All practice questions
1591 questions
A cloud security administrator needs to grant an automated compliance service permission to read metadata and configuration settings for both Cloud SQL instances and Cloud Pub/Sub topics within a target Google Cloud project named `prod-data-pipeline`. The solution must enforce the Principle of Least Privilege and restrict access strictly to the target project. Which two IAM role bindings should you grant to the service account? (Select TWO.)
Select all that apply
A cloud engineer is operating a VPC network named `prod-vpc` where a high-priority ingress firewall rule named `block-external-ingress` with priority `1000` denies all incoming traffic from external networks. The engineer needs to configure firewall access to allow Google Cloud load balancer health check probes (`35.191.0.0/16` and `130.211.0.0/22`) to reach backend instances tagged as `web-backend` over TCP port 80. Which `gcloud` command should the engineer run to ensure the health check probes are successfully evaluated and permitted?
A Cloud Engineer needs to update the resource configuration of an existing Cloud Run service named `order-service` in the `us-central1` region. The service must be configured to handle up to 50 concurrent requests per container instance while maintaining at least 3 warm instances at all times to minimize latency caused by cold starts. Which `gcloud` command should the engineer run to meet these operational requirements?
A security team enables Uniform Bucket-Level Access (UBLA) on a Google Cloud Storage bucket storing sensitive financial reports. Consequently, legacy automated pipelines attempting to apply per-object Access Control Lists (ACLs) fail. You must grant a financial auditor read access to objects in this bucket while maintaining organizational compliance and least privilege principles. Which TWO actions should you take?
Select all that apply
An infrastructure team wants to block all incoming SSH traffic (TCP port 22) to Compute Engine instances across a Virtual Private Cloud (VPC) network, while allowing SSH access strictly to instances assigned the network tag `bastion-host`. The team configures a VPC firewall rule with a priority of 1000 that denies ingress TCP port 22 for all instances in the network. Which configuration for a second firewall rule will successfully permit SSH traffic to only the tagged instances?
An organization is setting up a hybrid architecture where an on-premises application running inside a Linux server needs to upload hourly diagnostic reports directly to a Google Cloud Storage bucket in project `analytics-prod-994`. Security policy strictly forbids storing long-lived, downloadable service account key files (.json or .p12) on local disks outside of Google Cloud. Which of the following setup actions are required to establish secure, keyless access for this external workload using GCP recommended service account practices? (Select TWO.)
Select all that apply
An organization operates three separate Google Cloud projects (`proj-services-prod`, `proj-data-prod`, and `proj-auth-prod`) hosting microservice workloads. The Operations team needs a single, centralized Cloud Monitoring dashboard and alerting view to monitor compute infrastructure metrics across all three projects simultaneously without moving the workloads. They create a central administrative project named `proj-monitoring-central`. Which step should the Cloud Engineer perform to achieve this unified observability setup?
A healthcare organization is configuring a Google Cloud Storage bucket named `med-research-imaging-archive` to share anonymized medical data with external research partners. Regulatory compliance requires that all storage security policies be unified and administered strictly through IAM, prohibiting any per-object Access Control Lists (ACLs). Additionally, external partners must be granted read access to the stored objects while strictly following the principle of least privilege.
Which TWO configuration steps should the cloud administrator take? (Select TWO)
Select all that apply
A Cloud Operations engineer needs to provision a Compute Engine virtual machine instance named `data-processor-vm` in zone `us-central1-a`. The virtual machine requires an automated initial startup script stored in a Cloud Storage bucket at `gs://company-bootstrap-scripts/init-processor.sh` to execute upon system boot. Which `gcloud compute` command correctly configures the instance to use this remote script?
You are auditing the security configuration of a Google Cloud resource hierarchy. The root Organization node enforces an Organization Policy list constraint (`constraints/compute.trustedImageProjects`) that restricts Compute Engine instance creation to images from `projects/shared-base-images`. A newly created folder named `DataEngineering` requires access to images from `projects/analytics-images` in addition to the globally allowed images. How should you configure the Organization Policy at the `DataEngineering` folder level to satisfy this requirement for all underlying projects?
A cloud developer is deploying a containerized REST API microservice named orders-api to Google Cloud Run using the gcloud command-line tool. The microservice needs to accept public HTTP traffic from external clients and dynamically receive requests on the port assigned by the platform container contract. Which two configuration actions are required to ensure the microservice successfully receives and handles incoming requests on Cloud Run? Select 2 options.
Select all that apply
A Cloud Engineer is managing a network setup where two Virtual Private Cloud networks, `vpc-analytics` and `vpc-core`, are connected using VPC Network Peering. Custom static routes created in `vpc-analytics` are currently not propagating to virtual machines in `vpc-core`. Which two actions must be taken using `gcloud compute networks peerings` to allow custom static routes to be properly exchanged between these two peered networks? (Select TWO.)
Select all that apply
A cloud engineer is setting up a new custom-mode VPC subnet in the `us-central1` region named `backend-subnet` for internal application instances. The workload has two strict operational requirements:
1. Virtual machines in `backend-subnet` must be able to securely reach Google Cloud APIs and services without having external IPv4 addresses assigned.
2. Ingress traffic on TCP port 8080 must be restricted specifically to instances running under the service account `[email protected]`.
Which TWO configuration steps must the engineer perform when deploying the subnet and firewall rules to fulfill these requirements?
Select all that apply
A Cloud Engineer is tasked with performing a canary release for an updated container image on an existing Cloud Run service named `orders-api`. The objective is to deploy the updated revision without exposing it to live production traffic immediately, perform validation on the revision's dedicated URL, gradually shift 10% of production traffic to the new revision, and monitor its operational metrics. Sequence the following deployment and traffic management steps in the correct order from first to last.
Drag items to arrange them in the correct order
A cloud engineering team needs to standardize a base environment for auto-scaling a web application currently running on a standalone Compute Engine instance. The team plans to capture the configuration of the existing instance's boot disk, package it into a custom image, and use that image to generate an instance template for a new Managed Instance Group (MIG). In what sequential order should the engineer perform these gcloud CLI operations to ensure data consistency and proper resource dependency?
Drag items to arrange them in the correct order
An organization is onboarding a database administrator who is responsible for creating, modifying, and managing Cloud Spanner instances and databases within a specific development Google Cloud project. The administrator must not be granted permissions to manage IAM access policies or administer other unrelated cloud services in the project. Following the principle of least privilege, which IAM role should you grant to the administrator at the project level?
A cloud security administrator must set up audit logging to track and analyze user access to Cloud SQL databases across all projects within an organization. The solution requires enabling Cloud SQL Data Access audit logging, aggregating and routing these logs to a central BigQuery dataset in a security project, and granting a security analyst least-privilege permissions to inspect these logs in both Logs Explorer and BigQuery. What is the correct sequence of steps to configure log generation, export routing, writer authorization, and analyst access?
Drag items to arrange them in the correct order
An infrastructure team is standardizing security controls on Google Cloud Storage buckets containing telemetry data. To comply with corporate audit standards, the team enables Uniform Bucket-Level Access (UBLA) on a bucket named telemetry-analytics-prod. Shortly after, an automated data ingestion process fails when executing a script that uploads log files with specific Access Control Lists (ACLs) using the Cloud Storage API. You need to resolve the error while maintaining UBLA compliance on the bucket. What should you do?
An automated log-processing service account running in a GCP environment requires read-only access to source logs stored in a Cloud Storage bucket in Project Alpha (`src-logs-bucket`) and must write processed log output to a destination Cloud Storage bucket in Project Beta (`dst-logs-bucket`). Which of the following IAM role assignments adhere to the principle of least privilege while providing the necessary permissions? (Select TWO answers.)
Select all that apply
A software team is deploying an existing internal microservice named `analytics-ingest` to Google Cloud Run using the `gcloud` CLI. The application container is hardcoded to listen for incoming web traffic on port 3000 and does not dynamically adapt to the default `PORT` environment variable. When deployed with default parameters, the service fails health checks because Cloud Run routes requests to port 8080. Which `gcloud run deploy` parameter must be included to resolve this issue?