Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 81Question →

A site reliability engineer is managing an existing Compute Engine Managed Instance Group (MIG) hosting a microservice. The application startup script requires approximately 4 minutes to download dependencies and launch the server on port 8080. After configuring an autohealing health check, newly provisioned instances are continuously marked unhealthy and recreated in a continuous cycle before completing initialization. Which configuration change should the engineer make to resolve this issue?

Show answer & explanation

Answer: Increase the initial delay setting in the Managed Instance Group autohealing policy to 300 seconds.

Answer

Configure the initial delay setting in the Managed Instance Group autohealing policy to 300 seconds to allow application initialization before health checking begins.
Configuring an initial delay in the Managed Instance Group autohealing policy defers health check evaluation until the specified period elapses. Because the startup script takes approximately 4 minutes (240 seconds), setting an initial delay of 300 seconds ensures the application on port 8080 is fully running before probes assess health.

Step-by-Step Solution

1
Identify the cause of the continuous instance recreation cycle.
The autohealing health check evaluates the VM on port 8080 before the 4-minute startup script completes, marking the instance unhealthy and triggering a restart.
By default, health checking begins immediately or before the application service becomes responsive if the initial delay is insufficient.
2
Determine the proper Google Cloud Compute Engine MIG configuration parameter.
The initial delay (cool-down period for autohealing) specifies how long the MIG waits after VM creation before evaluating health check status.
Setting the initial delay to 300 seconds gives the 4-minute startup process sufficient buffer time to complete cleanly.

Key Concept

Compute Engine MIG Autohealing Initial Delay
Estimated Time:1m 15s
Question 82Question →

An e-commerce enterprise is planning its Google Cloud Compute Engine resource strategy for two distinct backend services:

1. An image processing service that runs batch resizing jobs on user-uploaded media. The jobs are stateless, fault-tolerant, and support checkpointing.
2. A 24/7 high-performance in-memory inventory caching service that requires massive RAM capacity and uninterrupted availability.

Which TWO deployment strategies should the cloud engineer implement to optimize cost and performance for these workloads? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Spot VM instances for the image processing batch service to achieve significant cost savings for fault-tolerant tasks.; Deploy Memory-optimized (M-series) VM instances backed by Committed Use Discounts (CUDs) for the inventory caching service.

Answer

The correct strategies are deploying Spot VM instances for the stateless image processing batch service and deploying Memory-optimized (M-series) instances with Committed Use Discounts (CUDs) for the 24/7 in-memory inventory caching service.
The correct choices match workload characteristics to GCP compute offerings: Spot VMs deliver maximum cost efficiency for fault-tolerant, checkpointed batch jobs, while Memory-optimized instances combined with Committed Use Discounts (CUDs) ensure high RAM allocation and predictable pricing for continuous 24/7 workloads.

Step-by-Step Solution

1
Analyze the workload requirements for the image processing service.
The image processing workload is stateless, batch-oriented, fault-tolerant, and supports checkpointing.
Fault-tolerant batch jobs that can handle interruptions are prime candidates for Spot VMs, which provide significant savings over on-demand pricing.
2
Analyze the workload requirements for the inventory caching service.
The inventory caching workload requires high RAM capacity, continuous 24/7 operation, and zero unplanned downtime.
Memory-optimized (M-series) machine types suit memory-heavy databases and caches, while Committed Use Discounts (CUDs) provide 1-year or 3-year cost reductions for predictable, continuous usage.
3
Evaluate potential discounting mechanisms and anti-patterns.
Spot VMs cannot be combined with Sustained Use Discounts, and Spot VMs should never be used for non-fault-tolerant production caching layers.
Selecting appropriate machine families and provisioning models requires matching business SLA and uptime needs with GCP billing structures.

Key Concept

Compute Engine Machine Type Selection and Pricing Model Optimization
Estimated Time:2m 0s
Question 83Question →

A retail enterprise uses an automated provisioning script executed by a service account named `[email protected]`. The script is designed to create new workload projects within a specific organizational folder named `Digital-Storefronts` and link those newly created projects to the company's central Cloud Billing Account. Which IAM role assignments are required for the service account to execute this workflow while adhering to the principle of least privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the Project Creator role (roles/resourcemanager.projectCreator) to the service account on the Digital-Storefronts folder.; Grant the Billing Account User role (roles/billing.user) to the service account on the central Cloud Billing Account.

Answer

The service account requires the Project Creator role (roles/resourcemanager.projectCreator) granted on the Digital-Storefronts folder and the Billing Account User role (roles/billing.user) granted on the central Cloud Billing Account.
Creating a project inside a specific folder requires the Project Creator role (roles/resourcemanager.projectCreator) assigned at that target folder level. Linking any newly created project to a Cloud Billing Account requires the Billing Account User role (roles/billing.user) assigned directly on the Cloud Billing Account resource itself.

Step-by-Step Solution

1
Identify the permission required to create projects in a specific container.
The permission `resourcemanager.projects.create` is contained in the Project Creator role (`roles/resourcemanager.projectCreator`).
Assigning this role at the `Digital-Storefronts` folder level scopes project creation rights exclusively to that folder under least privilege.
2
Identify the permission required to link projects to a billing account.
Linking a project to a billing account requires `resourcemanager.projects.createBillingAssignment` on the project (inherent during project creation) and `billing.resourceAssociations.create` on the billing account.
The Billing Account User role (`roles/billing.user`) granted directly on the Cloud Billing Account resource provides the necessary billing association permission.

Key Concept

Assigning scoped predefined IAM roles for project creation within resource hierarchy folders and billing account association.
Question 84Question →

An organization is designing a new cloud architecture for two distinct workloads:
1. A stateless containerized HTTP API that experiences unpredictable traffic spikes and requires automatic scaling down to zero instances during idle periods to minimize costs with zero node-management overhead.
2. A fault-tolerant nightly batch processing worker that processes queued images for several hours and can tolerate sudden node interruptions without data loss.

Which TWO Google Cloud compute deployment options should the cloud engineer select to meet these requirements while optimizing cost and operational efficiency? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy the stateless containerized HTTP API to Cloud Run.; Deploy the fault-tolerant nightly batch processing workload on Spot Compute Engine virtual machines.

Answer

The correct compute choices are deploying the stateless containerized HTTP API on Cloud Run and deploying the fault-tolerant nightly batch processing workload on Spot Compute Engine virtual machines.
Deploying the stateless containerized HTTP API on Cloud Run satisfies the requirement for container execution with scale-to-zero capabilities and minimal operational overhead. Deploying the fault-tolerant batch processing workload on Spot Compute Engine VMs leverages deeply discounted compute capacity suited for interruptible jobs.

Step-by-Step Solution

1
Assess the requirements for Workload 1 (Stateless HTTP API).
The service is packaged as a container, requires scaling to zero, and demands zero infrastructure/node management overhead.
Cloud Run natively executes containerized web applications, automatically handles scaling from zero to match request volume, and abstracts away node management.
2
Assess the requirements for Workload 2 (Nightly Batch Worker).
The job runs for several hours, is fault-tolerant to unexpected interruptions, and prioritizes cost optimization.
Spot VMs provide deep cost savings for compute workloads that can accommodate preemptions.
3
Evaluate and eliminate suboptimal architectural options.
Refactoring containers for Cloud Functions, managing GKE Standard node pools manually, or hosting stateful non-fault-tolerant databases on Spot VMs violate operational or architectural constraints.
Selecting appropriate compute engines requires matching workload statefulness, fault tolerance, and management preferences to GCP service capabilities.

Key Concept

Selecting GCP Compute Services Based on Workload Characteristics (Cloud Run vs Spot VMs vs GKE)
Question 85Question →

An enterprise is deploying an application on Google Cloud Compute Engine that requires two distinct storage mechanisms: (1) a temporary session state cache requiring sub-millisecond latency and high IOPS where data persistence across VM stops/starts is not required, and (2) a relational database engine for order management requiring strict ACID compliance, regional high availability, automated backups, and minimal database administration overhead. Which TWO storage and database configurations should you select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach a Local SSD volume to the Compute Engine instance for the session state cache.; Provision a Cloud SQL instance with High Availability (HA) enabled for the relational database.

Answer

Attaching a Local SSD volume for the temporary session cache and provisioning a Cloud SQL instance configured with High Availability for the order management database.
Local SSD is designed for ultra-high performance, low-latency scratch space or ephemeral caching where data does not need to survive instance termination. Cloud SQL provides a fully managed relational database with automated backups, patching, and regional high availability via active-standby replication.

Step-by-Step Solution

1
Analyze session cache requirements
Requirements call for sub-millisecond write latency, high IOPS, and ephemeral retention where persistence across VM restarts is unnecessary.
Local SSD provides maximum IOPS and lowest latency by mounting storage directly to the physical host, perfect for non-persistent caching.
2
Analyze database requirements
Requirements specify a managed relational database with strict ACID compliance, regional HA, automated backups, and zero OS maintenance overhead.
Cloud SQL provides managed relational engines (MySQL/PostgreSQL/SQL Server) with built-in regional failover and automated maintenance.
3
Evaluate and reject improper architectural choices
Cloud Bigtable lacks relational multi-table transactional features, and Spot VMs risk unannounced terminations causing database outage/corruption.
Matching storage engine characteristics to workload durability and query patterns is critical for availability and correctness.

Key Concept

Selecting GCP Database and Block Storage Options Based on Workload Latency, ACID, and Availability Requirements
Estimated Time:2m 0s
Question 86Question →

Arrange the components of the Google Cloud resource hierarchy in sequence, starting from the highest level of administrative control down to the lowest level where individual services exist.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from highest level to lowest level is: Organization Node, Folder, Project, and Individual Resource.
In Google Cloud, the resource hierarchy is structured sequentially from the root Organization node down through Folders, then Projects, and finally to individual Cloud Resources.

Step-by-Step Solution

1
Identify the top root element of Google Cloud organizational management.
Organization Node is first.
The Organization node is the mandatory or structural root of the resource tree.
2
Identify the sub-organizational grouping mechanism beneath the root.
Folder is second.
Folders exist under the Organization node to organize departments, environments, or teams.
3
Identify the base boundary container for quotas, APIs, and billing.
Project is third.
Projects are contained within folders (or directly under an Organization) and group resources.
4
Identify the actual deployed infrastructure or asset.
Individual Resource is fourth.
Cloud resources (VMs, buckets, databases) must always reside inside a project.

Key Concept

Google Cloud Resource Hierarchy Structure
Question 87Question →

An enterprise architecture team is planning the serverless compute deployment strategy for two distinct workloads:

• Workload 1: A real-time telemetry ingestion service requiring persistent WebSocket connections, custom C-based system dependencies, and high per-instance concurrency.
• Workload 2: A stateless background worker processing individual object creation events from a Google Cloud Storage bucket.

Which TWO architectural decisions correctly satisfy these operational requirements using Google Cloud serverless services? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Workload 1 to Cloud Run, because Cloud Run supports custom container images, WebSocket connections, and configurable multi-concurrency per instance.; Deploy Workload 2 to Cloud Functions (2nd gen) or Cloud Run triggered via Eventarc, because both serverless platforms natively process Cloud Storage event notifications.

Answer

Deploy Workload 1 to Cloud Run to support custom container dependencies, WebSockets, and multi-concurrency. Deploy Workload 2 to Cloud Functions (2nd gen) or Cloud Run using Eventarc triggers for event-driven storage processing.
Cloud Run is required for Workload 1 because it allows custom container packaging for system-level dependencies, supports persistent WebSocket connections, and enables configurable multi-concurrency. Cloud Functions (2nd gen) or Cloud Run combined with Eventarc is optimal for Workload 2 because both provide seamless serverless execution in response to Cloud Storage events.

Step-by-Step Solution

1
Analyze the runtime requirements for Workload 1.
Workload 1 demands custom OS libraries (C-based dependencies), persistent WebSockets, and multi-concurrency per instance.
Cloud Run accepts arbitrary Docker images (enabling custom OS packages) and supports long-lived streaming connections (WebSockets) with concurrency up to 1000 requests per instance.
2
Analyze the operational requirements for Workload 2.
Workload 2 is a stateless background worker responding to Cloud Storage bucket object events.
Cloud Functions (2nd gen) and Cloud Run both integrate with Eventarc to process storage mutations automatically without maintaining permanent VM infrastructure.
3
Synthesize the serverless compute architecture choice.
Select Cloud Run for Workload 1, and Cloud Functions (2nd gen) or Cloud Run for Workload 2.
This alignment matches workload technical constraints to the capabilities of GCP serverless execution paradigms.

Key Concept

Evaluating serverless execution paradigms (Cloud Run vs Cloud Functions) based on container customization, protocol requirements (WebSockets), concurrency settings, and event-driven trigger integrations.
Question 88Question →

A system administrator needs permissions to fully manage Cloud SQL database instances and view Pub/Sub topics within a single Google Cloud project. Following Google Cloud security best practices for least privilege without using primitive roles, which TWO predefined IAM roles should be assigned to the administrator?

Select all that apply

Show answer & explanation

Answer: Cloud SQL Admin (roles/cloudsql.admin); Pub/Sub Viewer (roles/pubsub.viewer)

Answer

The correct predefined roles are Cloud SQL Admin (roles/cloudsql.admin) to manage Cloud SQL instances and Pub/Sub Viewer (roles/pubsub.viewer) to view Pub/Sub topics.
Cloud SQL Admin allows full management of Cloud SQL instances, while Pub/Sub Viewer allows viewing Pub/Sub topics and subscriptions without granting modification rights. Together, these predefined roles fulfill the requirements under the principle of least privilege.

Step-by-Step Solution

1
Identify the required permissions for managing Cloud SQL instances.
The Cloud SQL Admin role provides full management permissions for Cloud SQL without granting permissions to unrelated services.
Predefined roles are preferred over primitive roles to enforce the principle of least privilege.
2
Identify the required permissions for viewing Pub/Sub messaging topics.
The Pub/Sub Viewer role grants permission to view topics and subscriptions without administrative or modification privileges.
Read-only access requests should be mapped to Viewer predefined roles rather than Admin roles.

Key Concept

Applying the principle of least privilege using predefined IAM roles instead of primitive or overly permissive roles.
Question 89Question →

A company needs to deploy a stateless, containerized web application to Google Cloud. The workload requires automatic scaling in response to incoming HTTP request volume while minimizing the operational overhead of managing underlying virtual machine infrastructure. Which Google Cloud compute service best satisfies these requirements?

Show answer & explanation

Answer: Cloud Run

Answer

Cloud Run is the optimal compute service because it runs stateless containers in a fully managed serverless environment that auto-scales based on HTTP traffic without requiring virtual machine or cluster management.
Cloud Run is a fully managed serverless compute platform that directly executes stateless HTTP container images. It automatically scales instances up or down according to incoming request volume (including scaling to zero when idle) and completely eliminates the need to provision, configure, or maintain virtual machines or Kubernetes cluster nodes.

Step-by-Step Solution

1
Analyze the workload requirements
The workload is containerized, stateless, web/HTTP-based, and requires minimal infrastructure management.
Matching workload attributes to GCP compute paradigms determines the optimal service choice.
2
Evaluate Google Cloud serverless container options
Cloud Run provides serverless execution for arbitrary container images with automatic scaling to zero and zero node management.
Cloud Run fulfills both the container deployment requirement and the minimal infrastructure operational constraint.

Key Concept

Selecting Serverless Container Platforms for Stateless Workloads
Question 90Question →

An organization is planning to deploy a large in-memory relational database on Google Cloud Compute Engine. The workload requires high memory-to-vCPU ratios and continuous, uninterrupted operational availability. Which Compute Engine machine family should you select?

Show answer & explanation

Answer: Memory-optimized machine family

Answer

Memory-optimized machine family
The memory-optimized machine family is designed specifically for memory-intensive workloads like large in-memory databases, delivering high memory per vCPU alongside continuous availability.

Step-by-Step Solution

1
Identify the workload requirements
The application requires high RAM capacity per core and non-interruptible operation.
In-memory database workloads demand specific compute profiles to run efficiently without resource throttling.
2
Evaluate Compute Engine machine families
Memory-optimized machine types offer high memory-to-vCPU ratios ideal for large databases.
General-purpose and compute-optimized families do not supply sufficient RAM density per vCPU.
3
Verify availability constraints
Standard virtual machine provisioning guarantees non-preemptible uptime.
Spot instances can be reclaimed at any moment, violating SLA uptime expectations.

Key Concept

Planning Compute Engine Resources and Machine Types
Question 91Question →

A financial company is planning to migrate a stateless API backend written in Go to Google Cloud. The service must handle incoming REST HTTP requests, scale to zero during off-peak hours to minimize costs, and process up to 250 concurrent requests per container instance to reduce cold starts and optimize memory utilization. The engineering team has already packaged the application into a custom OCI/Docker container image that listens on the PORT environment variable. Which serverless compute option best satisfies these requirements with the lowest operational overhead?

Show answer & explanation

Answer: Deploy the custom container image directly to Cloud Run and set the concurrency configuration parameter to handle multiple requests per instance.

Answer

Deploying the custom container image to Cloud Run and configuring the concurrency setting is the correct choice.
Cloud Run is designed specifically to run stateless containerized applications that listen for HTTP requests. It supports configuring concurrency (allowing up to 1000 concurrent requests per instance, fitting the 250 request requirement), scales automatically from zero to thousands of instances, and eliminates server management overhead.

Step-by-Step Solution

1
Analyze deployment artifact and runtime requirements
The application is packaged as a custom Docker container image, requires handling HTTP REST traffic, must scale to zero, and needs multi-concurrency (processing up to 250 requests per instance).
Cloud Run natively deploys stateless container images listening on HTTP ports and natively supports request multi-concurrency per container instance.
2
Evaluate serverless compute options against requirements
Cloud Run fits all criteria natively without code refactoring or infrastructure provisioning.
Cloud Functions 1st Gen processes only a single request per instance concurrently and does not deploy custom arbitrary containers.

Key Concept

Selecting Cloud Run vs Cloud Functions based on containerization, concurrency, and trigger requirements.
Question 92Question →

Your organization structures its Google Cloud resources using a resource hierarchy where the Finance department operates within a dedicated folder containing several workload projects. A compliance auditor requires read-only permissions to inspect configuration settings across all current projects within the Finance folder, as well as any new projects created inside this folder in the future. Following Google Cloud recommended practices and the principle of least privilege, which action should you take?

Show answer & explanation

Answer: Grant the predefined Security Reviewer role (roles/iam.securityReviewer) on the Finance folder.

Answer

Grant the predefined Security Reviewer role (roles/iam.securityReviewer) on the Finance folder.
In Google Cloud's resource hierarchy, IAM policies applied at a parent container (such as a folder) are automatically inherited by all child resources, including existing and future projects. Binding the predefined Security Reviewer role at the Finance folder level fulfills the auditing access requirement dynamically while strictly adhering to the principle of least privilege.

Step-by-Step Solution

1
Determine the appropriate level in the resource hierarchy for access binding.
Select the Finance folder level.
IAM policies set at the folder level automatically inherit to all present and future child projects within that folder.
2
Select an IAM role that satisfies the auditing requirement under least privilege.
Select the predefined Security Reviewer role (roles/iam.securityReviewer).
Predefined roles provide narrow permissions focused on viewing security configurations without giving unnecessary edit or administrative powers.

Key Concept

Resource Hierarchy IAM Policy Inheritance and Predefined Roles
Question 93Question →

You are setting up a new project environment and need to enable the Compute Engine API using the Google Cloud CLI (`gcloud`). Which of the following represents the correct sequence of steps to safely verify context, enable the API, and confirm activation?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins by targeting the proper project context with `gcloud config set project`, checking current enabled services with `gcloud services list --enabled`, enabling the specific service via `gcloud services enable compute.googleapis.com`, and finally verifying activation with a filtered `gcloud services list` command.
Enabling a service API requires selecting the target project first so that modifications affect the intended GCP resource. Inspecting existing enabled services before enabling and filtering the enabled list after enabling establishes standard operational hygiene for managing Service Usage in Google Cloud.

Step-by-Step Solution

1
Set active gcloud project context
CLI configuration points to the desired GCP project ID
Prevents enabling APIs in the wrong project or organization scope
2
Inspect currently enabled APIs
List of active services for the target project is displayed
Establishes baseline status of enabled APIs
3
Enable the target API service
Service Usage API processes the enablement request for `compute.googleapis.com`
Activates the required underlying GCP service capabilities
4
Filter and confirm enabled status
Confirmation that `compute.googleapis.com` appears in the enabled services list
Validates that enablement completed without error

Key Concept

Enabling Cloud Service APIs via gcloud CLI workflow
Question 94Question →

You need to allow a team of developers to enable and disable Google Cloud service APIs within a specific project. Following the principle of least privilege, you must avoid granting unnecessary administrative permissions over other project resources. Which IAM role should you grant to the developers?

Show answer & explanation

Answer: Service Usage Admin (roles/serviceusage.serviceUsageAdmin)

Answer

The Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) should be assigned because it grants permissions to enable and disable Cloud APIs following least privilege.
The Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) contains permissions to administer service usage, including enabling and disabling Google Cloud APIs within a project, satisfying the minimum required privileges requirement.

Step-by-Step Solution

1
Identify the specific task required
The task requires enabling and disabling Google Cloud service APIs in a project.
Understanding the precise permission needed prevents over-privileging.
2
Apply the principle of least privilege
Select a predefined role scoped specifically to Service Usage management rather than broad primitive or organization-level roles.
Predefined roles provide targeted permissions without unnecessary administrative capabilities.
3
Select the correct predefined IAM role
Choose Service Usage Admin (roles/serviceusage.serviceUsageAdmin).
This role includes serviceusage.services.enable and serviceusage.services.disable permissions.

Key Concept

IAM Roles for Enabling and Managing Cloud Service APIs
Question 95Question →

Your development team has developed a stateless HTTP web application packaged inside a custom Docker container image. You need to deploy this application to Google Cloud using a fully managed serverless platform that automatically scales up with traffic and scales down to zero when idle. Which Google Cloud service should you choose?

Show answer & explanation

Answer: Cloud Run

Answer

Cloud Run is the optimal choice for deploying custom stateless Docker container images on a fully managed serverless compute platform that scales to zero.
Cloud Run is Google Cloud's serverless platform for deploying arbitrary stateless containers over HTTP. It handles scaling automatically, including scaling down to zero instances when no requests are being processed.

Step-by-Step Solution

1
Identify the application requirements
The application is packaged as a custom Docker container, is stateless, handles HTTP web requests, and requires automatic scaling down to zero.
Determining architectural constraints narrows down serverless compute options in Google Cloud.
2
Compare serverless compute options in Google Cloud
Cloud Run directly accepts custom container images and scales HTTP requests serverlessly, whereas Cloud Functions relies on source code snippets.
Cloud Run is designed specifically to run arbitrary stateless containers in a serverless environment.

Key Concept

Selecting serverless compute services based on containerization and scaling requirements
Question 96Question →

A company is planning to deploy a stateless containerized web service packaged as a custom Docker image. The workload experiences unpredictable HTTP traffic spikes, requires automatic scaling down to zero instances during idle periods to minimize operational costs, and must be deployed with zero virtual machine or Kubernetes cluster management overhead. Which Google Cloud compute platform best meets these requirements?

Show answer & explanation

Answer: Cloud Run

Answer

Cloud Run is the optimal compute platform for containerized stateless web applications that require automatic scaling to zero with zero cluster management overhead.
Cloud Run is a fully managed serverless platform that deploys stateless container images directly. It automatically scales instances up to match incoming HTTP traffic and scales down to zero when no requests are being processed, completely eliminating cluster administration and idle compute costs.

Step-by-Step Solution

1
Analyze workload characteristics
The application is stateless, packaged as a Docker container, and processes HTTP requests with fluctuating demand.
Containerization and HTTP request pattern make the application eligible for container-based platforms.
2
Evaluate operational and cost requirements
The solution requires scaling to zero during idle times and zero infrastructure/cluster management overhead.
This rules out IaaS (Compute Engine) and managed Kubernetes clusters (GKE Standard) that require node management.
3
Select the appropriate GCP serverless platform
Cloud Run runs arbitrary Docker containers serverlessly while scaling to zero and eliminating node maintenance.
Cloud Run directly satisfies container portability and zero-management requirements better than function-based serverless runtimes.

Key Concept

Selecting Cloud Compute Services Based on Workload Characteristics and Operational Overhead
Estimated Time:1m 30s
Question 97Question →

Your organization is initializing a new Google Cloud project named `analytics-prod-12` to deploy containerized application workloads. A Cloud Engineer needs to enable the Cloud Run API (`run.googleapis.com`) for `analytics-prod-12` using the `gcloud` CLI while strictly adhering to the principle of least privilege. Which command and IAM role grant should the engineer use to successfully enable the service API?

Show answer & explanation

Answer: Grant the engineer the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on `analytics-prod-12`, and execute `gcloud services enable run.googleapis.com --project=analytics-prod-12`.

Answer

Grant the engineer the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on `analytics-prod-12`, and execute `gcloud services enable run.googleapis.com --project=analytics-prod-12`.
To enable Google Cloud service APIs in a project while following security best practices, you must assign the predefined Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`), which grants permissions to enable and disable services without granting full project ownership. The correct gcloud CLI command syntax to enable an API for a specific project is `gcloud services enable SERVICE_NAME --project=PROJECT_ID`.

Step-by-Step Solution

1
Identify the required IAM permissions for managing GCP Service APIs.
The Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) provides the permissions necessary to enable, disable, and inspect APIs in a project without granting excessive administrative rights.
Adhering to the principle of least privilege requires avoiding broad primitive roles like Owner or Editor when specific predefined roles exist.
2
Determine the correct Cloud SDK (`gcloud`) command syntax for enabling an API.
The syntax is `gcloud services enable SERVICE_NAME --project=PROJECT_ID`.
Specifying the `--project` flag guarantees that the API is enabled in the intended project (`analytics-prod-12`).

Key Concept

Enabling Cloud Service APIs using least-privilege IAM roles and the gcloud CLI
Question 98Question →

A financial services company is planning to deploy a dedicated transaction reporting microservice on Google Cloud Compute Engine. The service runs continuously 24/7 and requires an uninterrupted baseline of 4 vCPUs and 26 GB of RAM to meet strict Service Level Agreements (SLAs). Standard machine types offer either insufficient memory or excess unneeded vCPUs for this specific memory ratio. Which compute provisioning strategy should you choose to meet the operational requirements while minimizing costs?

Show answer & explanation

Answer: Provision a custom machine type with 4 vCPUs and 26 GB of RAM on Compute Engine, and purchase a Committed Use Discount (CUD) for the baseline capacity.

Answer

Provision a custom machine type with 4 vCPUs and 26 GB of RAM on Compute Engine, and purchase a Committed Use Discount (CUD) for the baseline capacity.
Custom Machine Types enable exact tailoring of CPU and RAM allocations when standard predefined shapes do not match the required memory ratio. Purchasing a Committed Use Discount (CUD) provides deep pricing discounts for steady-state 24/7 baseline capacity without risking preemption.

Step-by-Step Solution

1
Analyze workload resource requirements and operational constraints.
The workload runs 24/7 as a steady baseline, requires uninterrupted SLA execution, and needs a specific non-standard ratio of 4 vCPUs to 26 GB RAM.
Determining exact resource constraints prevents paying for excess vCPUs found in predefined machine shapes.
2
Select the appropriate Compute Engine machine configuration.
Create a Custom Machine Type with 4 vCPUs and 26 GB RAM.
Custom Machine Types enable tailor-made CPU and memory configurations when standard predefined shapes do not fit optimal resource ratios.
3
Select the cost optimization model for steady baseline usage.
Apply a Committed Use Discount (CUD) for the baseline compute resources.
Committed Use Discounts offer substantial savings for predictable 24/7 workloads without operational preemption risk.

Key Concept

Custom Machine Types and Committed Use Discounts (CUDs) for continuous Compute Engine workloads
Question 99Question →

Your organization uses a central CI/CD project named `proj-pipeline` hosting a deployment service account. This service account is configured to provision microservices inside a dedicated workload project named `proj-microservices-prod`. During the initial deployment execution, the pipeline fails with an error indicating that the Cloud Run API (`run.googleapis.com`) is not enabled. Following Google Cloud security and operational best practices, which action should be performed to resolve this issue?

Show answer & explanation

Answer: Enable the `run.googleapis.com` API inside `proj-microservices-prod` using an identity granted the Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role on `proj-microservices-prod`.

Answer

Enable the `run.googleapis.com` API inside `proj-microservices-prod` using an identity granted the Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role on `proj-microservices-prod`.
In Google Cloud, API enablement is scoped to individual projects where resources reside. To deploy Cloud Run services in `proj-microservices-prod`, the `run.googleapis.com` API must be enabled on `proj-microservices-prod`. Using the predefined Service Usage Admin role adheres to the principle of least privilege.

Step-by-Step Solution

1
Identify the resource target project
Resources (Cloud Run services) are being created inside `proj-microservices-prod`.
Google Cloud service APIs must be enabled on the target project hosting the resources, not the project initiating the deployment request.
2
Select the appropriate IAM permission role following least privilege
The Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) provides the `serviceusage.services.enable` permission.
Predefined roles specific to Service Usage should be preferred over broad primitive roles like Owner or Editor.
3
Enable the API using gcloud CLI or Cloud Console
Execute `gcloud services enable run.googleapis.com --project=proj-microservices-prod`.
Enabling the service API allows resource allocation and API calls targeting that service in `proj-microservices-prod`.

Key Concept

Enabling and Managing Cloud Service APIs
Question 100Question →

An enterprise organization is onboarding a specialized engineering team and needs to establish a new, isolated project environment under an existing Organization node. The administrator must create a dedicated folder, create a project inside it, link an active enterprise billing account, enable the Compute Engine API, and grant the team necessary permissions using least-privilege predefined roles via the gcloud CLI. What is the correct sequence of administrative steps to configure this environment?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: 1) Create the parent folder under the organization, 2) Create the project inside the folder, 3) Link the project to the billing account, 4) Enable the Compute Engine API on the project, and 5) Apply IAM policy bindings to grant permissions.
The deployment sequence must follow physical and logical resource dependencies in Google Cloud: establish the parent hierarchy container (Folder), instantiate the child project inside it, link monetary resource tracking (Billing Account), activate required service capabilities (APIs), and grant scoped access permissions (IAM Policy Bindings).

Step-by-Step Solution

1
Create the structural Folder container under the Organization
A new folder resource is established under the organization node.
Folders serve as logical grouping mechanisms and IAM/policy inheritance boundaries for projects.
2
Instantiate the Project within the created Folder
The project is created under the specified folder in the resource hierarchy.
Projects are child nodes of folders or organizations and host actual GCP resources.
3
Link the Project to an enterprise Billing Account
Billing is linked to the project ID.
Google Cloud requires an active billing account association before enabling paid APIs or provisioning infrastructure.
4
Activate the required Cloud Service APIs
The Compute Engine API (`compute.googleapis.com`) is enabled for the project.
APIs are disabled by default on new projects and must be enabled before underlying resources can be accessed.
5
Bind predefined IAM roles at the Project level
Developer Google Group receives scoped predefined roles on the project.
Applying least-privilege IAM bindings at the project level secures resource access after service initialization.

Key Concept

Resource Hierarchy Provisioning Lifecycle and Administrative Scoping Sequence
PreviousPage 5 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin