Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 1081Question →

An IoT telemetry platform is designing a Google Kubernetes Engine (GKE) cluster architecture to support two separate microservice workloads:
1. A customer-facing API service requiring high availability and operational simplicity with zero node-level infrastructure management.
2. A large-scale data transformation batch job that is fault-tolerant and stateless, where cost minimization is the top priority.

Which TWO architectural decisions should the cloud engineering team implement to satisfy these requirements? (Select TWO options.)

Select all that apply

Show answer & explanation

Answer: Deploy GKE Autopilot mode for the customer-facing API workload to ensure Google manages node provisioning and maintenance while billing only for requested pod resources.; Configure a dedicated node pool utilizing Spot VMs for running the batch transformation workload.

Answer

The team should deploy GKE Autopilot mode for the API workload to eliminate node management overhead and configure a Spot VM node pool for the stateless, fault-tolerant batch job to minimize costs.
Deploying GKE Autopilot satisfies the zero node-management overhead requirement by shifting node maintenance and scaling to Google while billing only for pod requests. Provisioning a dedicated Spot VM node pool optimizes costs for stateless, interruptible batch workloads by providing heavy compute discounts.

Step-by-Step Solution

1
Analyze the operational overhead requirement for the API service.
GKE Autopilot mode is selected because Google manages node infrastructure, OS security patching, and autoscaling, charging strictly per pod resource request.
The requirement specifies zero node-level management.
2
Analyze cost optimization requirements for the batch analytics workload.
Spot VM node pools are chosen because the workload is stateless and fault-tolerant, allowing extreme compute cost reduction despite potential interruptions.
Spot VMs are ideal for interruptible, batch processing jobs.

Key Concept

Planning GKE Cluster Architectures using Autopilot for managed operational boundary and Spot VMs for fault-tolerant cost reduction
Question 1082Question →

A Cloud Engineer notices elevated 5xx error rates following a recent deployment to a production Cloud Run service. To restore stability, the engineer must immediately route all live traffic back to the previous stable revision, reconfigure operational instance limits to handle expected traffic spikes, and clean up the broken revision. Arrange the operational steps in the correct logical sequence to execute this remediation workflow.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) List revisions to identify the stable revision ID, 2) Shift 100% of production traffic to the stable revision using `gcloud run services update-traffic`, 3) Update service instance scaling limits using `gcloud run services update`, and 4) Delete the faulty revision using `gcloud run revisions delete`.
Remediating a failing release requires identifying the target revision first, shifting 100% of live traffic to that healthy revision to resolve user-facing errors, modifying operational parameters (min/max instances) on the service configuration, and finally purging the inactive faulty revision.

Step-by-Step Solution

1
Inspect current service revisions
Obtained the precise revision names for both the degraded deployment and the prior stable revision.
Traffic management commands require accurate revision identifiers.
2
Re-route production traffic to the stable revision
Live traffic is immediately redirected away from the failing container revision.
Restoring end-user availability is the immediate priority during a production outage.
3
Reconfigure service autoscaling constraints
Minimum and maximum instance limits are applied to the active service deployment.
Updating service settings ensures cold starts are mitigated while protecting against runaway container creation.
4
Decommission the degraded revision
The faulty revision is safely removed from Google Cloud.
Revisions receiving zero traffic can be safely deleted to maintain clean operational state.

Key Concept

Cloud Run Traffic Management and Revision Lifecycle Operations
Question 1083Question →

A Cloud Engineer is conducting a disaster recovery drill for a production regional Cloud SQL for PostgreSQL instance configured for High Availability (HA). The operational objective is to test manual failover from the primary zone to the standby zone, verify application stability, and safely failback to the original primary zone. Place the following operational steps in the correct chronological sequence required to execute this failover test.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Initiate the manual failover command via gcloud; 2) Poll and confirm that the operation state reaches DONE; 3) Validate application connectivity and write operations in the failover zone; 4) Execute a second failover command to perform failback to the primary zone.
Testing High Availability (HA) failover in Cloud SQL requires a controlled sequence: initiating the failover using `gcloud sql instances failover`, monitoring the operation status until `DONE` using `gcloud sql operations describe`, validating application database operations in the failover zone, and finally triggering a second failover command to return the instance back to its original primary zone.

Step-by-Step Solution

1
Issue manual failover trigger
Cloud SQL initiates an explicit failover operation from the primary zone to the secondary standby zone.
The failover command `gcloud sql instances failover` explicitly commands GCP to serve traffic from the standby replica.
2
Monitor operational status
Operation status transitions from RUNNING to DONE.
Cloud SQL operations are asynchronous. Verification prevents testing against an instance during DNS propagation or state transition.
3
Perform application validation
Database health, read/write workloads, and connection pools are confirmed operational.
The core objective of a disaster recovery drill is to verify application resilience under secondary zone conditions.
4
Execute failback operation
The instance transitions back to its original primary zone.
To complete the drill cleanly, traffic must be returned to the designated default primary location.

Key Concept

Cloud SQL High Availability Manual Failover and Failback Testing
Question 1084Question →

A compliance auditor requires read-only access to query and analyze BigQuery dataset contents across all Google Cloud projects contained within a specific organizational folder. The auditor should not have access to manage project configurations or read data from other GCP services. To adhere to the principle of least privilege while minimizing management overhead, which IAM role configuration should you implement?

Show answer & explanation

Answer: Grant the BigQuery Data Viewer role (`roles/bigquery.dataViewer`) to the auditor at the Folder resource level.

Answer

Grant the BigQuery Data Viewer role (`roles/bigquery.dataViewer`) to the auditor at the Folder resource level.
Granting the predefined BigQuery Data Viewer role (`roles/bigquery.dataViewer`) at the Folder level leverages IAM policy inheritance down the resource hierarchy. All current and future projects under that folder will inherit this role, granting the auditor read-only access to BigQuery dataset contents while enforcing the principle of least privilege.

Step-by-Step Solution

1
Identify the target resource boundary
The requirement specifies access across all projects within a specific organizational folder.
IAM permissions granted at a parent node in the resource hierarchy (Folder) are automatically inherited by child nodes (Projects).
2
Select the appropriate role based on least privilege
Choose `roles/bigquery.dataViewer` over primitive or administrative roles.
The auditor only needs to read dataset contents within BigQuery, so a predefined role tailored specifically to BigQuery data viewing enforces least privilege.
3
Bind the role to the auditor at the Folder level
The auditor gains automatic read-only access to all present and future BigQuery datasets inside all projects under that folder.
This minimizes administrative effort by avoiding individual project-level bindings while restricting scope.

Key Concept

Resource hierarchy inheritance and predefined role selection for IAM access control
Estimated Time:1m 30s
Question 1085Question →

An operations engineer needs to recover a production Cloud SQL for PostgreSQL instance to a state prior to a data corruption incident that occurred at 14:30 UTC today. Automated daily backups and binary logging are enabled on the instance. The engineer must perform a point-in-time recovery (PITR) to a separate new Cloud SQL instance to inspect and verify the data without impacting the active production workload. Which command should the engineer execute?

Show answer & explanation

Answer: Run `gcloud sql instances clone prod-db-instance restored-db-instance --point-in-time="2026-07-30T14:25:00Z"`.

Answer

The correct action is to run `gcloud sql instances clone prod-db-instance restored-db-instance --point-in-time="2026-07-30T14:25:00Z"`.
The option specifying `gcloud sql instances clone` with the `--point-in-time` parameter creates a separate instance restored to the designated timestamp. This utilizes point-in-time recovery logs while satisfying the requirement to avoid downtime or modification on the active production instance.

Step-by-Step Solution

1
Identify the target recovery timestamp prior to the corruption event.
Timestamp identified as 14:25:00 UTC, which is 5 minutes before the 14:30 UTC corruption incident.
Point-in-time recovery requires an RFC 3339 formatted timestamp corresponding to a known good state.
2
Use the `gcloud sql instances clone` command with the `--point-in-time` flag.
A new target Cloud SQL instance is provisioned and populated with data up to the requested timestamp using write-ahead logs.
Cloning to a new instance ensures the primary production database remains online and accessible throughout the recovery and verification process.

Key Concept

Cloud SQL Point-in-Time Recovery (PITR) via Instance Cloning
Question 1086Question →

An enterprise application running locally on a developer's workstation needs temporary access to Google Cloud resources using a dedicated service account. To follow Google Cloud security best practices, you want to enable service account impersonation without creating long-lived credentials. Which IAM role must be granted to the developer on the target service account?

Show answer & explanation

Answer: Service Account Token Creator (roles/iam.serviceAccountTokenCreator)

Answer

The Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) granted directly on the target service account enables impersonation and generation of short-lived credentials without key file export.
Granting the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account provides the user with permission to impersonate the service account and generate short-lived credentials. This approach follows Google Cloud security best practices by avoiding long-lived JSON service account keys.

Step-by-Step Solution

1
Identify the requirement for keyless short-lived credential delegation (impersonation).
Recognize that service account impersonation is preferred over exporting long-lived service account JSON keys.
Impersonation eliminates the security risks associated with storing key files on local developer machines.
2
Determine the minimal predefined IAM role required for impersonation.
Select the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator).
This role grants permission to create short-lived OAuth2 access tokens, ID tokens, and signed blobs on behalf of the service account.
3
Apply the principle of least privilege by binding the role to the specific service account resource.
Grant the role directly to the developer's identity on the target service account.
Binding at the resource level restricts impersonation capabilities strictly to the required service account.

Key Concept

Service Account Impersonation
Question 1087Question →

A software developer needs to inspect the configuration parameters and operational status of Cloud Run services within a Google Cloud project named `prod-services` to troubleshoot performance issues. The developer must not be allowed to deploy new services, modify existing configurations, or view underlying source code and secrets. Following Google Cloud recommended security practices and the principle of least privilege, which IAM role assignment should you grant to the developer?

Show answer & explanation

Answer: Grant the `roles/run.viewer` role to the developer at the `prod-services` project level.

Answer

Granting the predefined role `roles/run.viewer` at the `prod-services` project level provides read-only access to Cloud Run resources without granting excessive permissions on other project resources.
Assigning the predefined role `roles/run.viewer` at the `prod-services` project level specifically limits the developer's permissions to viewing Cloud Run resources, fulfilling the task requirements while strictly honoring the principle of least privilege.

Step-by-Step Solution

1
Identify required resource permissions
The requirement specifies read-only inspection of Cloud Run services in the `prod-services` project.
Under the principle of least privilege, access should be restricted only to the specific service and action needed.
2
Evaluate role types (Primitive vs. Predefined)
Select the predefined role `roles/run.viewer` instead of primitive roles like `roles/viewer` or `roles/editor`.
Primitive roles grant broad project-wide permissions across all services, whereas predefined service roles grant targeted permissions.
3
Select the correct resource hierarchy scope
Bind the role directly to the user at the `prod-services` project level.
Granting permissions at the Organization level would propagate access to all projects across the enterprise because IAM policy inheritance is strictly additive.

Key Concept

Principle of Least Privilege and Predefined Roles in GCP IAM
Question 1088Question →

A cloud engineer needs to deploy a custom Virtual Private Cloud (VPC) environment in Google Cloud to host a secure internal application service. Arrange the following deployment steps in the correct logical sequence required to provision the infrastructure, set up IP addressing, enforce access security, and instantiate the workload.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps is: 1) Create the custom-mode VPC network, 2) Provision the custom subnet within the network and region, 3) Configure the ingress firewall rule targeting the specific network tag, and 4) Launch the Compute Engine instance attached to the subnet with the designated network tag.
The deployment sequence follows infrastructure dependency requirements in GCP: top-level VPC networks must be created first, followed by regional subnets within that VPC. Firewall rules belong to the VPC network and reference target network tags. Compute instances are created last because they reference both the subnet (for IP configuration) and network tags (for firewall rule binding).

Step-by-Step Solution

1
Create custom VPC network
The top-level container network `prod-vpc` is created without default subnets.
GCP resource hierarchy requires a parent VPC network to exist before subnets or firewall rules can be attached.
2
Provision custom regional subnet
`backend-subnet` is created inside `prod-vpc` with primary CIDR `10.240.10.0/24` in `us-east4`.
Compute instances require a regional subnet within the VPC to allocate network interface internal IP addresses.
3
Create firewall rule with target tags
Ingress firewall rule `allow-backend-internal` is established in `prod-vpc` bound to tag `backend-app`.
Defining network security controls prior to instance creation enforces zero-trust best practices and prevents unauthorized exposure during boot.
4
Deploy VM instance with subnet binding and network tags
Instance `backend-vm-1` is launched in `us-east4-a` connected to `backend-subnet` with tag `backend-app`.
The instance depends on the existing subnet for IP assignment and inherits ingress permissions via its applied network tag.

Key Concept

Dependency ordering for GCP VPC custom networking, regional subnet allocation, tag-based firewall policies, and VM provisioning.
Estimated Time:2m 0s
Question 1089Question →

An enterprise maintains an online transactional processing (OLTP) application backed by a production Cloud SQL for PostgreSQL instance. The data analytics team needs to execute complex, long-running analytical queries against historical data every week. Running these heavy read operations directly against the primary instance causes severe CPU spikes and latency degradation for end users. How should the cloud engineer configure the database infrastructure to support the analytics workload while safeguarding production performance?

Show answer & explanation

Answer: Create a Cloud SQL read replica in the same region, and configure the analytics applications to query the read replica.

Answer

The cloud engineer should create a Cloud SQL read replica in the same region and direct the analytics reporting applications to query the read replica.
The correct approach is to provision a Cloud SQL read replica. Read replicas continuously replicate data asynchronously from the primary Cloud SQL instance, allowing heavy analytical read workloads to be completely isolated from the primary instance, thereby maintaining performance for transactional end users.

Step-by-Step Solution

1
Identify the performance bottleneck on the primary OLTP Cloud SQL instance caused by heavy analytical read operations.
Recognize the need to isolate read-heavy workloads from transactional write workloads.
Analytical queries consume significant IOPS and CPU, degrading performance for primary application users.
2
Evaluate Google Cloud database replica mechanisms for Cloud SQL.
Determine that Cloud SQL read replicas asynchronously replicate data from the primary instance.
Read replicas allow read queries to be offloaded without impacting primary write operations.
3
Select and configure the read replica target for the analytics application connections.
The analytics queries run against the read replica endpoint, insulating the primary instance.
This configuration balances workload distribution while maintaining data consistency for reporting.

Key Concept

Cloud SQL Read Replicas and Read Offloading
Question 1090Question →

A DevOps engineer manages a Google Kubernetes Engine (GKE) Standard cluster named `prod-cluster` located in the `us-central1` region. The application workload experiences dynamic spikes in traffic, causing newly scheduled pods to remain in a `Pending` state whenever existing node capacity is exhausted. The engineer needs to update the existing node pool named `worker-pool` so that GKE automatically provisions or removes worker nodes as capacity demands shift, maintaining between 2 and 10 nodes per zone. Which command should the engineer execute?

Show answer & explanation

Answer: gcloud container node-pools update worker-pool --cluster=prod-cluster --region=us-central1 --enable-autoscaling --min-nodes=2 --max-nodes=10

Answer

The command `gcloud container node-pools update worker-pool --cluster=prod-cluster --region=us-central1 --enable-autoscaling --min-nodes=2 --max-nodes=10` enables GKE Cluster Autoscaler on the specified node pool with the requested node count limits.
To enable dynamic node scaling on an existing GKE Standard node pool, the `gcloud container node-pools update` command must be used with the `--enable-autoscaling` flag, specifying `--min-nodes` and `--max-nodes` parameters.

Step-by-Step Solution

1
Identify the scaling level required by the scenario
Pods are stuck in `Pending` due to insufficient node capacity, indicating that node-level scaling (Cluster Autoscaler) is needed rather than pod replica scaling (HPA).
Cluster Autoscaler adjusts the number of nodes in a node pool based on unschedulable pods.
2
Determine the appropriate tool and target resource for node pool configuration
GKE node pool properties are managed via the Google Cloud CLI using `gcloud container node-pools update`.
kubectl manages Kubernetes workload objects inside the cluster, whereas node infrastructure is managed via Google Cloud APIs.
3
Select the correct flag flags for node pool autoscaling
The flags `--enable-autoscaling`, `--min-nodes=2`, and `--max-nodes=10` explicitly configure the minimum and maximum node limits per zone for the node pool.
These flags tell Cluster Autoscaler the operational bounds within which it can automatically adjust compute resources.

Key Concept

Configuring GKE Cluster Autoscaler on Existing Node Pools
Question 1091Question →

A cloud engineer needs to deploy a Python microservice as a Cloud Functions (2nd gen) function triggered by messages published to a Cloud Pub/Sub topic. The deployment must adhere to least-privilege security by utilizing a dedicated user-managed service account instead of the default compute service account. Arrange the following deployment tasks in the correct chronological order from start to finish.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with enabling required GCP service APIs, followed by creating the custom service account, binding the necessary IAM roles to that service account, executing the `gcloud functions deploy` command with the Pub/Sub trigger and service account flags, and finally publishing a test message to the Pub/Sub topic to verify execution.
The correct order follows the standard Cloud GCP resource dependency lifecycle: baseline API enablement must precede resource creation. Next, the execution identity (service account) must be created and granted necessary permissions prior to deployment so that the runtime environment is properly secured. The `gcloud functions deploy` command attaches the custom service account and provisions the Eventarc Pub/Sub trigger. Finally, triggering a test Pub/Sub message verifies that the deployed architecture functions end-to-end.

Step-by-Step Solution

1
Enable required project APIs
Cloud Functions, Cloud Build, Eventarc, and Pub/Sub APIs are active in the project.
Resource creation and deployment commands will fail if underlying service APIs are disabled.
2
Create user-managed Service Account
A dedicated identity is created for function runtime execution.
Enforces least-privilege identity instead of relying on default primitive service accounts.
3
Assign IAM roles to the Service Account
The identity receives specific required permissions for downstream service integration.
Permissions must exist before the function attempts to execute code requiring access.
4
Deploy Cloud Function (2nd gen) with flags
The Cloud Function and Eventarc Pub/Sub trigger subscription are provisioned.
`gcloud functions deploy` links the code, trigger topic, and execution identity.
5
Publish test event to Pub/Sub topic
Cloud Function execution is triggered and validated via logs.
End-to-end event pipeline testing can only take place after infrastructure provisioning is complete.

Key Concept

Deploying 2nd gen Cloud Functions with Pub/Sub Event Triggers and Custom Service Accounts
Question 1092Question →

An organization requires a newly onboarded security compliance officer to inspect Cloud Key Management Service (Cloud KMS) key rings and key metadata within a target project named `sec-ops-prod`. The compliance officer must be able to view key configurations and IAM policy bindings on the keys, but must not be granted permissions to decrypt data, create new keys, or access resources in adjacent projects located under the same parent folder. Which IAM role assignment adheres to the principle of least privilege?

Show answer & explanation

Answer: Grant the Cloud KMS Viewer role (`roles/cloudkms.viewer`) to the compliance officer on the `sec-ops-prod` project.

Answer

Granting the Cloud KMS Viewer role (`roles/cloudkms.viewer`) to the user on the `sec-ops-prod` project provides read-only inspection of key metadata and IAM policies without decryption or key creation privileges.
Assigning the Cloud KMS Viewer role (`roles/cloudkms.viewer`) at the target project level (`sec-ops-prod`) fulfills the requirement cleanly. It permits viewing key rings, keys, and IAM policies, but explicitly excludes cryptographic operations like decryption as well as administrative privileges like key creation, adhering strictly to the principle of least privilege.

Step-by-Step Solution

1
Analyze the access scope required by the workload.
Access must be limited strictly to the `sec-ops-prod` project rather than inherited from a parent folder.
Granting roles at the parent folder level exposes all child projects under that folder due to resource hierarchy inheritance.
2
Identify required permissions for inspection versus administrative operations.
The officer needs permissions to list and get Cloud KMS metadata and IAM policies (`cloudkms.keyRings.get`, `cloudkms.cryptoKeys.getIamPolicy`), but not decryption (`cloudkms.cryptoKeyVersions.useToDecrypt`) or creation (`cloudkms.cryptoKeys.create`).
The principle of least privilege requires granting only the specific capabilities necessary to perform the job function.
3
Select the appropriate predefined IAM role over primitive or admin roles.
The predefined role `roles/cloudkms.viewer` maps directly to metadata inspection without key management or cryptographic execution permissions.
Predefined roles offer fine-grained privilege control compared to broad primitive roles (Viewer/Editor/Owner) or administrative predefined roles.

Key Concept

Principle of Least Privilege and Resource Hierarchy Scope in GCP IAM
Estimated Time:2m 0s
Question 1093Question →

A system administrator needs to monitor system-level metrics (such as memory utilization and disk space usage) as well as application logs on a fleet of Google Cloud Compute Engine virtual machines. Which component should be installed on the instances to collect both system telemetry and log data under Google Cloud recommended practices?

Show answer & explanation

Answer: The Google Cloud Ops Agent

Answer

Install the Google Cloud Ops Agent on the Compute Engine virtual machine instances.
The Google Cloud Ops Agent is the primary unified agent for collecting system metrics, custom metrics, and logs from Compute Engine instances. It provides comprehensive observability for guest operating systems in a single package.

Step-by-Step Solution

1
Identify the telemetry collection requirement for Compute Engine virtual machines.
The requirement specifies capturing both guest system metrics (such as memory and disk utilization) and log files.
Compute Engine default metrics only cover hypervisor-level data (e.g., CPU utilization), requiring in-guest telemetry tools for detailed OS metrics and logs.
2
Select the current Google Cloud recommended solution for agent-based telemetry.
Choose the Google Cloud Ops Agent.
The Google Cloud Ops Agent replaces legacy standalone agents by combining metric collection (OpenTelemetry-based) and log collection (Fluent Bit-based) into a single unified service.

Key Concept

Google Cloud Ops Agent telemetry collection
Estimated Time:45s
Question 1094Question →

A cloud architecture team is designing the infrastructure for a newly onboarded suite of enterprise applications. Match each technical workload requirement to the most appropriate Google Cloud storage or database option based on Google-recommended practices.

Click a left item, then click its matching right item

Items

A mobile application backend requiring real-time document synchronization across offline devices, client SDK integration, and seamless serverless scaling.
A mission-critical relational database requiring global multi-region ACID compliance, horizontal scaling without sharding, and up to 99.999% availability.
A high-performance database running on Compute Engine virtual machines requiring provisioned performance up to 120,000 IOPS independent of storage volume capacity.
A large-scale IoT sensor data processing pipeline requiring low single-digit millisecond latency for massive throughput of unstructured time-series records.

Matches

Show answer & explanation

Answer

Matching pairs: Mobile app offline sync matches Firestore; Global multi-region relational ACID matches Cloud Spanner; Compute Engine VM requiring independent high IOPS provisioning matches Extreme Persistent Disk (pd-extreme); Large-scale IoT time-series processing matches Cloud Bigtable.
Matching each workload to its ideal GCP storage option respects core database engine capabilities and persistent disk performance characteristics: Firestore handles mobile document state sync; Cloud Spanner handles global relational scale; Extreme Persistent Disk allows independent IOPS provisioning for VM workloads; Cloud Bigtable handles massive IoT time-series data ingestion.

Step-by-Step Solution

1
Analyze mobile app document sync requirement
Firestore is selected because of native offline synchronization support and serverless document storage capabilities.
Neither relational databases nor block storage provide native mobile client state synchronization.
2
Analyze global multi-region relational database requirement
Cloud Spanner is selected because it delivers global consistency, horizontal relational scaling, and ACID compliance.
Cloud SQL does not scale horizontally across global regions with multi-region write consistency.
3
Analyze Compute Engine high IOPS persistent block storage requirement
Extreme Persistent Disk (pd-extreme) is selected as it allows IOPS to be provisioned independently of capacity.
Standard SSD (pd-ssd) and Balanced (pd-balanced) Persistent Disks scale IOPS strictly based on allocated disk size.
4
Analyze high-throughput IoT time-series requirement
Cloud Bigtable is selected because it handles massive throughput key-value and time-series data with single-digit millisecond latency.
Bigtable is designed specifically for high-volume unstructured streaming ingest and analytical workloads.

Key Concept

Selecting GCP Database and Block Storage Solutions Based on Workload Characteristics
Question 1095Question →

A cloud engineer needs to deploy a primary Cloud SQL for MySQL database instance with private IP connectivity in a custom VPC network, enable binary logging, and provision a cross-region read replica in a secondary region. Arrange the steps in the correct operational sequence to complete this deployment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: 1) Reserve an internal IP address range for private services in the custom VPC network, 2) Establish a VPC peering connection to Google Services, 3) Create the primary Cloud SQL instance with private IP and binary logging enabled, and 4) Provision the cross-region read replica referencing the primary instance.
The correct deployment sequence starts by allocating an internal IP range in the custom VPC network for Google Services, followed by establishing VPC peering via Service Networking. Next, the primary Cloud SQL instance is created with private IP (--no-assign-ip and --network) and binary logging enabled (--enable-bin-log). Finally, the cross-region read replica is created by specifying the primary instance as its master.

Step-by-Step Solution

1
Allocate a named IP range in the custom VPC network using gcloud compute addresses create.
An IP block is allocated for Service Networking inside the VPC.
Private Service Access requires a dedicated internal IP address block allocated prior to establishing the peering connection.
2
Create the private connection using gcloud services vpc-peerings connect.
VPC peering is established between the custom VPC and the Google Service Producer network.
Cloud SQL private instances communicate with the VPC via this VPC peering connection.
3
Deploy the primary Cloud SQL MySQL instance using gcloud sql instances create with --network, --no-assign-ip, and --enable-bin-log.
The primary Cloud SQL instance is provisioned with private IP in the primary region.
Binary logging on the master instance is mandatory to enable point-in-time recovery and replication to read replicas.
4
Create the read replica using gcloud sql instances create specifying --master-instance-name and the target secondary --region.
The read replica is provisioned in the secondary region and begins replicating data from the primary instance.
Replicas require an existing active primary database instance that supports replication.

Key Concept

Deploying Cloud SQL Instances with Private IP and Cross-Region Read Replicas
Question 1096Question →

A cloud engineer is managing networking resources for an enterprise workload on Google Cloud. A Compute Engine virtual machine named `api-server-01` running in zone `us-central1-b` was initially deployed without an external IP address. Due to an emergency operational requirement, the VM must temporarily receive a static public IP address that has already been reserved under the name `api-static-ip` in region `us-central1`. The virtual machine is actively serving internal requests and cannot be deleted or recreated. Which `gcloud` command should the engineer run to assign the reserved external IP address to `api-server-01`?

Show answer & explanation

Answer: gcloud compute instances add-access-config api-server-01 --zone=us-central1-b --address=api-static-ip

Answer

To assign a reserved static external IP address to an existing Compute Engine VM instance, execute `gcloud compute instances add-access-config api-server-01 --zone=us-central1-b --address=api-static-ip`.
In Google Cloud Compute Engine, external IP addresses are associated with instances through network interface access configurations. To attach an existing reserved static external IP address to a running virtual machine without recreating it, you must use the command `gcloud compute instances add-access-config <INSTANCE_NAME> --zone=<ZONE> --address=<ADDRESS_NAME_OR_IP>`.

Step-by-Step Solution

1
Identify the operational requirement for attaching an external IP to a running Compute Engine instance.
Recognize that external IP addresses on Google Cloud Compute Engine virtual machines are managed as access configurations on the instance's network interface (nic0).
Compute Engine instances without external IP addresses lack an access config element on their network interface.
2
Determine the correct gcloud CLI command group and subcommand for adding access configurations.
Select `gcloud compute instances add-access-config` specifying the target instance name, zone, and reserved IP address via `--address`.
The `add-access-config` command creates a new access configuration (NAT type) for the specified VM interface using the reserved IP.
3
Evaluate alternative CLI options for invalid syntax or incorrect scope.
Reject generic update commands on instances, addresses, or subnets that lack the required parameters for access configuration management.
Flags such as `--external-ip`, `--attached-instance`, or `--assign-external-ip` do not exist in their respective gcloud command schemas.

Key Concept

Managing Compute Engine Instance Access Configurations and External Static IP Assignment
Estimated Time:2m 0s
Question 1097Question →

A logistics firm is planning a new Google Kubernetes Engine (GKE) cluster for an engine routing optimization engine. The application requires custom Linux kernel sysctl settings on the worker nodes to optimize network socket buffers, along with dedicated local NVMe SSD storage attached directly to the underlying virtual machines. Which GKE mode of operation should the team choose to support these infrastructure requirements?

Show answer & explanation

Answer: Deploy a GKE Standard cluster, because only Standard mode allows custom node pool configurations and host OS kernel tuning.

Answer

Deploy a GKE Standard cluster, as it provides administrative access to custom node pool configurations, specialized disk hardware, and host kernel tuning.
GKE Standard mode allows administrators to create and manage custom node pools with specific hardware types (such as local NVMe SSDs) and modify node OS configurations, including sysctl kernel parameters. Because GKE Autopilot restricts direct node access and custom host OS modifications, Standard mode is required.

Step-by-Step Solution

1
Analyze workload requirements
The application requires custom sysctl kernel parameter tuning on the Linux OS and local NVMe SSD disks.
Identifying whether requirements require node OS access determines the appropriate GKE cluster mode.
2
Evaluate GKE Autopilot vs. Standard operational boundaries
GKE Autopilot manages node provisioning and OS configuration entirely, restricting host-level modifications and custom kernel settings. GKE Standard provides full node pool management control.
When host OS customization or specific hardware configuration is required, Standard mode must be chosen.
3
Select the correct deployment model
GKE Standard cluster with custom node pools is the required architecture.
Standard mode satisfies all custom OS and hardware isolation constraints.

Key Concept

GKE Autopilot vs. Standard Operational Boundaries and Node Customization
Question 1098Question →

A DevOps team is configuring access control for an automated CI/CD deployment pipeline in a Google Cloud project named `payment-gateway-prod`. The pipeline's service account requires permissions to create and update Cloud Run service revisions, as well as read build configuration objects stored in a single specific Cloud Storage bucket named `payment-config-bucket`. Adhering strictly to the Principle of Least Privilege, which IAM role configuration should be applied?

Show answer & explanation

Answer: Grant `roles/run.developer` at the project level, and grant `roles/storage.objectViewer` directly on the `payment-config-bucket` bucket resource.

Answer

Granting `roles/run.developer` at the project level and `roles/storage.objectViewer` directly on the `payment-config-bucket` bucket resource provides the exact necessary permissions without granting excessive administrative privileges or expanding access to other projects.
The correct selection uses predefined roles (`roles/run.developer` and `roles/storage.objectViewer`) mapped specifically to the required operational tasks, and limits the Cloud Storage role binding directly to the specific bucket resource rather than project-wide or folder-wide.

Step-by-Step Solution

1
Identify the minimum required permissions for the Cloud Run workload requirement.
Creating and managing revisions for Cloud Run requires deployment permissions covered by the predefined role `roles/run.developer`.
Using `roles/run.developer` avoids granting administrative capabilities such as service deletion or IAM policy modifications provided by `roles/run.admin` or primitive `roles/editor`.
2
Identify the exact scope and minimum role required for the Cloud Storage access.
Reading build configuration objects requires `roles/storage.objectViewer` bound directly to the target bucket resource `payment-config-bucket`.
Resource-level IAM binding restricts object access strictly to the single required bucket rather than granting read access to all buckets across the project or folder hierarchy.
3
Evaluate resource hierarchy placement.
Permissions must be scoped at the project level for Cloud Run and at the bucket level for Cloud Storage.
Inheritance down the GCP resource hierarchy means granting roles at a higher level (like a Folder) exposes all other descendant resources to unintended access.

Key Concept

Applying Least Privilege via Predefined Roles and Resource-Level IAM Scoping
Estimated Time:2m 0s
Question 1099Question →

An organization is deploying Compute Engine virtual machines dedicated to executing fault-tolerant, stateless batch processing jobs. The instances must cost as little as possible and access BigQuery datasets securely using a dedicated custom service account. Which two actions or configuration flags should be specified when deploying these instances using the gcloud CLI? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Specify the --provisioning-model=SPOT flag to minimize compute costs for stateless, fault-tolerant workloads.; Specify the --service-account flag with your custom service account email and set --scopes=cloud-platform.

Answer

To minimize compute expenses while adhering to security best practices, select the Spot provisioning model (--provisioning-model=SPOT) for fault-tolerant batch workloads, and attach a dedicated custom service account using the --service-account flag along with the standard --scopes=cloud-platform flag.
Specifying the Spot provisioning model optimizes costs for fault-tolerant, stateless batch workloads, while configuring a dedicated custom service account with the cloud-platform scope enables least-privilege IAM permissions without relying on default service accounts or broad primitive roles.

Step-by-Step Solution

1
Determine cost optimization strategy for compute resources
Identify that fault-tolerant, stateless batch workloads can run on Spot instances by passing --provisioning-model=SPOT.
Spot instances offer up to a 90% discount compared to standard on-demand VMs and fit workloads that can resume after preemption.
2
Configure instance security and identity flags
Pass --service-account=[SA_EMAIL] along with --scopes=https://www.googleapis.com/auth/cloud-platform.
Combining a custom service account with the cloud-platform access scope delegates fine-grained security enforcement to IAM roles assigned to the service account.

Key Concept

Compute Engine gcloud deployment flags, Spot VM configuration, and service account authorization best practices.
Question 1100Question →

A cloud engineering team operates a Managed Instance Group (MIG) that processes asynchronous background tasks from a Cloud Pub/Sub subscription. During high-traffic events, CPU utilization across the VM instances remains below 25%, but the message backlog grows significantly, resulting in SLA violations. The team needs to reconfigure the MIG autoscaling strategy to scale based on the number of unacknowledged messages in the subscription and ensure newly launched instances complete their startup scripts before the autoscaler evaluates performance metrics. Which configuration approach should the engineer implement?

Show answer & explanation

Answer: Configure the autoscaling policy to use a Cloud Monitoring metric tracking Pub/Sub unacknowledged messages, and set an appropriate cool-down period on the autoscaler.

Answer

Configure the autoscaling policy to use a Cloud Monitoring metric tracking Pub/Sub unacknowledged messages, and set an appropriate cool-down period on the autoscaler.
To auto-scale a Managed Instance Group based on Pub/Sub workload requirements, Google Cloud best practice dictates using a Cloud Monitoring metric (such as unacknowledged message count). Configuring a cool-down period ensures the autoscaler ignores metric anomalies during VM startup and initialization.

Step-by-Step Solution

1
Identify the proper scaling signal for queue-based workloads
Cloud Monitoring metrics (such as pubsub.googleapis.com/subscription/num_undelivered_messages) reflect backlog depth rather than CPU utilization.
I/O bound or message processing tasks may not consume high CPU, making CPU metrics ineffective for workload-based scaling.
2
Configure the MIG initialization buffer
Define a cool-down period (initialization period) in the autoscaling policy equal to or greater than the average VM boot and initialization duration.
Prevents the autoscaler from prematurely launching extra instances while newly added instances are still booting.

Key Concept

Compute Engine MIG Custom Metric Autoscaling and Cool-down Periods
PreviousPage 55 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin