Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 121Question →

A logistics company needs to run a weekly 12-hour batch processing job to re-calculate global shipping routes. The workload is containerized, fully fault-tolerant, and designed to automatically save state to Cloud Storage and resume from checkpoints if interrupted. The operations team wants to minimize compute costs while ensuring that any terminated compute capacity is automatically replaced until the job finishes. Which compute configuration should the cloud engineer recommend to meet these requirements at the lowest cost?

Show answer & explanation

Answer: Deploy a Compute Engine Managed Instance Group (MIG) configured with Spot VMs.

Answer

Deploying a Compute Engine Managed Instance Group (MIG) configured with Spot VMs is the optimal solution because Spot VMs offer up to 60-91% discounts for fault-tolerant batch workloads, and the Managed Instance Group automatically maintains capacity by replacing preempted instances.
The option recommending a Compute Engine Managed Instance Group (MIG) configured with Spot VMs is correct because Spot VMs offer extreme cost savings for workloads that tolerate preemption. Since the batch application saves state to Cloud Storage and can resume from checkpoints, instance preemption will not cause data loss. The MIG ensures high availability by automatically recreating instances when GCP reclaims Spot capacity.

Step-by-Step Solution

1
Analyze workload characteristics and constraints.
The job runs intermittently (12 hours per week), is stateless/checkpoint-capable, and tolerates interruptions.
Fault-tolerant batch workloads can leverage discounted preemptible capacity.
2
Evaluate pricing models for intermittent fault-tolerant workloads.
Spot VMs provide maximum cost savings for preemptible workloads, whereas Committed Use Discounts require continuous steady-state usage.
Selecting Spot VMs yields significant cost reductions over standard or committed rates.
3
Determine the management mechanism for replacement capacity.
A Managed Instance Group (MIG) maintains target size and automatically creates replacement instances when preemption occurs.
Automating instance replacement fulfills the operational goal without manual intervention.

Key Concept

Selecting cost-effective compute solutions using Spot VMs and Managed Instance Groups for fault-tolerant batch workloads.
Question 122Question →

An enterprise organization maintains a centralized Google Cloud Billing Account managed by a finance operations team. A DevOps consultant needs to link several existing, unlinked Google Cloud projects to this central Billing Account. Organization security policies enforce strict least-privilege access: the consultant must not be allowed to view invoice history or modify payment methods on the Billing Account, nor should they have permissions to create, modify, or delete infrastructure resources within the projects. Which minimal combination of predefined IAM roles must be granted to the DevOps consultant?

Show answer & explanation

Answer: Grant roles/billing.user on the Billing Account and roles/billing.projectManager on the target Projects.

Answer

Granting the Billing Account User role (roles/billing.user) on the Billing Account and the Project Billing Manager role (roles/billing.projectManager) on the target Projects provides the minimal required permissions.
To successfully link an existing Google Cloud project to a Billing Account under the principle of least privilege, two specific predefined IAM roles are required: the Billing Account User role (roles/billing.user) on the Billing Account, and the Project Billing Manager role (roles/billing.projectManager) on the target Project. The Billing Account User role permits associating projects with the billing account without exposing sensitive financial settings, while the Project Billing Manager role allows updating project billing attachments without granting permissions to alter project resources.

Step-by-Step Solution

1
Identify the required actions for project linking
Linking a project requires permissions on two distinct Google Cloud resource boundaries: the Billing Account and the Google Cloud Project.
Google Cloud IAM enforces permissions separately for billing account resource operations and project resource operations.
2
Determine the least-privilege role for the Billing Account
roles/billing.user (Billing Account User) grants the resourcemanager.projects.createBillingAssignment permission without allowing access to billing account configuration, credit cards, or financial statements.
This satisfies the requirement to attach projects to the billing account while restricting access to financial management.
3
Determine the least-privilege role for the target Projects
roles/billing.projectManager (Project Billing Manager) grants permissions to link and unlink billing accounts for specific projects without granting access to project resources, code, or compute instances.
Using broad roles like Owner or Editor would violate the constraint against modifying project infrastructure or access policies.

Key Concept

Least-Privilege Project Billing Account Association
Question 123Question →

You need to link an unlinked Google Cloud project to an active Cloud Billing account using the Google Cloud Console. Arrange the steps in the correct chronological order to complete this configuration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order to link a project to a billing account in the console is: 1) Open the Google Cloud Console navigation menu and select Billing; 2) Select the target Cloud Billing account name from the billing account selector; 3) Click the My Projects tab to view all projects associated with or available for the billing account; 4) Locate the target project, open its action menu, and select Change billing to link the project.
To link a project to a billing account in the Google Cloud Console, you must first open the Billing navigation menu, select the target Billing Account, navigate to the My Projects tab, and finally choose Change billing for the unlinked project.

Step-by-Step Solution

1
Navigate to Billing in the Google Cloud Console.
Accesses the main Billing management area.
Billing operations are centralized under the Billing section of the console.
2
Choose the target Cloud Billing Account.
Displays management options specific to that billing account.
Project linking must be performed within the context of the billing account that will assume payment responsibility.
3
Open the My Projects tab.
Lists linked and unlinked projects under your administrative scope.
This view enables project-level billing management.
4
Use the project's action menu to select Change billing and confirm.
Links the project to the billing account.
This final action updates the project's billing configuration and enables resource provisioning.

Key Concept

Configuring billing account and project linking in Google Cloud Console
Question 124Question →

An enterprise organization manages its Google Cloud environment using a resource hierarchy where an 'Applications' folder contains three distinct sub-folders named 'Development', 'Staging', and 'Production'. The central compliance auditing team requires read-only access to inspect Cloud Storage objects across all current and future projects created within the 'Staging' and 'Production' folders. Company security policy strictly forbids this audit team from viewing any data in the 'Development' environment. Which administrative action correctly enforces these access requirements while adhering to the principle of least privilege and minimizing administrative overhead?

Show answer & explanation

Answer: Grant the Storage Object Viewer (roles/storage.objectViewer) role to the compliance auditing team separately on the 'Staging' folder and the 'Production' folder.

Answer

Granting the Storage Object Viewer (roles/storage.objectViewer) role to the compliance auditing team on both the 'Staging' folder and 'Production' folder correctly satisfies the requirement.
In the Google Cloud resource hierarchy, IAM access policies applied at a folder level automatically propagate down to all child projects and resources inside that folder. Granting the Storage Object Viewer role at the 'Staging' and 'Production' folder nodes ensures that current and future projects inherit read access, while completely isolating the 'Development' folder without incurring project-by-project management overhead.

Step-by-Step Solution

1
Analyze resource hierarchy and IAM inheritance requirements
Permissions granted at a folder level automatically inherit down to all child projects and resources within that folder, including future resources.
Hierarchical inheritance eliminates the administrative effort of granting permissions on individual projects.
2
Evaluate inheritance restriction rules across the hierarchy
GCP IAM policies are strictly additive; lower-level nodes cannot revoke access inherited from higher parent nodes.
Granting access at the parent 'Applications' folder would unavoidably inherit down into 'Development', violating policy.
3
Select predefined role meeting least privilege
The Storage Object Viewer (roles/storage.objectViewer) role provides read-only access to object data without granting excessive administrative permissions.
Using predefined roles avoids over-granting permissions compared to broad primitive roles.

Key Concept

Google Cloud Resource Hierarchy and IAM Policy Additive Inheritance
Question 125Question →

A media logistics company is planning its Google Cloud Compute Engine resource strategy for two distinct components of an enterprise video pipeline:

1. A memory-bound metadata indexing service that requires a specific non-standard resource ratio of 16 vCPUs to 128 GB of RAM (1:81:8 vCPU-to-memory ratio) and must run continuously 24/7 with strict zero-downtime SLAs.
2. A stateless, highly parallel batch video encoding job that processes queue messages, is fully fault-tolerant, and can automatically resume execution from checkpoints if interrupted.

Which provisioning strategy aligns with Google Cloud recommended practices to optimize costs while satisfying all operational requirements?

Show answer & explanation

Answer: Configure a custom N2 machine type with 16 vCPUs and 128 GB RAM coupled with Committed Use Discounts for the indexing service, and use Spot Virtual Machines in a Managed Instance Group for the batch video encoding workload.

Answer

Configure a custom N2 machine type with 16 vCPUs and 128 GB RAM coupled with Committed Use Discounts for the indexing service, and use Spot Virtual Machines in a Managed Instance Group for the batch video encoding workload.
The correct strategy combines custom machine sizing with targeted pricing models based on workload fault tolerance and steady-state patterns. Custom N2 machine types allow specifying exact vCPU and RAM ratios when standard machine types would cause paid over-provisioning. Pairing continuous 24/7 workloads with Committed Use Discounts (CUDs) secures deep contract discounts, while using Spot VMs inside a Managed Instance Group for stateless, checkpointable batch jobs yields the lowest possible compute cost for interruptible tasks.

Step-by-Step Solution

1
Analyze the workload characteristics of the metadata indexing service.
The service requires a custom memory ratio (1 vCPU to 8 GB RAM, totalling 16 vCPUs and 128 GB RAM) and runs 24/7 continuously with high availability requirements.
Standard machine types (like N2 standard with 1:4 vCPU-to-memory ratio) would force over-provisioning of vCPUs to achieve 128 GB RAM. A Custom Machine Type allows exact resource allocation, while Committed Use Discounts (CUDs) provide up to 57% savings for steady-state 24/7 usage.
2
Analyze the workload characteristics of the batch video encoding job.
The encoding job is stateless, fault-tolerant, queue-driven, and supports checkpointing.
Workloads that tolerate interruptions are prime candidates for Spot VMs, which provide significant cost savings (up to 60–91% compared to standard pricing) when managed via Managed Instance Groups (MIGs).
3
Synthesize the optimal Compute Engine architectural plan.
Combine Custom N2 Machine Types + CUDs for Workload 1, and Spot VMs + MIGs for Workload 2.
This combination minimizes waste from fixed machine predefined ratios and maximizes financial optimization across both steady-state and fault-tolerant compute components.

Key Concept

Compute Engine Resource Planning, Custom Machine Types, Committed Use Discounts (CUDs), and Spot VM Suitability
Question 126Question →

An organization is evaluating Google Cloud compute solutions for two newly developed services with distinct operational profiles:

1. Service Alpha: A stateless HTTP webhook receiver that experiences unpredictable request bursts. Single HTTP request execution times range from a few seconds up to 45 minutes. The team requires zero infrastructure/node management and automatic scaling down to zero when idle.
2. Service Beta: A batch analytics engine that performs large-scale computations overnight. The application is stateless, includes checkpointing logic to resume execution if interrupted, and must be deployed with maximum cost efficiency.

Which TWO compute architectural configurations should the cloud engineer select to meet the requirements for Service Alpha and Service Beta? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy Service Alpha on Cloud Run with a request timeout configured to 45 minutes.; Deploy Service Beta on Compute Engine instances using Spot VMs within a Managed Instance Group.

Answer

The optimal architecture combines Cloud Run with an extended request timeout for Service Alpha, and Compute Engine Spot VMs in a Managed Instance Group for Service Beta.
The combination of deploying Service Alpha on Cloud Run (configured with a 45-minute request timeout) and Service Beta on Compute Engine Spot VMs provides the exact alignment with technical and financial requirements. Cloud Run manages infrastructure entirely, scales to zero, and allows HTTP request timeouts up to 60 minutes. Spot VMs provide maximum cost savings for batch jobs that are fault-tolerant and use checkpointing.

Step-by-Step Solution

1
Assess the requirements for Service Alpha (HTTP webhook, stateless, 45-minute execution, scale to zero, zero node management).
Identify that Cloud Run supports stateless HTTP container workloads, scales to zero, eliminates node management, and allows configuring request timeouts up to 60 minutes.
Serverless containers fit the operational requirements without requiring VM or cluster lifecycle management.
2
Assess the requirements for Service Beta (stateless batch processing, checkpointing capability, extreme cost sensitivity).
Identify that Compute Engine Spot VMs offer massive cost reductions (60-91% off list price) and are fully suitable for workloads designed to handle node preemptions via checkpointing.
Fault-tolerant batch jobs should leverage excess GCP compute capacity via Spot VMs rather than paying full price for standard compute instances.
3
Evaluate and eliminate distractors based on operational constraints and service boundaries.
Eliminate Cloud Functions (due to default execution limits and framework constraints), standard On-Demand VMs (due to unnecessary cost for fault-tolerant workloads), and GKE Standard (due to manual node management overhead).
Selecting appropriate GCP compute resources requires balancing operational overhead, execution limits, and pricing models.

Key Concept

Selecting GCP Compute options based on workload statefulness, operational overhead, execution timeouts, and cost optimization trade-offs.
Question 127Question →

An architecture team is evaluating Google Cloud serverless compute options for a real-time notification dashboard. The workload requires handling persistent WebSocket connections from web clients and deploying a specialized custom runtime binary that listens on an assigned container port without adapting the code to a cloud function signature.

Which TWO features or constraints mandate choosing Cloud Run instead of Cloud Functions for this service? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Native support for persistent WebSocket connections and bidirectional streaming; Ability to package and deploy any custom container image listening on an environment-defined port without framework wrapping

Answer

The two correct choices are native support for persistent WebSocket connections and bidirectional streaming, and the ability to package and deploy any custom container image listening on an environment-defined port without framework wrapping.
Cloud Run accepts arbitrary OCI container images listening on the PORT environment variable, supporting full HTTP/2, WebSockets, and custom runtimes. Cloud Functions is constrained to supported function runtimes and request-response HTTP or event invocation patterns.

Step-by-Step Solution

1
Analyze protocol requirements
WebSockets require persistent long-lived TCP/HTTP-2 streaming connections.
Cloud Run natively supports WebSockets and streaming traffic, while Cloud Functions is designed strictly for request-response HTTP invocations or event handlers.
2
Evaluate runtime and container flexibility requirements
The application relies on a custom binary that listens on a specified port.
Cloud Run allows deploying any custom container image that listens on the PORT environment variable without rewriting code for specific function signatures.
3
Evaluate scale-to-zero and event trigger features
Scale-to-zero is supported by both services, while direct Cloud Storage event triggers are native to Cloud Functions.
Scale-to-zero does not favor Cloud Run over Cloud Functions, and native Storage triggers are a Cloud Functions strength.

Key Concept

Selecting Cloud Run versus Cloud Functions based on container runtime freedom, WebSockets support, and event integration patterns.
Question 128Question →

A cloud engineer needs to deploy a set of Compute Engine virtual machines and Cloud Storage buckets for a new application. Which Google Cloud resource hierarchy component serves as the primary base container required to create and manage these individual resources?

Show answer & explanation

Answer: Project

Answer

The correct answer is Project, because Google Cloud projects are the mandatory base containers for creating, configuring, and managing individual resources such as virtual machines and storage buckets.
In Google Cloud, a Project is the fundamental building block and container for creating, enabling, and managing individual service resources like Compute Engine instances, databases, and Cloud Storage buckets.

Step-by-Step Solution

1
Identify the base level container in Google Cloud required to instantiate individual infrastructure resources.
Recognize that resources must belong to a specific Project.
In Google Cloud, all infrastructure assets like Compute Engine VMs and Cloud Storage buckets exist within a Project.
2
Distinguish Projects from higher-level management nodes such as Folders and Organizations.
Confirm that Folders and Organizations group projects rather than directly holding individual resources.
Folders and Organization nodes exist to manage permissions and policies across multiple projects.

Key Concept

Google Cloud Resource Hierarchy Base Container
Question 129Question →

Your enterprise security team requires that all administrative permissions follow the principle of least privilege. An administrator needs to enable the Cloud Translation API (`translate.googleapis.com`) for a project named `finance-reporting-prod` without being granted access to modify project resources, billing accounts, or IAM permissions. Which IAM role should be assigned to the administrator on the project?

Show answer & explanation

Answer: Service Usage Admin (roles/serviceusage.serviceUsageAdmin)

Answer

Service Usage Admin (roles/serviceusage.serviceUsageAdmin) granted directly on the target project.
The Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) provides the necessary permissions (`serviceusage.services.enable` and `serviceusage.services.get`) to enable and manage APIs within a target project without granting unnecessary management access to other Google Cloud resources.

Step-by-Step Solution

1
Identify the required task and target scope
The task is to enable a Cloud Service API on the specific project `finance-reporting-prod`.
API activation commands and Console operations require service usage management permissions in the specific project context.
2
Evaluate required IAM roles under least privilege principles
The predefined role `roles/serviceusage.serviceUsageAdmin` grants permissions to list, enable, and disable services (`serviceusage.services.enable`).
Using predefined service-specific roles avoids over-granting permissions associated with primitive roles like Owner or Editor.

Key Concept

Least privilege IAM role selection for GCP API enablement
Estimated Time:1m 30s
Question 130Question →

A developer needs to run a small Python script that automatically resizes images whenever a user uploads a new image file to a Google Cloud Storage bucket. The solution must be serverless, event-driven, and execute code directly in response to cloud storage events without requiring the developer to build container images or manage cluster infrastructure. Which Google Cloud compute service should you recommend?

Show answer & explanation

Answer: Cloud Functions

Answer

Cloud Functions is the recommended compute solution because it provides a fully managed, serverless, event-driven execution environment for single-purpose code snippets triggered directly by Cloud Storage events.
Cloud Functions is designed specifically for event-driven, serverless execution of lightweight code triggered by Google Cloud services like Cloud Storage. It automatically scales and removes all server and container management overhead.

Step-by-Step Solution

1
Analyze the workload requirements
The requirement calls for running a Python script triggered by file upload events in Cloud Storage, without managing infrastructure or building container images.
Understanding the event trigger and operational management bounds allows choosing the most suitable serverless model.
2
Evaluate compute service options against constraints
Cloud Functions automatically listens to Cloud Storage bucket events and executes code directly. Cloud Run requires containerization, while Compute Engine and GKE require underlying infrastructure management.
Matching workload event-driven characteristics to native compute services identifies the optimal service.

Key Concept

Selecting serverless event-driven compute services for Cloud Storage event triggers
Question 131Question →

You are planning the Compute Engine configuration for a mission-critical relational database that runs continuously and cannot tolerate unexpected instance terminations. Which instance provisioning model should you select for this workload?

Show answer & explanation

Answer: Standard VM provisioning model using regular Compute Engine instances

Answer

Standard VM provisioning model using regular Compute Engine instances
Mission-critical relational databases require high availability and continuous uptime. Standard Compute Engine instances provide reliable, non-preemptible compute capacity suitable for stateful production services.

Step-by-Step Solution

1
Analyze workload requirements
Workload is a mission-critical relational database requiring 24/7 continuous uptime and zero unexpected terminations.
Stateful databases require predictable node availability to avoid data corruption or severe service downtime.
2
Evaluate provisioning model characteristics
Spot and Preemptible VMs provide cost discounts in exchange for sudden node reclamation, whereas Standard VMs offer persistent compute availability.
Spot/Preemptible VMs are designed for fault-tolerant batch or stateless workloads, not mission-critical databases.
3
Select the appropriate provisioning model
Choose Standard Compute Engine instances.
Standard instances guarantee continuous execution without preemption risk.

Key Concept

Compute Engine Instance Provisioning Models and Workload Suitability
Estimated Time:45s
Question 132Question →

A lead developer at a media enterprise needs permission to create new Google Cloud projects within a dedicated department folder named Media-Production. Additionally, these newly created projects must be linked to the company's central Billing Account. Following the principle of least privilege, which configuration of IAM roles should be granted to the lead developer?

Show answer & explanation

Answer: Project Creator (roles/resourcemanager.projectCreator) on the Media-Production folder, and Billing Account User (roles/billing.user) on the central Billing Account.

Answer

Granting Project Creator (roles/resourcemanager.projectCreator) on the target folder and Billing Account User (roles/billing.user) on the central Billing Account.
To create a project within a folder and associate it with a billing account, a principal needs `roles/resourcemanager.projectCreator` assigned on the specific folder (to allow project creation in that scope) and `roles/billing.user` assigned on the billing account (to allow linking projects to that billing account). This minimal role assignment adheres strictly to the principle of least privilege.

Step-by-Step Solution

1
Identify the resource scope for project creation
The developer only needs to create projects under the Media-Production folder, so the role should be applied at the folder level rather than the Organization level.
Applying roles at the folder level scopes permissions to that container and its descendants.
2
Determine the predefined IAM role required for creating projects
The predefined role `roles/resourcemanager.projectCreator` provides `resourcemanager.projects.create` permission.
Using predefined roles enforces least privilege over broad primitive roles like Owner or Editor.
3
Identify permissions required to link projects to a billing account
Linking a project to a Billing Account requires the `Billing Account User` (roles/billing.user) role on the Billing Account resource.
Project creation and billing association require dual-ended permissions: project creation permission in the resource hierarchy and billing link permission on the billing object.

Key Concept

Resource Hierarchy Scoping and Billing Account Delegation
Estimated Time:1m 30s
Question 133Question →

An enterprise application requires the Secret Manager API (`secretmanager.googleapis.com`) to be activated in a target Google Cloud project named `proj-sec-app`. A service account used by a CI/CD pipeline needs to enable this API and, if necessary, submit a request to raise the default API request quota. Which approach adheres to Google Cloud security best practices and the principle of least privilege?

Show answer & explanation

Answer: Grant the service account the Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role on `proj-sec-app` to enable the API, and submit a quota increase request via the Service Usage Quotas section in the Cloud Console.

Answer

Grant the service account the Service Usage Admin role on the target project to enable the API and request quota increases via the Service Usage Quotas interface.
The predefined role Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) grants the precise permissions required to list, enable, disable APIs, and view or request quota increases on a project level without giving unnecessary control over other GCP services.

Step-by-Step Solution

1
Identify the required IAM role for managing APIs.
The Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role provides permissions to enable/disable APIs and view/edit quotas.
Predefined roles should always be selected over primitive roles to satisfy least privilege.
2
Determine the correct resource scope for API enablement.
The role must be granted on the target project (`proj-sec-app`).
APIs are scoped to individual projects where workloads execute.
3
Identify the standard workflow for requesting higher quotas.
Quota increases are requested via the IAM & Admin > Quotas page or Service Usage API for the specific project.
Creating new projects to circumvent quota restrictions is an improper administrative anti-pattern.

Key Concept

Enabling Cloud APIs with Least Privilege IAM Roles and Requesting Resource Quota Increases
Question 134Question →

A biotechnology organization is designing the Compute Engine architecture for a genomics data platform featuring two distinct operational workloads:

1. Workload 1: A persistent, uninterrupted in-memory genomic reference database requiring at least 512 GB512\text{ GB} of RAM operating continuously 24/724/7 with strict availability SLAs.
2. Workload 2: A stateless batch processing pipeline that analyzes chunked genomic sequences asynchronously, can tolerate sudden instance termination with automated job re-queueing, and requires maximum cost reduction.

Which machine type family and provisioning strategy should you select to fulfill these requirements optimally?

Show answer & explanation

Answer: Provision Workload 1 on Memory-optimized (M-series) instances backed by 1-year or 3-year Committed Use Discounts (CUDs), and provision Workload 2 on Spot Virtual Machines using General-purpose instances.

Answer

Provision Workload 1 on Memory-optimized (M-series) instances backed by Committed Use Discounts (CUDs), and provision Workload 2 on Spot Virtual Machines using General-purpose instances.
The solution correctly identifies that high-memory, continuous workloads (≥512 GB\ge 512\text{ GB} RAM) require Compute Engine Memory-optimized machine types combined with Committed Use Discounts to secure maximum savings for 24/7 availability. Meanwhile, stateless and fault-tolerant batch workloads should use Spot VMs to leverage discount rates up to 91% without risking production data loss.

Step-by-Step Solution

1
Analyze Workload 1 compute and memory specifications.
Workload 1 requires high RAM (≥512 GB\ge 512\text{ GB}) and 24/7 uninterruptible execution.
Memory-optimized (M-series) instances are designed for high memory-to-vCPU ratios (up to 30 GB per vCPU), and continuous 24/7 production usage warrants Committed Use Discounts (CUDs) for maximum cost savings without risking eviction.
2
Analyze Workload 2 operational tolerance and cost constraints.
Workload 2 is stateless, batch-oriented, fault-tolerant, and re-queues failed tasks.
Workloads that tolerate preemption are ideal candidates for Spot VMs, which offer deep discounts (60–91%) compared to standard pricing.
3
Synthesize the optimal Compute Engine resource configuration.
Match M-series + CUD for Workload 1, and Spot VMs for Workload 2.
This combination aligns performance, high availability, and financial optimization according to Google Cloud architectural best practices.

Key Concept

Compute Engine Machine Type Selection, Committed Use Discounts (CUDs), and Spot VM Workload Suitability
Question 135Question →

An administrator is setting up a new application environment in Google Cloud. Arrange the administrative steps in the correct order to configure the resource hierarchy and project access from top-level container creation to user access assignment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with creating a folder under the Organization resource, followed by creating the project inside that folder, linking the project to an active Billing Account, and finally granting IAM roles to developers on the project.
The Google Cloud resource hierarchy follows a strict top-down structure: Organization > Folder > Project > Resources. Creating a folder first establishes the required container under the Organization. Next, creating the project inside that folder establishes the resource boundary. Linking an active Billing Account ensures resources can be consumed. Finally, assigning project-level IAM roles grants developers the necessary privileges to operate within the newly provisioned environment.

Step-by-Step Solution

1
Establish the folder container under the Organization.
A folder container is created under the Organization node.
Folders provide structural grouping within the Google Cloud resource hierarchy before child projects can be created.
2
Create the project under the parent folder.
A project container is instantiated inside the designated folder.
Projects represent the fundamental container for Google Cloud resources and must reside within the hierarchy.
3
Attach a billing account to the new project.
The project is enabled for paid Google Cloud service consumption.
Projects cannot deploy billing-enabled resources without an attached active billing account.
4
Configure IAM access permissions on the project.
Developers receive authorized roles to work within the project.
IAM roles are assigned to principals on the project container after it and its billing foundation are established.

Key Concept

Google Cloud Resource Hierarchy Setup Sequence
Question 136Question →

A Cloud Operations Engineer needs to relocate an existing workload project from a folder named 'Staging-Folder' to a folder named 'Production-Folder' within their Google Cloud resource hierarchy. The engineer already holds the Project Editor role (`roles/editor`) on the project being moved. However, running the command `gcloud beta resource-manager projects move` results in a permission denied error. Which IAM role configuration must be granted to the engineer on the resource hierarchy to allow this project relocation?

Show answer & explanation

Answer: Grant the Project Mover role (`roles/resourcemanager.projectMover`) on both the source folder ('Staging-Folder') and the destination folder ('Production-Folder').

Answer

Grant the Project Mover role (`roles/resourcemanager.projectMover`) on both the source folder ('Staging-Folder') and the destination folder ('Production-Folder').
To move a project between folders in the Google Cloud resource hierarchy, a user requires permissions to detach the project from the current parent folder and attach it to the new parent folder. The predefined role `roles/resourcemanager.projectMover` provides these required capabilities when granted on both the source and target folder nodes.

Step-by-Step Solution

1
Identify the administrative operations required during a project move in Google Cloud.
Relocating a project requires detaching it from its current parent node and attaching it to a new parent node.
Permissions on the project itself (such as Project Editor) only permit updates to the project internal configuration, not its structural placement.
2
Evaluate the mandatory Resource Manager IAM roles required on parent containers.
The principal performing the move must have project detachment rights on the source container and project attachment rights on the destination container.
The predefined role `roles/resourcemanager.projectMover` encapsulates `resourcemanager.projects.update` and `resourcemanager.projects.move` capabilities.
3
Apply the principle of least privilege across both parent hierarchy nodes.
Assigning `roles/resourcemanager.projectMover` on both the source folder and target folder satisfies the security requirement without over-granting administrative access.
Assigning permissions only on the destination or using broad primitive roles at the organization level either fails operationally or violates security best practices.

Key Concept

Moving projects between resource hierarchy folders requires Project Mover permissions on both source and destination parent containers.
Question 137Question →

A logistics enterprise is planning to deploy an enterprise resource planning (ERP) database on Google Cloud Compute Engine. The workload requires a constant 16 vCPUs and 128 GB of RAM to run continuously 24 hours a day, 7 days a week, with strict high availability SLA requirements. The finance team requires maximum cost optimization for this steady-state workload over a 3-year horizon. Which compute configuration and purchasing strategy should you recommend?

Show answer & explanation

Answer: Provision a standard Compute Engine instance matching the vCPU and RAM requirements, and purchase a 3-year Committed Use Discount for the workload.

Answer

Provision a standard Compute Engine instance matching the vCPU and RAM requirements, and purchase a 3-year Committed Use Discount for the workload.
The correct response combines standard Compute Engine virtual machines with a 3-year Committed Use Discount. Persistent enterprise databases with strict SLA requirements require reliable non-preemptible VMs. When resource consumption is predictable and continuous over a multi-year period, purchasing a Committed Use Discount yields significantly higher savings than on-demand rates or automatic Sustained Use Discounts.

Step-by-Step Solution

1
Evaluate workload availability and persistence requirements
The ERP database requires 24/7 uptime and high availability with a strict SLA, ruling out preemptible/Spot instances.
Spot VMs can be stopped at any time by GCP, which violates high-availability stateful database SLAs.
2
Determine appropriate compute architecture (VM vs Serverless)
Select Compute Engine Virtual Machines over serverless platforms.
Enterprise relational databases require stateful disk storage and dedicated compute resources, which fit Compute Engine better than Cloud Run.
3
Select optimal pricing model for 3-year steady-state baseline demand
Choose 3-year Committed Use Discounts (CUDs) over Sustained Use Discounts (SUDs).
CUDs offer the maximum percentage discount for predictable 24/7 workloads over a multi-year timeframe.

Key Concept

Planning Compute Engine Workloads with Committed Use Discounts vs Spot VMs
Question 138Question →

A software team is assessing compute options for an internal analytics application. The application consists of a single containerized web service that receives unpredictable, intermittent HTTP requests during business hours and no traffic overnight. The team requires a serverless solution with minimal operational overhead that automatically scales down to zero compute instances to eliminate costs when idle. Which Google Cloud compute service best satisfies these requirements?

Show answer & explanation

Answer: Cloud Run, because it deploys container images directly, manages underlying infrastructure automatically, and scales instances to zero during idle periods.

Answer

Cloud Run, because it deploys container images directly, manages underlying infrastructure automatically, and scales instances to zero during idle periods.
Cloud Run is a managed serverless platform designed for executing stateless container images. It automatically scales instances up or down based on incoming HTTP traffic, including scaling down to zero instances when idle so costs are only incurred during active request processing.

Step-by-Step Solution

1
Analyze the workload characteristics and constraints
The application is a containerized web service receiving intermittent HTTP traffic with zero traffic overnight, requiring zero infrastructure management and scale-to-zero capability.
Identifying containerization and traffic patterns narrows down the candidate compute options.
2
Evaluate Google Cloud compute options against workload criteria
Cloud Run supports standard container images, abstracts all server management, automatically scales compute instances based on request volume, and scales to zero when idle.
Cloud Run is the optimal fit for stateless containerized HTTP services seeking minimal cost during inactive periods.

Key Concept

Selecting Cloud Run for containerized web applications needing automatic scaling to zero
Question 139Question →

An infrastructure team is deploying an automated compliance scanner inside a target Google Cloud project named `sec-audit-984`. During execution, the scanner fails because calls to the Cloud Asset API (`cloudasset.googleapis.com`) return a `SERVICE_DISABLED` error. The security administrator wants to delegate the necessary permissions to a junior engineer to enable this API on `sec-audit-984`. To strictly follow the principle of least privilege, which action should the security administrator take?

Show answer & explanation

Answer: Grant the junior engineer the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) on project sec-audit-984, and have them execute gcloud services enable cloudasset.googleapis.com --project=sec-audit-984.

Answer

Grant the junior engineer the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) on project sec-audit-984, and have them execute gcloud services enable cloudasset.googleapis.com --project=sec-audit-984.
To enable Google Cloud APIs in accordance with the principle of least privilege, administrators should grant the predefined Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) scoped to the specific project. The operator can then use the gcloud CLI command 'gcloud services enable' targeting that project.

Step-by-Step Solution

1
Identify the specific capability required
The requirement is enabling a Google Cloud Service API on a specific project.
When a workload receives a SERVICE_DISABLED error, the corresponding API endpoint must be enabled for that consumer project.
2
Apply the principle of least privilege to select the appropriate IAM role
Select roles/serviceusage.serviceUsageAdmin over primitive roles like Editor or Owner.
Service Usage Admin allows enabling and disabling APIs without granting broader resource modification or IAM management rights.
3
Determine the scope and CLI command for execution
Bind the role at the target project level (sec-audit-984) and run gcloud services enable cloudasset.googleapis.com --project=sec-audit-984.
APIs are enabled on per-project consumer contexts, so the scope of the operation must target the specific project.

Key Concept

Enabling Cloud Service APIs using least-privilege IAM roles and gcloud CLI commands
Estimated Time:2m 0s
Question 140Question →

An e-commerce platform needs to deploy a stateless microservice on Google Cloud to handle dynamic image transformation requests. The solution must support incoming HTTP/2 traffic with up to 250 concurrent requests per instance, utilize a custom Linux container image containing proprietary pre-compiled C++ binaries, and allow a request timeout of up to 30 minutes for batch image processing. Which Google Cloud compute option should the solution architect choose to meet these requirements?

Show answer & explanation

Answer: Cloud Run, because it supports custom container images with arbitrary binary dependencies, high per-instance concurrency, and request timeouts up to 60 minutes.

Answer

Cloud Run, because it supports custom container images with arbitrary binary dependencies, high per-instance concurrency, and request timeouts up to 60 minutes.
Cloud Run is the optimal choice because it runs stateless containers packaging any runtime or binary library (such as C++ dependencies), supports up to 1000 concurrent requests per instance over HTTP/2, and allows request timeouts up to 60 minutes.

Step-by-Step Solution

1
Analyze workload deployment requirement for custom C++ binaries
Requires bringing a custom Docker container image rather than standard source code runtimes.
Cloud Run allows deploying arbitrary OCI/Docker container images containing pre-compiled binaries, whereas Cloud Functions targets standard language runtimes.
2
Evaluate concurrency and protocol constraints (250 concurrent HTTP/2 requests per instance)
Cloud Run supports up to 1000 concurrent requests per container instance over HTTP/2.
Cloud Run efficiently multiplexes multiple requests onto a single instance to reduce cold starts and lower billing costs.
3
Verify request timeout limitations (30-minute requirement)
Cloud Run supports request timeouts up to 60 minutes (3600 seconds) for HTTP services.
The 30-minute processing requirement falls comfortably within Cloud Run's 60-minute maximum timeout limit.

Key Concept

Selecting Cloud Run for stateless containerized microservices requiring custom binary dependencies, high concurrency, and extended timeouts.
PreviousPage 7 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin