Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 1421Question →

An organization has a Cloud Run service named `invoice-service` deployed in the `us-central1` region. You need to configure this Cloud Run service so that all outbound network traffic from the instances is routed through an existing Serverless VPC Access connector named `vpc-conn`. Which `gcloud` command should you run to accomplish this task?

Show answer & explanation

Answer: gcloud run services update invoice-service --vpc-connector=vpc-conn --vpc-egress=all-traffic --region=us-central1

Answer

Execute the command `gcloud run services update invoice-service --vpc-connector=vpc-conn --vpc-egress=all-traffic --region=us-central1` to attach the Serverless VPC Access connector and route all outbound traffic through it.
To route all outbound traffic from an existing Cloud Run service through a Serverless VPC Access connector, you update the service configuration using `gcloud run services update` with `--vpc-connector` to set the connector name and `--vpc-egress=all-traffic` to specify that all egress traffic must pass through the VPC.

Step-by-Step Solution

1
Identify the resource type and management action required.
The target is an existing Cloud Run service, so `gcloud run services update` is the correct base command.
Modifying runtime infrastructure parameters on Cloud Run requires updating service settings rather than deploying functions or modifying traffic splits.
2
Specify the VPC connector configuration flags.
Use `--vpc-connector=vpc-conn` and `--vpc-egress=all-traffic` along with the `--region=us-central1` flag.
Setting `--vpc-egress=all-traffic` ensures all outbound connections from the Cloud Run instances pass through the specified Serverless VPC Access connector.

Key Concept

Cloud Run Outbound Networking and Serverless VPC Access Connector Management
Question 1422Question →

A DevOps engineer is scripting the deployment of a Compute Engine instance using the `gcloud` CLI. The VM requires a local initialization script `./init.sh` to run at boot time and must run under an existing custom service account `[email protected]`. Which TWO `gcloud compute instances create` flags should be included in the command execution?

Select all that apply

Show answer & explanation

Answer: --metadata-from-file=startup-script=./init.sh; [email protected]

Answer

The correct options are `--metadata-from-file=startup-script=./init.sh` and `[email protected]`.
To provision a Compute Engine VM with a custom service account and a local startup script, two distinct `gcloud` flags are required: `--service-account` specifies the custom service account identity, and `--metadata-from-file=startup-script=...` loads the contents of the specified local file into the VM's metadata.

Step-by-Step Solution

1
Identify the flag required to pass a local startup script file during instance creation.
Determine that local file content must be loaded into instance metadata using `--metadata-from-file=startup-script=./init.sh`.
Compute Engine uses instance metadata to handle startup script execution, and local file contents must be read using the `--metadata-from-file` flag.
2
Identify the flag required to associate a custom service account with the Compute Engine instance.
Determine that `[email protected]` is used to attach the service account.
The `--service-account` flag explicitly assigns identity and associated credentials to the virtual machine instance.

Key Concept

Deploying Compute Engine Virtual Machines with custom service accounts and startup script metadata via gcloud CLI
Question 1423Question →

A network administrator needs to route all outbound internet traffic from a private subnet through a custom network virtual appliance (NVA) instance named 'nva-gateway' located in zone 'us-central1-a'. The route must be named 'route-outbound-nva', reside in the custom VPC network 'prod-vpc', target destination '0.0.0.0/0', and have a priority of 800. Which gcloud command should the administrator run to implement this custom route?

Show answer & explanation

Answer: gcloud compute routes create route-outbound-nva --network=prod-vpc --destination-range=0.0.0.0/0 --next-hop-instance=nva-gateway --next-hop-instance-zone=us-central1-a --priority=800

Answer

The administrator should run 'gcloud compute routes create route-outbound-nva --network=prod-vpc --destination-range=0.0.0.0/0 --next-hop-instance=nva-gateway --next-hop-instance-zone=us-central1-a --priority=800'.
The correct answer specifies the proper gcloud command 'gcloud compute routes create' along with the required parameters '--network', '--destination-range', '--next-hop-instance', '--next-hop-instance-zone', and '--priority'.

Step-by-Step Solution

1
Identify the required Google Cloud resource type for custom routing.
Routing decisions in VPC networks require a custom route resource under 'gcloud compute routes'.
Firewall rules and subnet updates do not define traffic next-hops.
2
Determine the mandatory CLI flags for creating a custom route to an instance.
The command requires '--destination-range', '--next-hop-instance', and '--next-hop-instance-zone' alongside the network name.
Compute Engine needs the zone of the target NVA instance to resolve the next hop correctly.
3
Construct the exact gcloud CLI command.
'gcloud compute routes create route-outbound-nva --network=prod-vpc --destination-range=0.0.0.0/0 --next-hop-instance=nva-gateway --next-hop-instance-zone=us-central1-a --priority=800'
This matches all specifications and syntax rules for Google Cloud CLI.

Key Concept

Creating and managing custom static routes in Google Cloud VPC networks using gcloud CLI
Estimated Time:1m 30s
Question 1424Question →

An application developer requires access to retrieve secret payloads stored in Secret Manager within project `proj-backend-services` to perform local integration testing. The security team mandates that access must adhere strictly to the Principle of Least Privilege without granting unnecessary permissions or broader hierarchy access. Which IAM role assignment should be granted to the developer?

Show answer & explanation

Answer: Grant the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) on project `proj-backend-services`.

Answer

Grant the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) on project `proj-backend-services`.
The Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) bound directly to project `proj-backend-services` provides the exact permission needed (`secretmanager.versions.access`) to read secret payloads without granting unnecessary administrative permissions or expanding access to other projects.

Step-by-Step Solution

1
Identify the target service and required capability.
The requirement is to retrieve secret payloads in Secret Manager.
Determines the specific IAM permissions required for the task.
2
Select the appropriate role type following the Principle of Least Privilege.
Choose the predefined role `roles/secretmanager.secretAccessor` instead of broad primitive roles like Owner, Editor, or Viewer.
Predefined roles provide only the minimal necessary permissions required to access secret contents.
3
Determine the narrowest required resource hierarchy binding scope.
Bind the role at the target project level (`proj-backend-services`).
Granting permissions at the project level prevents unwanted privilege escalation to other projects within the parent folder or organization.

Key Concept

Applying Least Privilege using Predefined IAM Roles at Project Scope
Question 1425Question →

A DevOps team needs to allow a cloud administrator ([email protected]) to execute infrastructure provisioning scripts against a target Google Cloud project from their local machine. Enterprise security policies strictly prohibit downloading or storing long-lived service account keys locally. The administrator must impersonate a dedicated deployment service account ([email protected]) using short-lived credentials. Which TWO actions must be completed to grant and use service account impersonation for this workflow?

Select all that apply

Show answer & explanation

Answer: Grant [email protected] the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account.; Configure the local gcloud CLI to use the --impersonate-service-account flag or set the auth/impersonate_service_account property.

Answer

The two required actions are granting the administrator identity the Service Account Token Creator role on the target service account, and configuring the local gcloud CLI to use the --impersonate-service-account flag or setting the auth/impersonate_service_account property.
To configure keyless short-lived service account impersonation from a local terminal, the principal must be granted the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account resource. Additionally, the local gcloud CLI must be configured to request short-lived tokens by supplying the --impersonate-service-account flag or setting the auth/impersonate_service_account configuration property.

Step-by-Step Solution

1
Grant identity delegation permissions on the service account resource
The user [email protected] receives permission to mint short-lived tokens for [email protected] via roles/iam.serviceAccountTokenCreator.
Impersonation requires explicit IAM authorization on the targeted service account.
2
Configure local tooling to invoke short-lived identity impersonation
Local gcloud CLI calls automatically request short-lived credentials for [email protected].
The gcloud CLI must be explicitly configured to request short-lived tokens on behalf of the authenticated user.

Key Concept

Configuring Service Account Impersonation with gcloud CLI
Question 1426Question →

A Cloud Engineer needs to establish secure outbound internet connectivity for internal workload instances without assigning public IP addresses. The engineer must build a custom Virtual Private Cloud (VPC) network and enable Cloud NAT for a subnet in region `us-central1` using the `gcloud` CLI.

What is the correct logical sequence of steps to provision this networking architecture?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of steps to deploy a private subnet with Cloud NAT outbound connectivity is: 1. Create the custom mode VPC network (`corp-vpc`), 2. Create the subnet (`backend-subnet`), 3. Create the Cloud Router (`nat-router`), and 4. Configure the Cloud NAT gateway on the Cloud Router (`nat-gateway`).
The correct order follows GCP resource dependency hierarchy: creating the parent VPC network first, followed by the regional subnet, then initializing the Cloud Router within that network/region, and finally attaching the Cloud NAT gateway configuration to the Cloud Router.

Step-by-Step Solution

1
Create the custom VPC network
Establishes the global network shell without automatically creating regional subnets.
Networking resources such as subnets, routers, and firewalls depend on the parent VPC network object.
2
Deploy the regional subnet
Allocates a CIDR prefix (`10.10.1.0/24`) in region `us-central1` attached to `corp-vpc`.
Cloud Router and Cloud NAT require an existing regional subnet to route outbound traffic.
3
Provision the regional Cloud Router
Initializes `nat-router` in `us-central1` linked to `corp-vpc`.
Cloud NAT operates as a regional service managed by a Cloud Router instance in the same region and network.
4
Add the Cloud NAT gateway service
Enables NAT service on `nat-router` for all primary subnets in the region.
Configures outward translation rules and external IP allocation on the operational Cloud Router.

Key Concept

Provisioning Cloud NAT Egress Architecture in Custom VPC Networks
Question 1427Question →

A DevOps engineer needs to manage an existing Cloud Run service named `report-generator-service` deployed in the `europe-west1` region. To optimize performance during morning peak hours, the engineer must ensure that at least 5 container instances remain warm and ready to serve requests immediately. Additionally, to enforce security policy, access must be limited exclusively to a dedicated worker service account named `[email protected]`. Which TWO `gcloud` commands should the engineer execute to achieve this configuration?

Select all that apply

Show answer & explanation

Answer: gcloud run services update report-generator-service --min-instances=5 --region=europe-west1; gcloud run services add-iam-policy-binding report-generator-service --member="serviceAccount:[email protected]" --role="roles/run.invoker" --region=europe-west1

Answer

To configure warm instances for Cloud Run and grant invocation permissions securely, execute `gcloud run services update` with `--min-instances=5` and `gcloud run services add-iam-policy-binding` assigning the predefined role `roles/run.invoker`.
To maintain pre-warmed containers on Cloud Run, the service update command with `--min-instances` must be used. To allow a service account to invoke the Cloud Run service securely, the predefined role `roles/run.invoker` must be assigned via IAM policy binding.

Step-by-Step Solution

1
Configure minimum instance scaling
Executes `gcloud run services update report-generator-service --min-instances=5 --region=europe-west1` to maintain warm container instances.
Setting `--min-instances` guarantees that the specified number of containers stay running, mitigating cold start latencies.
2
Assign IAM Invoker permission
Executes `gcloud run services add-iam-policy-binding report-generator-service --member="serviceAccount:[email protected]" --role="roles/run.invoker" --region=europe-west1`.
The predefined role `roles/run.invoker` grants specific invocation permissions adhering to the principle of least privilege.

Key Concept

Cloud Run Resource Management and IAM Security Policy
Question 1428Question →

A cloud engineer needs to configure network access for administrative maintenance on private Compute Engine instances in a custom VPC network. The instances do not have external IP addresses. The engineer wants to enable secure SSH access through Identity-Aware Proxy (IAP) TCP forwarding without exposing the instances to the public internet. Which two operational steps must be performed to meet these networking requirements?

Select all that apply

Show answer & explanation

Answer: Create an ingress firewall rule in the VPC network allowing TCP traffic on port 22 from the source IP range 35.235.240.0/20.; Execute the command gcloud compute ssh specifying the --tunnel-through-iap flag when connecting to the VM instance.

Answer

To securely access private VM instances via IAP TCP forwarding, you must create an ingress firewall rule in the custom VPC allowing TCP port 22 from the IAP proxy CIDR range 35.235.240.0/20, and connect using gcloud compute ssh with the --tunnel-through-iap flag.
Enabling Identity-Aware Proxy (IAP) TCP forwarding requires allowing ingress TCP traffic on port 22 from Google's dedicated IAP range (35.235.240.0/20) into the VPC network. Additionally, connecting to a private VM without a public IP requires passing the --tunnel-through-iap flag to gcloud compute ssh.

Step-by-Step Solution

1
Identify the ingress firewall requirement for IAP TCP forwarding.
Recognize that IAP connections originate from Google's dedicated IP block 35.235.240.0/20.
VPC firewall rules block incoming traffic by default, so explicit ingress permission for port 22 from 35.235.240.0/20 must be allowed.
2
Select the correct gcloud CLI connection method for private instances.
Use gcloud compute ssh with the --tunnel-through-iap flag.
Since the VM instance lacks an external IP address, standard direct SSH connections fail; tunneling through IAP establishes the connection securely over GCP APIs.

Key Concept

Identity-Aware Proxy (IAP) TCP Forwarding for VPC Network Management
Question 1429Question →

An Site Reliability Engineering (SRE) team is managing a fleet of GKE microservices that output custom application logs to Cloud Logging. The team needs to configure automated real-time incident routing whenever application logs register a severity of `ERROR`. The solution must trigger an alerting mechanism that sends notifications directly to a Cloud Pub/Sub topic for downstream automated remediation. Which TWO actions must the team perform to achieve this requirement using Google-recommended practices?

Select all that apply

Show answer & explanation

Answer: Create a custom log-based metric in Cloud Logging with a log filter defined for severity `ERROR`.; Configure an alerting policy in Cloud Monitoring that monitors the log-based metric threshold and targets a Pub/Sub notification channel.

Answer

To implement real-time incident routing based on error log entries, the SRE team must create a log-based counter metric in Cloud Logging filtered for `ERROR` severity, and then create a Cloud Monitoring alerting policy evaluating this metric that sends alerts to a Pub/Sub notification channel.
To trigger automated workflows from log events in Google Cloud, log entries must first be converted into metric data using a custom log-based metric in Cloud Logging. Once the metric exists, a Cloud Monitoring alerting policy can monitor the metric stream and publish alert notifications directly to a Cloud Pub/Sub topic channel.

Step-by-Step Solution

1
Define a log filter for `severity = ERROR` in Cloud Logging and create a log-based counter metric.
Cloud Logging aggregate count data becomes available as a metric stream inside Cloud Monitoring.
Alerting policies in Cloud Monitoring evaluate time-series metric data, which requires converting discrete log occurrences into a log-based metric.
2
Create an alerting policy in Cloud Monitoring based on the new log-based metric and assign a Pub/Sub notification channel.
When the metric crosses the specified threshold, Cloud Monitoring publishes an alert payload message to the designated Pub/Sub topic.
Cloud Monitoring natively supports Cloud Pub/Sub as a notification channel type for automated incident handling workflows.

Key Concept

Log-based Metrics and Cloud Monitoring Alerting Policies with Pub/Sub Notification Channels
Question 1430Question →

A cloud engineer needs to configure a Google Compute Engine VM instance to securely access objects in a Cloud Storage bucket following Google Cloud security best practices and least-privilege principles. Arrange the procedural steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with creating the custom user-managed service account, followed by granting the specific storage IAM role to that service account, attaching the custom service account identity to the Compute Engine VM, and finally running the workload utilizing Application Default Credentials (ADC).
The correct operational order follows standard GCP security lifecycle practices: first, define the custom service account identity; second, delegate minimal resource-level IAM roles to that identity; third, attach the identity to the Compute Engine VM; and fourth, run the application using non-static Application Default Credentials (ADC) fetched from the metadata server.

Step-by-Step Solution

1
Create a custom user-managed service account identity using 'gcloud iam service-accounts create'.
A unique service account email identity is generated within the Google Cloud project.
Before permissions can be configured or assigned, the dedicated service account principal must exist.
2
Bind the predefined role 'roles/storage.objectViewer' to the service account email on the designated Cloud Storage bucket.
The service account gains read access to objects inside the target bucket according to the principle of least privilege.
Resource-level IAM permissions should be configured before attaching identity to running workloads.
3
Attach the custom service account to the Compute Engine VM instance during instance creation using '--service-account'.
The metadata server of the VM instance is configured to mint tokens for the custom service account instead of the default compute service account.
Attaching custom identities avoids using default service accounts that often carry overly permissive Editor roles.
4
Configure and execute the workload to authenticate using Google Application Default Credentials (ADC).
The application automatically queries the VM instance metadata server for short-lived access tokens without requiring exported JSON service account keys.
Google Cloud security best practices strongly discourage exporting and managing static service account keys.

Key Concept

Service Account Creation, Least Privilege Role Binding, and Compute Engine Attachment via Application Default Credentials
Estimated Time:2m 0s
Question 1431Question →

An automated build pipeline's service account requires access to project `proj-artifact-deploy-409`. The service account must be able to push container images to Artifact Registry repositories and update existing Cloud Run services with new container revisions. It must not be granted permissions to modify other infrastructure components or manage IAM policies. Which TWO predefined roles should be granted to the service account at the project level to adhere to the principle of least privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Artifact Registry Writer (roles/artifactregistry.writer); Cloud Run Developer (roles/run.developer)

Answer

To follow the principle of least privilege, grant the Artifact Registry Writer role to allow pushing container images and the Cloud Run Developer role to permit updating Cloud Run service revisions, both scoped to the specific project.
The combination of Artifact Registry Writer and Cloud Run Developer provides exactly the necessary permissions to push container images and deploy updated Cloud Run service revisions at the project scope, perfectly adhering to the principle of least privilege.

Step-by-Step Solution

1
Identify the minimum permissions required for container image management.
The Artifact Registry Writer role permits pushing and pulling container images without granting repository deletion or policy management rights.
Matching container deployment actions to specific predefined roles avoids unnecessary resource access.
2
Identify the minimum permissions required for Cloud Run application deployment.
The Cloud Run Developer role allows creating and updating service revisions while restricting broader compute administration.
Predefined workload roles isolate service management permissions.
3
Select project-scoped predefined roles over primitive or organization-wide roles.
Combining Artifact Registry Writer and Cloud Run Developer at the project resource level satisfies all functional requirements under least privilege.
Primitive roles and organization-level bindings introduce excessive security risks.

Key Concept

Applying least privilege IAM predefined roles for CI/CD container artifact management and Cloud Run service deployments.
Question 1432Question →

A cloud engineer is provisioning a custom-mode Virtual Private Cloud (VPC) network named `production-vpc` using the `gcloud` CLI. A new subnet named `data-subnet` must be deployed in `us-central1` with the IP range 10.120.0.0/2410.120.0.0/24. Virtual machine instances deployed in this subnet will not have external IP addresses but must be able to communicate with Google Cloud APIs and services. Furthermore, an ingress firewall rule named `allow-internal-pg` must be configured to allow TCP port 5432 traffic from 10.120.0.0/2410.120.0.0/24 to instances tagged `postgres-db`, overriding a baseline rule with priority 1000 that denies all ingress traffic to database nodes. Which two `gcloud` CLI commands or flags are required to complete this deployment correctly? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Include `--enable-private-ip-google-access` when creating `data-subnet` using `gcloud compute networks subnets create` to allow VMs without external IPs to reach Google APIs.; Specify `--priority=500` when executing `gcloud compute firewall-rules create allow-internal-pg` to ensure the allow rule evaluates before the priority 1000 deny rule.

Answer

The deployment requires configuring `--enable-private-ip-google-access` at the subnet level when creating the subnet and using a priority number lower than 1000 (such as 500) for the ingress firewall rule to override the existing baseline rule.
Private Google Access is configured on individual subnets using `gcloud compute networks subnets create` with the `--enable-private-ip-google-access` flag to allow VMs with only internal IP addresses to communicate with Google services. Additionally, firewall rules in GCP process in order of priority from lowest numerical integer to highest. Therefore, to override an existing rule with priority 1000, setting `--priority=500` ensures that the allow rule takes precedence.

Step-by-Step Solution

1
Identify the required flag for enabling internal VM access to Google APIs without external IP addresses.
Private Google Access must be enabled at the subnet level (`gcloud compute networks subnets create ... --enable-private-ip-google-access`).
VPC-level networks do not accept subnet-level flags like Private Google Access.
2
Determine firewall rule priority evaluation order in GCP.
GCP evaluates firewall rules starting from 0 up to 65535. Lower numbers have higher priority.
To override a rule with priority 1000, the new rule must be assigned a priority integer less than 1000 (e.g., 500).

Key Concept

VPC Subnet Private Google Access configuration and Firewall Rule Priority Precedence
Estimated Time:1m 30s
Question 1433Question →

A DevOps engineer is updating an automated data pipeline script that uploads nightly log archives to a Cloud Storage bucket named `analytics-logs-prod`. The security team recently enabled Uniform Bucket-Level Access (UBLA) on this bucket to satisfy compliance requirements. Following this change, the pipeline script fails during file upload when executing `gcloud storage cp` with the `--canned-acl=bucket-owner-full-control` flag. How should the engineer resolve this pipeline failure while following Google Cloud security best practices?

Show answer & explanation

Answer: Remove the canned ACL flag from the upload command and assign the Storage Object Creator predefined IAM role to the pipeline service account.

Answer

Remove the canned ACL flag from the upload command and assign the Storage Object Creator predefined IAM role to the pipeline service account.
When Uniform Bucket-Level Access is enabled on a Cloud Storage bucket, individual object ACLs are ignored and specifying canned ACL parameters in CLI or SDK calls causes an API error. The recommended remediation is removing the ACL parameter from the upload command and delegating access control strictly to predefined Cloud Storage IAM roles like Storage Object Creator.

Step-by-Step Solution

1
Identify the cause of the operation failure.
Uniform Bucket-Level Access (UBLA) disables Access Control Lists (ACLs) entirely for all objects in the bucket.
When UBLA is enabled, specifying canned ACL flags (such as `--canned-acl` or `gsutil -a`) causes requests to be rejected by Cloud Storage.
2
Modify the pipeline upload command.
Remove the `--canned-acl` flag from the `gcloud storage cp` invocation.
Object permissions are now governed uniformly at the bucket level using IAM.
3
Verify and grant appropriate IAM roles.
Assign `roles/storage.objectCreator` to the service account executing the upload.
Following the principle of least privilege, `roles/storage.objectCreator` provides exact permissions required to write objects without exposing excess project-wide permissions.

Key Concept

Uniform Bucket-Level Access (UBLA) disables individual object ACLs and mandates Google Cloud IAM for all access control decisions on the bucket.
Question 1434Question →

A cloud engineer needs to deploy a custom Compute Engine virtual machine instance named report-worker in zone us-central1-a. The instance requires a custom machine configuration using the E2 machine family with 4 vCPUs and 16 GB (16,384 MB) of RAM. Which gcloud command should the engineer execute to create this VM instance?

Show answer & explanation

Answer: gcloud compute instances create report-worker --zone=us-central1-a --machine-type=e2-custom-4-16384

Answer

The command 'gcloud compute instances create report-worker --zone=us-central1-a --machine-type=e2-custom-4-16384' correctly specifies the custom E2 instance type.
To create a Compute Engine instance with a custom machine type using the gcloud CLI, you must pass the custom configuration string to the --machine-type flag. For the E2 family, the required format is e2-custom-VCPUS-MEMORY_MB. Converting 16 GB to megabytes yields 16,384 MB (16 * 1024), making 'e2-custom-4-16384' the valid specification.

Step-by-Step Solution

1
Identify the requirement for custom VM sizing in Compute Engine.
The target instance requires 4 vCPUs and 16 GB of RAM on the E2 machine family.
Compute Engine allows defining custom machine types when standard predefined machine types do not fit workload requirements.
2
Format the custom machine type string for gcloud.
The custom machine string follows the format FAMILY-custom-VCPUS-MEMORY_MB, resulting in 'e2-custom-4-16384'.
gcloud requires memory to be converted to megabytes (16 GB * 1024 MB/GB = 16,384 MB).
3
Pass the custom machine string to the standard --machine-type flag.
The complete flag is '--machine-type=e2-custom-4-16384'.
There are no separate flags like --custom-cpu or --custom-memory in the gcloud compute instances create command.

Key Concept

Custom Machine Type Syntax in gcloud CLI
Estimated Time:1m 30s
Question 1435Question →

A cloud engineer needs to ensure that no Virtual Machine instances created inside any project within the 'Data-Analytics' folder can be provisioned with external IP addresses. Developers currently hold project-level permissions that allow them to configure network interfaces. Which configuration should the engineer implement to enforce this restriction across all current and future projects in the folder?

Show answer & explanation

Answer: Set the `constraints/compute.vmExternalIpAccess` Organization Policy constraint at the 'Data-Analytics' folder level to block external IPs.

Answer

Enforce the Organization Policy constraint `constraints/compute.vmExternalIpAccess` at the 'Data-Analytics' folder level to restrict external IP assignment for all child projects.
The correct approach is applying the Organization Policy constraint `constraints/compute.vmExternalIpAccess` at the folder level. Organization Policies allow administrators to restrict resource configuration attributes across all projects contained within a folder, overriding any individual user's IAM permissions to create external IP interfaces.

Step-by-Step Solution

1
Identify the governance requirement.
The requirement calls for a programmatic restriction on resource attributes (external IPs) across a folder hierarchy regardless of user IAM privileges.
Organization Policies are specifically designed to define constraints on resource configurations across Google Cloud resource hierarchy nodes.
2
Select the appropriate constraint mechanism.
The `constraints/compute.vmExternalIpAccess` constraint restricts Compute Engine instances from receiving external IP addresses.
Applying this constraint at the folder level ensures that all existing and future projects beneath that folder inherit the restriction automatically.

Key Concept

Organization Policies vs IAM Governance in Google Cloud
Question 1436Question →

A cloud administration team manages a resource hierarchy where a specific folder named `Analytics-Prod` contains multiple sensitive data processing projects. Security guidelines require that no Compute Engine virtual machine instances within this folder are assigned external IP addresses, and all Cloud Storage buckets created inside this folder must strictly use Uniform Bucket-Level Access. These restrictions must automatically apply to all current and future projects in the `Analytics-Prod` folder, regardless of root-level defaults. Which TWO actions should the administrator take to implement these constraints using Google Cloud Organization Policies?

Select all that apply

Show answer & explanation

Answer: Apply an Organization Policy at the `Analytics-Prod` folder level for `constraints/compute.vmExternalIpAccess` and set the policy rule to deny all external IPs.; Apply an Organization Policy at the `Analytics-Prod` folder level for `constraints/storage.uniformBucketLevelAccess` and set the boolean constraint to Enforced.

Answer

The correct actions are applying the `constraints/compute.vmExternalIpAccess` list constraint set to deny all external IPs at the target folder node, and enforcing the `constraints/storage.uniformBucketLevelAccess` boolean constraint at the same target folder node.
To restrict resource capabilities across an entire branch of the resource hierarchy, Organization Policy constraints must be applied at the desired parent folder node. Setting `constraints/compute.vmExternalIpAccess` to deny external IPs and enforcing `constraints/storage.uniformBucketLevelAccess` directly on the target folder ensures compliance across all existing and future child projects via resource hierarchy inheritance.

Step-by-Step Solution

1
Identify the target resource hierarchy node for scope enforcement.
The target scope is the `Analytics-Prod` folder, which allows constraints to propagate down to all contained child projects through inheritance.
Organization policies applied at a folder node automatically inherit down to child projects without impacting unaffected sibling folders.
2
Configure the VM external IP constraint.
The constraint `constraints/compute.vmExternalIpAccess` is configured at the folder level to deny all external IP assignments.
This list constraint blocks external network interfaces on Compute Engine instances within the folder's hierarchy.
3
Configure the storage bucket access constraint.
The boolean constraint `constraints/storage.uniformBucketLevelAccess` is set to Enforced at the folder level.
This forces all newly created and existing Cloud Storage buckets under the folder hierarchy to disable per-object ACLs and enforce uniform bucket-level IAM access.

Key Concept

Organization Policies enforce resource behavior constraints across the GCP resource hierarchy, inheriting down to child folders and projects, distinct from IAM access control permissions.
Estimated Time:2m 0s
Question 1437Question →

A cloud administrator recently deployed a new revision named `orders-v2` for an existing Cloud Run service named `order-processor` in the `us-central1` region. During testing, the administrator specified the `--no-traffic` flag, so 100% of production traffic is still being served by the previous revision `orders-v1`. After verifying that `orders-v2` functions correctly, the administrator needs to immediately route all incoming production traffic to `orders-v2`. Which `gcloud` command should the administrator execute to achieve this target configuration?

Show answer & explanation

Answer: gcloud run services update-traffic order-processor --region=us-central1 --to-revisions=orders-v2=100

Answer

Execute `gcloud run services update-traffic order-processor --region=us-central1 --to-revisions=orders-v2=100` to direct all live traffic to the specified revision.
The command using `gcloud run services update-traffic` with the `--to-revisions=orders-v2=100` flag explicitly adjusts the traffic management configuration of the target Cloud Run service so that 100% of incoming production requests are routed to the specified revision.

Step-by-Step Solution

1
Identify the goal
Shift 100% of live HTTP traffic from revision `orders-v1` to the newly verified revision `orders-v2` for Cloud Run service `order-processor`.
The revision was originally deployed with `--no-traffic` for testing purposes.
2
Select the correct gcloud command group
Use `gcloud run services update-traffic`.
Traffic management operations on existing revisions require the `update-traffic` subcommand.
3
Apply the appropriate flags
Specify `--region=us-central1` and `--to-revisions=orders-v2=100`.
The `--to-revisions` flag maps revision names to integer percentage values.

Key Concept

Cloud Run Traffic Management
Question 1438Question →

A financial services company is deploying a multi-tier web application across a fleet of Linux virtual machines on Compute Engine. To comply with operational SLAs and security auditing guidelines, the infrastructure team must collect system-level memory utilization, disk space metrics, and custom syslog files from the instances into Google Cloud Observability. The implementation must follow Google Cloud recommended practices for telemetry agent configuration and IAM access management. Which deployment strategy should the Cloud Engineer implement?

Show answer & explanation

Answer: Install the unified Google Cloud Ops Agent on each Compute Engine instance and grant the attached service account the Logs Writer (roles/logging.logWriter) and Monitoring Metric Writer (roles/monitoring.metricWriter) predefined roles.

Answer

Install the unified Google Cloud Ops Agent on each Compute Engine instance and grant the attached service account the Logs Writer (roles/logging.logWriter) and Monitoring Metric Writer (roles/monitoring.metricWriter) predefined roles.
The correct strategy is to deploy the unified Google Cloud Ops Agent to the Compute Engine VMs and configure the instance service account with the predefined roles roles/logging.logWriter and roles/monitoring.metricWriter. The Ops Agent supports collecting system metrics (such as memory utilization and disk space) and custom syslog files within a single agent framework, while using specific predefined roles enforces security best practices by limiting permissions strictly to writing telemetry data.

Step-by-Step Solution

1
Identify telemetry requirements for memory, disk, and custom syslog collection on Compute Engine VMs.
Determine that the unified Google Cloud Ops Agent is required because default Compute Engine hypervisor metrics do not capture OS-level memory or syslog files.
Google Cloud Ops Agent is the current recommended telemetry agent replacing legacy agents for Compute Engine.
2
Determine the minimal IAM permissions necessary for the VM service account to push logs and metrics to Cloud Observability.
Select predefined roles roles/logging.logWriter and roles/monitoring.metricWriter.
Predefined roles limit permission scope to writing telemetry data, adhering to the principle of least privilege without granting unnecessary primitive permissions.
3
Verify API enablement location requirement.
Ensure Cloud Logging API and Cloud Monitoring API are enabled in the workload project containing the Compute Engine instances.
APIs are enabled at the individual project scope level where resources operate.

Key Concept

Compute Engine Telemetry Collection with Google Cloud Ops Agent and Least-Privilege IAM
Estimated Time:2m 0s
Question 1439Question →

An enterprise operations team needs to allow a database administrator to create, update, and manage Cloud SQL database instances within project `proj-finance-db-4091`. The administrator must not receive read access to data stored inside the databases or permissions to manage non-database cloud resources. To adhere strictly to the Principle of Least Privilege, which identity configuration should you apply?

Show answer & explanation

Answer: Grant the Cloud SQL Admin (roles/cloudsql.admin) predefined role to the user on project proj-finance-db-4091.

Answer

Grant the Cloud SQL Admin (roles/cloudsql.admin) predefined role bound specifically at project scope (proj-finance-db-4091).
Granting the Cloud SQL Admin (`roles/cloudsql.admin`) predefined role at the specific project scope (`proj-finance-db-4091`) strictly limits administrative permissions to Cloud SQL instances within that specific project, fully satisfying the Principle of Least Privilege.

Step-by-Step Solution

1
Identify the required permissions and target service
The requirement specifies managing Cloud SQL database instances without access to underlying data or non-database resources.
Selecting a predefined role targeted specifically at Cloud SQL enforces the Principle of Least Privilege.
2
Determine the minimum role type needed
The predefined role `roles/cloudsql.admin` provides instance management capabilities without granting access to unrelated services.
Primitive roles like Editor or Owner grant excessive privileges across all services in GCP.
3
Determine the precise resource hierarchy binding scope
The IAM policy binding must be created directly on project `proj-finance-db-4091`.
Binding roles at higher nodes (Folder or Organization) causes inherited access across all child projects in that scope.

Key Concept

Applying Least Privilege via Predefined Roles at Project Scope
Question 1440Question →

A company is migrating a fleet of Linux Compute Engine virtual machines to Google Cloud. The operations team needs to collect system telemetry—including OS-level memory utilization, detailed disk metrics, and system log entries—and send this telemetry to Cloud Monitoring and Cloud Logging. The implementation must follow Google-recommended best practices for agent deployment and adhere to the principle of least privilege for access control. Which TWO actions must you perform to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Install and configure the unified Google Cloud Ops Agent on each Compute Engine virtual machine instance.; Attach a service account to the virtual machine instances and grant it the Monitoring Metric Writer (roles/monitoring.metricWriter) and Logs Writer (roles/logging.logWriter) predefined IAM roles.

Answer

To collect system memory utilization and system logs following Google Cloud best practices with least privilege access, you must install the unified Google Cloud Ops Agent on each Compute Engine VM instance and attach a service account assigned the Monitoring Metric Writer (roles/monitoring.metricWriter) and Logs Writer (roles/logging.logWriter) predefined roles.
The Google Cloud Ops Agent combines log ingestion and system metric collection (including memory and disk utilization) into a single, unified agent recommended by Google Cloud. For authentication and authorization, assigning the predefined roles Monitoring Metric Writer (roles/monitoring.metricWriter) and Logs Writer (roles/logging.logWriter) to the instance service account provides the minimal necessary permissions required to write observability data.

Step-by-Step Solution

1
Select the correct telemetry agent software for Compute Engine instances.
Identify that the unified Google Cloud Ops Agent is the official replacement for legacy agents and is required to capture extended OS-level metrics like memory usage alongside logs.
Legacy agents are deprecated and do not represent current Google Cloud best practices.
2
Determine the minimum required IAM permissions for telemetry submission.
Identify the predefined roles Monitoring Metric Writer (roles/monitoring.metricWriter) and Logs Writer (roles/logging.logWriter).
These predefined roles allow the service account attached to the VM instance to write metrics and logs to Google Cloud Observability without over-granting administrative permissions.

Key Concept

Google Cloud Ops Agent installation and IAM minimal privilege configuration for Compute Engine observability
PreviousPage 72 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin