Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 1241Question →

An operations engineering team is configuring an application running on a Compute Engine instance to read sensitive configuration data from Secret Manager. Security policies strictly prohibit creating or downloading service account JSON keys. The application runs under the VM instance's service account (`[email protected]`) and must temporarily impersonate a dedicated target service account (`[email protected]`) to retrieve the secrets. Which TWO actions must be completed to grant the minimum necessary permissions for this impersonation setup? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant `[email protected]` the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on `[email protected]`.; Grant `[email protected]` the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) on the required secret.

Answer

To configure secure service account impersonation without service account keys, grant the calling service account the Service Account Token Creator role on the target service account, and grant the target service account the specific resource permissions (Secret Manager Secret Accessor).
To establish service account impersonation, the calling principal (`[email protected]`) needs `roles/iam.serviceAccountTokenCreator` specifically on the target service account resource (`[email protected]`). In addition, the target service account itself must hold the required role (`roles/secretmanager.secretAccessor`) to perform the intended workload operation.

Step-by-Step Solution

1
Configure impersonation permissions
The identity `[email protected]` is granted `roles/iam.serviceAccountTokenCreator` bound directly to the resource `[email protected]`.
The Service Account Token Creator role allows the initiating principal to generate short-lived OAuth 2.0 access tokens and OIDC tokens for the target service account.
2
Grant target workload permissions
The identity `[email protected]` is granted `roles/secretmanager.secretAccessor` on the target Secret Manager secret.
Once impersonated, the application inherits the IAM permissions assigned specifically to the target service account.

Key Concept

Service Account Impersonation requires binding the Service Account Token Creator role on the target service account to the calling identity, while assigning necessary resource access roles to the target service account itself.
Question 1242Question →

A cloud administrator is configuring access for a Google Cloud Storage bucket named `corp-financial-records`. The security policy requires enforcing central governance by activating Uniform Bucket-Level Access (UBLA). A data analyst requires read-only access to the data in this bucket. How should the administrator grant the analyst the required access while adhering to Google Cloud security best practices?

Show answer & explanation

Answer: Grant the predefined `roles/storage.objectViewer` IAM role to the analyst at the bucket level.

Answer

Grant the predefined `roles/storage.objectViewer` IAM role to the analyst at the bucket level.
When Uniform Bucket-Level Access is enabled on a Cloud Storage bucket, Access Control Lists (ACLs) are disabled, and access management relies entirely on Cloud IAM. Granting the predefined `roles/storage.objectViewer` role to the analyst at the bucket level follows Google Cloud security best practices and the principle of least privilege.

Step-by-Step Solution

1
Analyze the access control requirement and constraint.
Uniform Bucket-Level Access (UBLA) is enabled on `corp-financial-records`, which disables per-object ACLs entirely.
UBLA requires all access to be granted exclusively via Cloud IAM policies.
2
Determine the appropriate identity role for a read-only analyst.
The predefined role `roles/storage.objectViewer` provides permission to view objects without administrative access.
Predefined roles conform to the principle of least privilege.
3
Apply the role at the appropriate resource level.
Assigning the role directly on the Cloud Storage bucket resource scopes permissions specifically to `corp-financial-records`.
Scoped IAM assignments prevent over-granting permissions across unrelated project resources.

Key Concept

Uniform Bucket-Level Access (UBLA) disables Cloud Storage ACLs and mandates access control management via Cloud IAM roles.
Question 1243Question →

An enterprise application exports daily database dump files into a Google Cloud Storage Standard bucket. Corporate governance mandates that these dump files remain immediately available for audit queries during their first 30 days, after which they are rarely accessed. All dump files must be automatically purged after 365 days. You want to implement an Object Lifecycle Management policy to meet these requirements with minimal operational overhead and optimized storage costs. Which TWO lifecycle rule configurations should you apply? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Set a lifecycle rule action to change the object storage class to Coldline when the object age reaches 30 days.; Set a lifecycle rule action to delete the object when the object age reaches 365 days.

Answer

The two correct actions are setting a lifecycle rule to transition objects older than 30 days to Coldline storage, and setting a lifecycle rule to delete objects when their age reaches 365 days.
Transitioning objects to Coldline storage after 30 days matches the reduced access pattern while saving storage costs. Deleting objects after 365 days ensures compliance with retention policies without ongoing operational overhead.

Step-by-Step Solution

1
Analyze access frequency and cost requirements
Standard storage is appropriate for active queries during the first 30 days; Coldline storage is optimal after 30 days for infrequent access.
Transitioning early incurs retrieval fees, while remaining in Standard long-term incurs unnecessary storage fees.
2
Configure transition rule
Add a lifecycle rule condition for age = 30 days with action SetStorageClass to Coldline.
Automatically shifts storage tier without altering file locations or application pointers.
3
Configure deletion rule
Add a lifecycle rule condition for age = 365 days with action Delete.
Automates complete purging of expired database backups to fulfill the retention requirement.

Key Concept

Cloud Storage Object Lifecycle Management Tiering and Retention
Estimated Time:1m 30s
Question 1244Question →

An administrator needs to establish resource constraints on a folder named 'Staging'. The requirements state that developers must not be allowed to create external service account keys, and Compute Engine virtual machines in this folder must be restricted from obtaining public IP addresses. Which two Organization Policy constraint configurations directly fulfill these security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enforce the 'iam.disableServiceAccountKeyCreation' constraint on the 'Staging' folder.; Configure the 'compute.vmExternalIpAccess' constraint to deny external IP allocations on the 'Staging' folder.

Answer

Enforce the 'iam.disableServiceAccountKeyCreation' constraint on the 'Staging' folder and configure the 'compute.vmExternalIpAccess' constraint to deny external IP allocations on the 'Staging' folder.
Organization Policy constraints are programmatic guardrails applied to resource hierarchy nodes. Enforcing 'iam.disableServiceAccountKeyCreation' blocks key export, and setting 'compute.vmExternalIpAccess' to deny external IP assignment restricts public IP access for all projects in the designated folder.

Step-by-Step Solution

1
Identify the target resource hierarchy node for policy application.
Select the 'Staging' folder as the target scope.
Applying Organization Policy constraints at the folder level ensures automatic inheritance across all contained projects.
2
Identify the constraint for service account key restriction.
Enforce 'iam.disableServiceAccountKeyCreation'.
This specific Organization Policy constraint stops users from creating service account JSON/P12 keys.
3
Identify the constraint for public IP restriction.
Configure 'compute.vmExternalIpAccess' to deny external IPs.
This constraint restricts Compute Engine instances from being assigned external IP addresses.

Key Concept

Organization Policy Constraints and Resource Hierarchy Inheritance
Question 1245Question →

An operations team needs to deploy a non-critical, fault-tolerant batch data processing workload on Google Compute Engine. The solution must minimize compute costs and require custom memory usage metrics to be sent to Cloud Monitoring for operational visibility. Which TWO actions should the team take to satisfy these requirements?

Select all that apply

Show answer & explanation

Answer: Provision the Compute Engine VM instances using Spot VMs.; Install and configure the Google Cloud Ops Agent on the VM instances.

Answer

Provision the Compute Engine VM instances using Spot VMs, and install and configure the Google Cloud Ops Agent on the VM instances.
Provisioning instances as Spot VMs fulfills the requirement to minimize costs for a non-critical, fault-tolerant batch processing workload. Installing the Google Cloud Ops Agent provides the necessary system memory metrics to Cloud Monitoring according to Google Cloud best practices.

Step-by-Step Solution

1
Select the appropriate Compute Engine instance purchasing model for cost-optimized, fault-tolerant batch processing.
Using Spot VMs significantly reduces compute expenditure while meeting the requirement for non-critical, preemption-tolerant workloads.
Spot VMs are designed specifically for fault-tolerant applications where cost efficiency is prioritized.
2
Determine the current Google Cloud standard agent for telemetry and memory metric collection on Compute Engine VMs.
The Google Cloud Ops Agent is selected as the active, supported standard for logging and system metrics (including memory).
Legacy agents are deprecated and do not represent current Google Cloud operational best practices.

Key Concept

Compute Engine operational management involving Spot VM cost optimization and Ops Agent deployment for system telemetry.
Estimated Time:1m 30s
Question 1246Question →

A cloud engineer is deploying a Linux Compute Engine instance to host an internal application. The engineer needs to collect operating system-level metrics—specifically detailed RAM/memory usage—and application log files, streaming both to Google Cloud Observability. Which solution aligns with Google Cloud recommended practices for VM telemetry collection and access control?

Show answer & explanation

Answer: Install the Google Cloud Ops Agent on the instance and attach a custom service account with the Monitoring Metric Writer and Logs Writer predefined IAM roles.

Answer

Install the Google Cloud Ops Agent on the instance and attach a custom service account with the Monitoring Metric Writer and Logs Writer predefined IAM roles.
The Google Cloud Ops Agent combines logging and metrics collection into a single high-performance package. Gathering guest operating system telemetry—such as detailed memory utilization—requires installing an in-guest agent. Configuring the VM with a service account possessing the predefined roles Monitoring Metric Writer (roles/monitoring.metricWriter) and Logs Writer (roles/logging.logWriter) grants the exact minimal permissions required for telemetry ingestion.

Step-by-Step Solution

1
Identify the required telemetry metrics and logs
Realize that hypervisor metrics (CPU utilization, network traffic, disk I/O) are collected automatically, but guest OS metrics (memory usage) and log file parsing require an in-guest agent.
Compute Engine hypervisors cannot read internal guest OS memory state or local application files directly.
2
Select the correct telemetry agent
Choose the Google Cloud Ops Agent over legacy Stackdriver agents.
The Google Cloud Ops Agent is the current unified solution for logging and metrics on Compute Engine instances.
3
Apply least-privilege security permissions
Attach a custom service account with 'roles/monitoring.metricWriter' and 'roles/logging.logWriter'.
Predefined roles limit permissions to necessary operations without granting unnecessary administrative access.

Key Concept

Compute Engine Telemetry & Ops Agent Deployment
Estimated Time:1m 30s
Question 1247Question →

A Cloud Operations engineer is configuring a new Regional Internal Application Load Balancer in a custom Virtual Private Cloud (VPC) network named `corp-vpc` in the `us-central1` region. The load balancer will distribute internal HTTP traffic across a Compute Engine managed instance group deployed in a workload subnet (`10.1.0.0/24`). Before deploying the backend service and forwarding rule, the engineer needs to establish the underlying networking infrastructure required by Google Cloud for proxy-based internal load balancing. Which TWO networking configuration steps must be performed to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create a dedicated proxy-only subnet in `corp-vpc` for the `us-central1` region with the purpose set to REGIONAL_MANAGED_PROXY.; Create an ingress firewall rule in `corp-vpc` allowing traffic from the proxy-only subnet IP range to the backend Compute Engine instances on the application port.

Answer

To operationalize a Regional Internal Application Load Balancer on GCP, you must create a proxy-only subnet with purpose REGIONAL_MANAGED_PROXY in the specified region and configure an ingress firewall rule allowing traffic from the proxy-only subnet range to the backend instances.
Regional Internal Application Load Balancers use an Envoy proxy architecture. Google Cloud requires a designated proxy-only subnet in the region (with purpose REGIONAL_MANAGED_PROXY) to host these proxies. Additionally, because connections to backend instances originate from the IP addresses in this proxy-only subnet, an ingress firewall rule allowing traffic from the proxy-only subnet CIDR to the backend VM instances is required.

Step-by-Step Solution

1
Identify the architectural requirements for GCP Envoy-based regional load balancers.
Regional Internal Application Load Balancers require a regional proxy-only subnet to allocate IP addresses for Envoy proxy instances.
Google Cloud manages Envoy proxies automatically inside the allocated proxy-only subnet for the region.
2
Configure the necessary network security controls for proxy-to-backend communication.
Create an ingress firewall rule permitting traffic originating from the proxy-only subnet CIDR to reach backend instances on the application port.
By default, VPC network firewalls block incoming connections unless explicitly allowed.

Key Concept

Regional Internal Application Load Balancers require a dedicated proxy-only subnet (REGIONAL_MANAGED_PROXY) per region and corresponding VPC ingress firewall rules to allow proxy traffic to reach backend virtual machines.
Estimated Time:2m 0s
Question 1248Question →

A cloud engineer needs to deploy a secure web server workload using the Google Cloud CLI (`gcloud`). The architecture requires a dedicated custom-mode Virtual Private Cloud (VPC) network, a custom subnet in the `us-central1` region, an ingress firewall rule allowing HTTP traffic to instances with the network tag `web-server`, and a Compute Engine virtual machine instance provisioned inside the custom subnet. What is the correct sequence of operational steps to deploy this infrastructure from scratch?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts by creating the custom-mode VPC network, followed by creating the custom subnet in the target region, then creating the ingress firewall rule with target network tags, and finally provisioning the Compute Engine instance attached to the subnet with the matching network tag.
Google Cloud resource hierarchy and dependency constraints dictate that a parent custom VPC network must be created first (`--subnet-mode=custom`). Next, regional subnets must be defined within the network. Ingress firewall rules targeting specific network tags can then be associated with the network. Finally, Compute Engine instances are launched inside the provisioned subnet with matching network tags applied.

Step-by-Step Solution

1
Create custom-mode VPC network
Establishes the global network resource shell.
Parent VPC network resources must precede child subnet and firewall rule objects.
2
Create regional custom subnet
Allocates a dedicated CIDR block within the custom VPC network.
Instances in custom-mode networks require a pre-allocated subnet for network interface binding.
3
Configure ingress firewall rule
Applies network security rules filtering traffic by target tags.
Configuring security boundaries on the VPC network prepares the environment for safe instance placement.
4
Provision Compute Engine VM instance
Deploys the VM attached to the subnet and binds the `web-server` tag.
The VM relies on existing subnet infrastructure and inherits firewall policies matching its assigned tag.

Key Concept

Google Cloud infrastructure deployment order and resource dependencies for custom VPC networks, subnets, firewall rules, and tagged Compute Engine VMs.
Question 1249Question →

An organization requires a third-party security auditor service account to review configuration settings and read log archives stored inside a single designated Cloud Storage bucket (`sec-audit-logs-2026`) located within the `analytics-prod` project. The auditor must not be able to view objects in any other buckets, nor should they have permissions to alter or delete any resources. Following Google Cloud best practices and the Principle of Least Privilege, how should you grant the necessary permissions?

Show answer & explanation

Answer: Grant the predefined role Storage Object Viewer (`roles/storage.objectViewer`) directly on the `sec-audit-logs-2026` Cloud Storage bucket.

Answer

Grant the predefined role Storage Object Viewer (`roles/storage.objectViewer`) directly on the `sec-audit-logs-2026` Cloud Storage bucket.
Binding the predefined role Storage Object Viewer directly to the designated bucket follows the Principle of Least Privilege by restricting access strictly to the requested bucket resource without granting excessive project-wide permissions or write capabilities.

Step-by-Step Solution

1
Identify required permissions and access scope
Read-only access to objects inside a single Cloud Storage bucket (`sec-audit-logs-2026`).
The scenario explicitly restricts access to a single bucket without permitting access to other buckets or resource modifications.
2
Select the appropriate role type
Predefined role `roles/storage.objectViewer` instead of primitive roles (`roles/viewer` or `roles/editor`).
Predefined roles provide narrow, task-specific permissions, adhering to the Principle of Least Privilege.
3
Determine the resource hierarchy binding target
Bind the role directly to the bucket resource rather than project or folder level.
IAM permissions are inherited down the resource hierarchy. Binding at the bucket level prevents permission leakage to other resources in the project or folder.

Key Concept

Applying IAM policy bindings at the specific resource level using predefined roles to enforce least privilege.
Estimated Time:2m 0s
Question 1250Question →

A cloud engineer needs to standardize access management for a new Cloud Storage bucket by enforcing Cloud IAM permissions exclusively across all stored objects and completely disabling individual object-level Access Control Lists (ACLs). Which bucket configuration must the engineer enable to achieve this requirement?

Show answer & explanation

Answer: Uniform Bucket-Level Access

Answer

Uniform Bucket-Level Access
Uniform Bucket-Level Access (UBLA) unifies access control by disabling Access Control Lists (ACLs) for all objects in the bucket, ensuring that permissions are managed strictly via Cloud IAM roles.

Step-by-Step Solution

1
Identify the requirement to disable object ACLs and enforce IAM-only access.
Recognized that individual object-level ACLs must be turned off for unified access management.
Uniform access management simplifies security policies and ensures compliance across all objects in a bucket.
2
Select the Cloud Storage feature designed specifically for this purpose.
Selected Uniform Bucket-Level Access.
Enabling Uniform Bucket-Level Access (UBLA) disables legacy object ACLs and relies solely on Cloud IAM for access checks.

Key Concept

Uniform Bucket-Level Access (UBLA)
Estimated Time:45s
Question 1251Question →

A data engineering team configures an automated script running on a Compute Engine instance to upload daily transaction logs to a Cloud Storage bucket named `fintech-settlements-prod`. To satisfy regulatory compliance, the security team has already enabled Uniform Bucket-Level Access on `fintech-settlements-prod`. During initial testing, the script fails with a HTTP 400 Bad Request error stating that ACLs cannot be set because Uniform Bucket-Level Access is enabled. Inspection of the script reveals it invokes `gcloud storage cp` with the flag `--predefined-acl=bucket-owner-full-control`. How should the team modify the workflow to resolve the upload failure while preserving compliance standards?

Show answer & explanation

Answer: Remove the `--predefined-acl` flag from the script command and grant the instance service account the predefined `roles/storage.objectCreator` role on the bucket using Cloud IAM.

Answer

Remove the predefined ACL flag from the upload script and grant the service account the predefined Storage Object Creator IAM role on the bucket.
Enabling Uniform Bucket-Level Access (UBLA) on a Google Cloud Storage bucket disables legacy Access Control Lists (ACLs) entirely. Consequently, any operations attempting to set ACLs (such as passing the `--predefined-acl` flag in `gcloud storage cp`) will fail. To resolve this error while preserving compliance, the script must stop specifying ACL flags, and write permissions must be granted exclusively via Cloud IAM using the least-privilege predefined role `roles/storage.objectCreator`.

Step-by-Step Solution

1
Analyze the error cause
Uniform Bucket-Level Access (UBLA) disables Access Control Lists (ACLs) entirely for the bucket and all objects contained within it.
Attempts to specify per-object ACL flags during commands like `gcloud storage cp` will fail with an explicit API validation error when UBLA is enforced.
2
Identify the remediation for command flags
Remove fine-grained ACL parameters (such as `--predefined-acl` or `--acl`) from the CLI execution command.
Permissions must be handled exclusively through Cloud IAM rather than ACL headers.
3
Configure least-privilege IAM permissions
Assign the predefined `roles/storage.objectCreator` role to the service account on `fintech-settlements-prod`.
Granting `roles/storage.objectCreator` satisfies the least privilege requirement for write-only log ingestion without granting unnecessary read or admin privileges.

Key Concept

Uniform Bucket-Level Access Enforcement and IAM Role Assignment
Question 1252Question →

What is the correct sequential order of steps required to configure GKE Workload Identity so that an application running in a Kubernetes namespace can access Google Cloud resources using a dedicated Google Service Account (GSA) without relying on static service account keys?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with enabling Workload Identity on the GKE cluster, followed by creating and granting IAM roles to the Google Service Account (GSA). Next, create the Kubernetes Service Account (KSA), grant the `roles/iam.workloadIdentityUser` role on the GSA to the KSA identity URI, and finally annotate the KSA with the GSA's email address.
Configuring Workload Identity follows a logical top-down sequence: infrastructure setup, identity provisioning on both GCP and Kubernetes layers, authorization via IAM binding, and pod configuration via KSA annotation. First, the GKE cluster must have Workload Identity enabled to create the workload identity pool. Second, the Google Service Account (GSA) is created and assigned resource permissions. Third, the Kubernetes Service Account (KSA) is created in the target namespace. Fourth, the IAM role `roles/iam.workloadIdentityUser` is granted on the GSA to the formatted KSA member URI. Finally, the KSA is annotated with the GSA email so the GKE metadata server handles keyless token negotiation.

Step-by-Step Solution

1
Enable Workload Identity at the cluster level.
The GKE cluster establishes a workload identity pool (`PROJECT_ID.svc.id.goog`) and enables the GKE metadata server daemonset on cluster nodes.
Workload Identity infrastructure must be active before identity delegation can take place.
2
Configure the target Google Service Account (GSA).
A GSA is provisioned in Google Cloud IAM with resource access permissions following the principle of least privilege.
The GSA provides the Google Cloud identity that performs actual operations against GCP APIs.
3
Provision the Kubernetes Service Account (KSA).
A KSA object exists in the target Kubernetes namespace.
The KSA provides the pod-level workload identity within Kubernetes.
4
Bind the KSA identity to the GSA using IAM permissions.
The KSA identity string `serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]` receives the `roles/iam.workloadIdentityUser` role on the GSA.
This step grants permission for the specific Kubernetes service account to impersonate the target GSA.
5
Annotate the KSA with the GSA email address.
Pods using the KSA are automatically intercepted by the GKE metadata server to exchange Kubernetes tokens for short-lived GCP OAuth tokens.
The annotation completes the mapping between the Kubernetes workload and the GCP service account identity.

Key Concept

GKE Workload Identity Configuration Sequence
Question 1253Question →

An enterprise manages its Google Cloud infrastructure using a multi-layer resource hierarchy. At the organization root level, an Organization Policy enforces the Domain Restricted Sharing constraint (`constraints/iam.allowedPolicyMemberDomains`) with an allowed list containing Primary Domain Customer ID `C01111111`.

To allow integration with a partner company, a cloud administrator updates the policy for `constraints/iam.allowedPolicyMemberDomains` on the `Partner-Projects` folder by setting `inheritFromParent: true` and adding Customer ID `C02222222` to the allowed list.

A project administrator for `Project-X` (located inside the `Partner-Projects` folder) attempts to perform two separate IAM policy updates on `Project-X`:
1. Granting `roles/storage.admin` to an identity belonging to Customer ID `C01111111`.
2. Granting `roles/storage.admin` to an identity belonging to Customer ID `C03333333`.

Which outcome will occur when the project administrator attempts these IAM role assignments?

Show answer & explanation

Answer: The grant for Customer ID C01111111 succeeds because setting inheritFromParent to true merges allowed values from the organization and folder levels, while the grant for Customer ID C03333333 is blocked by the effective organization policy constraint.

Answer

The grant for Customer ID C01111111 succeeds because setting inheritFromParent to true merges allowed values from the organization and folder levels, while the grant for Customer ID C03333333 is blocked by the effective organization policy constraint.
For Organization Policy list constraints, setting `inheritFromParent: true` creates an effective policy that combines (merges) the allowed values from parent nodes with those defined at the local node. Therefore, both Customer ID C01111111 and Customer ID C02222222 are permitted members for IAM bindings in child projects. The attempt to add an identity from Customer ID C03333333 fails because it is not on the effective allowed list, and Organization Policies strictly restrict IAM operations regardless of user role privilege level.

Step-by-Step Solution

1
Evaluate Organization Policy list constraint inheritance behavior at the folder level.
Because `inheritFromParent: true` is explicitly configured on the `Partner-Projects` folder for `constraints/iam.allowedPolicyMemberDomains`, the effective policy at the folder (and child projects) is the union of the parent allowed list (`C01111111`) and the folder allowed list (`C02222222`).
List constraints with inheritance enabled merge allowed values down the resource hierarchy.
2
Evaluate the first IAM grant attempt for Customer ID C01111111 on Project-X.
The operation succeeds.
Customer ID C01111111 is present in the effective allowed domain list inherited from the organization root.
3
Evaluate the second IAM grant attempt for Customer ID C03333333 on Project-X.
The operation is denied by the resource manager enforcement check.
Customer ID C03333333 is not included in either the organization root policy or the folder policy, and IAM permissions cannot bypass Organization Policy constraints.

Key Concept

Organization Policy List Constraint Inheritance and IAM Guardrail Enforcement
Question 1254Question →

An engineer is deploying a custom web microservice named `order-processor` to Google Cloud Run using a container image stored in Artifact Registry (`us-docker.pkg.dev/prod-project/apps/order-processor:v1`). The containerized application is hardcoded to listen for HTTP requests on port `3000`. The service must run using a dedicated service account (`[email protected]`) to follow the principle of least privilege, and it must accept public incoming traffic from third-party webhooks without requiring Google IAM authentication. Which `gcloud` command should you run to deploy the service with these specifications?

Show answer & explanation

Answer: gcloud run deploy order-processor --image=us-docker.pkg.dev/prod-project/apps/order-processor:v1 [email protected] --allow-unauthenticated --port=3000

Answer

The command starting with 'gcloud run deploy order-processor' with flags '[email protected]', '--allow-unauthenticated', and '--port=3000' correctly deploys the Cloud Run service.
The correct command uses `gcloud run deploy` with `--image` pointing to Artifact Registry, `--service-account` specifying the dedicated identity, `--allow-unauthenticated` for public webhook access, and `--port=3000` to properly instruct Cloud Run to route traffic to the container's custom listening port.

Step-by-Step Solution

1
Identify the target deployment platform and CLI tool.
Since a custom pre-built container image from Artifact Registry is being deployed as a web service, the correct tool is `gcloud run deploy`.
Cloud Run is designed for deploying pre-packaged container images listening on HTTP.
2
Configure runtime identity and ingress authentication requirements.
Use `[email protected]` to specify the identity and `--allow-unauthenticated` to enable public HTTP access.
This enforces least privilege identity while allowing external webhooks to invoke the HTTP endpoint without IAM credentials.
3
Configure the container port mapping flag.
Use `--port=3000` to inform Cloud Run to send incoming HTTP traffic to port 3000 inside the container.
Cloud Run routes traffic to port 8080 by default. When a container listens on a non-standard port like 3000, `--port=3000` must be explicitly specified during deployment.

Key Concept

Deploying containerized microservices to Cloud Run with custom port mappings, runtime service accounts, and unauthenticated ingress using gcloud CLI.
Question 1255Question →

A cloud administration team manages a stateless web application deployed across a Managed Instance Group (MIG) in Google Cloud. The team has created a new instance template containing an updated container image for the application. They need to update all virtual machine instances in the group to the new version with zero downtime for end users. Which action should the team take to perform this update?

Show answer & explanation

Answer: Initiate a rolling update on the Managed Instance Group using the newly created instance template.

Answer

Initiate a rolling update on the Managed Instance Group using the newly created instance template.
The standard and Google-recommended practice for updating Compute Engine instances in a Managed Instance Group is to create a new instance template and initiate a rolling update. This automatically provisions new instances using the updated configuration while terminating old instances in a controlled, zero-downtime manner.

Step-by-Step Solution

1
Identify the target Managed Instance Group and the new Instance Template.
The new template contains the desired VM configuration and updated application code.
Managed Instance Group instances are immutable configurations defined by their instance template.
2
Execute a rolling action update on the Managed Instance Group.
The group controller gradually creates new instances with the updated template while removing old instances.
Rolling updates maintain active instance availability during the transition, preventing downtime.

Key Concept

Updating Compute Engine Managed Instance Groups using Instance Templates and Rolling Updates
Estimated Time:1m 30s
Question 1256Question →

A cloud engineer needs to deploy a Compute Engine virtual machine named `app-frontend` using the Google Cloud CLI. The VM must be configured to run with a dedicated custom service account to access Google Cloud resources securely. Additionally, the instance requires initial configuration parameters provided via key-value key pairs at boot time. Which flags should the engineer include in the `gcloud compute instances create` command to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use `--service-account` followed by the email address of the dedicated custom service account.; Use `--metadata` followed by key-value pairs to pass custom instance startup parameters.

Answer

The correct options are specifying `--service-account` with the service account email and using `--metadata` to pass key-value parameters.
Attaching a custom service account via `--service-account` provides proper IAM identity without exposing static keys, while passing configuration data via `--metadata` allows boot-time settings to be read by the virtual machine.

Step-by-Step Solution

1
Identify the CLI flag required to attach a custom identity to a Compute Engine instance.
The `--service-account` flag specifies the target service account email address without needing private key files.
This enforces identity attachment natively within Compute Engine IAM management.
2
Identify the CLI flag required to pass custom key-value pairs to instance metadata at creation.
The `--metadata` flag defines custom key-value pairs available via the instance metadata server.
Custom metadata values allow boot-time script or application configuration parameters to be consumed.

Key Concept

Attaching custom service accounts and key-value metadata to Compute Engine instances via gcloud CLI flags.
Question 1257Question →

A cloud solution architect is deploying a custom-mode Virtual Private Cloud (VPC) subnet to host internal Compute Engine virtual machines that do not have public IP addresses assigned. These virtual machines must be able to upload log files directly to a Google Cloud Storage bucket without sending traffic over the public internet or utilizing NAT gateways.

Which configuration must be enabled on the subnet to support this connectivity requirement?

Show answer & explanation

Answer: Enable Private Google Access on the target VPC subnet.

Answer

Enable Private Google Access on the target VPC subnet.
Enabling Private Google Access on the subnet permits Compute Engine VM instances with only internal IP addresses to reach the external IP addresses of Google APIs and services such as Google Cloud Storage.

Step-by-Step Solution

1
Identify the network requirements for instances lacking public IP addresses.
Instances only have internal IP addresses and cannot send packets directly over default internet gateways to public endpoints.
Google API endpoints like Cloud Storage resolve to public IP space, which standard internal VM instances without public IPs cannot reach without special networking features.
2
Determine the Google Cloud network feature designed for private Google API access.
Private Google Access enables internal IP instances in a subnet to communicate with Google services.
Enabling Private Google Access on a subnet allows traffic destined for Google APIs to be routed internally over Google's internal network backbone.
3
Configure the setting at the subnet level.
Subnet setting `privateIpGoogleAccess` is set to enabled.
Private Google Access is enabled per-subnet in GCP custom or auto VPC networks.

Key Concept

Private Google Access on VPC Subnets
Estimated Time:1m 15s
Question 1258Question →

An organization is updating its Cloud Storage operational guidelines to align with corporate data governance standards. The security policy mandates consolidating object access controls under identity and access management policies. Which TWO statements correctly describe the operational behaviors and configuration rules when Uniform Bucket-Level Access (UBLA) is enabled on a storage bucket?

Select all that apply

Show answer & explanation

Answer: Access Control Lists (ACLs) are disabled, making IAM permissions the single source of authority for access requests to the bucket and its objects.; Granting predefined IAM roles like Storage Object Viewer at the bucket level provides access across all stored objects without evaluating individual object ACLs.

Answer

Enforcing Uniform Bucket-Level Access disables ACL evaluation entirely, making IAM policies the sole access authority and allowing predefined bucket-level IAM roles to grant uniform object access.
Enforcing Uniform Bucket-Level Access ensures that Access Control Lists are disabled for all resources within the bucket, shifting access decision authority exclusively to IAM policies. Granting predefined roles such as Storage Object Viewer at the bucket level provides uniform access to all objects contained within it.

Step-by-Step Solution

1
Analyze how Uniform Bucket-Level Access alters the Google Cloud Storage access control architecture.
Confirm that UBLA disables object-level ACLs and forces all access checks to use IAM policies at the bucket, folder, or project level.
UBLA simplifies security governance by removing dual-layer access checks (IAM + ACLs).
2
Evaluate the role of predefined IAM roles under UBLA enforcement.
Determine that assigning roles like Storage Object Viewer at the bucket level uniformly grants access to all contained objects without needing individual object permissions.
Bucket-level IAM bindings uniformly apply to all current and future objects within the bucket.

Key Concept

Uniform Bucket-Level Access (UBLA) enforcement and IAM single-source access control
Question 1259Question →

A Cloud Operations engineer is managing networking resources in a Google Cloud Virtual Private Cloud (VPC) network. To audit network traffic for an upcoming security compliance review, the engineer needs to enable VPC Flow Logs on an existing subnet named `sb-analytics` located in the `us-east1` region. The operational policy specifies that the aggregation interval must be set to 5 minutes (5 min5\text{ min}) and the sampling rate must capture 50%50\% of traffic (0.50.5). Which `gcloud` command must the engineer execute to correctly update the subnet configuration?

Show answer & explanation

Answer: gcloud compute networks subnets update sb-analytics --region=us-east1 --enable-flow-logs --logging-aggregation-interval=interval-5-min --logging-sample-rate=0.5

Answer

The correct command is `gcloud compute networks subnets update sb-analytics --region=us-east1 --enable-flow-logs --logging-aggregation-interval=interval-5-min --logging-sample-rate=0.5`.
The correct command uses the proper resource command group `gcloud compute networks subnets update`, specifies the required `--region=us-east1` flag, enables logging with `--enable-flow-logs`, sets the aggregation interval to the accepted enum `interval-5-min`, and expresses the 50% sample rate as a decimal float `0.5`.

Step-by-Step Solution

1
Identify the target Google Cloud CLI resource command group for subnets
VPC subnet operations are managed under `gcloud compute networks subnets`.
Subnets belong to regional compute network resources in the CLI hierarchy.
2
Determine the required operation and flags for updating existing subnet configurations
Use `update sb-analytics --region=us-east1` with `--enable-flow-logs`.
Modifying existing resources requires the `update` subcommand along with mandatory regional scoping.
3
Validate the parameter flag names and acceptable value types for VPC Flow Logs settings
`--logging-aggregation-interval` requires acceptable enum values (`interval-5-sec`, `interval-30-sec`, `interval-1-min`, `interval-5-min`, `interval-15-min`), and `--logging-sample-rate` requires a floating-point value between 0.00.0 and 1.01.0 (0.50.5 for 50%50\%).
Passing invalid string formats or integer percentages causes CLI parser errors.

Key Concept

VPC Subnet Operations & Flow Logs Configuration via gcloud CLI
Estimated Time:2m 0s
Question 1260Question →

A Cloud Engineer is responsible for verifying the disaster recovery preparedness of a production Cloud SQL for PostgreSQL instance configured with High Availability (HA). The engineer needs to perform a scheduled manual failover test to switch traffic to the standby instance with minimal operational disruption. Which gcloud command should the engineer execute to initiate this test?

Show answer & explanation

Answer: Execute gcloud sql instances failover INSTANCE_NAME to trigger an explicit failover to the standby replica.

Answer

Execute gcloud sql instances failover INSTANCE_NAME to trigger an explicit failover to the standby replica.
The correct option executes `gcloud sql instances failover INSTANCE_NAME`, which is the official Google Cloud CLI command designed specifically to initiate a manual failover test on a High Availability Cloud SQL instance.

Step-by-Step Solution

1
Identify the requirement for testing High Availability (HA) failover on a Cloud SQL instance.
The operation target is an existing Cloud SQL instance configured for High Availability.
Standard operational testing requires executing an explicit failover to verify standby responsiveness.
2
Select the correct gcloud CLI command group and subcommand designed for Cloud SQL failover.
The sub-command `gcloud sql instances failover` is identified as the dedicated action.
This command instructs Cloud SQL to switch active operation from the primary zone to the secondary standby zone.

Key Concept

High Availability failover operation for Cloud SQL instances
PreviousPage 63 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin