All practice questions

A database administrator needs to execute local gcloud CLI commands to update Cloud Spanner schema configurations using the dedicated service account [email protected]. Security policy strictly forbids creating or downloading static service account JSON keys. Which IAM role assignment and gcloud configuration allows the administrator to temporarily assume the identity of the service account?

A site reliability engineer is executing a Terraform configuration to provision Google Kubernetes Engine (GKE) clusters in a newly created Google Cloud project named `proj-dev-app-101`. During the `terraform apply` step, the deployment fails with an error indicating that `container.googleapis.com` is disabled. The engineer notes that the Kubernetes Engine API was previously enabled in the central administration project where their local credentials originate. Why did this deployment fail, and what action should be taken to resolve the issue?

An organization is configuring access control for an external site reliability consulting team. The team requires read-only access to view metrics in Cloud Monitoring and read standard application log entries in Cloud Logging within a single Google Cloud project named `telemetry-prod-app`. According to corporate policy, the team must not have access to any other projects in the resource hierarchy, nor should they receive broad read access to unrelated GCP service resources. Which TWO IAM roles should be bound to the consulting team's group identity at the project level to satisfy these requirements while adhering to the principle of least privilege? Select TWO options.

A Cloud Operations engineer is managing Virtual Private Cloud (VPC) networking resources in Google Cloud. The engineer needs to route all outbound traffic destined for a third-party vendor's network range $198.51.100.0/24$ through an existing custom gateway Virtual Machine instance named `gateway-instance-1` located in zone `us-east1-b`. The target VPC network is named `enterprise-vpc`. Which `gcloud` command should the engineer execute to correctly configure this routing resource?

Your organization requires that access to objects inside a Google Cloud Storage bucket named `finance-reports-prod` be managed strictly using unified Cloud IAM permissions, completely disabling fine-grained Object Access Control Lists (ACLs). Which command should you run to enable Uniform Bucket-Level Access on this bucket?

A systems administrator needs to deploy a secure workload in Google Cloud Platform using the `gcloud` CLI. The design requires a custom-mode Virtual Private Cloud network named `prod-vpc`, a dedicated regional subnet named `prod-subnet-uscentral1` ($10.2.0.0/24$), an ingress firewall rule permitting SSH traffic to instances with a specific network tag, and a Compute Engine VM instance associated with this configuration. In what chronological order must these administrative commands be executed?

You are configuring access controls for a new microservice in your Google Cloud project. You need to create a new user-managed service account named 'app-monitoring-sa' using the Google Cloud Command-Line Interface (CLI). Which gcloud command should you run to create this service account?

A DevOps engineer manages a Cloud Storage bucket named `analytics-central-logs-prod` that has Uniform Bucket-Level Access (UBLA) enforced across the enterprise. A third-party security auditing application running on a Compute Engine instance uses a dedicated service account. The application requires read access strictly to log files located under the `application-a/` object prefix path (`gs://analytics-central-logs-prod/application-a/*`), but must be denied access to all other object prefixes inside the bucket. A team member proposes running a command to set fine-grained Access Control Lists (ACLs) on the object prefix, but the command fails with a 400 Bad Request error due to UBLA. Which configuration approach correctly grants the required scoped access while maintaining compliance with UBLA?

A Cloud Engineer is tasked with establishing passwordless, keyless authentication for a pod running in a Google Kubernetes Engine (GKE) cluster to query BigQuery tables. The team has mandated using GKE Workload Identity following Google Cloud best practices. In what precise sequence should the engineer execute the configuration steps to enable this access?

An enterprise application requires a managed relational database service that provides horizontal scaling across multiple Google Cloud regions while maintaining transactional consistency for both read and write operations. A cloud engineer must provision this database using the Google Cloud CLI. Which command correctly provisions the appropriate managed database instance to meet these requirements?

A DevOps team is setting up access controls for a company's cloud infrastructure. An internal compliance auditing group needs to inspect security configurations and IAM policies across all projects contained within a dedicated folder named `financial-services`. Additionally, an automated deployment pipeline service account requires permissions to create and manage Compute Engine instances exclusively inside a single project named `staging-workloads`. Which of the following IAM role assignments adhere to the principle of least privilege and proper resource hierarchy scoping? (Select TWO correct answers.)

An operations team is evaluating database solutions for an application that requires ACID compliance, multi-table SQL joins, and relational transaction capabilities. A developer recommends replacing the current database instance with Cloud Bigtable to increase write throughput. Which statement accurately explains why Cloud Bigtable does not meet the operational requirements for this workload?

Your organization operates an on-premises automated data processing platform that needs to read and write data objects in Google Cloud Storage buckets located in a target project named `proj-analytics-prod`. Security mandates require that no long-lived service account JSON keys are generated or stored on external systems, access must strictly adhere to the principle of least privilege, and identity management must be centralized in a dedicated project named `proj-iam-central`.

Which TWO configuration steps must you execute to grant the external workload access to Cloud Storage? (Select TWO.)

You are configuring access control for a background application running in Google Cloud. You need to create a new user-managed service account named `analytics-worker` using the `gcloud` CLI. Which command should you execute to create this service account?

An enterprise administrator needs to ensure that no virtual machines created within a specific folder can be assigned external IP addresses. Which Google Cloud service or feature should be configured on the folder to enforce this restriction across all descendant projects?

A cloud engineer needs to safely transition an existing Google Cloud Storage bucket from fine-grained access control to Uniform Bucket-Level Access. What is the correct sequence of steps to complete this transition without disrupting user access?

An infrastructure engineer is managing an existing Google Kubernetes Engine (GKE) Standard cluster hosting a multi-tier web application. During high-traffic events, the Horizontal Pod Autoscaler (HPA) successfully increases the target replica count for the deployment. However, several newly created pods remain stuck in a `Pending` state because the current nodes lack sufficient CPU and memory capacity to accommodate the pod resource requests. The engineer needs to ensure that the infrastructure automatically provisions additional node capacity when pods cannot be scheduled due to resource constraints, and scales down nodes when they are underutilized. Which action should the engineer take?

A Cloud Operations team manages a production Compute Engine instance cluster in a custom Virtual Private Cloud (VPC) network named `prod-vpc` and subnet `prod-subnet-01` located in region `us-central1`. The instances operate without external IP addresses for security compliance. Administrators need to enable Cloud Ops Telemetry logging from these private instances while also permitting secure administrative SSH access through Identity-Aware Proxy (IAP) TCP forwarding. Existing custom ingress rules currently deny all incoming TCP traffic on port 22 with priority 1000. Which TWO `gcloud` configuration steps must the administrator execute to achieve these operational requirements?

An administrator needs to perform scheduled offline maintenance on a standalone Compute Engine instance named `app-server-1`. The administrator must upgrade its machine type to `e2-standard-4` and attach a newly provisioned persistent disk named `log-disk-1` for additional log storage using the `gcloud` CLI. What is the correct sequence of steps to perform this maintenance operation?

A platform engineering team is configuring Workload Identity on a Google Kubernetes Engine (GKE) cluster to enable passwordless authentication to Google Cloud resources. A pod running in the namespace `data-pipeline` uses the Kubernetes service account `exporter-ksa` and needs to write files to Cloud Storage. The target Google service account `[email protected]` has already been assigned the Cloud Storage Object Creator role on the destination bucket. Which IAM role binding configuration is required on `storage-writer-sa` to allow the Kubernetes workload to impersonate it?