Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 1061Question →

An operations team needs to adjust execution limits for a production Cloud Run service named `inventory-api` running in the `us-central1` region to prevent connection starvation on a backend database. The service must be constrained to handle a maximum of 80 concurrent requests per container instance and cap overall scaling at 20 concurrent container instances, while still allowing the service to scale down to zero when idle. Which `gcloud` command correctly configures these operational limits?

Show answer & explanation

Answer: gcloud run services update inventory-api --concurrency=80 --max-instances=20 --region=us-central1

Answer

The command 'gcloud run services update inventory-api --concurrency=80 --max-instances=20 --region=us-central1' correctly updates the service configuration.
The correct command uses 'gcloud run services update' with the '--concurrency=80' flag to restrict simultaneous requests per container and '--max-instances=20' to prevent autoscaling beyond 20 total container instances.

Step-by-Step Solution

1
Identify the proper Google Cloud CLI target binary for Cloud Run resource management.
Selected 'gcloud run services update' as the correct management command for existing services.
Cloud Run service management requires 'gcloud run services', whereas 'gcloud functions' manages Cloud Functions.
2
Identify the correct flag for limiting per-instance request concurrency.
Determined that '--concurrency=80' sets max requests per container instance.
The '--concurrency' flag defines how many simultaneous requests a single container instance can receive.
3
Identify the correct flag for setting upper bounds on instance scaling.
Determined that '--max-instances=20' caps total instances while retaining default min-instances behavior of zero.
Using '--max-instances' caps maximum scaling to protect backend resources, while '--min-instances' specifies baseline capacity.

Key Concept

Cloud Run Autoscaling and Concurrency Configuration
Estimated Time:2m 0s
Question 1062Question →

An organization needs to grant an external network security auditor read-only access to inspect Virtual Private Cloud (VPC) firewall rules and Compute Engine virtual machine instance configurations within a single Google Cloud project named `prod-network-sec`. The auditor must not be allowed to make structural changes, view sensitive data payloads, or automatically inherit access to other projects under the same organization node. Which of the following IAM role assignments satisfy these requirements while adhering to the principle of least privilege? (Select TWO choices.)

Select all that apply

Show answer & explanation

Answer: Grant the Compute Viewer (`roles/compute.viewer`) role to the auditor at the `prod-network-sec` project level.; Grant the Security Reviewer (`roles/iam.securityReviewer`) role to the auditor at the `prod-network-sec` project level.

Answer

The auditor should be granted the Compute Viewer (`roles/compute.viewer`) role and the Security Reviewer (`roles/iam.securityReviewer`) role, both bounded explicitly to the target `prod-network-sec` project level.
To satisfy the auditing requirements under the principle of least privilege, predefined roles specific to the required capabilities must be assigned at the narrowest relevant resource boundary. The Compute Viewer role provides read-only visibility into compute resources within the project, while the Security Reviewer role grants access to view security configurations such as firewall rules and IAM policies. Both bindings must be applied at the project level to prevent unintended inherited access across other projects.

Step-by-Step Solution

1
Identify the required functional access capabilities.
The auditor requires read-only access to VM instance metadata and security firewall configurations.
Choosing fine-grained predefined roles ensures compliance with the principle of least privilege.
2
Map required capabilities to predefined roles instead of broad primitive roles.
Compute Viewer handles VM inspection; Security Reviewer handles security configuration and policy inspection.
Primitive roles like Editor grant unnecessary modification capabilities.
3
Determine the precise scope within the Google Cloud resource hierarchy.
Bind roles at the specific project level (`prod-network-sec`).
Granting roles higher in the resource hierarchy (Organization or Folder level) causes permissions to inherit across unintended projects.

Key Concept

Applying Least Privilege via Scoped Predefined IAM Roles
Question 1063Question →

An enterprise Cloud Operations team is managing Virtual Private Cloud (VPC) networking resources for a production environment hosted on Google Cloud Platform. The team needs to modify network configurations to accommodate expanding workloads and ensure predictable traffic evaluation. Which of the following statements regarding VPC subnet range expansion and firewall rule priority evaluation are correct? (Select TWO)

Select all that apply

Show answer & explanation

Answer: When expanding an existing primary IPv4 subnet CIDR block, the new netmask prefix length must be smaller (broader IP range) than the existing prefix length and cannot overlap with existing subnets in the same VPC network.; Google Cloud VPC firewall rule priority evaluation follows an ascending numerical order, meaning a rule with priority 100 takes precedence over a rule with priority 1000.

Answer

The correct statements are that primary subnet expansion requires a smaller netmask prefix length without overlapping other subnets in the VPC, and VPC firewall rules process lower numerical priority values first (e.g., priority 100 takes precedence over priority 1000).
Expanding a primary IPv4 subnet requires decreasing the netmask prefix length (making the IP block larger) while ensuring no overlapping CIDR ranges exist within the VPC. In addition, Google Cloud VPC firewall rules process priority values in ascending numerical order, where smaller numbers represent higher priority rules and take precedence during packet evaluation.

Step-by-Step Solution

1
Evaluate the rules for expanding VPC subnet IP ranges in Google Cloud.
Confirm that expanding a primary IP range requires specifying a smaller CIDR prefix length (e.g., /24 to /22) and avoiding CIDR range overlaps across the VPC network.
GCP subnets support expanding the primary CIDR range dynamically without downtime, but shrinking a subnet range is strictly prohibited.
2
Analyze how Google Cloud evaluates firewall rule priorities.
Determine that lower integers correspond to higher evaluation priority (0 is the highest priority, 65535 is the lowest priority).
Firewall rules are evaluated in ascending numerical order, so a rule with priority 100 overrides a rule with priority 1000.

Key Concept

Managing VPC Subnets and Firewall Priorities
Question 1064Question →

A cloud administrator needs to promote an existing Cloud SQL read replica to an independent, standalone database instance to complete a planned regional workload separation. Arrange the operational steps in the correct chronological order to execute this promotion safely without data loss.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Stop incoming write operations from application workloads to the primary Cloud SQL instance, 2) Monitor Cloud SQL metrics to confirm that replication lag on the read replica has reached zero, 3) Execute the command `gcloud sql instances promote-replica` for the target instance, and 4) Reconfigure application database connection strings to point to the IP address of the newly promoted standalone instance.
To safely promote a Cloud SQL read replica without data loss, write operations to the primary instance must first be stopped. Next, administrators must verify that replication lag has dropped to zero so all committed transactions are reflected on the replica. Once synchronized, the promotion command is executed to convert the replica into a standalone instance. Finally, application configurations are updated to direct traffic to the new database endpoint.

Step-by-Step Solution

1
Quiesce write operations on the primary database
The primary Cloud SQL instance ceases accepting new write transactions.
Prevents state divergence between the primary instance and the replica prior to promotion.
2
Verify replication synchronization
Replication lag metric drops to zero seconds.
Guarantees zero data loss by ensuring all queued write-ahead logs are fully processed by the replica.
3
Execute the promotion operation
The read replica transitions into an independent read/write instance.
Severing the replication topology enables the target database instance to process independent write operations.
4
Update application connection endpoints
Application connections are redirected to the new standalone Cloud SQL instance.
Restores full application connectivity to the newly independent database.

Key Concept

Cloud SQL Read Replica Promotion Procedure
Question 1065Question →

A cloud operations engineer needs to safely isolate a malfunctioning node in a Google Kubernetes Engine (GKE) cluster for maintenance while ensuring high application availability. In which correct sequential order should the engineer execute these operational steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is to first mark the node unschedulable (`kubectl cordon`), then gracefully evict workloads (`kubectl drain`), next verify that evicted pods are healthy on remaining cluster nodes (`kubectl get pods`), and finally perform maintenance or deletion on the underlying VM instance (`gcloud compute instances delete`).
Cordoning must be performed first to set the node to unschedulable state, preventing Kubernetes from scheduling new pods onto it during maintenance. Next, draining evicts existing non-DaemonSet workloads so they can be recreated on other healthy nodes. After draining, engineers must verify that all pods have resumed normal execution on alternative nodes before taking destructive or maintenance actions against the underlying VM instance.

Step-by-Step Solution

1
Run `kubectl cordon <node-name>`
The target node status changes to `SchedulingDisabled`.
This prevents new pods from being scheduled onto the node while preparing for eviction.
2
Run `kubectl drain <node-name> --ignore-daemonsets --delete-emptydir-data`
Running pods are evicted and rescheduled on remaining healthy nodes in the cluster.
This gracefully vacates the node without causing unnecessary workload disruption.
3
Run `kubectl get pods -o wide`
Confirms all application replicas have transitioned to `Running` state on active nodes.
Ensures service availability before taking the host node offline.
4
Execute maintenance or delete the VM via `gcloud compute instances delete`
The physical/virtual node instance is safely removed or rebooted.
Node maintenance can now take place without impacting running applications.

Key Concept

GKE Node Maintenance and Pod Eviction Sequence
Estimated Time:1m 30s
Question 1066Question →

A Cloud Engineer maintains an existing infrastructure repository managed with Terraform. The engineer modifies the configuration files to update the lifecycle rules of a Google Cloud Storage bucket named `google_storage_bucket.analytics_data` and add a new Compute Engine virtual machine instance. Before running a full deployment across the entire workspace, the engineer needs to deploy ONLY the storage bucket resource changes without creating the virtual machine or altering any other resources. Which Terraform CLI command should the engineer execute?

Show answer & explanation

Answer: terraform apply -target=google_storage_bucket.analytics_data

Answer

The command `terraform apply -target=google_storage_bucket.analytics_data` targets and applies changes exclusively to the specified resource.
The `-target` flag allows cloud engineers to isolate a single resource (or module) for plan and apply operations. Executing `terraform apply -target=google_storage_bucket.analytics_data` forces Terraform to apply changes exclusively to the targeted Cloud Storage bucket while ignoring unrelated resource declarations like the new Compute Engine VM.

Step-by-Step Solution

1
Identify the goal of targeted resource deployment
The engineer needs to isolate the Cloud Storage bucket resource update from other uncommitted configuration additions in the same directory.
Running a standard `terraform apply` would attempt to provision all defined resources, including the unwanted virtual machine instance.
2
Select the correct Terraform CLI targeting flag
Use `-target=resource_type.resource_name` during the execution phase.
The `-target` option instructs Terraform to focus only on the specified resource address and any of its direct dependencies.

Key Concept

Resource Targeting in Terraform Deployments
Question 1067Question →

An organization is deploying an internal backend service packaged as a custom Docker container to Google Cloud Run. The service processes sensitive financial transactions and must only accept HTTP requests originating from resources within the same Virtual Private Cloud (VPC) network or VPC Service Controls perimeter. Additionally, unauthenticated public invocations must be prevented. Which `gcloud` command should the Cloud Engineer run to deploy this serverless application according to these security requirements?

Show answer & explanation

Answer: Run `gcloud run deploy financial-api --image=gcr.io/my-project/fin-api:v1 --ingress=internal --no-allow-unauthenticated` specifying the target region.

Answer

Execute the `gcloud run deploy` command specifying `--ingress=internal` to block public traffic and `--no-allow-unauthenticated` to mandate IAM authentication.
Deploying a container image to Cloud Run with `--ingress=internal` restricts network traffic strictly to internal VPC resources and internal HTTP(S) load balancers. Adding `--no-allow-unauthenticated` ensures callers must present valid GCP identity tokens, fulfilling both network boundary and authentication security requirements.

Step-by-Step Solution

1
Identify the appropriate serverless compute service for pre-built container images.
Cloud Run is selected because it natively executes arbitrary containerized applications.
Cloud Run provides serverless container execution with configurable network ingress controls.
2
Configure network ingress boundaries.
Pass the `--ingress=internal` flag to the `gcloud run deploy` command.
This restricts network access strictly to traffic within the VPC network, internal load balancers, or VPC Service Controls.
3
Configure access control and identity requirements.
Specify the `--no-allow-unauthenticated` flag during deployment.
This prevents unauthenticated public invocations and enforces IAM access evaluation for incoming requests.

Key Concept

Cloud Run Ingress and Authentication Controls
Question 1068Question →

An enterprise e-commerce platform relies on a Regional Managed Instance Group (RMIG) named `checkout-rmig` deployed in `us-east1` to handle production API traffic. The operations team created a updated Compute Engine instance template named `checkout-v2` containing critical software updates. To ensure zero downtime and maintain full serving capacity during the rollout, the deployment must guarantee that no active instances are terminated before replacement instances are provisioned and verified healthy. Which `gcloud` CLI command should you execute to accomplish this rolling update?

Show answer & explanation

Answer: gcloud compute instance-groups managed rolling-action start-update checkout-rmig --version=template=checkout-v2 --max-surge=3 --max-unavailable=0 --region=us-east1

Answer

Execute 'gcloud compute instance-groups managed rolling-action start-update checkout-rmig --version=template=checkout-v2 --max-surge=3 --max-unavailable=0 --region=us-east1'. Setting max-unavailable to 0 guarantees zero capacity reduction during the update.
The correct command uses 'gcloud compute instance-groups managed rolling-action start-update' targeted at the regional group with '--region=us-east1'. Setting '--max-unavailable=0' guarantees that no existing running instances are taken offline before new replacement instances created via '--max-surge=3' are fully provisioned and report healthy.

Step-by-Step Solution

1
Identify the proper gcloud command group for instance updates in Managed Instance Groups.
Recognize that updating instances to a new template requires 'gcloud compute instance-groups managed rolling-action start-update'.
Managed Instance Groups handle rolling instance replacements through rolling-action start-update commands.
2
Analyze capacity requirements for the rolling update.
Determine that maintaining full serving capacity without terminating instances prematurely requires setting '--max-unavailable=0'.
Setting --max-unavailable=0 forces the MIG to launch surge instances first and wait until they pass health checks before deleting old instances.
3
Confirm resource scope parameters.
Specify '--region=us-east1' to target the Regional Managed Instance Group (RMIG).
Regional instance groups require explicit region flags rather than zone flags.

Key Concept

Compute Engine Regional Managed Instance Group Rolling Updates
Question 1069Question →

An infrastructure engineer needs to restrict outbound network traffic for Compute Engine instances located within a custom Virtual Private Cloud (VPC) subnet. The engineer creates a custom egress firewall rule that denies all egress traffic to destination 0.0.0.0/00.0.0.0/0 with a priority of 10001000. A specific set of virtual machines tagged with `api-client` requires HTTPS access to an external partner service hosted at IP address 198.51.100.25/32198.51.100.25/32. How should the engineer configure the firewall rules to allow this specific outbound connection while maintaining the blanket block?

Show answer & explanation

Answer: Create an egress firewall rule with priority 900, target tag `api-client`, action ALLOW, destination CIDR range `198.51.100.25/32`, and protocol/port `tcp:443`.

Answer

Create an egress firewall rule with priority 900, target tag `api-client`, action ALLOW, destination CIDR range `198.51.100.25/32`, and protocol/port `tcp:443`.
Google Cloud Virtual Private Cloud (VPC) firewall rules are evaluated based on rule priority, where lower numerical values indicate higher precedence. When creating a specific exception to a broad deny rule (such as a blanket egress block at priority 1000), the allowed rule must have a priority number lower than 1000 (such as 900) so that it is processed first. Furthermore, because the virtual machine initiates outbound traffic to an external endpoint, an egress firewall rule targeting the destination IP address and port is required.

Step-by-Step Solution

1
Determine the direction of network traffic.
Traffic originates inside the VPC from internal Compute Engine instances toward an external endpoint (198.51.100.25/32198.51.100.25/32), requiring an egress firewall rule.
Connection attempts initiated by VM instances outward must match egress firewall rules.
2
Analyze VPC firewall priority resolution rules.
Lower priority numerical values represent higher evaluation precedence (00 is highest priority, 6553565535 is lowest priority).
The specific ALLOW exception rule must evaluate before the broader DENY rule configured at priority 10001000.
3
Specify a priority value lower than 1000 for the ALLOW rule.
Configuring priority 900900 ensures that matching outbound HTTPS packets for instances tagged `api-client` are allowed and evaluation terminates before reaching priority 10001000.
Traffic matching priority 900900 is granted egress access immediately.

Key Concept

GCP VPC Firewall Priority and Egress Traffic Direction
Question 1070Question →

A cloud engineer is deploying a new Cloud SQL for SQL Server instance for an enterprise application using the gcloud CLI. The application architecture specifies high availability with automatic failover across two zones in the us-central1 region, private network access within an existing Virtual Private Cloud named prod-vpc, and complete prevention of public IP allocation. Which gcloud command correctly provisions the database instance according to these requirements?

Show answer & explanation

Answer: gcloud sql instances create prod-db --database-version=SQL_SERVER_2019_STANDARD --cpu=4 --memory=16GiB --region=us-central1 --availability-type=REGIONAL --network=projects/my-project/global/networks/prod-vpc --no-assign-ip

Answer

The command using --availability-type=REGIONAL together with --network specifying the target VPC path and the --no-assign-ip flag correctly meets all high-availability and private IP requirements.
The correct command provisions a regional Cloud SQL instance (--availability-type=REGIONAL) to ensure zone-redundant high availability, attaches it to the specified VPC network via the --network flag, and explicitly suppresses public IP allocation by setting --no-assign-ip.

Step-by-Step Solution

1
Identify High Availability requirement
Setting --availability-type=REGIONAL configures Cloud SQL with a primary and standby instance in separate zones within the region for automated failover.
ZONAL availability provides single-zone deployment without failover.
2
Identify private IP connectivity requirement
Specifying --network=<VPC_PATH> connects the instance to the private network via Private Service Access.
Private Service Access connects the database directly to the customer VPC.
3
Ensure public IP prevention
Including the --no-assign-ip flag explicitly prevents the creation of a public IPv4 address on the Cloud SQL instance.
By default, Cloud SQL assigns a public IP address unless --no-assign-ip is specified.

Key Concept

Deploying Cloud SQL Instances with Regional High Availability and Private Service Access
Question 1071Question →

A Cloud Engineer is writing a deployment script to provision a backend database proxy virtual machine named `proxy-prod-01` on Compute Engine in zone `us-central1-a`.

The instance must meet the following strict requirements:
1. Prevent direct exposure to the public internet by omitting an external IP address.
2. Run using a user-managed service account named `[email protected]`.
3. Adhere to Google Cloud security best practices by delegating access control strictly to IAM roles assigned to the service account, rather than restricting access via legacy API access scopes.
4. Ensure the workload runs continuously without risk of sudden 30-second termination notices caused by host resource reclaim events.

Which `gcloud compute instances create` command correctly configures the instance according to these requirements?

Show answer & explanation

Answer: gcloud compute instances create proxy-prod-01 \
--zone=us-central1-a \
--no-address \
--service-account=app-proxy-sa@my-gcp-project.iam.gserviceaccount.com \
--scopes=https://www.googleapis.com/auth/cloud-platform

Answer

The command using `gcloud compute instances create proxy-prod-01` with `--no-address`, `--service-account=app-proxy-sa@my-gcp-project.iam.gserviceaccount.com`, and `--scopes=https://www.googleapis.com/auth/cloud-platform` without `--provisioning-model=SPOT` correctly meets all requirements.
The correct command uses `--no-address` to omit external IP assignment, specifies `--service-account` with the target user-managed service account, and grants `--scopes=https://www.googleapis.com/auth/cloud-platform`. This allows the exact IAM roles bound to the service account to govern access without scope limitations, while leaving out Spot VM flags guarantees continuous availability.

Step-by-Step Solution

1
Analyze network exposure requirement.
To ensure the instance does not get assigned an external public IP address, the `--no-address` flag must be passed to `gcloud compute instances create`.
By default, Compute Engine instances receive an ephemeral external IP address unless `--no-address` is specified.
2
Determine service account flag syntax and IAM access scope best practices.
The correct flag to attach a service account is `--service-account=<EMAIL>`. To allow IAM roles attached to the service account to dictate permission boundaries, use `--scopes=https://www.googleapis.com/auth/cloud-platform`.
Google Cloud best practices dictate enabling the `cloud-platform` scope on custom service accounts so that IAM policies govern specific GCP resource access rather than legacy restricted scope aliases.
3
Evaluate workload availability requirements.
The database proxy is a stateful continuous workload, so standard provisioning must be used instead of `--provisioning-model=SPOT`.
Spot/Preemptible VMs can be reclaimed by Google at any time with a 30-second warning, making them unfit for non-fault-tolerant infrastructure components.

Key Concept

Compute Engine Instance Provisioning Flags and Security Scopes
Estimated Time:2m 0s
Question 1072Question →

A cloud administrator needs to grant a development team access to view Pub/Sub topic details and inspect Cloud Monitoring metrics within a single Google Cloud project named `pubsub-prod-data`. The team must not have permission to publish messages, modify resources, or access other projects within the parent folder. To comply with the principle of least privilege, which TWO IAM role assignments should you configure? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Assign the Pub/Sub Viewer (`roles/pubsub.viewer`) role to the development group on the `pubsub-prod-data` project.; Assign the Monitoring Viewer (`roles/monitoring.viewer`) role to the development group on the `pubsub-prod-data` project.

Answer

Assign the Pub/Sub Viewer (`roles/pubsub.viewer`) role and the Monitoring Viewer (`roles/monitoring.viewer`) role to the development group directly on the `pubsub-prod-data` project.
The principle of least privilege requires assigning fine-grained predefined roles at the lowest necessary level of the resource hierarchy. Assigning Pub/Sub Viewer and Monitoring Viewer directly on the specific project grants exactly the required read-only permissions for Pub/Sub resources and Monitoring metrics without exposing other projects in the folder or enabling resource modification.

Step-by-Step Solution

1
Identify the required permissions and target scope
Target scope is strictly the `pubsub-prod-data` project. Required capabilities are viewing Pub/Sub resources and inspecting Cloud Monitoring metrics.
Applying roles directly at the project level prevents inherited permissions on other projects within the parent folder.
2
Select predefined roles according to the principle of least privilege
Select `roles/pubsub.viewer` for Pub/Sub read access and `roles/monitoring.viewer` for metrics inspection.
Predefined roles grant only the specific permissions needed for tasks, whereas primitive roles (like Editor) grant overly broad permissions.

Key Concept

Applying principle of least privilege using predefined roles at the appropriate resource hierarchy scope
Question 1073Question →

A security engineer is configuring access control for a log telemetry pipeline in a Google Cloud project named `telemetry-prod`. The architecture requires two distinct access configurations:

1. A developer group `[email protected]` must have full administrative control to manage Cloud Pub/Sub topics and subscriptions within `telemetry-prod`, but must not be granted permissions to modify other project resources or IAM policies.
2. An ingestion service account `[email protected]` must publish incoming log events to Cloud Pub/Sub topics within `telemetry-prod`, but must not be allowed to create, delete, or manage topic configurations.

Which TWO IAM policy bindings should you apply to fulfill these requirements while strictly adhering to the principle of least privilege?

Select all that apply

Show answer & explanation

Answer: Grant `roles/pubsub.admin` to `[email protected]` on the `telemetry-prod` project.; Grant `roles/pubsub.publisher` to `[email protected]` on the `telemetry-prod` project.

Answer

Grant `roles/pubsub.admin` to the developer group at the project level, and grant `roles/pubsub.publisher` to the ingestion service account at the project level.
To satisfy least-privilege requirements for Pub/Sub administration, the predefined role `roles/pubsub.admin` provides full Pub/Sub resource management within the target project without granting permissions over other GCP services. To allow a service account to send telemetry without administrative capability, the predefined role `roles/pubsub.publisher` provides the exact publish permissions at the project scope.

Step-by-Step Solution

1
Identify the minimum predefined role required for topic and subscription administration.
The predefined role `roles/pubsub.admin` grants administrative access specifically to Cloud Pub/Sub resources without granting broad project-level permissions.
Using predefined Pub/Sub roles avoids over-granting permissions compared to broad primitive roles like Editor.
2
Identify the minimum predefined role required for publishing telemetry messages.
The predefined role `roles/pubsub.publisher` allows publishing messages to Pub/Sub topics without allowing resource modification or creation.
Service accounts should only receive the precise operational permissions needed for their functional role.
3
Determine the appropriate resource hierarchy scope for the IAM bindings.
Bind both roles at the project level (`telemetry-prod`).
Granting roles at a higher scope (such as a parent Folder or Organization) would inherit permissions to unintended child projects.

Key Concept

Principle of Least Privilege with Predefined Roles and Hierarchy Scoping
Question 1074Question →

A newly hired database administrator needs read-only access to view Cloud SQL instance configuration details within a single project named `db-dev-app`. The administrator does not require access to read database table contents or modify any resources. Adhering to the principle of least privilege, which IAM role assignment should you select?

Show answer & explanation

Answer: Grant the Cloud SQL Viewer role (`roles/cloudsql.viewer`) on the `db-dev-app` project.

Answer

Grant the Cloud SQL Viewer role (`roles/cloudsql.viewer`) on the `db-dev-app` project.
Granting the predefined `roles/cloudsql.viewer` role directly on the target project (`db-dev-app`) provides the exact read-only access necessary for Cloud SQL resources without granting permissions to other services or other projects.

Step-by-Step Solution

1
Identify the specific GCP service and required permission level.
The target workload requires inspecting Cloud SQL instance configurations without administrative rights or broader service access.
Least privilege mandates giving only the specific role required for the task.
2
Select between Primitive and Predefined roles.
Choose `roles/cloudsql.viewer` over broad primitive roles like `roles/viewer` or overly permissive administrative roles like `roles/cloudsql.admin`.
Predefined roles limit scope strictly to Cloud SQL resources.
3
Determine the minimal resource hierarchy scope.
Bind the role directly at the `db-dev-app` project level rather than a parent folder or organization level.
Scope inheritance would grant access across unintended sibling projects if bound higher up the resource hierarchy.

Key Concept

Principle of Least Privilege and Resource Hierarchy Scope in IAM
Estimated Time:45s
Question 1075Question →

An operations team needs to collect system metrics (such as memory utilization) and application log files from a fleet of Compute Engine Virtual Machine (VM) instances. Which of the following actions should the team perform following Google Cloud recommended practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Install the unified Google Cloud Ops Agent on each Compute Engine VM instance.; Configure the Ops Agent configuration file (config.yaml) to specify custom log receivers and metric pipelines.

Answer

To collect system metrics and log files from Compute Engine VMs following Google Cloud recommended practices, the team should install the unified Google Cloud Ops Agent on each instance and configure the agent's config.yaml file to define the required log and metric pipelines.
Google Cloud recommends installing the unified Google Cloud Ops Agent on Compute Engine instances to gather telemetry such as memory usage, disk metrics, and system logs. Custom log paths and metric ingestion settings are configured directly in the Ops Agent's config.yaml file.

Step-by-Step Solution

1
Identify the recommended telemetry agent for Compute Engine VMs
Recognize that the Google Cloud Ops Agent combines logging and monitoring into a single unified agent.
Google Cloud recommends the Ops Agent over legacy Stackdriver agents for all new Compute Engine observability setups.
2
Determine agent configuration procedure
Identify that configuring /etc/google-cloud-ops-agent/config.yaml allows custom log paths and system metric gathering.
The unified agent uses a YAML file to customize logging receivers and metrics pipelines.

Key Concept

Google Cloud Ops Agent deployment and configuration for Compute Engine telemetry
Question 1076Question →

An infrastructure team is configuring ingress firewall rules in a custom-mode Virtual Private Cloud (VPC) network. The web application frontend Compute Engine instances carry the network tag `web-frontend`. The team needs to allow public inbound HTTPS (TCP port 443) traffic to these instances from any IPv4 source (`0.0.0.0/0`), but must strictly block all inbound HTTPS traffic coming from a known malicious subnet (`198.51.100.0/24`), even if those requests target the `web-frontend` instances. Which firewall rule configuration correctly achieves this requirement while adhering to Google Cloud VPC rule evaluation precedence?

Show answer & explanation

Answer: Create an ingress DENY rule for TCP port 443 from source CIDR 198.51.100.0/24 with priority 500 targeting web-frontend, and an ingress ALLOW rule for TCP port 443 from source CIDR 0.0.0.0/0 with priority 1000 targeting web-frontend.

Answer

Create an ingress DENY rule for TCP port 443 from source CIDR 198.51.100.0/24 with priority 500 targeting web-frontend, and an ingress ALLOW rule for TCP port 443 from source CIDR 0.0.0.0/0 with priority 1000 targeting web-frontend.
In Google Cloud Virtual Private Cloud (VPC) firewall rule architecture, rules are processed in order of priority from 0 to 65535, where a lower numerical value indicates higher precedence. When network traffic matches a rule, rule processing terminates. Assigning priority 500 to the DENY rule for source CIDR 198.51.100.0/24 ensures that requests from this restricted block are evaluated and denied before reaching the priority 1000 ALLOW rule for 0.0.0.0/0.

Step-by-Step Solution

1
Understand GCP VPC firewall rule priority evaluation order.
GCP evaluates rules sequentially based on numerical priority from 0 (highest precedence) to 65535 (lowest precedence). Once a matching rule is found for a packet, evaluation stops.
Lower priority numbers take precedence over higher priority numbers.
2
Identify the specific exception traffic that must be blocked.
Inbound HTTPS traffic from `198.51.100.0/24` must be blocked regardless of general allow policies.
Specific deny rules must take higher precedence than general allow rules.
3
Assign numerical priority values ensuring the DENY rule is evaluated before the ALLOW rule.
Setting the DENY rule priority to 500 and the ALLOW rule priority to 1000 ensures packets from `198.51.100.0/24` hit the DENY rule first and are immediately dropped.
500 is less than 1000, so priority 500 is evaluated first.

Key Concept

VPC Firewall Rule Priority Precedence
Estimated Time:2m 0s
Question 1077Question →

A Cloud Engineer needs to update an existing Google Cloud Deployment Manager deployment named `prod-network` using a revised template configuration file `vpc-config.yaml`. The engineer must first preview the resource modifications without finalizing the deployment, and then apply the previewed changes to update the live environment. Which TWO `gcloud` CLI commands should the engineer execute to complete this workflow?

Select all that apply

Show answer & explanation

Answer: Run `gcloud deployment-manager deployments update prod-network --config vpc-config.yaml --preview` to stage and view the proposed resource changes.; Run `gcloud deployment-manager deployments update prod-network` without specifying the `--config` flag to commit the previewed deployment changes.

Answer

The two required commands are running `gcloud deployment-manager deployments update prod-network --config vpc-config.yaml --preview` to stage the changes, followed by `gcloud deployment-manager deployments update prod-network` to apply the previewed configuration.
To safely preview changes in Google Cloud Deployment Manager, you execute `gcloud deployment-manager deployments update [DEPLOYMENT_NAME] --config [CONFIG_FILE] --preview`. Once verified, executing `gcloud deployment-manager deployments update [DEPLOYMENT_NAME]` without referencing the configuration file applies the staged preview to active resources.

Step-by-Step Solution

1
Stage and preview changes in Deployment Manager
Deployment Manager creates a preview state showing planned resource changes without modifying active infrastructure.
Passing `--preview` with `gcloud deployment-manager deployments update` evaluates the new template configuration against current resources safely.
2
Review the preview output
The engineer verifies intended additions, modifications, and deletions.
Validating the preview ensures no unintended resource disruptions occur during update execution.
3
Commit the previewed update
Deployment Manager applies the previewed state to the target project.
Executing `gcloud deployment-manager deployments update prod-network` without the `--config` flag instructs Deployment Manager to commit the pending preview.

Key Concept

Deployment Manager Preview and Update Lifecycle Workflow
Estimated Time:1m 30s
Question 1078Question →

You need to update an existing regional Managed Instance Group named `frontend-mig` to use a new instance template named `frontend-v2` without incurring application downtime. Which sequence represents the correct chronological order of `gcloud` operations to execute this update and verify system stability?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Create the new instance template (`frontend-v2`), 2) Associate the template with the Managed Instance Group (`frontend-mig`), 3) Initiate the rolling update action, and 4) Confirm the instance group has returned to a stable state (`isStable: true`).
The standard operational lifecycle for updating a GCP Managed Instance Group requires creating a new instance template first, as instance templates are immutable. Next, the target Managed Instance Group must be updated to reference this new template. After updating the group's template assignment, the engineer starts a rolling update to replace running VM instances gradually. Finally, running a describe command allows the engineer to confirm that the group has reached a stable status (`isStable: true`) and all instances pass health checks.

Step-by-Step Solution

1
Create a new instance template containing the updated machine specs and boot image.
A new instance template resource named `frontend-v2` is registered in the project.
Compute Engine instance templates are immutable; modifying configuration requires creating a new template.
2
Update the Managed Instance Group configuration to point to the new instance template.
The target instance template for `frontend-mig` becomes `frontend-v2`.
The group controller needs the new template binding so it knows what specification to apply during rolling updates.
3
Execute the rolling update action on the group.
The group manager begins replacing instances in batches according to surge/unavailable settings.
This command actively initiates the replacement rollout without interrupting overall service availability.
4
Inspect the state of the Managed Instance Group.
The output confirms `isStable: true` once all VM instances are fully provisioned and healthy.
Verifying group stability ensures the deployment completed successfully and all instances passed autohealing checks.

Key Concept

Sequence of operations for updating Managed Instance Group (MIG) templates and performing rolling updates.
Question 1079Question →

A data analyst needs to execute query jobs in a Google Cloud project and read table data within a specific BigQuery dataset. Following the principle of least privilege, which TWO IAM roles should be granted to the analyst?

Select all that apply

Show answer & explanation

Answer: Grant the BigQuery Job User role (roles/bigquery.jobUser) at the project level.; Grant the BigQuery Data Viewer role (roles/bigquery.dataViewer) at the dataset level.

Answer

Grant the BigQuery Job User role (roles/bigquery.jobUser) at the project level and grant the BigQuery Data Viewer role (roles/bigquery.dataViewer) at the dataset level.
Executing BigQuery queries requires project-level permissions to create and manage job resources via the BigQuery Job User role, whereas reading dataset contents requires data access permissions granted via the BigQuery Data Viewer role on the specific dataset.

Step-by-Step Solution

1
Identify the minimum permission required to run query jobs.
The BigQuery Job User role (roles/bigquery.jobUser) allows running query jobs in the project.
Executing queries requires project-level permissions to create job resources.
2
Identify the minimum permission required to read table data in a specific dataset.
The BigQuery Data Viewer role (roles/bigquery.dataViewer) assigned specifically on the target dataset grants read access.
Scoping dataset permissions to the dataset resource itself prevents unnecessary access to other datasets in the project.
3
Verify least privilege compliance against alternative options.
Reject primitive roles and organization-wide scopes.
Primitive roles (Editor) and organization-wide administrative assignments grant excessive access.

Key Concept

Applying Least-Privilege Predefined IAM Roles and Scoping Resource Hierarchy
Question 1080Question →

A cloud engineer needs to deploy a high-availability Compute Engine instance named `web-prod-01` in zone `us-central1-a` using the `gcloud` CLI. The application hosted on this instance cannot tolerate unexpected downtime during host infrastructure updates, so the virtual machine must be migrated to another host during maintenance events rather than shut down. Additionally, if the host hardware experiences a failure, the instance must automatically restart. Which `gcloud compute instances create` command should the engineer execute to meet these requirements?

Show answer & explanation

Answer: gcloud compute instances create web-prod-01 --zone=us-central1-a --on-host-maintenance=MIGRATE --automatic-restart

Answer

The correct command is `gcloud compute instances create web-prod-01 --zone=us-central1-a --on-host-maintenance=MIGRATE --automatic-restart`.
The command containing `--on-host-maintenance=MIGRATE` and `--automatic-restart` correctly applies the standard Compute Engine availability policy flags for live migration during maintenance and automated restart after hardware failure.

Step-by-Step Solution

1
Identify the availability requirements for host maintenance.
Live migration requires setting the host maintenance policy to `MIGRATE`.
Compute Engine allows instances to be live-migrated to another host in the background without shutting down.
2
Identify the flag for handling hardware crash recovery.
Automatic restart requires setting the boolean flag `--automatic-restart`.
If host hardware fails, this setting instructs GCP to restart the instance automatically.
3
Verify correct gcloud CLI syntax.
The valid syntax uses `--on-host-maintenance=MIGRATE` and `--automatic-restart`.
Flags like `--maintenance-policy` or `--auto-restart` are invalid flag syntax in the gcloud SDK.

Key Concept

Compute Engine Instance Scheduling & Availability Policies
Estimated Time:1m 30s
PreviousPage 54 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin