All practice questions
1591 questions
A system administrator is deploying a custom Virtual Private Cloud (VPC) network to host internal microservices in Google Cloud. The microservices run on Compute Engine virtual machines that do not have external public IP addresses assigned. These instances must be able to reach Google Cloud Storage buckets and BigQuery API endpoints securely without exposing traffic to the public internet. Which configuration option must be enabled on the subnet to meet this requirement?
An integration engineer must grant a third-party application service account access to publish metric events to a single Cloud Pub/Sub topic named `events-telemetry` within the GCP project `analytics-prod-88`. The application must not be granted permissions to manage Pub/Sub topics or publish messages to any other topics. Which configuration adheres to the principle of least privilege?
A cloud administrator needs to deploy a custom Virtual Private Cloud (VPC) environment in Google Cloud using the gcloud CLI. The environment must host a web application and include a custom network, a region-specific subnet, an ingress firewall rule restricted by network target tags, and a virtual machine instance. Arrange the following administrative steps in the correct chronological execution order from first to last.
Drag items to arrange them in the correct order
A DevOps team needs to grant a newly onboarded service account permissions to deploy and manage Cloud Run services within project `proj-staging-101`, as well as read build artifacts stored inside a specific Cloud Storage bucket named `bkt-staging-artifacts-99`. To adhere strictly to the Principle of Least Privilege without granting unnecessary permissions across other resources or projects, which TWO IAM role assignments should the team configure?
Select all that apply
An organization maintains a Cloud DNS private managed zone named `corp-internal-zone` that provides internal domain name resolution for workloads. The private zone is currently associated with a single Virtual Private Cloud (VPC) network named `vpc-analytics`. An operations engineer must extend DNS resolution for `corp-internal-zone` so that virtual machines in a second VPC network named `vpc-services` can also resolve these internal DNS records without removing access from `vpc-analytics`. Which `gcloud` command should the engineer run to accomplish this goal?
An enterprise organization uses a multi-project structure in Google Cloud. A Cloud Engineer sets up an organization-level aggregated Log Router sink to export all Cloud Audit logs from all projects to a BigQuery dataset hosted in a dedicated security telemetry project (proj-sec-logs). After configuring the sink filter and destination, the engineer observes that audit logs are not populating the target BigQuery tables. What step must the engineer perform to ensure logs are successfully delivered to BigQuery?
A DevOps team is configuring an automated deployment workflow executed from a developer workstation to provision cloud infrastructure inside a staging project named `proj-staging-884`. Organizational security directives prohibit exporting long-lived JSON service account keys to developer machines and mandate the principle of least privilege. The workflow requires creating a dedicated user-managed service account named `deployer-sa` in `proj-staging-884`, granting this service account the `roles/resourcemanager.projectIamAdmin` role on `proj-staging-884`, and enabling developer `[email protected]` to generate short-lived credentials for `deployer-sa` via impersonation. Which sequence of `gcloud` commands correctly fulfills these security and operational requirements?
A Cloud Engineer must set up telemetry collection for a fleet of Linux-based Compute Engine virtual machines. The requirements state that custom application log files must be ingested into Cloud Logging, and system-level performance metrics (such as memory utilization and disk space usage) must be reported to Cloud Monitoring. Access permissions must strictly adhere to the principle of least privilege. Which TWO actions should the engineer take to achieve this configuration? (Select TWO.)
Select all that apply
An organization deployed a backend microservice named `analytics-collector` on Cloud Run in the `us-central1` region. You need to ensure that only a dedicated service account, `[email protected]`, is authorized to invoke this Cloud Run service while preventing all unauthenticated public access. Which `gcloud` command should you execute to grant the necessary access using the principle of least privilege?
An operations engineer needs to update an existing Cloud NAT gateway named `nat-gateway` managed by Cloud Router `router-central` in the `us-central1` region. The gateway must be updated to use a newly provisioned static regional external IP address named `nat-static-ip` instead of automatically allocated IPs, and detailed logging for all translation connections must be enabled. Which TWO commands should the engineer run to accomplish this setup?
Select all that apply
A cloud engineer needs to create a standardized custom boot image from an existing baseline Compute Engine VM instance named `web-base-vm` and deploy a new instance named `web-prod-1` in zone `us-central1-b` using this custom image. Arrange the administrative steps required to complete this VM cloning and deployment workflow in the correct chronological order from first to last.
Drag items to arrange them in the correct order
An application deployed on Google Cloud outputs structured JSON logs to Cloud Logging. An Operations SRE must configure an automated real-time notification whenever the system generates more than 50 HTTP 500 error responses within a 5-minute rolling window. Which approach follows Google Cloud recommended practices to achieve this objective?
An organization hosts a data-processing workload on a Compute Engine virtual machine instance located in GCP Project `proj-analytics`. The application requires read-only access to a Cloud Storage bucket situated in a separate project named `proj-data-warehouse`. According to Google Cloud security best practices for creating and managing service accounts, which of the following actions should the administrator perform to enable cross-project authorization securely? (Select TWO correct answers.)
Select all that apply
A cloud engineer is deploying a Compute Engine virtual machine instance named `gpu-worker-1` with an attached NVIDIA GPU in zone `us-central1-a` using the `gcloud` CLI. The initial deployment command fails because the default host maintenance behavior is incompatible with GPU-attached instances. Which `gcloud compute instances create` flag configuration must the engineer specify to deploy the instance successfully?
A cloud administrator is managing an internal web service hosted on a Compute Engine Managed Instance Group (MIG). During temporary traffic spikes, the application suffers performance degradation because the MIG's autoscaler scales out too late and immediately scales in as soon as CPU load drops briefly, resulting in rapid instance thrashing. Upon reviewing the configuration, the administrator observes that target CPU utilization is set to with a scale-in stabilization period of seconds. Which configuration change to the autoscaling policy should the administrator make to stabilize the instance group in accordance with Google-recommended best practices?
A cloud engineer needs to manage an operational Cloud Run service named `order-service` deployed in the `us-central1` region. To handle peak traffic demands while preventing runaway infrastructure costs, the engineer must update the existing service configuration so that no more than 50 container instances scale out, and each instance handles up to 80 concurrent requests. Which TWO `gcloud` CLI commands or flags can the engineer execute to correctly set these parameters? (Select TWO.)
Select all that apply
An organization uses an automated security auditing script running on a centralized admin virtual machine. The script needs temporary credentials to inspect configuration settings across multiple Google Cloud projects by impersonating a target service account named `[email protected]`. The security policy strictly prohibits creating or downloading long-lived service account key files. Which IAM configuration should the cloud engineer apply to enable this setup while adhering to the principle of least privilege?
A cloud administrator needs to replace the default Compute Engine service account on an existing virtual machine with a newly created custom user-managed service account. The application running on the instance requires read-only access to objects inside a specific Google Cloud Storage bucket. Following Google Cloud security best practices, in what correct sequential order should the administrator perform the steps to configure and attach the identity?
Drag items to arrange them in the correct order
A security team needs to grant a newly hired compliance auditor access to review IAM policy bindings and inspect Cloud Logging logs within project `analytics-prod-404`. The auditor must NOT be granted access to read actual data stored inside Cloud Storage buckets or BigQuery tables, nor be permitted to modify any security policies. Which of the following IAM role assignments adhere to the principle of least privilege while fulfilling these requirements? (Select TWO.)
Select all that apply
A cloud engineer is deploying a custom VPC network named `prod-vpc` with multiple subnets across different regions. To secure an internal microservice running on Compute Engine instances within `subnet-backend`, the engineer needs to allow ingress TCP traffic on port 8080 specifically to these backend instances without exposing other instances in `prod-vpc`. Which configuration approach correctly achieves this selective access?