All practice questions

An infrastructure team needs to secure an existing Cloud Run service named `order-processor` deployed in the `us-central1` region. The service must only accept network traffic originating from internal Virtual Private Cloud (VPC) networks within the same project, and execution permissions must be granted exclusively to an automated service account named `[email protected]` following the principle of least privilege. Which TWO configuration steps should the team perform?

A research institute is designing a Google Kubernetes Engine (GKE) cluster architecture to execute large-scale, fault-tolerant batch analysis jobs. The workloads require specialized host-level OS kernel modifications via custom `sysctl` settings on the underlying node OS, and the organization wants to minimize compute infrastructure expenses as much as possible. Which GKE cluster architecture should the cloud engineer select?

A Site Reliability Engineering team maintains a Google Kubernetes Engine (GKE) cluster hosted in a custom Virtual Private Cloud (VPC) named `corp-vpc` in the `us-east1` region. An existing Cloud NAT gateway named `nat-gateway-us-east1` configured on Cloud Router `nat-router` currently handles egress traffic, but was initially deployed using the `--nat-primary-subnet-ip-ranges` flag. After adding a new secondary IP range for GKE Pods on `subnet-analytics`, traffic originating from Pods in this secondary range fails to reach external services. Which command should the engineer execute to enable Internet egress for the secondary IP range while preserving existing NAT functionality?

An organization is setting up a centralized compliance logging architecture in Google Cloud. An engineer configures a Cloud Logging Log Router sink in Project A to route all data access audit logs to a Cloud Storage bucket located in a dedicated security storage project, Project B. After creating the sink, logs fail to appear in the destination Cloud Storage bucket. The engineer confirms that the destination bucket path is correct, the sink filter is properly defined, and the bucket exists. Following the principle of least privilege, which action should the engineer take to resolve this issue and ensure logs are successfully written?

A Cloud Engineer needs to migrate a local Terraform state file to a Google Cloud Storage (GCS) remote backend for a production deployment. Place the steps required to complete this migration in the correct execution order.

An application developer needs to receive an automated email notification whenever a specific error code string appears in the log stream of a Google Cloud application. What is the Google-recommended method to accomplish this requirement?

A DevOps engineer manages a stateless web application deployed on a Google Kubernetes Engine (GKE) cluster. During peak traffic events, incoming traffic triggers additional Pod creation, but several newly created Pods remain stuck in a Pending state with a reason of insufficient CPU resources. The engineer wants the GKE infrastructure to automatically add Compute Engine virtual machine instances to the cluster whenever Pods cannot be scheduled due to resource starvation. Which operational action should the engineer take?

A security policy prohibits developers from creating or downloading private service account keys. An administrator needs to allow a developer's identity to temporarily generate short-lived credentials for a target service account to execute deployment tasks. Which IAM role should be granted to the developer's identity on the target service account?

A company is configuring access for a site reliability engineer (SRE) who needs to create, modify, and delete Google Kubernetes Engine (GKE) clusters and node pools in a single Google Cloud project named `k8s-platform-prod`. The engineer must not be able to modify project IAM policies, alter billing account settings, or manage unrelated services like Cloud Storage or BigQuery. Following Google Cloud recommended security practices and the principle of least privilege, which IAM configuration should you implement?

A logistics company is deploying a custom Go-based tracking service to Google Cloud Run. The containerized application inside the image listens on TCP port $8000$, and the deployment policy requires the endpoint to be publicly reachable on the web without requiring IAM authentication. Which TWO configuration options or `gcloud run deploy` command flags should be specified to achieve this outcome?

An IoT energy management company is designing a Google Cloud architecture to collect and process telemetry data from millions of smart electric meters. The architecture requires two storage capabilities: first, a scalable NoSQL database optimized for continuous high-throughput writes and low-latency reads of time-series device telemetry; second, block storage for worker Compute Engine virtual machines that provides durable storage surviving instance stops while delivering cost-effective performance. Which TWO Google Cloud storage solutions should be selected to meet these requirements? (Select TWO)

A system administrator is deploying a managed Cloud SQL instance for an enterprise application. The security policy dictates that the database must communicate strictly within a custom Virtual Private Cloud (VPC) network named 'corp-vpc' and must not have a public IP address. Which TWO actions must be completed to deploy the Cloud SQL instance with private IP connectivity and no public IP?

An external security auditor needs read-only access to inspect Compute Engine instance configurations, network interface details, and instance metadata within a specific Google Cloud project named `retail-store-prod`. The auditor must not be permitted to make modifications to any compute resources or access resources outside of this project. Following the principle of least privilege, which IAM role configuration should be granted to the auditor?

An organization operates a cluster of stateful application servers on Google Compute Engine. The operations team needs to establish a automated, maintenance-free persistent disk backup strategy that takes daily snapshots of all data disks and automatically deletes snapshots older than 30 days. The solution must adhere to the principle of least privilege and avoid administrative overhead from managing custom scripts or third-party cron schedulers. Which approach aligns with Google-recommended best practices for managing Compute Engine resources?

You are deploying a custom web application on a Compute Engine instance that needs to fetch static files from Cloud Storage and record application logs in Cloud Logging. Following Google Cloud security best practices for service account creation and management, which TWO steps should you take to grant the required permissions? (Select TWO)

A Cloud Engineer is configuring the unified Ops Agent on a fleet of Linux Compute Engine virtual machines (VMs) to ingest custom application logs located at `/var/log/app_telemetry.log` into Cloud Logging. After installing the agent with its default configuration, system metrics and standard syslog entries are correctly appearing in Cloud Observability, but entries from `/var/log/app_telemetry.log` are missing. Which modification to the Ops Agent configuration file (`/etc/google-cloud-ops-agent/config.yaml`) is required to ingest these custom log entries?

Your organization is configuring a third-party CI/CD pipeline hosted outside Google Cloud to deploy applications to a Google Cloud project. Company security policies strictly prohibit the creation and download of static, long-lived service account JSON key files. A target service account named [email protected] already exists with the necessary deployment permissions. Which approach should you implement to allow the external pipeline to authenticate and act as the service account while complying with Google security best practices?

A Cloud Engineer needs to import data into a Cloud SQL for MySQL instance from a SQL dump file stored in a Google Cloud Storage bucket using the gcloud command-line interface. Which sequence of steps represents the correct procedure to execute this operation successfully?

A cloud engineer is deploying a custom-mode Virtual Private Cloud (VPC) network named `corp-vpc`. The application team requires ingress TCP traffic on port 8080 to be allowed on Compute Engine instances tagged with `backend` ONLY if the traffic originates from instances tagged with `frontend`. All other ingress traffic on port 8080 to `backend` instances must be explicitly blocked by a fallback rule. Which TWO actions must the engineer take when creating these firewall rules using `gcloud`? (Select TWO.)

A Cloud Engineer needs to add an additional non-boot persistent disk to an existing running Linux Compute Engine VM instance named `analytics-vm`. The persistent disk `log-data-disk` has already been created in the same zone. Arrange the administrative steps in the correct chronological sequence to attach, format, mount, and configure persistent mounting across reboots for this disk.