable Cluster Autoscaler on the node pool with defined minimum and maximum node limits.

Answer

Create a dedicated GKE node pool configured with Spot VMs and enable Cluster Autoscaler on the node pool with defined minimum and maximum node limits.
Configuring a dedicated node pool with Spot VMs provides up to 60-90% cost savings for stateless, fault-tolerant batch processing. Enabling Cluster Autoscaler on the node pool allows GKE to automatically scale the worker node count up when pending pods need resources and down when demand subsides.

Step-by-Step Solution

1
Identify workload characteristics and cost optimization requirements.
Stateless, fault-tolerant batch processing jobs are ideal candidates for Spot VMs, which offer significant discounts compared to standard instances.
Spot VMs can be preempted by Compute Engine at any time, making them suitable only for stateless or resilient workloads.
2
Select the appropriate scaling mechanism for GKE infrastructure nodes.
Cluster Autoscaler automatically adjusts the number of nodes in a given node pool based on unschedulable pods and node resource utilization.
Horizontal Pod Autoscaler (HPA) adjusts pod replica counts, not node instance counts.
3
Combine Spot VM node pool provision with Cluster Autoscaler configuration.
Configuring a dedicated node pool with `--spot` and `--enable-autoscaling` achieves both automated infrastructure scaling and cost optimization.
This combination ensures nodes expand when batch pods are queued and scale down to minimum bounds when idle.

Key Concept

GKE Spot VM Node Pools and Cluster Autoscaler Operations
Question 76Question →

A medical research firm is planning a Google Cloud Storage solution for raw genomic sequencing data. Newly uploaded datasets are heavily processed and read multiple times daily during the first 30 days. After 30 days, processing completes and datasets are accessed less than once a year for compliance audits, but must remain available with millisecond retrieval SLA times. To optimize total cost of ownership while adhering to storage class minimum duration rules, which TWO lifecycle management and storage class strategies should the team implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Set the default bucket storage class to Standard Storage to handle initial active data processing.; Configure an Object Lifecycle Management rule to transition objects to Archive Storage 30 days after creation.

Answer

The team should set the default storage class to Standard Storage for the initial active processing phase and configure an Object Lifecycle Management rule to transition objects to Archive Storage after 30 days.
The correct strategy combines Standard Storage for the initial active 30-day window (preventing retrieval fee penalties during frequent reads) with a direct Object Lifecycle Management rule transition to Archive Storage at 30 days (maximizing monthly storage savings for data read less than once per year while maintaining millisecond access time).

Step-by-Step Solution

1
Analyze access frequency and patterns for the first 30 days.
Data is accessed multiple times per day. Standard Storage is required to avoid per-GB retrieval fees during active processing.
Coldline, Nearline, and Archive classes charge retrieval fees for data access, which makes them expensive for active daily workloads.
2
Analyze access frequency and latency requirements after day 30.
Access is less than once a year, requiring long-term archiving with millisecond retrieval SLA.
Archive Storage provides sub-second retrieval latency at the lowest monthly storage cost among Google Cloud Storage classes.
3
Evaluate intermediate transitions against minimum storage duration rules.
Transitioning directly from Standard to Archive at 30 days avoids intermediate minimum duration penalties.
Coldline has a 90-day minimum storage duration penalty; moving data from Coldline to Archive after 20 days would incur early transition charges.

Key Concept

Cloud Storage Class Selection & Lifecycle Minimum Storage Duration Penalties
Estimated Time:2m 0s
Question 77Question →

A data analyst must execute a scheduled Python script from an on-premises workstation to pull analytics data from BigQuery using a dedicated service account named `[email protected]`. Organization security policies explicitly prohibit generating or downloading long-lived service account JSON key files to local machines. The analyst has already authenticated their personal user identity using `gcloud auth login`. Which configuration best satisfies this security requirement while adhering to the principle of least privilege?

Show answer & explanation

Answer: Grant the data analyst's user account the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the target service account.

Answer

Grant the data analyst's user account the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the target service account.
Granting the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) directly on the target service account enables the user to generate short-lived credentials via `gcloud` or Google API client libraries. This completely removes the need for long-lived JSON service account keys while adhering to the principle of least privilege.

Step-by-Step Solution

1
Identify the security requirement regarding authentication without key files.
Long-lived service account JSON keys cannot be created or downloaded to local workstations.
Security policies require keyless authentication using identity impersonation.
2
Determine the minimum IAM role required for identity impersonation.
The user requires `roles/iam.serviceAccountTokenCreator` granted on the specific service account resource.
This role allows the user to mint short-lived credentials (OIDC/OAuth2 tokens) for the service account.
3
Apply the principle of least privilege.
Grant the role strictly on the target service account rather than broadly at the project or organization level.
Restricting the IAM binding to the target service account resource prevents unauthorized impersonation of other service accounts.

Key Concept

Service Account Impersonation via Service Account Token Creator Role
Estimated Time:1m 30s
Question 78Question →

A cloud administrator attempts to restrict a DevOps engineer's permissions within a specific Google Cloud project residing inside a folder named 'Production'. The DevOps engineer was previously assigned the Compute Admin (`roles/compute.admin`) role at the 'Production' folder level. The administrator removes the engineer's Compute Admin role assignment from the child project's IAM policy page. However, the engineer can still create and delete Compute Engine instances inside that project. What is the cause of this behavior?

Show answer & explanation

Answer: IAM permissions granted at a parent level in the resource hierarchy are inherited by child resources and cannot be revoked at the child resource level.

Answer

IAM permissions granted at a parent resource level in Google Cloud are inherited down the resource hierarchy and cannot be restricted or revoked at a lower child level.
In Google Cloud, IAM policies are inherited downward through the resource hierarchy (Organization → Folder → Project → Resource) and are strictly additive. If a user is granted a role at a higher level (such as a Folder), that permission applies to all child resources within that folder. Removing a role binding on a child project does not remove or override the binding inherited from the parent folder.

Step-by-Step Solution

1
Analyze the Google Cloud Resource Hierarchy for the scenario.
The resource structure is Folder ('Production') → Child Project.
Permissions bound at the folder level apply to all child projects contained within that folder.
2
Evaluate IAM policy inheritance behavior.
IAM policies in GCP are additive. Effective permissions for a resource are the union of the policy set on the resource and all policies inherited from its ancestors.
Child resources inherit all permissions granted at parent levels.
3
Determine why removing the role at the project level failed to restrict access.
Removing a direct role binding on the project only removes project-specific bindings. It does not affect inherited bindings from the parent folder.
To revoke access, the role binding must be removed at the folder level where it was originally granted.

Key Concept

Resource Hierarchy IAM Policy Inheritance
Question 79Question →

An enterprise organization is designing a custom-mode Virtual Private Cloud (VPC) network in Google Cloud to support a multi-region deployment across `us-east4` and `europe-west3`. The VPC will connect to an existing on-premises data center via Cloud VPN with BGP dynamic routing over an on-premises IP block of 172.20.0.0/14172.20.0.0/14. Additionally, the team plans to deploy VPC-native Google Kubernetes Engine (GKE) clusters in both regions. Which TWO networking design choices are required to ensure proper IP allocation and prevent routing conflicts?

Select all that apply

Show answer & explanation

Answer: Design subnets with primary IP ranges in each region that do not overlap with each other or with the 172.20.0.0/14172.20.0.0/14 on-premises CIDR block.; Define separate, non-overlapping secondary IP ranges for GKE pods and services within each regional subnet.

Answer

The correct requirements are to design primary IP ranges in each region that do not overlap with each other or on-premises networks, and to define separate, non-overlapping secondary IP ranges for GKE pods and services within each regional subnet.
In custom-mode VPC networks connected to on-premises data centers, primary subnet IP ranges must be non-overlapping across regions and with on-premises CIDR blocks (172.20.0.0/14172.20.0.0/14) to enable accurate BGP route propagation over Cloud VPN. Furthermore, VPC-native GKE clusters rely on secondary subnet ranges for pods and services, which must be unique across all subnets to prevent internal IP conflicts within the global VPC network.

Step-by-Step Solution

1
Analyze primary subnet IP space requirements for hybrid routing.
In a custom VPC connected to an on-premises network (172.20.0.0/14172.20.0.0/14), primary CIDR blocks for every regional subnet must be non-overlapping across the VPC and the on-premises network.
Overlapping primary CIDRs break dynamic routing (BGP over Cloud VPN) and prevent communication between GCP instances and on-premises hosts.
2
Evaluate secondary IP range requirements for VPC-native GKE clusters.
GKE pod and service ranges are configured as secondary IP ranges on subnets. Each regional subnet's secondary ranges must be distinct and non-overlapping across the global VPC.
VPC-native clusters assign alias IP addresses to pods from secondary ranges; overlapping secondary ranges lead to address collisions.
3
Reject invalid VPC creation modes and secondary range duplication.
Auto-mode VPCs use predefined CIDRs that conflict with enterprise networks, and duplicating secondary ranges across subnets creates duplicate IP routes.
Custom-mode VPC design is mandatory for enterprise hybrid setups.

Key Concept

VPC Subnet & Secondary Range IP Planning for Hybrid GKE Architectures
Estimated Time:2m 0s
Question 80Question →

An enterprise organization manages a Google Cloud resource hierarchy containing an Organization root node, a folder named `Production`, and a child project named `Payment-Service` inside `Production`. The security team wants to enforce strict network perimeter controls and ensure proper administrative access delegation across the environment. Which of the following statements correctly describe the behavior and management of Organization Policies in this resource hierarchy? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Enforcing an Organization Policy constraint at the `Production` folder level automatically applies the restriction to `Payment-Service` through resource hierarchy inheritance.; Assigning the Organization Policy Admin role (`roles/orgpolicy.policyAdmin`) gives an administrator the authority to configure constraints, but does not inherently grant data access or resource management permissions on Compute Engine instances.

Answer

The correct statements are that Organization Policy constraints enforced at a parent folder level automatically inherit down to child projects, and that the Organization Policy Admin role (`roles/orgpolicy.policyAdmin`) grants permission to manage constraints without conferring permissions to access underlying project resources.
Organization Policies inherit down the Google Cloud resource hierarchy, meaning policies enforced at a parent folder level automatically apply to all contained projects. Furthermore, Google Cloud maintains a strict separation of duties: the `roles/orgpolicy.policyAdmin` role allows administrators to manage policy constraints across the resource hierarchy without giving them access to project-level resource data or management operations.

Step-by-Step Solution

1
Analyze Organization Policy resource hierarchy inheritance behavior.
Constraints defined at higher levels of the hierarchy (such as Folders or the Organization root) pass down to child nodes (such as Projects) automatically.
Google Cloud Organization Policies adhere to hierarchical inheritance unless an explicit restore or override policy is applied at a child node.
2
Evaluate the distinction between Organization Policies and IAM permissions.
Organization Policies set guardrails on resource behaviors (what can be done to resources), whereas IAM roles define identity permissions (who can perform actions).
Enforcing an Organization Policy restriction does not alter IAM policy bindings, nor can IAM roles like `roles/owner` grant immunity from enforced Organization Policies.
3
Examine the scope of the `roles/orgpolicy.policyAdmin` role.
The Organization Policy Admin role provides administrative capabilities over organization policy constraints only, maintaining least privilege separation from workload administration.
Google Cloud enforces separation of duties between compliance policy governance and underlying infrastructure/data management.

Key Concept

Organization Policy inheritance and separation of governance controls from IAM access permissions across the resource hierarchy
PreviousPage 4 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin