All practice questions
1591 questions
A Cloud Engineer needs to update an existing Compute Engine Managed Instance Group (MIG) to use a new VM configuration. In which sequence should the engineer execute the administrative steps to perform a zero-downtime rolling update?
Drag items to arrange them in the correct order
An enterprise operations team is managing a mission-critical containerized microservice named `payment-service` deployed on Cloud Run. Security policy mandates two strict operational requirements:
1. The service must block direct public internet access and only accept inbound requests routed through an internal Application Load Balancer or internal VPC resources.
2. All outbound requests made by container instances to external third-party payment gateways must egress through a static, reserved IP address using a Cloud NAT instance attached to the company's Virtual Private Cloud (VPC).
Which TWO configuration settings or `gcloud run services update` command flags must be configured on the Cloud Run resource to meet these security requirements? (Select TWO.)
Select all that apply
Your production Cloud SQL for PostgreSQL database instance is experiencing high CPU utilization caused by heavy analytical reporting queries. You need to offload this read-only query workload from the primary database instance with minimal operational effort. What should you do?
A DevOps engineering team is designing the network architecture for an internal real-time metrics ingestion service hosted on Compute Engine instances across multiple zones within a single region. The service receives incoming data via a custom raw TCP protocol on port 9090. The backend instances must receive the original client IP addresses to perform IP-based rate limiting and logging. All client traffic originates from within the internal Virtual Private Cloud (VPC). Which Google Cloud load balancer should you choose for this workload?
An organization needs to configure IAM permissions for an automated monitoring service account. The service account must be able to read log entries in Cloud Logging for a specific project and upload generated report files into a designated Cloud Storage bucket, without being able to read or modify existing files in that bucket. Adhering strictly to Google Cloud's principle of least privilege, which TWO role assignments should be granted? (Select TWO.)
Select all that apply
An organization is planning the storage architecture for an enterprise application running on Compute Engine virtual machines. The workload has two distinct operational requirements:
1. A fully managed relational database that supports standard SQL and ACID transactions with automatic regional High Availability (HA) failover.
2. Extremely high-throughput, low-latency ephemeral scratch space attached directly to individual VM instances for temporary cache calculations, where data persistence after instance termination is not required.
Which TWO database and storage options should the Cloud Engineer select to satisfy these requirements? (Select TWO.)
Select all that apply
An enterprise database team plans to execute a long-running, non-fault-tolerant database schema migration on Google Cloud Compute Engine. The job requires 12 hours of uninterrupted processing and cannot withstand instance termination or preemption mid-execution. Additionally, administrative access for the operational team responsible for starting, stopping, and maintaining these instances must adhere strictly to the principle of least privilege. Which configuration strategy should the Cloud Engineer implement to meet these requirements following Google-recommended best practices?
A cloud administrator needs to securely provision a Compute Engine virtual machine instance that uses a Customer-Managed Encryption Key (CMEK) for its boot disk and runs a startup script retrieved from a private Cloud Storage bucket. In what sequence should the administrator execute the administrative tasks to ensure successful VM provisioning and execution under least privilege?
Drag items to arrange them in the correct order
A DevOps engineer receives access to a newly provisioned Google Kubernetes Engine (GKE) Standard cluster named `analytics-cluster` located in the `us-east1-b` zone. When running `kubectl get nodes`, the command fails with an error indicating that connection to `localhost:8080` was refused because the local environment lacks cluster endpoint credentials. Which `gcloud` command must the engineer execute to generate the necessary `kubeconfig` entry and enable `kubectl` management?
Your team manages a production Cloud SQL for PostgreSQL instance configured with High Availability (HA) across two zones in the us-central1 region. As part of a disaster recovery audit, you are required to perform a controlled failover test to verify that the standby instance takes over primary duties without destroying or re-creating the database instance. Which command or action should you execute to accomplish this operational task?
A cloud operations engineer manages a regional Google Kubernetes Engine (GKE) Standard cluster hosting stateless web services and background batch workloads. During peak traffic events, newly created Pods remain in the `Pending` state with `Insufficient cpu` status events, even though the cluster has autoscaling enabled globally. Investigation reveals that the specific node pool handling these Pods was created with a fixed size of 3 nodes and lacks node-pool-level autoscaling settings. Which command should the engineer execute to enable automatic node scaling for this specific node pool so it can scale from 3 up to 10 nodes when Pods cannot be scheduled?
A healthcare technology company is planning its Google Kubernetes Engine (GKE) cluster architecture to host an electronic health record integration system. The application requires strict network security, meaning cluster nodes must only have private internal IP addresses with restricted egress access through Cloud NAT. Additionally, the infrastructure team wants to eliminate manual worker node management, node provisioning, and security patching overhead without needing custom Linux kernel configurations. Which GKE cluster architectural design best satisfies these operational and security requirements?
A cloud engineer needs to deploy a containerized microservice to an existing Google Kubernetes Engine (GKE) cluster using kubectl. Running kubectl commands currently fails because the local environment lacks authentication credentials for the cluster. Additionally, the microservice requires access to Cloud Storage buckets and must adhere to Google Cloud security best practices by avoiding long-lived downloaded service account keys. Which TWO actions should the cloud engineer perform?
Select all that apply
A system administrator is deploying a production Cloud SQL for MySQL database named `corp-db` in the `us-central1` region. The instance must be configured with High Availability for multi-zone redundancy and must be restricted to internal network traffic within an existing VPC network named `prod-vpc`. Which TWO configuration steps must be performed to meet these requirements?
Select all that apply
An administrator needs to configure a continuous BigQuery billing export for detailed cost analysis across an organization. Arrange the following steps in the correct order to set up the BigQuery billing export from start to finish.
Drag items to arrange them in the correct order
Your organization runs a high-traffic e-commerce application on Google Cloud. Analytical clickstream event data is written continuously to a Cloud Bigtable instance, while transactional orders are stored in a Cloud SQL for PostgreSQL instance. Monitoring alerts indicate that CPU utilization on the Cloud Bigtable cluster has exceeded 80% for the past 20 minutes, leading to increased write latency for incoming events. You need to quickly mitigate the Bigtable performance bottleneck without causing data loss or downtime. Which action should you take?
A cloud systems engineer is deploying a non-fault-tolerant telemetry processing application onto a Google Compute Engine VM named `telemetry-node-01` in the `europe-west3-a` zone. The VM requires a dedicated user-managed service account `[email protected]` for identity authorization, must attach an existing persistent disk named `log-archive-disk` in read-only mode to prevent data corruption, and must not be assigned a public external IP address. Which `gcloud` command correctly provisions this Compute Engine virtual machine instance according to these requirements?
Your organization needs to configure Google Cloud DNS to resolve internal service hostnames to private IP addresses within a Virtual Private Cloud (VPC) network. In what order should an engineer perform the administrative steps to establish and validate internal DNS resolution?
Drag items to arrange them in the correct order
A software engineer needs to deploy new revisions to an existing Cloud Run service and view application logs in a specific Google Cloud project. The engineer must not be able to modify service IAM policies, delete the service, or manage other infrastructure in the project. Which role assignment follows Google's recommended practice of least privilege?
An enterprise IoT management solution running on Compute Engine instances inside a Virtual Private Cloud (VPC) receives raw, non-HTTP TCP telemetry data on port 8883 from internal client instances. The client instances must reach the load balancing backend using a private domain name (iot.internal.example.com), and the solution must preserve client source IP addresses for logging. Which TWO architectural components should you configure to meet these requirements?
Select all that apply