Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 981Question →

An administrator needs to allow incoming traffic on TCP port 8443 for an existing firewall rule named app-ingress in a Google Cloud Virtual Private Cloud (VPC). Which gcloud command should be executed to modify this existing firewall rule?

Show answer & explanation

Answer: gcloud compute firewall-rules update app-ingress --allow tcp:8443

Answer

The command 'gcloud compute firewall-rules update app-ingress --allow tcp:8443' correctly modifies the existing rule to allow traffic on port 8443.
To modify an existing Google Cloud firewall rule, the command group 'gcloud compute firewall-rules update' must be used along with the '--allow' parameter specifying the target protocol and port.

Step-by-Step Solution

1
Identify the target resource group in the gcloud CLI
Firewall rules in GCP are managed under 'gcloud compute firewall-rules'.
Networking firewall rules belong to the compute service group.
2
Determine the correct verb for modifying an existing configuration
The verb 'update' is used to change existing resources, whereas 'create' is used for new resources.
Attempting to create an existing rule will result in a resource conflict error.
3
Select the proper flag to specify allowed protocols and ports
The flag '--allow tcp:8443' specifies protocol tcp and port 8443.
The '--allow' flag accepts protocol:port format.

Key Concept

Modifying existing VPC firewall rules using gcloud compute firewall-rules update
Question 982Question →

A cloud engineer needs to configure a fine-grained custom IAM role for a service account using the gcloud CLI to enforce least privilege access in a Google Cloud project. What is the correct sequence of steps to create the custom role, provision the service account, and apply the required access permissions?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order is to draft the custom role YAML definition file, run `gcloud iam roles create` to create the role resource, run `gcloud iam service-accounts create` to provision the service account identity, and finally execute `gcloud projects add-iam-policy-binding` to assign the role to the service account.
The sequence follows mandatory resource dependencies: permissions are defined in a specification file, the custom role is registered in GCP IAM, the target service account identity is provisioned, and finally the role is bound to the identity using project policy bindings.

Step-by-Step Solution

1
Prepare the custom IAM role definition locally in YAML format.
A structured YAML file containing title, description, stage, and allowed permissions.
The gcloud CLI requires a YAML or JSON definition file to specify custom permission sets.
2
Create the custom IAM role resource in the GCP project.
The custom role is registered and assigned a unique role ID within the project.
IAM roles must exist in the target hierarchy before policy bindings can reference them.
3
Create the service account identity.
A service account principal is initialized with a generated email identifier.
A valid principal identity must exist before IAM roles can be granted to it.
4
Bind the custom role to the service account on the project resource.
The project's IAM policy is updated to grant the specified role permissions to the service account.
Adding an IAM policy binding completes the access configuration by attaching the role to the identity.

Key Concept

Managing IAM Roles and Resource Access Permissions via gcloud CLI
Estimated Time:1m 30s
Question 983Question →

An operator accidentally deleted a critical customer table from a production Cloud SQL for PostgreSQL instance at 14:15 UTC. Automated daily backups and transaction logging (point-in-time recovery) are enabled on the instance. You must restore the database to a new instance to recover the missing data and resume normal operations. Sequence the correct order of steps to complete this recovery process.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Identify the exact timestamp prior to deletion, 2) Execute the point-in-time restore to a new Cloud SQL instance, 3) Verify data integrity on the restored instance, and 4) Update application connection parameters to point to the new instance.
The proper administrative workflow begins by determining the target timestamp immediately prior to data corruption. Next, a point-in-time restoration is executed targeting a new instance. Once provisioned, the database contents are validated for completeness, and finally the application connection parameters are updated to route traffic to the restored instance.

Step-by-Step Solution

1
Locate the precise restore target timestamp.
Obtained a timestamp (e.g., 14:14 UTC) immediately prior to the table drop event.
Restoring to a timestamp after the drop event would still result in missing data.
2
Provision and populate a new Cloud SQL instance using point-in-time recovery.
A new Cloud SQL instance is created containing the state of the database up to the designated timestamp.
Cloud SQL PITR requires specifying a target instance to prevent accidental overwrites of live production instances.
3
Inspect the restored database instance.
Confirmed that the deleted table exists and all data is present and uncorrupted.
Operational best practices require verification before switching application connections.
4
Reconfigure application connection endpoints.
Application workloads now communicate with the newly verified Cloud SQL instance.
Updating connection strings or Secret Manager references directs live traffic to the recovered instance.

Key Concept

Cloud SQL Point-in-Time Recovery (PITR) and Instance Management
Question 984Question →

A DevOps engineer needs to safely migrate running workloads from an existing GKE node pool named `old-pool` to a newly created node pool named `new-pool` in a GKE Standard cluster without incurring unexpected downtime. Arrange the operational steps in the correct order to safely migrate the workloads and decommission the old node pool.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of operations is: first cordon the nodes in `old-pool` to prevent new pod assignments, then drain `old-pool` to evict existing pods, next verify workload readiness on `new-pool`, and finally delete `old-pool` using gcloud.
To perform a zero-downtime workload migration between GKE node pools, the existing nodes must first be cordoned (`kubectl cordon`) so Kubernetes marks them unschedulable. Next, nodes are drained (`kubectl drain`) to evict existing pods, forcing them to reschedule onto the new node pool. After verifying that the pods are healthy and running on the new node pool, the old node pool can be safely deleted using `gcloud container node-pools delete`.

Step-by-Step Solution

1
Mark nodes in `old-pool` as unschedulable using `kubectl cordon`.
Prevents new pod replicas from being scheduled on `old-pool` nodes.
Cordoning first ensures that evicted pods are directed to `new-pool` instead of being rescheduled back onto `old-pool`.
2
Gracefully evict workloads using `kubectl drain <node-name> --ignore-daemonsets` on nodes in `old-pool`.
Safely terminates pods on `old-pool` so Kubernetes recreates them on `new-pool`.
Draining ensures pods are evicted cleanly while ignoring system DaemonSets.
3
Inspect workload pod status and service health on `new-pool`.
Confirms all pods are in the `Running` state and ready to handle user requests.
Verification prevents deleting infrastructure while workloads might be failing to schedule or start.
4
Execute `gcloud container node-pools delete old-pool` to delete the old node pool.
Decommissions the compute instances associated with `old-pool` in GCP.
Deletes obsolete GCP compute resources after successful workload migration.

Key Concept

Safely migrating workloads between GKE node pools using cordon, drain, health verification, and node pool deletion commands.
Question 985Question →

A backend development team requires permissions to publish messages to existing Cloud Pub/Sub topics and pull messages from existing subscriptions within the `app-messaging-prod` project. The team must not be permitted to create, modify, or delete Pub/Sub topics or subscriptions, nor should they receive access to any other projects within the resource hierarchy. Which TWO IAM role bindings should be granted to the team's principal group to adhere to the Principle of Least Privilege?

Select all that apply

Show answer & explanation

Answer: Grant the Pub/Sub Publisher role (roles/pubsub.publisher) on project app-messaging-prod.; Grant the Pub/Sub Subscriber role (roles/pubsub.subscriber) on project app-messaging-prod.

Answer

Granting the Pub/Sub Publisher role (roles/pubsub.publisher) and the Pub/Sub Subscriber role (roles/pubsub.subscriber) bound at the specific project level (app-messaging-prod).
To satisfy least privilege requirements for message publishing and consumption in a single project, specific predefined roles—Pub/Sub Publisher and Pub/Sub Subscriber—must be assigned directly on the target project. This ensures the team can execute message data operations without receiving topic creation privileges or permissions on other projects.

Step-by-Step Solution

1
Analyze the operational requirements.
The team only needs to publish messages and consume/acknowledge messages from existing Pub/Sub resources.
Administrative rights such as creating or deleting topics/subscriptions are explicitly forbidden.
2
Select predefined IAM roles matching the principle of least privilege.
The Pub/Sub Publisher (roles/pubsub.publisher) and Pub/Sub Subscriber (roles/pubsub.subscriber) roles provide granular access for publishing and message consumption respectively.
Primitive roles like Editor grant overly broad permissions across multiple GCP services.
3
Identify the correct resource hierarchy scope.
Bind the predefined roles directly at the target project level (`app-messaging-prod`).
Binding roles at a parent Folder or Organization level would inherit permissions down to unintended sibling projects.

Key Concept

Granting Granular Predefined IAM Roles at the Target Project Scope under Least Privilege
Question 986Question →

An enterprise application requires a fully managed relational database that provides strong consistency, horizontal scaling, and multi-region transactional replication across multiple continents. A cloud engineer needs to deploy this database instance named `global-orders-db` with 3 nodes using a multi-region configuration (`nam-eur-asia1`). Which command should the cloud engineer run to provision this database instance?

Show answer & explanation

Answer: gcloud spanner instances create global-orders-db --config=nam-eur-asia1 --description="Global Orders Database" --nodes=3

Answer

The command 'gcloud spanner instances create global-orders-db --config=nam-eur-asia1 --description="Global Orders Database" --nodes=3' correctly provisions the required multi-region Cloud Spanner instance.
Cloud Spanner is Google Cloud's managed relational database service designed for mission-critical transactional workloads requiring high availability and multi-region, strong consistency. The `gcloud spanner instances create` command uses the `--config` flag to specify regional or multi-region instance configurations (such as `nam-eur-asia1`) and the `--nodes` flag to allocate compute capacity.

Step-by-Step Solution

1
Identify the database engine requirement based on workload needs.
Cloud Spanner is selected because the workload requires a relational database with global horizontal scalability, strong consistency, and multi-region transactional support.
Neither Cloud SQL nor Cloud Bigtable satisfies the combined requirements of relational SQL query support and multi-region active-active transactional replication.
2
Determine the correct `gcloud` CLI command group and required flags for Cloud Spanner deployment.
Use `gcloud spanner instances create` with `--config` for instance location topology and `--nodes` for compute allocation.
Cloud Spanner topology is specified using predefined instance configurations (e.g., `nam-eur-asia1`) via `--config` rather than single-zone flags like `--zone`.

Key Concept

Cloud Spanner Instance Deployment and CLI Syntax
Question 987Question →

A renewable energy company is planning a Google Kubernetes Engine (GKE) cluster architecture to support two distinct cloud workloads:
1. A stateless telemetry ingestion API service with fluctuating traffic, where the operations team requires zero node management overhead and pod-level resource billing.
2. A fault-tolerant, stateless batch calculation engine that processes sensor data off-peak, where reducing compute cost is the primary constraint.

Which TWO cluster configuration decisions should the cloud engineering team implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision a GKE Autopilot cluster for the telemetry ingestion API workload.; Create a Spot VM node pool for the off-peak batch calculation engine workload.

Answer

The team should provision a GKE Autopilot cluster for the telemetry ingestion API service and create a Spot VM node pool for the off-peak batch calculation engine workload.
Provisioning a GKE Autopilot cluster satisfies the requirement for zero node management overhead and pod-based billing. Utilizing a Spot VM node pool for the stateless, fault-tolerant batch calculation engine drastically reduces operational compute costs.

Step-by-Step Solution

1
Analyze the operational requirements for the telemetry ingestion API workload.
GKE Autopilot is selected because it completely removes node management responsibilities from the operations team while enforcing pod-level billing.
GKE Autopilot automates node provisioning, updates, and maintenance.
2
Analyze the financial and operational constraints for the batch calculation workload.
A Spot VM node pool is selected for batch processing.
Spot VMs deliver substantial cost savings for stateless, fault-tolerant workloads that can tolerate unexpected instance preemptions.

Key Concept

Planning GKE cluster operational models (Autopilot vs. Standard) and node pool provisioning strategies (Spot VMs)
Question 988Question →

A financial services firm is migrating a custom relational PostgreSQL database to a Compute Engine virtual machine. The workload requires steady, reliable IOPS and low latency for transactional processing, but the engineering team wants a cost-effective block storage option that performs better than standard HDDs without paying the premium cost of high-performance SSDs. Additionally, the data must persist independently of the VM lifecycle and support automated snapshot backups. Which storage option best satisfies these requirements?

Show answer & explanation

Answer: Balanced Persistent Disk (pd-balanced)

Answer

Balanced Persistent Disk (pd-balanced) is the recommended GCP block storage solution for general enterprise workloads needing SSD performance at a lower cost point while retaining persistence and snapshot support.
Balanced Persistent Disk (pd-balanced) provides backed SSD storage optimized for enterprise applications that need a balance of performance and cost. It supports snapshots, persistent attach/detach capabilities, and reliable IOPS required by relational database engines like PostgreSQL on Compute Engine.

Step-by-Step Solution

1
Analyze storage persistence requirements
Database storage must persist when the Compute Engine VM stops or restarts and must support snapshots.
Ephemeral options like Local SSD lose data on instance stop events and cannot be backed up directly via standard Compute Engine snapshots.
2
Evaluate workload operational type (Block Storage vs Object/NoSQL)
The requirement calls for block storage for a VM hosting PostgreSQL.
Managed NoSQL services (Cloud Bigtable) or object storage tiers (Cloud Storage) cannot serve as attached block storage for relational SQL engines.
3
Compare Persistent Disk cost/performance trade-offs
Balanced Persistent Disk (pd-balanced) provides a cost-effective middle tier between Standard Persistent Disk (pd-standard HDD) and Performance SSD (pd-ssd).
pd-balanced offers solid SSD performance and IOPS appropriate for standard database instances at a reduced price point compared to pd-ssd.

Key Concept

Selecting persistent block storage types for Compute Engine database workloads based on IOPS performance, persistence, and cost constraints.
Estimated Time:1m 30s
Question 989Question →

Your organization requires an external security auditor to inspect the configurations of Pub/Sub topics and subscriptions in a specific Google Cloud project. The auditor also needs read-only access to inspect the IAM policy bindings configured on that project, but must not be granted permissions to modify any resources or publish/consume messages. Which TWO roles should be assigned to the auditor at the project level to follow the principle of least privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Pub/Sub Viewer (`roles/pubsub.viewer`); Security Reviewer (`roles/iam.securityReviewer`)

Answer

Assigning Pub/Sub Viewer and Security Reviewer roles at the project level grants the minimum necessary read-only permissions for Pub/Sub configurations and IAM policies.
To satisfy least privilege for inspecting Pub/Sub configurations and IAM policies, specific predefined read-only roles must be selected at the target project level. The Pub/Sub Viewer role allows reviewing topic and subscription properties without modifying them or accessing data payloads. The Security Reviewer role permits auditing IAM bindings and security posture without permission to edit access rights.

Step-by-Step Solution

1
Identify the required capabilities
The auditor requires read-only metadata access for Pub/Sub resources and read-only inspection access for project IAM security policies.
Least privilege mandates granting only the specific permissions needed for the role.
2
Select the appropriate predefined role for Pub/Sub inspection
Choose Pub/Sub Viewer (`roles/pubsub.viewer`) at the project level.
Predefined roles target specific service permissions, avoiding over-privileged access like message publishing or administrative management.
3
Select the appropriate predefined role for security/IAM inspection
Choose Security Reviewer (`roles/iam.securityReviewer`) at the project level.
Security Reviewer allows viewing IAM policies and configuration state across the project without granting permission to grant or revoke roles.

Key Concept

Applying principle of least privilege using predefined IAM roles at the narrowest resource scope
Question 990Question →

A solution architect needs to deploy a web microservice stored as a container image in Artifact Registry (`us-central1-docker.pkg.dev/my-project/apps/order-api:v1`) to Google Cloud Run. The deployment must meet the following requirements:
- The service name must be `order-api`.
- It must be deployed to the `us-central1` region.
- It must pass an environment variable `DB_HOST=10.0.0.5` to the application container.
- It must allow incoming public HTTP requests without authentication.

Which `gcloud` command correctly accomplishes this deployment?

Show answer & explanation

Answer: gcloud run deploy order-api --image=us-central1-docker.pkg.dev/my-project/apps/order-api:v1 --region=us-central1 --set-env-vars=DB_HOST=10.0.0.5 --allow-unauthenticated

Answer

The correct command uses 'gcloud run deploy order-api' with '--image=us-central1-docker.pkg.dev/my-project/apps/order-api:v1', '--region=us-central1', '--set-env-vars=DB_HOST=10.0.0.5', and '--allow-unauthenticated'.
The command correctly uses the 'gcloud run deploy' surface to target Cloud Run, supplies the container image URL via the '--image' flag, designates the target region with '--region=us-central1', sets runtime environment variables using '--set-env-vars', and explicitly enables public HTTP ingress via '--allow-unauthenticated'.

Step-by-Step Solution

1
Identify the target serverless compute product.
Cloud Run is required because the workload is supplied as a container image.
Cloud Run is designed for stateless container execution, whereas Cloud Functions targets code snippets.
2
Select the correct location and environment flags for Cloud Run.
Cloud Run services are regional resources, so '--region=us-central1' is required instead of zonal flags.
Specifying '--zone' causes a gcloud CLI syntax error for Cloud Run deployment commands.
3
Verify access control requirements.
The flag '--allow-unauthenticated' enables public HTTP traffic without requiring IAM authentication tokens.
Using '--no-allow-unauthenticated' restricts access to authenticated identity tokens.

Key Concept

Cloud Run Service Deployment CLI Syntax
Estimated Time:1m 35s
Question 991Question →

A DevOps engineer is using Terraform to automate infrastructure deployment into a dedicated target project named `app-prod-1029`. The service account executing the Terraform pipeline resides in a shared management project `mgmt-hub-8821`. During execution, the pipeline fails with an error indicating that the Compute Engine API (`compute.googleapis.com`) is not enabled for the operation. Which action should the engineer perform to successfully deploy the resources?

Show answer & explanation

Answer: Enable the Compute Engine API in the target project `app-prod-1029` where the infrastructure resources are being provisioned.

Answer

Enable the Compute Engine API in the target project `app-prod-1029` where the infrastructure resources are being provisioned.
In Google Cloud, infrastructure service APIs (such as `compute.googleapis.com`) must be enabled specifically within the target project where the resources are created. Even if a Terraform execution service account resides in a separate central management project, resource calls target the destination project, requiring the API to be enabled there.

Step-by-Step Solution

1
Identify the project where resources are being provisioned
The target project is `app-prod-1029`.
Google Cloud service APIs must be enabled within the specific project hosting the target resources.
2
Activate the required Google Cloud API
Enable `compute.googleapis.com` in `app-prod-1029`.
Without activating the service API in the target project, API calls sent by Terraform to create resources will fail.

Key Concept

API enablement in Google Cloud target projects for IaC deployments
Question 992Question →

A security engineer must configure IAM access for an external automated auditing tool's service account. The tool needs to read all object data stored inside Cloud Storage buckets in a project named `finance-reporting` and send custom metric telemetry to Cloud Monitoring within the same project. To pass compliance, access must strictly enforce the principle of least privilege and be scoped without granting unnecessary administrative permissions or resource hierarchy inheritance overhead. Which TWO role assignments should be granted to the service account on the `finance-reporting` project?

Select all that apply

Show answer & explanation

Answer: Grant the Storage Object Viewer role (roles/storage.objectViewer) on the finance-reporting project.; Grant the Monitoring Metric Writer role (roles/monitoring.metricWriter) on the finance-reporting project.

Answer

Granting the Storage Object Viewer role (roles/storage.objectViewer) and the Monitoring Metric Writer role (roles/monitoring.metricWriter) bound directly at the target project level fulfills the read and telemetry requirements while strictly enforcing the principle of least privilege.
To satisfy security auditing requirements under the principle of least privilege, specific predefined roles must be selected for each task and scoped directly to the target project. The Storage Object Viewer role provides necessary object read access without bucket management rights, while the Monitoring Metric Writer role provides exact permissions to write telemetry data to Cloud Monitoring without additional observability privileges.

Step-by-Step Solution

1
Analyze storage access requirement
Identified that reading object data in Cloud Storage requires object read permissions without bucket management rights.
The Storage Object Viewer predefined role (roles/storage.objectViewer) grants read access to bucket objects without administrative capabilities.
2
Analyze monitoring access requirement
Identified that writing custom metric telemetry requires specific monitoring write permissions.
The Monitoring Metric Writer predefined role (roles/monitoring.metricWriter) permits publishing metric data to Cloud Monitoring.
3
Evaluate scoping and least privilege boundaries
Bound both predefined roles directly at the target project level (`finance-reporting`).
Binding roles at the project level prevents permission inheritance across other projects and avoids overly broad primitive roles like Editor or Owner.

Key Concept

Applying Least-Privilege Predefined IAM Roles at Project Scope
Question 993Question →

A cloud engineer is tasked with executing a zero-downtime canary rollout of a newly built container revision `v2` for an existing production Cloud Run service named `inventory-api` currently serving all traffic from revision `v1`. The engineering policy mandates testing the isolated new revision via a dedicated endpoint prior to exposing any production users, followed by a staged traffic migration. In what chronological sequence should the engineer execute these operational steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Deploy the new container image with `--no-traffic` and assign a URL tag named `green`; 2) Send test HTTP requests directly to the tagged revision URL; 3) Run `gcloud run services update-traffic inventory-api --to-revisions=v1=90,v2=10`; 4) Run `gcloud run services update-traffic inventory-api --to-revisions=v2=100`.
The proper sequence for a safe Cloud Run rollout requires isolating the new revision upon creation by supplying `--no-traffic` and `--tag=green`, testing the isolated revision endpoint directly, initiating a canary traffic allocation using `gcloud run services update-traffic`, and finally completing the 100% traffic cutover after canary telemetry is validated.

Step-by-Step Solution

1
Deploy revision `v2` without routing live traffic and attach a revision tag
Revision `v2` is created and accessible strictly via its tag-specific URL endpoint, receiving 0% of main service traffic.
Using `--no-traffic` prevents automatic 100% traffic assignment upon deployment.
2
Validate revision behavior against the tagged URL endpoint
Functionality and health checks pass without exposing live users to potential defects.
Revision tags provide isolated subdomains to test specific revisions before production exposure.
3
Configure canary traffic allocation
10% of main service endpoint requests are handled by `v2` while 90% remain on `v1`.
Canary deployments allow monitoring real user traffic telemetry at reduced risk.
4
Migrate remaining production traffic to the new revision
Revision `v2` handles 100% of live production traffic for `inventory-api`.
Completing the traffic split completes the rollout cycle after canary verification.

Key Concept

Cloud Run Tagged Canary Deployment and Traffic Splitting Workflow
Question 994Question →

A cloud engineer is authoring an automated shell script to deploy Compute Engine virtual machines dedicated to nightly batch analytics processing. The processing jobs are fault-tolerant, stateless, and require aggressive cost optimization. Additionally, each VM must automatically execute a boot configuration script located on the local administrator machine at `/local/config/init.sh` upon startup. Which flags should be included in the `gcloud compute instances create` command to satisfy these operational requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: --provisioning-model=SPOT; --metadata-from-file=startup-script=/local/config/init.sh

Answer

The correct options are the flag specifying the SPOT provisioning model and the flag using metadata-from-file to pass the local startup script path.
For fault-tolerant batch workloads, specifying `--provisioning-model=SPOT` ensures the instance runs on GCP excess capacity at significant cost savings. Furthermore, to pass a script stored on the client machine to Compute Engine instance metadata for execution at boot, `--metadata-from-file` must be used so that `gcloud` reads the file content prior to API submission.

Step-by-Step Solution

1
Analyze the compute workload cost and reliability constraints.
Since the workload consists of fault-tolerant and stateless batch processing, selecting Spot VMs via `--provisioning-model=SPOT` optimizes cost.
Spot instances offer up to 60-91% discounts over standard instances in exchange for preemption readiness.
2
Determine the proper gcloud CLI flag for loading a local script onto a new Compute Engine instance.
Use `--metadata-from-file=startup-script=/local/config/init.sh` to read the script contents from disk.
Standard `--metadata` only assigns literal string values, whereas `--metadata-from-file` parses the contents of the file on the local machine executing the command.

Key Concept

Compute Engine instance deployment flags for Spot VMs and local startup script metadata.
Question 995Question →

A Cloud Engineer needs to inspect the Virtual Private Cloud (VPC) network configurations in a Google Cloud project using the command-line tool. Which of the following commands can be used to view or list VPC network information? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: gcloud compute networks describe prod-vpc; gcloud compute networks list

Answer

The commands 'gcloud compute networks describe prod-vpc' and 'gcloud compute networks list' are used to view VPC network details and list project networks.
To inspect VPC networks using the gcloud CLI, 'gcloud compute networks describe' provides detailed parameters of a specific network resource, while 'gcloud compute networks list' outputs a tabulated summary of all networks in the active GCP project.

Step-by-Step Solution

1
Identify the CLI tool required for managing Google Cloud VPC networking resources.
Networking resources in GCP are managed using the gcloud CLI under the 'gcloud compute' group.
VPC networks, subnets, firewall rules, and routes fall under Compute Engine networking services.
2
Select the correct command flags for retrieving and listing information.
'gcloud compute networks describe [NAME]' retrieves full configuration details of a specific network, and 'gcloud compute networks list' displays all project networks.
Read-only inspection tasks use 'describe' and 'list' subcommands in gcloud.

Key Concept

Viewing and listing VPC network resources using gcloud CLI
Question 996Question →

An organization needs to grant a newly onboarded team of data analysts access to process datasets within a Google Cloud project named `analytics-prod`. The analysts must be able to read files stored inside Cloud Storage buckets in this project and run BigQuery SQL queries to analyze data. They must not be permitted to create or delete Cloud Storage buckets, modify object contents, or manage BigQuery dataset permissions. Which TWO predefined IAM roles should be assigned to the analysts' Google Group at the project level to meet these requirements while following the principle of least privilege?

Select all that apply

Show answer & explanation

Answer: Storage Object Viewer (roles/storage.objectViewer); BigQuery Job User (roles/bigquery.jobUser)

Answer

The data analysts should be granted the Storage Object Viewer role (roles/storage.objectViewer) and the BigQuery Job User role (roles/bigquery.jobUser) at the project level.
The combination of Storage Object Viewer and BigQuery Job User fulfills the exact operational needs of reading bucket objects and running BigQuery SQL queries without granting unnecessary permissions to edit resources or manage administrative settings.

Step-by-Step Solution

1
Identify the minimum required Cloud Storage permissions for reading bucket contents.
Selecting Storage Object Viewer provides object read access while preventing object deletion, modification, or bucket administrative operations.
Adheres to least privilege for Cloud Storage data access.
2
Identify the minimum required BigQuery permissions for running SQL query jobs.
Selecting BigQuery Job User grants permission to run jobs within the project without providing permissions to alter dataset permissions or table schemas.
Adheres to least privilege for BigQuery computational job execution.
3
Reject broad primitive roles and administrative predefined roles.
Eliminate roles such as Editor or Storage Admin as they grant unnecessary administrative or write capabilities.
Prevents security risk from over-privileged role bindings.

Key Concept

Applying Least-Privilege Predefined IAM Roles for Multi-Resource Access
Question 997Question →

An operations engineer is managing a production Cloud SQL for PostgreSQL database instance. To analyze query performance bottlenecks, the engineer needs to enable the `pg_stat_statements` extension and adjust database configuration flags. Modifying `shared_preload_libraries` requires a database restart to take effect. Which sequence of administrative actions must the engineer execute to properly apply this configuration using GCP standard practices?

Show answer & explanation

Answer: Execute `gcloud sql instances patch` specifying `--database-flags=shared_preload_libraries=pg_stat_statements`, allow the automatic restart to complete, and then connect to the database to run `CREATE EXTENSION pg_stat_statements;`.

Answer

The engineer must run `gcloud sql instances patch` with the `--database-flags` parameter specifying `shared_preload_libraries=pg_stat_statements`, wait for the instance to restart, and then execute `CREATE EXTENSION pg_stat_statements;` within a SQL client session.
In Cloud SQL for PostgreSQL, configuring database flags that alter preloaded shared libraries requires updating instance flags via `gcloud sql instances patch`. Cloud SQL handles the required instance restart automatically when static flags are modified. Once restarted, running `CREATE EXTENSION pg_stat_statements;` inside a SQL connection enables the extension features.

Step-by-Step Solution

1
Configure the Cloud SQL instance database flag using the gcloud CLI tool.
The command `gcloud sql instances patch INSTANCE_NAME --database-flags shared_preload_libraries=pg_stat_statements` updates the instance configuration.
Cloud SQL manages engine configuration flags through instance patch operations.
2
Allow the managed instance restart to take place.
The database instance restarts automatically because `shared_preload_libraries` is a static PostgreSQL parameter requiring initialization at boot.
Static parameters in PostgreSQL cannot be loaded into memory without restarting the database daemon.
3
Connect to the database and register the extension.
Executing `CREATE EXTENSION pg_stat_statements;` enables the query monitoring views.
PostgreSQL requires explicit SQL DDL registration of preloaded shared libraries within the target database.

Key Concept

Cloud SQL Database Flag Management and Extension Lifecycle
Question 998Question →

An operations engineer needs to restore a PostgreSQL database backup file stored in a Google Cloud Storage bucket into a target Cloud SQL for PostgreSQL instance using the gcloud CLI. Place the following operational steps in the correct chronological sequence to perform this restoration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Retrieve the service account email of the Cloud SQL instance, 2) Grant the service account the Storage Object Viewer role on the Cloud Storage bucket, 3) Execute the gcloud sql import sql command with the Cloud Storage URI, and 4) Monitor the operation status using gcloud sql operations list until DONE.
To perform a Cloud SQL import from Cloud Storage, the instance service account must first be retrieved and granted read permissions (Storage Object Viewer) on the bucket containing the dump file. Only after permission propagation can the `gcloud sql import sql` command be executed, followed by monitoring the operation status via `gcloud sql operations list` to confirm successful completion.

Step-by-Step Solution

1
Identify Instance Service Account
Obtain the unique serviceAccountEmailAddress associated with the Cloud SQL instance.
Cloud SQL accesses Google Cloud Storage using its own system-generated service account, not the user's personal credentials.
2
Configure Bucket IAM Permissions
Grant the Storage Object Viewer (roles/storage.objectViewer) role to the Cloud SQL service account on the bucket.
Without explicit bucket-level read access, Cloud SQL will return permission errors when attempting to read the dump file.
3
Trigger SQL Import
Run gcloud sql import sql <INSTANCE> gs://<BUCKET>/<FILE>.
Initiates the import task using the authenticated Cloud SQL instance service account.
4
Track Operation Completion
Query gcloud sql operations list --instance=<INSTANCE> to verify the status.
Import operations run asynchronously; verifying DONE status confirms data has been loaded successfully.

Key Concept

Cloud SQL Database Import IAM Prerequisites and CLI Execution Sequence
Question 999Question →

A cloud architecture team is designing an internal microservices layer deployed across Compute Engine instances inside a Google Cloud VPC. The microservices communicate using gRPC over HTTP/2 and require URL path-based routing to direct traffic to appropriate backend service groups. All traffic must remain strictly private within the internal VPC without exposure to the public internet. Which Google Cloud load balancer should be planned to satisfy these requirements?

Show answer & explanation

Answer: Internal Regional Application Load Balancer

Answer

Internal Regional Application Load Balancer
The Internal Regional Application Load Balancer is a proxy-based Layer 7 load balancer that enables internal VPC traffic distribution for HTTP, HTTPS, and gRPC workloads. It supports advanced content-based routing policies, such as URL path matching, while using internal IP addresses within the VPC network.

Step-by-Step Solution

1
Analyze network traffic scope requirement
Traffic must be restricted to internal VPC networks without public internet exposure, ruling out external load balancers.
Security constraints dictate that services must not be reachable via public IP addresses.
2
Analyze application protocol and routing requirement
The workload uses gRPC over HTTP/2 and requires URL path-based routing, which requires Layer 7 (Application) capabilities.
Layer 4 passthrough load balancers cannot inspect HTTP/2 headers or perform path-based content routing.
3
Select the appropriate Google Cloud load balancer
The Internal Regional Application Load Balancer provides Layer 7 features (gRPC support, path matching) internally within the VPC.
It matches both the internal private scope requirement and the Layer 7 protocol/routing requirement.

Key Concept

Selecting GCP Load Balancers based on Traffic Scope (Internal vs. External) and OSI Layer Requirements (Layer 4 Passthrough vs. Layer 7 Proxy)
Estimated Time:1m 30s
Question 1000Question →

An enterprise application stores generated invoice PDF files in a Google Cloud Storage bucket. Business compliance rules require retaining these files for 7 years (2,555 days). Operational analysis indicates that invoices are accessed frequently during the first 30 days after creation, accessed roughly once a month between day 31 and day 365, and accessed less than once per year after 365 days. Which Cloud Storage Lifecycle Management configuration optimizes operational storage costs while maintaining accessibility and compliance?

Show answer & explanation

Answer: Create a lifecycle rule to transition objects from Standard to Nearline Storage after 30 days, transition to Archive Storage after 365 days, and delete objects after 2,555 days.

Answer

The correct operational approach is to configure a Lifecycle Management rule that transitions objects to Nearline Storage after 30 days, to Archive Storage after 365 days, and deletes them after 2,555 days.
The solution correctly maps object age and access frequency to GCP storage classes. Standard storage handles initial frequent access, Nearline storage handles monthly reads after 30 days, and Archive storage provides the lowest cost for long-term retention after 1 year, culminating in deletion at 7 years (2,555 days).

Step-by-Step Solution

1
Analyze access frequency and minimum storage durations for Cloud Storage classes.
Standard storage is best for the first 30 days (frequent access). Nearline storage fits monthly access patterns (30-day minimum threshold). Archive storage is optimal for data accessed less than once per year (365-day minimum threshold).
Matching object age to the appropriate storage tier minimizes both storage per-GB costs and data retrieval fees.
2
Evaluate compliance retention rules.
Retention for 7 years corresponds to 2,555 days before deletion.
Setting an automatic deletion action at 2,555 days ensures compliance without incurring unnecessary long-term storage costs beyond the requirement.
3
Formulate the multi-stage Cloud Storage Lifecycle Management policy.
Stage 1: Age 30 days -> SetStorageClass Nearline. Stage 2: Age 365 days -> SetStorageClass Archive. Stage 3: Age 2,555 days -> Delete.
Automating storage class transitions via lifecycle rules eliminates manual overhead and guarantees cost optimization.

Key Concept

Cloud Storage Lifecycle Management & Tiered Storage Optimization
PreviousPage 50 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin