Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 1361Question →

A DevOps engineer needs to safely roll out a new version of a Cloud Run service named `billing-api` in the `us-central1` region by creating a tagged revision, sending a small percentage of test traffic to it, and finally shifting all production traffic to the new revision once verified. Place the following `gcloud` CLI steps in the correct chronological order to complete this canary release workflow.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence to perform a tagged canary rollout on Cloud Run is: 1) Deploy the new revision with `--no-traffic` and `--tag=canary`, 2) Test the revision via its dedicated tag URL, 3) Update traffic to route 10% of production traffic to the `canary` tag, and 4) Route 100% of traffic to the new revision using `--to-latest`.
A standard zero-downtime canary deployment sequence in Cloud Run requires deploying the new code revision with no initial traffic allocation using `--no-traffic` while assigning a revision tag (`--tag`). Next, the engineer tests the container using the generated tag-specific URL. After successful direct verification, a small percentage of live production traffic is assigned to the tag using `gcloud run services update-traffic --to-tags`. Finally, after monitoring stability, 100% of live traffic is shifted to the latest revision.

Step-by-Step Solution

1
Deploy the updated container container with `--no-traffic` and `--tag=canary`.
The revision is created and receives a uniqueURL prefix (`canary---...`), but receives 0% of the main service URL's incoming traffic.
This allows safe deployment to production infrastructure without exposing live users to unverified code.
2
Perform smoke tests directly against the tagged URL.
Validation of service responses and health checks in the live environment.
Verifies that the revision initializes correctly without risking production traffic.
3
Execute `gcloud run services update-traffic billing-api --region=us-central1 --to-tags=canary=10`.
10% of live traffic hitting the main service URL is diverted to the canary revision.
Gradually introduces production load to monitor error rates and latency metrics.
4
Execute `gcloud run services update-traffic billing-api --region=us-central1 --to-latest`.
100% of main service URL traffic is directed to the newest revision.
Completes the canary release once stability is confirmed.

Key Concept

Cloud Run Traffic Splitting & Revision Tagging Workflow
Question 1362Question →

A DevOps engineer needs to manage an existing Cloud Run service named `inventory-api` deployed in the `us-east1` region. The engineer must route exactly 20% of incoming production traffic to a newly deployed revision tagged `v2` while keeping the remaining 80% on the prior revision. Additionally, the service must be configured so that unauthenticated public requests are blocked. Which TWO actions should the engineer perform using `gcloud` commands or IAM configurations to achieve these requirements?

Select all that apply

Show answer & explanation

Answer: Execute `gcloud run services update-traffic inventory-api --region=us-east1 --to-tags v2=20` to allocate traffic to the tagged revision.; Execute `gcloud run services update inventory-api --region=us-east1 --no-allow-unauthenticated` to enforce authentication requirements.

Answer

The engineer must run `gcloud run services update-traffic inventory-api --region=us-east1 --to-tags v2=20` to shift traffic and run `gcloud run services update inventory-api --region=us-east1 --no-allow-unauthenticated` to block unauthenticated requests.
To manage Cloud Run traffic splits safely, `gcloud run services update-traffic` with `--to-tags` allows fine-grained percentage routing to tagged revisions. To restrict public access, `gcloud run services update` with the `--no-allow-unauthenticated` flag removes the `allUsers` invoker binding and enforces IAM authentication.

Step-by-Step Solution

1
Configure traffic split using the gcloud CLI
Assign 20% of incoming production requests to revision tag v2
The `gcloud run services update-traffic` command with `--to-tags v2=20` explicitly updates the service's traffic routing configuration while retaining the remaining percentage on existing revisions.
2
Update Cloud Run ingress authentication settings
Remove public access and require IAM authentication
Applying the `--no-allow-unauthenticated` flag via `gcloud run services update` updates the IAM policy on the Cloud Run service to block unauthenticated invocations.

Key Concept

Cloud Run Traffic Management & IAM Access Control
Question 1363Question →

An infrastructure engineer is configuring ingress firewall rules for a custom Virtual Private Cloud (VPC) network. Two firewall rules are applied to Compute Engine instances with the network tag `api-server`:

- Rule 1 (`allow-internal-api`): Action: Allow, Protocol/Port: TCP:8080, Source CIDR: `10.1.0.0/16`, Priority: `1000`.
- Rule 2 (`deny-partner-api`): Action: Deny, Protocol/Port: TCP:8080, Source CIDR: `10.1.5.0/24`, Priority: `500`.

A client host at IP address `10.1.5.25` attempts a TCP connection on port 8080 to an `api-server` instance. How will Google Cloud VPC firewall rule evaluation process this traffic request?

Show answer & explanation

Answer: The traffic will be denied because Rule 2 has a lower priority number (500), giving it higher precedence over Rule 1 (1000).

Answer

The traffic will be denied because Rule 2 has a lower priority number (500), giving it higher precedence over Rule 1 (1000).
In Google Cloud Virtual Private Cloud (VPC), firewall rules are evaluated in ascending numerical order of their priority values (from 0 to 65535). A lower integer value represents a higher priority. Because priority 500 is lower than priority 1000, Rule 2 (`deny-partner-api`) is evaluated first. Since the incoming IP address `10.1.5.25` falls within `10.1.5.0/24`, Rule 2 matches and immediately denies the connection.

Step-by-Step Solution

1
Identify matching firewall rules for incoming traffic.
Both Rule 1 (Source `10.1.0.0/16`) and Rule 2 (Source `10.1.5.0/24`) match traffic from `10.1.5.25` on TCP port 8080 targeting instances with tag `api-server`.
Traffic matching requires evaluating target tags, protocols, ports, and source IP CIDRs.
2
Compare the priority numbers of the matching rules.
Rule 2 has priority 500, while Rule 1 has priority 1000.
GCP evaluates firewall rules in ascending order of priority integer value (0 to 65535, where 0 is evaluated first).
3
Determine the outcome based on the highest precedence rule.
Rule 2 takes precedence due to its lower priority number (500 < 1000), executing its action (Deny).
Once a matching rule with the lowest numerical priority is found, its action is applied and evaluation stops.

Key Concept

GCP VPC Firewall Rule Priority Precedence
Question 1364Question →

A cloud engineer needs to deploy stateless, fault-tolerant Compute Engine virtual machine instances for a batch processing workload using the gcloud CLI. The instances must minimize compute costs and automatically execute a setup script stored in a Google Cloud Storage bucket (gs://my-app-scripts/setup.sh) during boot. Which TWO gcloud compute instances create flag configurations should the engineer use? (Select TWO)

Select all that apply

Show answer & explanation

Answer: --provisioning-model=SPOT; --metadata=startup-script-url=gs://my-app-scripts/setup.sh

Answer

To achieve minimum compute costs for fault-tolerant workloads while executing a startup script from a Cloud Storage bucket, the engineer must specify '--provisioning-model=SPOT' to request Spot VM pricing and '--metadata=startup-script-url=gs://my-app-scripts/setup.sh' to point to the remote script path.
The combination of using '--provisioning-model=SPOT' and '--metadata=startup-script-url=gs://my-app-scripts/setup.sh' correctly provisions a low-cost Spot VM and instructs Compute Engine to fetch and execute the startup script directly from the designated Cloud Storage bucket.

Step-by-Step Solution

1
Determine the cost-optimization deployment model suitable for stateless, fault-tolerant batch workloads.
Identify that Spot VMs (configured via --provisioning-model=SPOT) provide maximum cost savings for preemptible batch jobs.
Spot instances offer up to 60-91% discounts compared to standard VMs and fit stateless, fault-tolerant batch workloads.
2
Identify the proper gcloud CLI flag for passing a startup script hosted in a Cloud Storage bucket.
Use --metadata=startup-script-url=gs://... rather than local file metadata flags.
When referencing scripts stored remotely in Cloud Storage, the startup-script-url key inside the --metadata flag is required.

Key Concept

Compute Engine Instance Deployment and Metadata Configuration
Question 1365Question →

Your team needs to deploy a dedicated Compute Engine virtual machine instance named prod-api-worker in zone us-east1-b to execute critical database schema migration tasks. To follow security best practices, the VM must run using a non-default, user-managed service account named [email protected] and grant full Google Cloud platform access scopes so IAM roles govern permissions. Which gcloud command should you run to deploy the VM instance according to these requirements?

Show answer & explanation

Answer: gcloud compute instances create prod-api-worker --zone=us-east1-b [email protected] --scopes=https://www.googleapis.com/auth/cloud-platform

Answer

Execute gcloud compute instances create specifying [email protected] and --scopes=https://www.googleapis.com/auth/cloud-platform.
The correct option uses gcloud compute instances create with [email protected] to attach the user-managed service account identity and --scopes=https://www.googleapis.com/auth/cloud-platform to allow IAM policies to manage resource access.

Step-by-Step Solution

1
Identify the required gcloud compute instances create flags for service account identity.
The correct flag to specify identity is --service-account with the full service account email.
Attaching custom service accounts ensures the instance operates under least-privilege IAM permissions instead of the default Compute Engine service account.
2
Determine the appropriate access scope flag.
Use --scopes=https://www.googleapis.com/auth/cloud-platform to delegate effective permission checks to IAM.
Google Cloud best practice recommends enabling the cloud-platform scope when using custom service accounts so IAM policies dictate API permissions.
3
Evaluate workload suitability for availability policies.
Omit flags like --preemptible or --provisioning-model=SPOT for stateful migration tasks.
Database migration jobs are critical operations that should not be unexpectedly terminated.

Key Concept

Attaching User-Managed Service Accounts to Compute Engine Instances via gcloud CLI
Estimated Time:1m 30s
Question 1366Question →

An Associate Cloud Engineer needs to increase the available disk space for a stateful application running on a Linux Compute Engine VM without restarting or replacing the existing Persistent Disk. Sequence the steps required to safely expand the disk capacity and make the additional storage space usable by the operating system.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with expanding the Persistent Disk capacity in GCP (`gcloud compute disks resize`), followed by connecting to the VM via SSH (`gcloud compute ssh`), extending the disk partition table (`growpart`), and finally expanding the guest filesystem (`resize2fs` or `xfs_growfs`).
Expanding persistent storage on a live Compute Engine VM requires a top-down layer approach: provision additional raw block storage at the GCP control plane (`gcloud compute disks resize`), gain access to the OS (`gcloud compute ssh`), update the partition table to encompass the new space (`growpart`), and finally resize the filesystem layer (`resize2fs` or `xfs_growfs`).

Step-by-Step Solution

1
Resize the Persistent Disk resource via GCP infrastructure.
GCP provisions additional raw block storage for the disk attached to the VM.
The hypervisor must present larger physical disk space before the VM guest OS can recognize added capacity.
2
SSH into the VM instance CLI.
An active interactive terminal session inside the guest OS is opened.
Resizing the GCP disk resource does not automatically reconfigure guest OS partitions or filesystems.
3
Run partition expansion tools (`growpart`).
The target partition boundary is grown to encompass the unallocated blocks on the raw disk device.
Filesystems reside within partition boundaries; expanding the partition table must precede filesystem expansion.
4
Run filesystem growth utilities (`resize2fs` or `xfs_growfs`).
The filesystem expands to consume the newly enlarged partition space.
The filesystem layer manages block allocation tables and must be explicitly resized to make storage usable by applications.

Key Concept

Compute Engine Persistent Disk Resizing Procedure
Estimated Time:1m 30s
Question 1367Question →

An organization manages a critical microservice deployed on Cloud Run named `payment-processor` in the `us-central1` region. Following the deployment of a new revision named `payment-processor-00005-xyz`, Cloud Monitoring metrics reveal a sharp increase in HTTP 500 error rates. The operations team needs to immediately redirect 100% of live incoming production traffic back to the previous stable revision named `payment-processor-00004-abc` without deleting the failed revision so developers can inspect its logs. Which `gcloud` CLI command should the operations team run to execute this rollback?

Show answer & explanation

Answer: gcloud run services update-traffic payment-processor --to-revisions=payment-processor-00004-abc=100 --region=us-central1

Answer

Execute `gcloud run services update-traffic payment-processor --to-revisions=payment-processor-00004-abc=100 --region=us-central1` to immediately route all production traffic back to the stable revision.
The command `gcloud run services update-traffic payment-processor --to-revisions=payment-processor-00004-abc=100 --region=us-central1` correctly routes 100% of live traffic to the specified healthy revision while leaving the faulty revision intact for troubleshooting.

Step-by-Step Solution

1
Identify the target revision to receive traffic and the required percentage.
The target revision is `payment-processor-00004-abc` and needs 100% of production traffic.
Emergency rollbacks require directing full live traffic away from the erroneous revision instantly.
2
Select the proper gcloud CLI tool for Cloud Run traffic routing.
Use `gcloud run services update-traffic`.
`update-traffic` explicitly adjusts routing weights between revisions.
3
Specify the revision mapping flag `--to-revisions` along with region metadata.
Construct `gcloud run services update-traffic payment-processor --to-revisions=payment-processor-00004-abc=100 --region=us-central1`.
This guarantees that revision `payment-processor-00005-xyz` receives 0% of traffic while preserving its instance data and logs.

Key Concept

Cloud Run Traffic Management and Revision Rollbacks
Question 1368Question →

A cloud engineer needs to deploy an isolated enterprise application environment in Google Cloud using the Google Cloud CLI (`gcloud`). Arrange the administrative steps in the correct operational order to provision the networking infrastructure and deploy the application instance safely.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The operational sequence requires first creating the custom VPC network, next adding the custom subnet, followed by establishing the ingress firewall rule with target tags, and finally creating the Compute Engine instance bound to the subnet and network tag.
In Google Cloud Platform networking, resources must be created following structural dependencies. First, a custom-mode VPC network must exist to act as the parent object. Second, a subnet within that VPC must be created to define regional CIDR IP blocks. Third, firewall rules are attached to the VPC network with target tags so traffic rules are active. Finally, the Compute Engine VM instance is created referencing the custom subnet and network tags.

Step-by-Step Solution

1
Create the custom-mode VPC network
The VPC container is initialized with no automatically generated subnets.
Subnets and firewall rules require a host VPC network to exist before they can be configured.
2
Create the custom subnet within the designated region
An IP CIDR allocation is bound to the target region under the custom VPC.
Compute instances in a custom VPC require an explicit subnet reference upon creation.
3
Configure firewall rules for incoming traffic
Traffic filters and target network tags are registered within the VPC network.
Security policies should be established before instance deployment to ensure instances are immediately protected.
4
Provision the Compute Engine virtual machine instance
The VM starts with an internal IP assigned from the subnet and traffic controlled by the firewall rule.
Creating the instance depends on both the active subnet for IP allocation and network tags for firewall policy matching.

Key Concept

Deployment dependency order for GCP Virtual Private Cloud (VPC) networks, custom subnets, firewall rules, and compute workloads.
Question 1369Question →

A Cloud Engineer needs to update an existing global HTTP(S) load balancer configuration on Google Cloud Platform. Specifically, the connection draining duration for a global backend service named `app-backend-service` must be reduced from 300 seconds to 60 seconds to decrease deployment waiting times during instance updates. Which gcloud command should the engineer execute to apply this change?

Show answer & explanation

Answer: gcloud compute backend-services update app-backend-service --global --connection-draining-timeout=60

Answer

Execute the command `gcloud compute backend-services update app-backend-service --global --connection-draining-timeout=60`.
The correct command uses `gcloud compute backend-services update` targeting `app-backend-service` with the `--global` flag and sets the `--connection-draining-timeout` parameter to 60 seconds.

Step-by-Step Solution

1
Identify the resource type and scope
The resource is a global backend service named `app-backend-service` associated with an HTTP(S) load balancer.
Backend services manage backend instance groups and settings such as health checks, capacity, and connection draining for HTTP(S) load balancers.
2
Determine the correct gcloud command group and flag for connection draining
Use `gcloud compute backend-services update` with the `--global` location scope flag and `--connection-draining-timeout=60`.
Connection draining is a parameter of the backend service resource measured in seconds.

Key Concept

Configuring connection draining timeout on Google Cloud Load Balancer backend services
Estimated Time:1m 30s
Question 1370Question →

A company operates a critical processing application deployed on a Managed Instance Group (MIG) in a specific Compute Engine region. During peak traffic hours, autoscaling events fail, and system logs report that the project has reached its maximum regional vCPU threshold. The workload must continue scaling horizontally within the same region to accommodate demand. Which action should an Associate Cloud Engineer take to resolve this capacity constraint?

Show answer & explanation

Answer: Submit a formal quota increase request for regional vCPUs in the Google Cloud console Quotas page.

Answer

Submit a formal quota increase request for regional vCPUs in the Google Cloud console Quotas page.
Submitting a quota increase request via the Quotas page in the Google Cloud console is the correct operational method to request additional vCPU capacity for Compute Engine in a designated region.

Step-by-Step Solution

1
Identify the cause of the autoscaling failure
System logs confirm that the regional vCPU quota limit has been exhausted.
Compute Engine resources are constrained by regional and project-level quota caps to prevent unexpected spending and resource exhaustion.
2
Determine the appropriate administrative procedure
Select the option to request an official GCP quota evaluation and increase.
Quota limits cannot be bypassed by network reconfiguration, role modifications, or switching instance types without separate quota provisions.
3
Execute the request via Google Cloud Console
Navigate to IAM & Admin > Quotas, select the regional vCPU metric, and submit an increase request.
Google Cloud approval workflows process quota expansions officially through this channel.

Key Concept

Managing GCP Resource Quotas for Compute Engine Resources
Question 1371Question →

A cloud operations team is configuring a compute infrastructure on Google Cloud to process stateless, fault-tolerant data transformation tasks. The architecture must minimize compute costs while ensuring high availability and automatic replacement of failed instances. Which TWO management strategies should the team implement? (Select 2 answers)

Select all that apply

Show answer & explanation

Answer: Configure the Managed Instance Group (MIG) to use Spot VMs for instance provisioning to reduce compute expenses.; Define an HTTP health check and assign an autohealing policy to the Managed Instance Group to automatically recreate unhealthy instances.

Answer

The correct strategies are to configure the Managed Instance Group to use Spot VMs for stateless processing and to configure an autohealing policy with an HTTP health check to recreate degraded instances.
For stateless, fault-tolerant batch workloads, using Spot VMs within a Managed Instance Group delivers maximum cost savings. Pairing the MIG with an HTTP health check and an autohealing policy ensures high availability because any instance that becomes unresponsive or fails its health check is automatically terminated and recreated.

Step-by-Step Solution

1
Identify cost optimization mechanisms appropriate for stateless workloads
Spot VMs provide significant cost reductions for fault-tolerant and stateless workloads that handle preemptions gracefully.
Stateless batch transformations do not store local persistent state, so unexpected preemptions by Compute Engine will not degrade data integrity.
2
Identify health monitoring and auto-recovery configurations for Compute Engine MIGs
Attaching an explicit HTTP health check to the MIG autohealing policy ensures automatic instance recreation upon application freeze or crash.
Autohealing continuously monitors application endpoints and replaces failed VM instances automatically.

Key Concept

Compute Engine Resource Management: Managed Instance Groups (MIGs), Spot VM placement, and Autohealing Policies
Question 1372Question →

A cloud engineer must deploy a Compute Engine virtual machine instance that automatically executes a startup script to read files from a secure Cloud Storage bucket. To ensure least-privilege security, the VM must authenticate using a dedicated custom service account rather than the default Compute Engine service account. Place the operational steps in the correct chronological order required to set up and deploy this VM instance.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order is: 1) Create the custom IAM service account, 2) Grant the Storage Object Viewer IAM role to the service account, 3) Execute the gcloud compute instances create command with the service account and startup script metadata flags, and 4) Verify VM startup and inspect logs.
Proper GCP infrastructure deployment dictates creating identity resources (service accounts) first, granting them specific role permissions second, instantiating compute resources with those identities and metadata scripts third, and verifying log execution fourth.

Step-by-Step Solution

1
Identity Creation
A custom service account is created in the project.
An identity must exist before access permissions can be granted or assigned to resources.
2
Role Binding
The service account receives the Storage Object Viewer role on the bucket.
Granting least-privilege access prior to VM creation ensures the VM's workload can immediately access required resources upon initialization.
3
Instance Provisioning
The VM is created via gcloud CLI with the identity and script attached.
Specifying `--service-account` and `--metadata-from-file` during provisioning binds the identity and startup script to the instance.
4
Validation
Logs confirm the startup script successfully read from the bucket.
Post-deployment validation ensures the identity credentials and startup script operated as expected.

Key Concept

Compute Engine Service Account Provisioning & Startup Configuration
Question 1373Question →

An infrastructure engineer needs to update a production web application hosted on a Compute Engine Managed Instance Group (MIG). A new instance template with the updated application image has already been created. The deployment must update the running VM instances gradually without interrupting ongoing user traffic. Which Google-recommended approach should the engineer use to perform this update?

Show answer & explanation

Answer: Update the Managed Instance Group target instance template and initiate a rolling update using the gcloud compute instance-groups managed rolling-action start-update command.

Answer

Update the Managed Instance Group target instance template and execute a rolling update via gcloud compute instance-groups managed rolling-action start-update.
The standard and Google-recommended method to update instances in a Managed Instance Group without downtime is to point the MIG to the new Instance Template and execute a rolling update command (`gcloud compute instance-groups managed rolling-action start-update`). This automatically handles replacing instances while maintaining minimum available capacity.

Step-by-Step Solution

1
Identify the requirement for zero-downtime rolling updates in Compute Engine Managed Instance Groups.
Determined that instance updates must be performed incrementally using instance templates.
Managed Instance Groups maintain instance consistency through instance templates rather than manual per-VM edits.
2
Apply the newly created instance template to the Managed Instance Group.
The MIG configuration points to the updated instance template.
The MIG requires an updated template definition before starting the automated update process.
3
Trigger the rolling update action via the gcloud CLI command `gcloud compute instance-groups managed rolling-action start-update`.
Compute Engine replaces old VM instances with new instances in a controlled, rolling manner.
Rolling updates replace instances gradually to preserve service capacity and prevent downtime.

Key Concept

Managed Instance Group (MIG) Rolling Updates
Question 1374Question →

A site reliability engineer needs to optimize a latency-sensitive microservice running on Cloud Run named `telemetry-service` in the `europe-west1` region. To prevent cold starts during peak traffic hours, the service must maintain at least 5 warm container instances at all times, while restricting the upper autoscaling limit to 50 instances to maintain budget boundaries. Which `gcloud` command should be executed to apply these scaling configurations?

Show answer & explanation

Answer: Execute `gcloud run services update telemetry-service --region=europe-west1 --min-instances=5 --max-instances=50`.

Answer

The command `gcloud run services update telemetry-service --region=europe-west1 --min-instances=5 --max-instances=50` properly configures autoscaling limits for Cloud Run.
Executing `gcloud run services update telemetry-service --region=europe-west1 --min-instances=5 --max-instances=50` correctly updates the active configuration of the existing Cloud Run service. Specifying `--min-instances=5` keeps 5 instances ready to process incoming requests without cold start latency, while `--max-instances=50` ensures that Cloud Run will not scale beyond 50 concurrent instances.

Step-by-Step Solution

1
Identify the target serverless platform and required operation
The target workload is deployed on Cloud Run, requiring resource autoscaling updates.
Cloud Run service operational configurations are managed via `gcloud run services update`.
2
Select the correct gcloud flags for minimum and maximum instance count limits
The `--min-instances` flag ensures minimum active instances to prevent cold starts, and `--max-instances` sets the scaling ceiling.
These flags directly modify the service template spec for instance limits.

Key Concept

Cloud Run Autoscaling and Instance Management
Question 1375Question →

An operations team needs to update the network configuration for a custom subnet named `prod-analytics-subnet` located in region `us-east1` within the Virtual Private Cloud (VPC) network `corp-vpc`. The requirements are:

1. Enable VPC Flow Logs on `prod-analytics-subnet` with an aggregation interval set to 5 seconds (`INTERVAL_5_SEC`).
2. Update the existing Cloud NAT service named `nat-config-east` on Cloud Router `nat-router-east` so that `prod-analytics-subnet` is included to provide outbound internet access for private virtual machines using automatically allocated external IP addresses.

Which TWO `gcloud` CLI commands must the team run to satisfy these operational requirements?

Select all that apply

Show answer & explanation

Answer: `gcloud compute networks subnets update prod-analytics-subnet --region=us-east1 --enable-flow-logs --logging-aggregation-interval=INTERVAL_5_SEC`; `gcloud compute routers nats update nat-config-east --router=nat-router-east --region=us-east1 --auto-allocate-nat-external-ips --add-subnetworks=prod-analytics-subnet`

Answer

The two correct commands are `gcloud compute networks subnets update prod-analytics-subnet --region=us-east1 --enable-flow-logs --logging-aggregation-interval=INTERVAL_5_SEC` and `gcloud compute routers nats update nat-config-east --router=nat-router-east --region=us-east1 --auto-allocate-nat-external-ips --add-subnetworks=prod-analytics-subnet`.
To manage Google Cloud networking resources effectively, enabling or modifying VPC Flow Logs on an existing subnet requires running `gcloud compute networks subnets update` with the `--enable-flow-logs` flag and setting `--logging-aggregation-interval=INTERVAL_5_SEC`. To attach a subnet to an existing Cloud NAT configuration without replacing current settings, `gcloud compute routers nats update` must be used with the `--add-subnetworks` flag along with required parameters such as `--router` and `--region`.

Step-by-Step Solution

1
Identify the proper gcloud command to modify subnet settings for logging.
Use `gcloud compute networks subnets update` with `--enable-flow-logs` and `--logging-aggregation-interval=INTERVAL_5_SEC`.
VPC Flow Logs properties on existing subnets are altered using the subnet update command group.
2
Identify the proper gcloud command to add a subnet to an existing Cloud NAT gateway.
Use `gcloud compute routers nats update` targeting the NAT gateway, specifying `--router`, `--region`, `--auto-allocate-nat-external-ips`, and `--add-subnetworks=prod-analytics-subnet`.
Cloud NAT operates on top of Cloud Routers, so adding subnet mapping requires modifying the NAT configuration on the associated Cloud Router.

Key Concept

Managing VPC Subnet Settings and Cloud NAT Resources
Estimated Time:1m 30s
Question 1376Question →

A Cloud Engineer needs to execute a safe canary rollout of a updated container image for an existing Cloud Run service named `order-processor`. Arrange the operational steps in the correct order from first to last to complete the canary deployment and traffic transition without risking immediate full-production downtime.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for a Cloud Run canary rollout is: 1) Deploy the new image using `--no-traffic` and assign a revision tag. 2) Direct verification requests to the tag-specific URL. 3) Route a small percentage of live traffic to the tagged revision. 4) Shift 100% of live production traffic to the latest revision.
A safe canary deployment in Cloud Run follows a distinct lifecycle: first creating the new revision isolated with `--no-traffic` and a dedicated tag, testing the tag-specific URL directly, initiating a partial live traffic split using `gcloud run services update-traffic --to-tags`, and finally updating the service traffic to 100% (`--to-latest`) once stability is verified.

Step-by-Step Solution

1
Deploy revision with traffic suppression and a revision tag
A new revision is instantiated without receiving traffic from the primary service URL.
The `--no-traffic` flag prevents automatic 100% traffic assignment to new deployments.
2
Validate revision via tag-specific endpoint URL
Functionality is verified on `https://canary---order-processor-REGION.a.run.app`.
Revision tags provide isolated subdomains for pre-release validation.
3
Apply canary traffic split using CLI
10% of incoming live traffic is routed to the `canary` tag, while 90% remains on the previous stable revision.
`gcloud run services update-traffic --to-tags` manages granular percentage traffic allocation.
4
Promote latest revision to receive full traffic load
100% of production traffic is routed to the new revision.
Using `--to-latest` completes the canary deployment once stability is confirmed under live load.

Key Concept

Cloud Run Revision Tagging and Traffic Splitting Sequence
Question 1377Question →

An operations team is updating telemetry collection for a fleet of Linux Compute Engine virtual machines hosting enterprise applications. The security policy requires collecting system memory (RAM) utilization metrics and ingesting custom application logs into Google Cloud Observability, while strictly adhering to Google-recommended practices and the principle of least privilege. Which TWO actions should the team take to complete this configuration?

Select all that apply

Show answer & explanation

Answer: Install and configure the Google Cloud Ops Agent on each Compute Engine virtual machine instance.; Grant the VM service account the predefined roles Monitoring Metric Writer (`roles/monitoring.metricWriter`) and Logs Writer (`roles/logging.logWriter`).

Answer

The team must install the unified Google Cloud Ops Agent on each VM instance and assign the predefined Monitoring Metric Writer and Logs Writer IAM roles to the VM service account.
Collecting OS-level metrics such as RAM utilization alongside application log files on Compute Engine requires deploying the unified Google Cloud Ops Agent. To allow the agent to write telemetry to Google Cloud Observability in accordance with security best practices, the VM service account must be granted specific predefined roles: Monitoring Metric Writer and Logs Writer.

Step-by-Step Solution

1
Select the modern unified telemetry agent for Compute Engine
Deploy the Google Cloud Ops Agent across all VM instances.
The Ops Agent is Google's official agent for capturing OS-level metrics like RAM usage alongside application log files.
2
Configure standard least-privilege IAM permissions for metric and log ingestion
Attach `roles/monitoring.metricWriter` and `roles/logging.logWriter` to the attached Compute Engine service account.
These predefined roles allow telemetry ingestion into Cloud Monitoring and Cloud Logging without providing broader resource management access.

Key Concept

Compute Engine Observability & Least-Privilege Telemetry Roles
Estimated Time:2m 0s
Question 1378Question →

A cloud engineer needs to deploy a new Compute Engine virtual machine instance named analytics-db-tool in zone us-central1-a to host a dedicated database management utility. The business requirements specify that the instance must be placed in a custom subnet named analytics-subnet, assigned the network tag db-client, and explicitly configured to terminate rather than live-migrate during Google Cloud host maintenance events. Which gcloud command should the engineer execute to meet these requirements?

Show answer & explanation

Answer: gcloud compute instances create analytics-db-tool --zone=us-central1-a --subnet=analytics-subnet --tags=db-client --on-host-maintenance=TERMINATE

Answer

The command 'gcloud compute instances create analytics-db-tool --zone=us-central1-a --subnet=analytics-subnet --tags=db-client --on-host-maintenance=TERMINATE' correctly deploys the VM with all requested network and maintenance specifications.
The correct command uses '--subnet=analytics-subnet' to target the custom subnet, '--tags=db-client' to attach the required network tag, and '--on-host-maintenance=TERMINATE' to specify that the VM should be stopped rather than live-migrated when maintenance occurs on the underlying host hardware.

Step-by-Step Solution

1
Identify the proper gcloud command flag for placing a VM into a specific subnet.
Use '--subnet=analytics-subnet' instead of '--network' when targeting a custom subnet.
The '--network' flag expects the VPC network name, whereas specific subnets require the '--subnet' flag.
2
Identify the flag controlling instance behavior during infrastructure maintenance.
Use '--on-host-maintenance=TERMINATE' (valid choices are MIGRATE or TERMINATE).
The flag '--maintenance-policy' is not a valid gcloud flag for instance creation.
3
Verify network tag and provisioning settings.
Apply '--tags=db-client' on a standard provisioned instance.
Spot VMs are designed for fault-tolerant batch workloads, not dedicated utility instances that require standard maintenance policy configuration.

Key Concept

Deploying Compute Engine instances with custom subnets and host maintenance policies using gcloud CLI
Estimated Time:1m 30s
Question 1379Question →

An Associate Cloud Engineer needs to add an additional non-boot persistent disk to an existing Compute Engine Linux VM instance and prepare it for application data storage. What is the correct sequence of steps to provision, attach, and configure this storage resource?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Create the Persistent Disk via gcloud compute disks create, 2) Attach the disk to the VM instance via gcloud compute instances attach-disk, 3) SSH into the VM and format the raw device using sudo mkfs.ext4, and 4) Create a target directory and mount the formatted disk using sudo mount.
The correct workflow follows a standard infrastructure provisioning and operating system administration pattern. First, the cloud resource must be provisioned in GCP using the `gcloud compute disks create` command. Second, the newly created disk resource is attached to the VM instance via `gcloud compute instances attach-disk`. Third, within the VM's SSH session, the Linux operating system formats the newly recognized raw block device with an `ext4` filesystem using `sudo mkfs.ext4`. Finally, the formatted filesystem is mounted to a designated local directory using `sudo mount`.

Step-by-Step Solution

1
Provision the zonal Persistent Disk in Google Cloud.
A new block storage disk is allocated within the target zone.
Storage resources must exist in the cloud control plane prior to attachment.
2
Attach the disk resource to the Compute Engine VM instance.
The block device becomes accessible to the guest operating system hardware controller.
Attaching exposes the raw block device (e.g., /dev/sdb or google-disk-name) to the Linux kernel.
3
Format the raw block device inside the VM guest OS.
An ext4 file system structure is written to the block device.
Operating systems cannot write or read files on unformatted raw block devices.
4
Mount the filesystem to a target directory in Linux.
The persistent storage becomes active and usable at the specified directory path.
Linux requires mounting formatted storage devices into the OS directory tree for application access.

Key Concept

Compute Engine Persistent Disk provisioning, attachment, formatting, and mounting lifecycle.
Estimated Time:1m 30s
Question 1380Question →

An engineer needs to configure a `gcloud` command to deploy a Compute Engine virtual machine named `batch-processor` in zone `us-central1-a`. The VM must run using a dedicated custom service account named `[email protected]` and must automatically execute a script stored on the local administrative machine named `setup.sh` upon first boot. Which of the following flags must be included in the `gcloud compute instances create` command? (Select TWO correct answers.)

Select all that apply

Show answer & explanation

Answer: [email protected]; --metadata-from-file=startup-script=setup.sh

Answer

The command requires `[email protected]` to attach the identity of the custom service account, and `--metadata-from-file=startup-script=setup.sh` to read and upload the local bash script as the startup script.
To assign a custom service account identity and execute a local script file on startup, `gcloud compute instances create` requires `--service-account` to define the identity and `--metadata-from-file=startup-script=...` to load local file contents into the startup script metadata entry.

Step-by-Step Solution

1
Identify the flag required to attach a specific custom service account identity to a Compute Engine instance during creation.
The correct flag is `--service-account=EMAIL`.
Attaching a custom service account defines the IAM identity for applications running inside the VM.
2
Identify the flag required to pass a local script file as an instance startup script.
The correct flag is `--metadata-from-file=startup-script=LOCAL_FILE_PATH`.
The `--metadata-from-file` flag reads content from the local disk, whereas `--metadata=startup-script-url=...` expects a remote URL.

Key Concept

Deploying Compute Engine VMs with custom service accounts and local startup scripts via gcloud CLI
Estimated Time:1m 30s
PreviousPage 69 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin