Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 1001Question →

A cloud engineer is deploying a custom-mode Virtual Private Cloud (VPC) network named `prod-vpc` to host a secure tier of web application instances in Google Cloud. The deployment specification requires creating a custom subnet named `prod-subnet-us`, defining an ingress firewall rule named `allow-prod-web` restricted to target network tag `web-frontend`, and launching a Compute Engine VM instance named `app-server-1` attached to the new subnet with the matching target tag. What is the correct chronological sequence of gcloud CLI commands to successfully provision this complete network infrastructure from scratch?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with creating the custom-mode VPC network, followed by creating the custom subnet within that network, configuring the VPC ingress firewall rule with target tags, and finally launching the Compute Engine instance bound to the custom subnet and tag.
Google Cloud resource dependencies dictate that higher-level network structures must exist before lower-level components. First, the custom VPC network (`prod-vpc`) must be created without default subnets. Second, the regional subnet (`prod-subnet-us`) must be created inside `prod-vpc`. Third, firewall rules targeting `prod-vpc` and specific tags (`web-frontend`) must be created to enforce ingress policy. Finally, the virtual machine (`app-server-1`) is created, referencing both the existing subnet for IP allocation and the network tag for firewall rule matching.

Step-by-Step Solution

1
Execute `gcloud compute networks create prod-vpc --subnet-mode=custom`
Creates the top-level custom VPC network entity in the GCP project without auto-generated subnets.
GCP resource hierarchy requires the parent VPC network to exist before subnets or network-scoped firewall policies can be defined.
2
Execute `gcloud compute networks subnets create prod-subnet-us --network=prod-vpc --region=us-central1 --range=10.130.0.0/20`
Provisions a regional custom subnet associated with `prod-vpc`.
Subnets require an existing parent VPC network (`--network=prod-vpc`) to define regional IP address ranges.
3
Execute `gcloud compute firewall-rules create allow-prod-web --network=prod-vpc --allow=tcp:80,tcp:443 --target-tags=web-frontend`
Establishes network security controls for incoming HTTP/HTTPS traffic targeting instances with tag `web-frontend`.
Firewall rules belong to a specific network (`prod-vpc`) and must be defined before or alongside instances to ensure immediate perimeter protection upon VM startup.
4
Execute `gcloud compute instances create app-server-1 --zone=us-central1-a --subnet=prod-subnet-us --tags=web-frontend`
Deploys the Compute Engine virtual machine into `prod-subnet-us` with `web-frontend` tag applied.
Instantiating a Compute Engine VM requires valid, pre-existing subnets (`--subnet`) to allocate internal IP addresses successfully.

Key Concept

GCP VPC and Compute Provisioning Dependency Order
Question 1002Question →

A junior administrator needs to check the status and configuration details of Compute Engine virtual machine instances within a specific Google Cloud project. The administrator must not be allowed to perform administrative tasks, create new instances, or stop running virtual machines. To comply with the principle of least privilege, which IAM role should you grant to the administrator at the project level?

Show answer & explanation

Answer: Compute Viewer (roles/compute.viewer)

Answer

Grant the Compute Viewer (roles/compute.viewer) role at the project level.
Granting the Compute Viewer (roles/compute.viewer) role at the project level adheres strictly to the principle of least privilege by providing read-only access to Compute Engine resources while withholding read access to unrelated services and preventing any modification or lifecycle control.

Step-by-Step Solution

1
Identify the specific resource scope and access requirement.
The requirement is read-only access to Compute Engine instances in a single project.
Permissions should be restricted only to the service required.
2
Apply the principle of least privilege by selecting a predefined service role over broad primitive roles.
Compute Viewer (roles/compute.viewer) provides read-only access to Compute Engine resources without granting access to other GCP services or administrative write actions.
Primitive roles like Viewer or Editor grant excessive permissions across the entire project.

Key Concept

Selecting predefined service roles to enforce the principle of least privilege.
Question 1003Question →

A security team grants an auditor the Storage Object Viewer role (`roles/storage.objectViewer`) at the Google Cloud Organization resource level. Later, a project administrator attempts to restrict this access by removing the auditor's role assignment from a specific project's IAM policy within that organization. Which outcome occurs when the auditor attempts to read an object in a Cloud Storage bucket inside that project?

Show answer & explanation

Answer: The auditor retains full access to read objects because permissions granted at higher levels in the resource hierarchy are inherited and cannot be revoked at lower levels.

Answer

The auditor retains full access to read objects because permissions granted at higher levels in the resource hierarchy are inherited and cannot be revoked at lower levels.
In Google Cloud IAM, policies are evaluated as an additive union across the resource hierarchy. Roles assigned at a parent level (such as an Organization or Folder) are inherited by all child resources (such as Projects and Cloud Storage buckets). Removing a role binding at a child project level does not affect permissions granted at the Organization level.

Step-by-Step Solution

1
Analyze the IAM resource hierarchy levels in the scenario.
The role assignment (`roles/storage.objectViewer`) was created at the Organization level (parent), and the removal attempt occurred at the Project level (child).
Understanding where role bindings exist in the hierarchy is key to calculating effective permissions.
2
Apply Google Cloud IAM inheritance rules.
Permissions in GCP are additive down the hierarchy tree (Organization → Folder → Project → Resource).
Effective access is the union of all permissions granted at the resource itself and all parent nodes.
3
Evaluate the effect of removing a binding at the project level.
Removing a role binding at the project level only removes permissions that were directly granted at that project level; it has no effect on inherited permissions from the Organization level.
Child policies cannot restrict or deny permissions inherited from higher levels in Google Cloud IAM.

Key Concept

Resource Hierarchy IAM Policy Inheritance
Question 1004Question →

A Cloud Engineer is tasked with deploying a containerized microservice to Google Cloud Run from local source code while enforcing security best practices and least privilege. Place the following deployment steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct deployment sequence is: 1) Enable the Cloud Run and Cloud Build APIs, 2) Create a dedicated user-managed service account with minimal IAM roles, 3) Build and push the container image to Artifact Registry using gcloud builds submit, 4) Deploy the image to Cloud Run attaching the custom service account.
Deploying a containerized application to Cloud Run from source code follows a dependency-driven workflow. First, the required API endpoints (Cloud Run and Cloud Build) must be enabled in the project. Second, a custom service account with least-privilege permissions must be created so it can be assigned during service instantiation. Third, the container image must be built and stored in Artifact Registry using `gcloud builds submit`. Finally, `gcloud run deploy` is executed to launch the revision using the container image and custom service account.

Step-by-Step Solution

1
Enable required Cloud Service APIs
Cloud Run and Cloud Build APIs are active and ready to accept API calls.
Google Cloud service endpoints must be enabled in the project before managing or invoking resource builds.
2
Configure runtime IAM service account
A least-privilege service account is provisioned for the microservice.
Attaching the default Compute Engine service account violates security best practices; custom service accounts should be prepared prior to deployment.
3
Build and push container image to Artifact Registry
A fully compiled container image URI is available in Artifact Registry.
Cloud Run requires a container image hosted in a registry like Artifact Registry before a revision can be deployed.
4
Deploy revision to Cloud Run
The Cloud Run service is active and running with the specified container image and service account identity.
Deploying the container image with gcloud run deploy is the final execution step in the release workflow.

Key Concept

Cloud Run Source-to-Deployment Pipeline & Least-Privilege Identity Management
Question 1005Question →

A cloud engineer is managing a stateless application on a Google Kubernetes Engine (GKE) cluster. The application needs to read data from a Google Cloud Storage bucket securely. To adhere to Google Cloud security best practices, the application must authenticate without using long-lived service account key files stored inside Kubernetes secrets or container images. Which approach should the engineer implement?

Show answer & explanation

Answer: Configure GKE Workload Identity by binding the Kubernetes ServiceAccount used by the pod to a Google Cloud IAM Service Account assigned the required Storage role.

Answer

Configure GKE Workload Identity by binding the Kubernetes ServiceAccount used by the pod to a Google Cloud IAM Service Account assigned the required Storage role.
The correct approach is to configure GKE Workload Identity. Workload Identity binds a Kubernetes ServiceAccount to a Google Cloud IAM Service Account, enabling application pods to securely authenticate to Google Cloud services like Cloud Storage using short-lived tokens without storing long-lived service account keys.

Step-by-Step Solution

1
Identify the authentication requirements for GKE workloads accessing GCP resources.
Recognize that long-lived service account JSON keys should be avoided in favor of short-lived tokens.
Security best practices demand least privilege and credential-less access paradigms for containerized workloads.
2
Select GKE Workload Identity as the recommended solution.
Map the Kubernetes ServiceAccount (KSA) to a Google Cloud IAM Service Account (GSA).
Workload Identity securely bridges Kubernetes RBAC identity with GCP IAM identity.
3
Grant the required IAM roles to the IAM Service Account.
The application pod assumes the permissions of the IAM Service Account via short-lived token exchange.
This allows fine-grained, secure access to Cloud Storage without mounting key files.

Key Concept

GKE Workload Identity Authentication
Estimated Time:1m 30s
Question 1006Question →

A cloud operations team manages a Google Cloud Storage bucket containing regulatory financial records. To satisfy strict compliance requirements, all uploaded records must remain unmodified and undeletable for a mandatory retention duration of five years. The team has already set a retention period of 1,825 days on the bucket. Now, they must ensure that no user—including administrators and project owners—can reduce the retention period or remove the policy. Which operational action must the engineer perform to fulfill this requirement?

Show answer & explanation

Answer: Execute `gcloud storage buckets update gs://[BUCKET_NAME] --lock-retention-policy` and confirm the action.

Answer

Execute the command `gcloud storage buckets update gs://[BUCKET_NAME] --lock-retention-policy` and confirm the prompt.
Locking a bucket retention policy irreversibly enforces Write Once Read Many (WORM) storage compliance. Once locked, the retention policy cannot be removed, and the retention duration cannot be reduced by any user or service account, guaranteeing compliance against accidental or malicious deletion.

Step-by-Step Solution

1
Identify the compliance requirement
The requirement demands irreversible immutability (WORM compliance) for stored objects so that retention settings cannot be lowered or deleted by any identity.
Regulatory frameworks often require immutable data retention where administrative overrides are impossible.
2
Evaluate Cloud Storage Retention Policy lifecycle states
An unlocked retention policy allows bucket administrators to remove or shorten the retention duration. Locking the policy renders it permanent and irreversible.
Once locked, only object retention expiration allows deletion; the retention period itself cannot be modified or removed.
3
Select the proper `gcloud` operational command
Using `gcloud storage buckets update gs://[BUCKET_NAME] --lock-retention-policy` directly locks the retention policy at the bucket level.
This command enforces bucket retention locking via the standard Google Cloud SDK CLI.

Key Concept

Cloud Storage Bucket Retention Policy Locking
Estimated Time:2m 0s
Question 1007Question →

An organization is onboarding a database maintenance specialist who requires full operational control over Cloud SQL database instances—including modifying instance flags, restarting instances, and creating backups—within a target project named `finance-prod`. To satisfy strict compliance policies, the specialist must not be granted permissions to modify VPC network settings, manage project-level access controls, or access resources in adjacent environment projects. Which IAM role assignment strategy correctly fulfills these operational requirements while adhering to the principle of least privilege?

Show answer & explanation

Answer: Grant the Cloud SQL Admin (`roles/cloudsql.admin`) role to the specialist on the `finance-prod` project.

Answer

Granting the predefined Cloud SQL Admin (`roles/cloudsql.admin`) role specifically on the `finance-prod` project.
The Cloud SQL Admin (`roles/cloudsql.admin`) role is a service-specific predefined role that contains all permissions needed to manage Cloud SQL instances, flags, and backups. Binding this role directly on the `finance-prod` project restricts access exclusively to Cloud SQL within that single project, perfectly aligning with the principle of least privilege without exposing VPC networking or IAM access controls.

Step-by-Step Solution

1
Analyze required job responsibilities and scope
The user needs operational management of Cloud SQL database instances specifically within the single project `finance-prod`.
Determining exact resource boundaries prevents granting excess scope across folders or organizations.
2
Evaluate role types against the principle of least privilege
Predefined roles provide service-specific capabilities (Cloud SQL administration) whereas primitive roles (Owner, Editor, Viewer) grant overly broad project-wide rights.
Selecting predefined roles ensures compliance by withholding permissions for VPC networking and IAM policy management.
3
Select the appropriate resource hierarchy scope
Binding `roles/cloudsql.admin` at the project level (`finance-prod`) limits the permissions to that exact project.
Binding at the folder or organization level causes mandatory downward inheritance to all other projects.

Key Concept

Principle of Least Privilege using Predefined IAM Roles and Project-Level Scoping
Question 1008Question →

An enterprise media streaming platform is architecting its storage and database tier on Google Cloud. Match each technical workload requirement to the most appropriate Google Cloud database service or block storage option.

Click a left item, then click its matching right item

Items

Ephemeral, sub-millisecond latency block storage for high-performance video transcoding scratch files on Compute Engine
Fully managed relational database supporting standard SQL and ACID compliance with regional failover for subscription billing
Serverless, globally available NoSQL document database for managing dynamic user profile attributes and active session states
Petabyte-scale, high-throughput NoSQL database optimized for real-time video playback telemetry and time-series analytical ingestion

Matches

Show answer & explanation

Answer

The requirement for ephemeral video transcoding scratch space pairs with Local SSD; the relational subscription billing workload pairs with Cloud SQL (Regional High Availability configuration); the serverless user profile document store pairs with Firestore in Native mode; and the petabyte-scale real-time telemetry workload pairs with Cloud Bigtable.
Each requirement is mapped directly to its optimal GCP engine based on architectural strengths: Local SSD for maximum throughput ephemeral block storage, Cloud SQL for relational transactional consistency, Firestore for flexible document management, and Cloud Bigtable for heavy time-series telemetry ingestion.

Step-by-Step Solution

1
Evaluate the requirement for high-performance temporary storage.
Video transcoding requires maximum throughput and minimal latency for scratch files, but does not require data persistence across instance restarts.
Local SSD is physically bound to the host server, providing ultra-high performance suitable for temporary scratch disk needs.
2
Evaluate the requirement for transactional relational data.
Subscription billing relies on standard SQL transactions and strict ACID guarantees paired with regional redundancy.
Cloud SQL provides managed relational engine capabilities complete with regional automated failover setups.
3
Evaluate the requirement for mobile/web user session and profile data.
Document-oriented session states benefit from a serverless, auto-scaling database with multi-region availability.
Firestore in Native mode simplifies serverless application architecture while scaling seamlessly for user state.
4
Evaluate the requirement for real-time analytics and time-series telemetry.
High-velocity streaming playback events require continuous high-throughput writes at scale.
Cloud Bigtable is designed specifically for time-series ingestion and massive analytical write workloads.

Key Concept

Selecting appropriate GCP storage types based on relational schema requirements, IOPS/latency needs, data longevity, and access patterns.
Estimated Time:1m 30s
Question 1009Question →

A Cloud Engineer needs to migrate an existing standalone, stateful Compute Engine VM instance named 'prod-db-node' and its boot persistent disk from zone us-central1-a to zone us-central1-b due to a planned zone retirement. The database engine requires complete data consistency prior to taking storage backups. Which sequence of gcloud CLI actions correctly performs this zonal migration while ensuring data integrity?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence to migrate a stateful Compute Engine instance to a new zone is: 1) Stop the source instance in us-central1-a to ensure disk consistency. 2) Take a snapshot of the boot persistent disk. 3) Provision a new persistent disk in target zone us-central1-b using the snapshot as source. 4) Launch a new Compute Engine instance in us-central1-b attached to the restored persistent disk as its boot disk.
Because Compute Engine Persistent Disks are bound to a single zone, migrating a stateful VM to another zone requires creating a new persistent disk in the target zone. The proper workflow starts with stopping the VM instance to guarantee data consistency, capturing a project-wide persistent disk snapshot, instantiating a new persistent disk in target zone us-central1-b using the snapshot as a source, and finally launching a new Compute Engine VM in us-central1-b referencing the new disk as its boot disk.

Step-by-Step Solution

1
Execute `gcloud compute instances stop prod-db-node --zone=us-central1-a`
The virtual machine transitions to the TERMINATED state, stopping all write operations to the persistent disk.
Stopping the database VM ensures unwritten data in buffer cache is flushed, avoiding data corruption in the snapshot.
2
Execute `gcloud compute disks snapshot prod-db-node-disk --zone=us-central1-a --snapshot-names=prod-db-snapshot`
A project-level persistent disk snapshot is generated from the consistent disk state.
Persistent Disks are zonal resources, but disk snapshots are available project-wide across all zones.
3
Execute `gcloud compute disks create prod-db-node-disk-b --zone=us-central1-b --source-snapshot=prod-db-snapshot`
A new zonal persistent disk containing the source data is created in us-central1-b.
Disks cannot be directly moved or re-attached across zones without recreating them in the target zone from a snapshot.
4
Execute `gcloud compute instances create prod-db-node --zone=us-central1-b --disk=name=prod-db-node-disk-b,boot=yes`
The newly provisioned instance boots up in us-central1-b with all original data intact.
Attaching the new zonal disk as the primary boot device restores the workload in the target zone.

Key Concept

Cross-Zone Compute Engine Persistent Disk Migration
Estimated Time:2m 0s
Question 1010Question →

A Cloud Engineer is setting up an automated Google Cloud infrastructure deployment process using Terraform. To follow Google Cloud security and operational best practices, the engineer must ensure that team members can collaborate without state file conflicts and that deployment processes do not rely on static, long-lived authentication keys. Which two actions should the engineer take to achieve this configuration?

Select all that apply

Show answer & explanation

Answer: Configure a `backend "gcs"` block in the Terraform configuration to store the state file in a central Cloud Storage bucket with object versioning enabled.; Configure the automated CI/CD pipeline to use IAM Service Account Impersonation or Workload Identity Federation for authenticating Terraform commands.

Answer

The correct configuration requires defining a Cloud Storage remote backend (`backend "gcs"`) with object versioning enabled for state locking and backup, and configuring authentication using IAM Service Account Impersonation or Workload Identity Federation instead of static service account keys.
Configuring the `backend "gcs"` block allows Terraform to manage state centrally in a Cloud Storage bucket with locking and versioning. Authenticating using IAM Service Account Impersonation or Workload Identity Federation ensures zero long-lived key storage, aligning with GCP security principles.

Step-by-Step Solution

1
Configure remote state storage in Cloud Storage
Terraform state is stored securely in a central GCS bucket with state locking to prevent concurrent state corruption.
Remote state backends allow teams to collaborate safely and prevent state file sync issues.
2
Configure passwordless IAM authentication
Short-lived tokens are issued automatically via IAM Service Account Impersonation or Workload Identity.
Static long-lived JSON keys pose credential leak risks and violate security best practices.

Key Concept

Terraform Remote Backend and IAM Authentication Best Practices in GCP
Question 1011Question →

A cloud engineer needs to configure Private Service Access and deploy a Cloud SQL PostgreSQL database instance with Private IP connectivity in a custom Virtual Private Cloud (VPC) network using the `gcloud` command-line interface. Sequence the required steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps is: 1) Allocate an internal IP address range in the VPC network, 2) Establish a private connection (VPC Network Peering) to Google services, 3) Provision the Cloud SQL PostgreSQL instance with `--network` and `--no-assign-ip`, and 4) Create an initial database user account on the instance.
To provision a Cloud SQL database instance exclusively on Private IP, Google Cloud requires establishing Private Service Access beforehand. The deployment workflow strictly requires: first reserving an internal IP block in the target VPC, second creating the VPC network peering connection to servicenetworking.googleapis.com, third executing `gcloud sql instances create` with `--network` and `--no-assign-ip`, and finally managing database resources such as creating initial database users.

Step-by-Step Solution

1
Allocate an internal IP range
A named internal IP address allocation is created within the custom VPC network.
Google Cloud requires dedicated private IP space allocated within your VPC before connecting to managed services.
2
Connect the VPC network to Service Networking
A Private Service Access peering connection is created between the VPC and Google's internal service network.
Cloud SQL Private IP instances communicate with client VPCs over this private peering connection.
3
Deploy the Cloud SQL instance with Private IP
The Cloud SQL PostgreSQL instance is provisioned with a private IP address and no public IP assigned.
Passing `--network` attaches the instance to the peered VPC, while `--no-assign-ip` disables public endpoint exposure.
4
Configure database user credentials
A user credential account is created within the provisioned PostgreSQL instance.
Administrative database entities can only be instantiated after the underlying database engine is fully running.

Key Concept

Provisioning Cloud SQL Private IP via Private Service Access
Question 1012Question →

An analytics team needs to grant access to an automated reporting tool's service account. The service account must execute SQL query jobs in the project `proj-analytics-prod` and read table data exclusively from a specific BigQuery dataset named `ds_finance`. Following the principle of least privilege, which combination of IAM role assignments should you configure?

Show answer & explanation

Answer: Grant `roles/bigquery.jobUser` on the project `proj-analytics-prod`, and grant `roles/bigquery.dataViewer` on the `ds_finance` dataset.

Answer

Grant `roles/bigquery.jobUser` at the project level (`proj-analytics-prod`) and `roles/bigquery.dataViewer` at the specific dataset level (`ds_finance`).
Executing BigQuery SQL queries requires the permission to create jobs in the designated project, which is provided by the predefined role BigQuery Job User (`roles/bigquery.jobUser`) bound at the project level. To restrict data access exclusively to `ds_finance`, the BigQuery Data Viewer role (`roles/bigquery.dataViewer`) must be assigned directly on the dataset resource itself rather than the project.

Step-by-Step Solution

1
Identify the project-level requirement for query job execution.
Creating and running BigQuery jobs (queries, exports, loads) requires `bigquery.jobs.create` permission, which is granted by the `roles/bigquery.jobUser` role at the project level.
Jobs belong to the project resource scope where compute resources are consumed.
2
Identify the resource-level requirement for data access restriction.
Reading dataset contents requires `roles/bigquery.dataViewer`, which can be bound directly to the dataset `ds_finance`.
Binding read roles directly on the dataset prevents inheriting read access over other datasets in the same project.
3
Combine the permissions adhering to the Principle of Least Privilege.
The identity receives job execution rights on the billing/query project and scoped read rights only on the target dataset.
This minimizes security exposure while providing exact functional capabilities.

Key Concept

Fine-Grained BigQuery IAM Resource Scoping
Question 1013Question →

A database compliance auditor needs to inspect table schemas and execute read-only queries against a Cloud Spanner database named `inventory-db` within the production project `retail-prod`. The auditor must not have permissions to modify data, alter schemas, or access unrelated GCP resources in the project. Adhering to the principle of least privilege, which IAM role configuration should you grant to the auditor?

Show answer & explanation

Answer: Grant the Cloud Spanner Database Reader role (roles/spanner.databaseReader) on the specific project or database resource.

Answer

Grant the Cloud Spanner Database Reader role (roles/spanner.databaseReader) to the auditor for the specific database or project scope.
Granting the Cloud Spanner Database Reader role (roles/spanner.databaseReader) at the project or database scope adheres strictly to the principle of least privilege. It enables read access to database data and schema definitions without granting access to write data or manage other GCP resources.

Step-by-Step Solution

1
Analyze the access requirement
The auditor requires read-only permissions (schema inspection and querying) for a Cloud Spanner database without data modification rights.
Security compliance requires restricting write operations and avoiding unnecessary privileges.
2
Apply the Principle of Least Privilege
Select the predefined role `roles/spanner.databaseReader` over primitive roles (`roles/viewer` or `roles/editor`).
Predefined roles limit permissions strictly to the Cloud Spanner service, unlike primitive roles which span all services in the project.
3
Determine proper resource scope
Bind the role at the target project or database level, avoiding higher hierarchy nodes like Folders or Organizations.
IAM roles set at higher levels in the resource hierarchy inherit downward to all child resources, leading to excessive access across other projects.

Key Concept

Selecting granular predefined roles bounded to specific project resources according to the Principle of Least Privilege.
Question 1014Question →

An organization is deploying a global public web application on Google Cloud Compute Engine. The application serves static web assets (such as images and scripts) as well as dynamic web endpoints over HTTPS. The networking team needs to reduce load times for static assets by caching them near end users worldwide, and they must configure public DNS resolution for their custom domain using geo-based traffic steering to direct users to regional backend entry points. Which TWO of the following configuration choices should the team implement to satisfy these requirements?

Select all that apply

Show answer & explanation

Answer: Deploy a Global External HTTP(S) Load Balancer and enable Cloud CDN on the backend services or Cloud Storage buckets that host the static content.; Create a Cloud DNS public managed zone and configure a Geolocation routing policy for the domain's record set.

Answer

The team should deploy a Global External HTTP(S) Load Balancer with Cloud CDN enabled on static content backends, and set up a Cloud DNS public managed zone using Geolocation routing policies.
Global External HTTP(S) Load Balancers support Cloud CDN for caching static assets at Google edge locations worldwide, satisfying the requirement to reduce static load times. Additionally, Cloud DNS public managed zones support Geolocation routing policies to steer user DNS queries based on source location.

Step-by-Step Solution

1
Identify the load balancing and caching requirements for public HTTP(S) static media content.
Determine that a Global External HTTP(S) Load Balancer integrated with Cloud CDN is required for global edge caching.
Cloud CDN integrates specifically with Layer 7 External HTTP(S) Load Balancers and Cloud Storage buckets to cache static web content near end users.
2
Identify the public DNS routing requirement for custom domain steering based on client location.
Select a Cloud DNS public managed zone configured with Geolocation routing policies.
Cloud DNS public managed zones allow administrators to route incoming DNS queries based on the geographic location of the client or resolving DNS server.

Key Concept

Planning Layer 7 HTTP(S) Load Balancing with Cloud CDN caching alongside Cloud DNS Geolocation routing policies for global public web workloads.
Question 1015Question →

An infrastructure team manages a production Cloud Run service named `data-processor` running in the `europe-west1` region. To mitigate cold start latency during bursty traffic windows while establishing strict cost controls, a Cloud Engineer is instructed to reconfigure the service to maintain at least 3 warm container instances, cap the maximum scaling limit to 25 container instances, and allow each instance to process up to 100 simultaneous requests. The change must be applied to the existing running service configuration without re-deploying a new container image. Which `gcloud` command should the engineer execute?

Show answer & explanation

Answer: gcloud run services update data-processor --min-instances=3 --max-instances=25 --concurrency=100 --region=europe-west1

Answer

Execute `gcloud run services update data-processor --min-instances=3 --max-instances=25 --concurrency=100 --region=europe-west1` to modify operational parameters on an existing Cloud Run service.
Updating operational settings like minimum instances, maximum instances, and per-instance concurrency on an existing Cloud Run service is performed using `gcloud run services update` with the `--min-instances`, `--max-instances`, `--concurrency`, and `--region` flags. This command creates a new revision with the updated operational configuration without requiring a new container image binary to be specified.

Step-by-Step Solution

1
Identify the target resource management task
The requirement is to update operational properties (min instances, max instances, concurrency) of an existing Cloud Run service without deploying new container code.
Cloud Run service settings can be updated independently of container image deployments.
2
Select the correct gcloud command group and sub-command
Use `gcloud run services update` because `services update` modifies configuration flags on existing services.
`gcloud run deploy` requires specifying a container image, whereas `services update` applies changes directly to the existing service configuration.
3
Validate the required parameters and flag syntax
Combine `--min-instances=3`, `--max-instances=25`, `--concurrency=100`, and `--region=europe-west1`.
Cloud Run uses `--min-instances` and `--max-instances` for autoscaling boundaries, `--concurrency` for per-instance request limits, and regional targeting via `--region`.

Key Concept

Managing Cloud Run scaling bounds and concurrency via gcloud run services update
Question 1016Question →

An operations engineer needs to configure automated backup retention and disaster recovery for a production Cloud SQL for PostgreSQL instance, while also exporting database dumps periodically to a centralized Google Cloud Storage bucket located in a separate security project. Which TWO actions must the engineer perform to establish this operational workflow securely and effectively?

Select all that apply

Show answer & explanation

Answer: Enable automated daily backups and binary logging (point-in-time recovery) on the Cloud SQL instance configuration.; Grant the automatically assigned Cloud SQL instance service account the Storage Object Creator role on the target destination Cloud Storage bucket.

Answer

To establish secure automated backups and cross-project database exports, the operations engineer must enable automated daily backups and point-in-time recovery on the Cloud SQL instance, and grant the instance's service account the Storage Object Creator role on the target Cloud Storage bucket.
The solution requires configuring Cloud SQL native automated backups with point-in-time recovery for continuous database protection, and granting the Cloud SQL instance's built-in service account the Storage Object Creator IAM role on the external Cloud Storage bucket to enable secure cross-project database exports.

Step-by-Step Solution

1
Identify native database backup mechanisms
Enabling automated backups and point-in-time recovery ensures transaction logs and daily snapshots are retained natively by Cloud SQL.
Native automated backups provide automated point-in-time restoration without relying on external export scripts for local instance recovery.
2
Determine service account identity and IAM permissions for Cloud Storage exports
Identify the Cloud SQL service account email address using `gcloud sql instances describe` and grant it `roles/storage.objectCreator` on the destination Cloud Storage bucket in the central project.
Cloud SQL perform SQL dump exports using its underlying managed service account identity, requiring object creation permissions in the target bucket.

Key Concept

Managing Cloud SQL Automated Backups and Cross-Project Storage Export Permissions
Estimated Time:2m 0s
Question 1017Question →

An organization needs to grant a newly contracted developer read-only access to inspect Compute Engine virtual machines and view Cloud Storage objects within a specific Google Cloud project named `dev-sandbox-304`. The access must strictly adhere to the principle of least privilege without granting permissions across other projects. Which of the following actions should the cloud administrator take? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the Compute Viewer (`roles/compute.viewer`) role to the developer on the `dev-sandbox-304` project.; Grant the Storage Object Viewer (`roles/storage.objectViewer`) role to the developer on the `dev-sandbox-304` project.

Answer

Granting the Compute Viewer (`roles/compute.viewer`) role and the Storage Object Viewer (`roles/storage.objectViewer`) role directly on the target project `dev-sandbox-304` provides the exact read-only permissions required while adhering to least privilege.
Assigning predefined roles (`roles/compute.viewer` and `roles/storage.objectViewer`) at the specific project level gives the developer precisely the read permissions required for Compute Engine and Cloud Storage without granting excess rights or broad scope across other projects.

Step-by-Step Solution

1
Identify the required permissions for Compute Engine and Cloud Storage.
The developer requires read-only access to Compute Engine instances and Cloud Storage objects.
Least privilege mandates choosing predefined roles tailored to specific service read requirements rather than broad primitive roles.
2
Select the appropriate predefined roles.
`roles/compute.viewer` provides read access to Compute Engine, and `roles/storage.objectViewer` provides read access to Cloud Storage objects.
Predefined roles limit actions to specific resource capabilities.
3
Determine the resource hierarchy scope for the role bindings.
Bind both roles at the project level (`dev-sandbox-304`).
Granting roles at higher levels (Folder or Organization) causes child inheritance across unintended projects.

Key Concept

Applying Least Privilege IAM Role Scope and Predefined Roles
Question 1018Question →

Your organization maintains a production workload running on Compute Engine virtual machines in a custom Virtual Private Cloud (VPC) subnet with no external IP addresses assigned. The application requires outbound internet access to send telemetry data to an external API endpoint. In addition, system administrators require secure SSH access to these private instances without assigning public IP addresses or exposing the instances to the open internet. Which TWO network configuration actions should you perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure a Cloud NAT gateway associated with a Cloud Router in the VPC subnet's region to enable outbound internet connectivity for the private instances.; Create an ingress firewall rule permitting TCP traffic on port 22 originating from the source IP CIDR range 35.235.240.0/20.

Answer

The correct actions are to configure a Cloud NAT gateway associated with a Cloud Router in the subnet's region to enable outbound internet access, and to create an ingress firewall rule permitting TCP traffic on port 22 from the source IP range 35.235.240.0/20 to support Identity-Aware Proxy (IAP) TCP forwarding.
To allow instances without public IP addresses to initiate outbound connections to internet endpoints, Cloud NAT must be configured with a Cloud Router in the instance's region. To enable administrative SSH access without assigning public IP addresses, Identity-Aware Proxy (IAP) TCP forwarding should be used, which requires allowing ingress TCP traffic on port 22 from the designated Google IAP proxy IP range (35.235.240.0/20).

Step-by-Step Solution

1
Identify the requirement for outbound internet access from private instances.
Determine that Cloud NAT must be deployed alongside Cloud Router in the target region to handle outbound NAT for instances without public IP addresses.
Cloud NAT enables instances with private IP addresses to reach external services on the internet securely without exposing them to inbound connections.
2
Identify the requirement for secure administrative SSH access to private instances.
Select Identity-Aware Proxy (IAP) TCP forwarding as the GCP standard mechanism for SSH access to private VMs without public IPs.
IAP TCP forwarding authenticates users via IAM and proxies SSH sessions through Google-owned IP ranges.
3
Configure the necessary firewall rule for IAP TCP forwarding.
Create an ingress firewall rule allowing TCP port 22 from source range 35.235.240.0/20.
All IAP TCP forwarding connections originate from Google's IP range 35.235.240.0/20.

Key Concept

Cloud NAT and IAP TCP Forwarding Configuration for Private Compute Engine Instances
Estimated Time:3m 0s
Question 1019Question →

An organization is configuring IAM access for an automated CI/CD pipeline service account. The service account must submit build tasks via Cloud Build and deploy updated code to Cloud Functions within the project `app-backend-prod`. The access must strictly adhere to the Principle of Least Privilege without extending rights to other projects or granting administrative control over unrelated services. Which TWO role bindings should be assigned to the service account? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Grant Cloud Build Editor (`roles/cloudbuild.builds.editor`) on the `app-backend-prod` project.; Grant Cloud Functions Developer (`roles/cloudfunctions.developer`) on the `app-backend-prod` project.

Answer

To enforce least privilege, the service account must be granted specific predefined roles (Cloud Build Editor and Cloud Functions Developer) bounded strictly to the target project level (`app-backend-prod`), rather than primitive roles or higher-level folder/organization bindings.
Granting Cloud Build Editor and Cloud Functions Developer directly on the target project provides exact permissions for build execution and function deployment without over-granting rights.

Step-by-Step Solution

1
Analyze required functional capabilities
The pipeline requires building container/source artifacts via Cloud Build and deploying Cloud Functions in the project `app-backend-prod`.
Determines the specific IAM service permissions needed.
2
Select predefined roles over primitive roles
Cloud Build Editor (`roles/cloudbuild.builds.editor`) and Cloud Functions Developer (`roles/cloudfunctions.developer`) fulfill requirements precisely.
Primitive roles like Editor grant wide modify access across all GCP services, violating least privilege.
3
Apply role bindings at the correct resource hierarchy scope
Bind both predefined roles directly at the `app-backend-prod` project scope.
Bindings at Folder or Organization nodes inherit permissions downward to unintended projects and resources.

Key Concept

Applying least-privilege predefined IAM roles at the narrowest appropriate scope in the Google Cloud resource hierarchy.
Question 1020Question →

A Cloud Engineer is using Google Cloud Deployment Manager to deploy infrastructure resources into a newly created target Google Cloud project named `prod-analytics-net`. During the execution of `gcloud deployment-manager deployments create`, the deployment fails because the required Compute Engine API has not been activated. How should the engineer resolve this failure?

Show answer & explanation

Answer: Enable the Compute Engine API in the target project `prod-analytics-net` before running the deployment command again.

Answer

Enable the Compute Engine API directly within the target project `prod-analytics-net` before executing the deployment.
Enabling the Compute Engine API directly within the target project ensures that Google Cloud accepts API calls to provision resources. Infrastructure as Code tools like Deployment Manager or Terraform require target service APIs to be active in the target project before resource creation can begin.

Step-by-Step Solution

1
Identify the target project where infrastructure resources are being provisioned by Deployment Manager.
The target project is identified as `prod-analytics-net`.
Google Cloud resource deployment requires that target service APIs are enabled within the project where resources reside.
2
Enable the required Compute Engine API (`compute.googleapis.com`) in the target project.
The target project gains permission to interact with and provision Compute Engine resources.
Deployment Manager cannot make API calls to provision resources if the service API is disabled in that project.
3
Re-execute the `gcloud deployment-manager deployments create` command.
The deployment succeeds as Deployment Manager can now invoke Compute Engine resources in `prod-analytics-net`.
With API enablement complete, Deployment Manager has valid endpoints to execute resource creation.

Key Concept

Project-Level API Enablement for Infrastructure Deployment
Estimated Time:1m 30s
PreviousPage 51 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin