Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 1441Question →

A cloud operations team needs to grant a newly assigned infrastructure technician permissions to create, stop, and restart Compute Engine virtual machine instances within project `proj-finance-workloads-992`, as well as view system logs in Cloud Logging. Following Google Cloud security best practices and adhering strictly to the principle of least privilege, which TWO IAM predefined roles should be assigned to the technician at the project level? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1); Logs Viewer (roles/logging.viewer)

Answer

Assign the Compute Instance Admin (v1) role and the Logs Viewer role at the project scope.
Combining the Compute Instance Admin (v1) role and the Logs Viewer role at the project level provides the technician with exact permissions needed to manage Compute Engine VM lifecycle operations and inspect log entries while adhering to least privilege.

Step-by-Step Solution

1
Identify the specific task permissions required for Compute Engine operations.
Creating, stopping, and restarting Compute Engine virtual machines requires instance-level administrative capabilities supplied by the predefined Compute Instance Admin (v1) role.
Choosing a predefined role targeted to instance operations upholds least privilege without exposing network or security configuration settings.
2
Identify the required logging observation permissions.
Inspecting system logs in Cloud Logging requires log read access, which is supplied by the Logs Viewer role.
Granting Logs Viewer ensures the user can view log entries without granting permission to modify log sinks, metrics, or bucket configurations.
3
Verify resource hierarchy scope.
The role bindings must be applied specifically at the project level (`proj-finance-workloads-992`).
Applying bindings at project scope limits the technician's permissions strictly to the target project environment.

Key Concept

Principle of Least Privilege and Resource Hierarchy Scoping in GCP IAM
Question 1442Question →

An administrator manages a fleet of non-critical, fault-tolerant web scraping tasks running on Compute Engine instances. The team needs to reduce compute infrastructure costs while collecting detailed host system memory metrics in Google Cloud Observability. Which TWO actions should the administrator take?

Select all that apply

Show answer & explanation

Answer: Provision the workload instances as Spot VMs to lower compute costs for fault-tolerant tasks.; Install and configure the Google Cloud Ops Agent on the Compute Engine instances.

Answer

The administrator should provision the workload on Spot VMs to optimize cost for fault-tolerant tasks and install the Google Cloud Ops Agent to gather guest system memory metrics.
Provisioning fault-tolerant web scraping tasks as Spot VMs significantly reduces compute costs because these instances take advantage of unused Google Cloud capacity. Additionally, installing the Google Cloud Ops Agent enables the collection of detailed guest OS memory metrics, which are not natively visible at the hypervisor level.

Step-by-Step Solution

1
Evaluate workload fault tolerance for cost optimization
Identify that Spot VMs offer high cost savings for stateless, interruption-tolerant processing.
Spot VMs utilize spare compute capacity at steep discounts.
2
Identify telemetry requirements for memory monitoring
Determine that OS-level memory metrics require an in-guest telemetry agent.
Hypervisor-level metrics cannot inspect guest OS memory without an installed agent.
3
Select the recommended observability agent
Choose the Google Cloud Ops Agent over deprecated legacy agents.
The Ops Agent combines logging and system metric collection under current Google Cloud best practices.

Key Concept

Managing Compute Engine resource efficiency with Spot VMs and gathering guest OS memory telemetry using the Cloud Ops Agent.
Question 1443Question →

A Cloud Engineer needs to restore a corrupted boot disk on a Compute Engine virtual machine instance named `app-server-1` using an existing disk snapshot named `app-boot-snapshot-v2`. In what sequence should the engineer execute the `gcloud` operations to replace the boot disk and restore the server?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence to restore the VM boot disk from a snapshot is: 1) Stop the `app-server-1` VM instance; 2) Create a new persistent disk from the snapshot; 3) Detach the corrupted boot disk; 4) Attach the new persistent disk with the `--boot` flag; 5) Start the VM instance.
To replace a boot disk on a Compute Engine instance using a snapshot, the engineer must follow a strict order: first, stop the instance because root disks cannot be detached while active; second, restore the snapshot to a new persistent disk; third, detach the broken boot disk; fourth, attach the newly restored disk using the `--boot` flag to declare it as the OS boot drive; and finally, start the VM instance.

Step-by-Step Solution

1
Stop the target VM instance
The instance transitions from `RUNNING` to `TERMINATED` state.
Compute Engine requires a virtual machine to be stopped before its boot disk can be detached or modified.
2
Provision a new persistent disk from the target snapshot
A standalone bootable persistent disk resource is generated containing data from the snapshot.
Snapshots represent point-in-time backups and must be instantiated into persistent disk objects before attachment.
3
Detach the failed boot disk volume from the VM
The VM instance metadata releases the existing boot disk reference.
Detaching the damaged volume clears the primary attachment interface for the replacement disk.
4
Attach the new persistent disk with boot priority
The restored disk is linked to the VM instance as index 0 (boot disk).
Including the `--boot` flag explicitly marks the volume as the bootable root disk rather than an additional data volume.
5
Start the repaired VM instance
The VM boots up using the restored operating system image.
Starting the instance executes the bootloader from the newly designated boot disk.

Key Concept

Compute Engine VM Boot Disk Replacement & Snapshot Recovery
Question 1444Question →

A security team needs to configure cross-project permissions for a audit service account named `[email protected]` in project `finance-prod`. The security group `[email protected]` must be allowed to generate short-lived OAuth2 access tokens for this service account to run security scans without using long-lived key files. Additionally, the service account itself requires read-only access to Cloud Storage objects stored in a separate project named `finance-data`. Following Google Cloud security best practices, which TWO actions should the security team perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to group:[email protected] on the service account [email protected].; Grant the Storage Object Viewer role (roles/storage.objectViewer) to serviceAccount:[email protected] on project finance-data.

Answer

To establish short-lived credential delegation and cross-project storage access according to Google Cloud security best practices, the administrator must grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to group:[email protected] directly on the service account resource, and grant the Storage Object Viewer role (roles/storage.objectViewer) to the service account identity on project finance-data.
To allow external identities to generate short-lived access tokens for a service account without key exports, Google Cloud requires assigning the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to the user group on the specific service account resource. Additionally, granting the predefined Storage Object Viewer role (roles/storage.objectViewer) to the service account identity on the target project satisfies least-privilege data access requirements.

Step-by-Step Solution

1
Configure Service Account Impersonation
Members of [email protected] gain permission to generate short-lived tokens for [email protected]
Assigning roles/iam.serviceAccountTokenCreator on the service account resource enables secure impersonation without exporting private keys.
2
Assign Least-Privilege Predefined Storage Role
The service account [email protected] receives read-only access to Cloud Storage objects in project finance-data
Assigning roles/storage.objectViewer on the target project provides necessary object read access without granting excessive permissions.

Key Concept

Service Account Delegation and Cross-Project Least Privilege IAM Architecture
Question 1445Question →

An operations team needs to enable network traffic telemetry on an existing VPC subnet named `prod-analytics-subnet` in the `us-east1` region. They must activate VPC Flow Logs, set the log aggregation interval to 10 seconds, and adjust the sampling rate to 50%50\% (0.50.5). Which two `gcloud` flags or command invocations must the administrator execute to complete this network management task? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Execute `gcloud compute networks subnets update prod-analytics-subnet --region=us-east1 --enable-flow-logs`; Execute `gcloud compute networks subnets update prod-analytics-subnet --region=us-east1 --logging-aggregation-interval=interval-10-sec --logging-flow-sampling=0.5`

Answer

To manage and enable VPC Flow Logs on an existing subnet with specific aggregation and sampling parameters, run `gcloud compute networks subnets update prod-analytics-subnet --region=us-east1 --enable-flow-logs` to turn on logging, and `gcloud compute networks subnets update prod-analytics-subnet --region=us-east1 --logging-aggregation-interval=interval-10-sec --logging-flow-sampling=0.5` to configure the sampling rate and aggregation interval.
VPC Flow Logs are enabled and configured on a subnet level using the `gcloud compute networks subnets update` command. Passing `--enable-flow-logs` activates the feature on the subnet, while `--logging-aggregation-interval=interval-10-sec` and `--logging-flow-sampling=0.5` set the aggregation window and 50% sample rate respectively.

Step-by-Step Solution

1
Identify the gcloud compute command group for managing subnet properties.
The correct command group is `gcloud compute networks subnets update` specifying the target subnet name and region.
Subnet settings such as flow log status, sampling rate, and aggregation intervals are managed at the VPC subnet resource layer.
2
Enable VPC Flow Logs on the target subnet.
Include the `--enable-flow-logs` flag in the subnet update invocation.
VPC Flow Logs must be explicitly enabled on the subnet.
3
Configure flow log sampling and aggregation settings.
Use `--logging-aggregation-interval=interval-10-sec` and `--logging-flow-sampling=0.5`.
These flags control the frequency of log aggregation and the fraction of network packets sampled for logging.

Key Concept

VPC Flow Logs Configuration via gcloud CLI
Question 1446Question →

An enterprise Google Cloud organization enforces a list constraint at the root organization node using `constraints/compute.trustedImageProjects`, which explicitly allows images only from `projects/corp-base-images`. A cloud team managing a folder named `DataOps` needs to deploy Virtual Machine instances using custom images from `projects/dataops-custom-images`. However, instances in `DataOps` must also remain capable of using images from `projects/corp-base-images`. Which policy configuration on the `DataOps` folder will fulfill these security requirements?

Show answer & explanation

Answer: Enforce `constraints/compute.trustedImageProjects` on the `DataOps` folder, set the allowed values to include `projects/dataops-custom-images`, and retain policy inheritance from the parent node.

Answer

Enforce constraints/compute.trustedImageProjects on the DataOps folder, add projects/dataops-custom-images to the allowed values list, and retain policy inheritance from the parent node.
For list constraints such as `constraints/compute.trustedImageProjects`, setting an allowed value at a child folder level while inheriting from the parent node merges the allowed values. This allows Compute Engine workloads within the `DataOps` folder to consume images from both `projects/corp-base-images` (inherited from the organization root) and `projects/dataops-custom-images` (defined at the folder level).

Step-by-Step Solution

1
Analyze policy inheritance for list constraints in the GCP resource hierarchy.
By default, child nodes inherit allowed values from parent organization policy nodes unless inheritance is explicitly disabled.
Understanding list constraint inheritance allows combining allowed values across hierarchy levels.
2
Evaluate the requirement for allowing both image source projects.
The requirement specifies allowing images from both `projects/corp-base-images` (inherited from the root) and `projects/dataops-custom-images` (added at folder level).
Setting folder allowed values while keeping parent inheritance enabled merges both sets of allowed values.
3
Distinguish IAM permissions from Organization Policy constraints.
IAM roles govern identity actions, whereas Organization Policies establish guardrails that IAM roles cannot override.
Rule out solutions relying on IAM roles (including primitive roles) to override organization policy constraints.

Key Concept

Organization Policy List Constraint Inheritance and Merging
Question 1447Question →

A security operations team is reviewing firewall rules configured for a custom-mode Virtual Private Cloud (VPC) network. Two ingress firewall rules target Compute Engine instances carrying the tag `analytics-worker`:

- Rule 1: Action: DENY | Priority: 900 | Source CIDR: `10.10.0.0/16` | Protocol/Port: `tcp:80`
- Rule 2: Action: ALLOW | Priority: 1100 | Source CIDR: `10.10.1.0/24` | Protocol/Port: `tcp:80`

An internal client with IP address `10.10.1.50` sends an HTTP request on port 80 to a VM tagged `analytics-worker`. Which behavior will Google Cloud exhibit for this network request?

Show answer & explanation

Answer: The request is denied because Rule 1 has a lower priority number (900), giving it higher precedence over Rule 2.

Answer

The request is denied because Rule 1 has a lower priority number (900), giving it higher precedence over Rule 2 (1100).
In Google Cloud VPC networking, firewall rules are evaluated strictly by their priority integer (ranging from 0 to 65535). Lower numerical values signify higher precedence. Because Rule 1 is assigned priority 900 and Rule 2 is assigned priority 1100, Rule 1 is evaluated first and denies the incoming HTTP request.

Step-by-Step Solution

1
Identify matching rules
Both Rule 1 (DENY) and Rule 2 (ALLOW) match the target tag (`analytics-worker`), protocol/port (`tcp:80`), and source IP (`10.10.1.50` falls into both `10.10.0.0/16` and `10.10.1.0/24`).
Before comparing priorities, verify which rules apply to the specific packet.
2
Compare firewall rule priorities
Rule 1 has priority 900, while Rule 2 has priority 1100.
GCP evaluates firewall rules strictly by priority order.
3
Determine rule precedence
Rule 1 (priority 900) takes precedence because lower numerical integers represent higher priority in GCP.
Lower priority values are evaluated first and terminate further rule matching once a match occurs.

Key Concept

GCP Firewall Priority Order Evaluation
Estimated Time:1m 30s
Question 1448Question →

A security specialist needs to mandate that no user or service account can generate long-lived service account keys across any existing or future projects located inside the `Staging-Services` folder. This security requirement must be automatically inherited across all child resources without restricting developers from performing standard resource management tasks within their projects. Which solution enforces this operational restriction?

Show answer & explanation

Answer: Apply an Organization Policy enforcing the `constraints/iam.disableServiceAccountKeyCreation` boolean constraint at the `Staging-Services` folder node.

Answer

The requirement is met by applying an Organization Policy enforcing the `constraints/iam.disableServiceAccountKeyCreation` boolean constraint at the `Staging-Services` folder node.
Organization Policies are designed to set programmatic constraints on specific GCP resources across an Organization, Folder, or Project. By enforcing `constraints/iam.disableServiceAccountKeyCreation` at the `Staging-Services` folder level, all current and future projects inside that folder automatically inherit the restriction, preventing any user or service account from creating long-lived service account keys while retaining their standard IAM permissions for other tasks.

Step-by-Step Solution

1
Identify the governance mechanism required to enforce programmatic restrictions across a group of projects.
Recognize that Organization Policies (not IAM roles) define constraints on GCP resource configurations across the resource hierarchy.
IAM controls who (identity) has permissions to act on resources, whereas Organization Policies control what (resource constraints) can be done on resources regardless of user identity.
2
Determine the appropriate placement node in the GCP resource hierarchy.
Select the `Staging-Services` folder node.
Applying the constraint at the folder level ensures that all existing and future child projects under that folder automatically inherit the enforcement policy.
3
Select the exact Organization Policy constraint matching the operational security requirement.
Enforce `constraints/iam.disableServiceAccountKeyCreation`.
This specific boolean constraint disables the creation of external service account credentials (service account keys) for all projects within the targeted hierarchy scope.

Key Concept

Organization Policies govern resource configuration constraints across the GCP resource hierarchy via inheritance, distinct from IAM access controls.
Estimated Time:1m 30s
Question 1449Question →

A DevOps engineer manages a critical application running on a Linux-based Compute Engine virtual machine. The attached persistent disk containing application data is approaching full capacity. The engineer needs to expand the storage capacity of this persistent disk with minimal disruption and without recreating the instance. Which procedure should the engineer follow?

Show answer & explanation

Answer: Resize the disk using the Cloud Console or gcloud CLI, and then extend the file system partition inside the guest operating system.

Answer

The correct procedure is to resize the disk using the Cloud Console or gcloud CLI, and then extend the file system partition inside the guest operating system.
Resizing a persistent disk in Google Cloud is a two-step process: first, increase the size of the persistent disk resource using GCP tools (Console or gcloud compute disks resize), and second, use guest OS utilities (such as growpart and resize2fs/xfs_growfs) to expand the file system into the newly available space.

Step-by-Step Solution

1
Increase the disk capacity in Google Cloud
The block device capacity assigned to the Compute Engine VM is increased without stopping the VM.
Google Cloud persistent disks can be resized online using the Console or gcloud compute disks resize command.
2
Expand the guest OS partition and file system
The operating system formats and allocates the newly expanded block storage space for immediate application use.
Increasing the block disk size in GCP does not automatically update partition tables or file systems inside Linux (e.g., via resize2fs or xfs_growfs).

Key Concept

Compute Engine Persistent Disk Management and Expansion
Question 1450Question →

A cloud security administrator needs to transition an enterprise Cloud Storage bucket containing financial audit data from legacy Access Control Lists (ACLs) to Uniform Bucket-Level Access. To ensure zero service disruption for automated workloads accessing the objects, what is the correct sequence of steps the administrator should execute?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: (1) Audit existing object ACL permissions and logs, (2) Grant equivalent predefined IAM roles at the bucket level, (3) Enable Uniform Bucket-Level Access on the bucket, and (4) Verify application workflows and monitor audit logs.
When transitioning a Cloud Storage bucket from fine-grained ACLs to Uniform Bucket-Level Access, you must first inspect current ACL usage to know which users require access. Second, you must grant those users equivalent bucket-level IAM roles (such as Storage Object Viewer or Creator) so their permissions remain valid under IAM. Third, you enable Uniform Bucket-Level Access on the bucket, which ignores ACLs and enforces IAM rules uniformly. Finally, you verify that all applications can still successfully access the bucket objects.

Step-by-Step Solution

1
Audit current access dependencies
Identified all accounts and service principals using object ACLs
Prevents accidental access loss by determining necessary access permissions prior to enforcement changes.
2
Assign IAM roles at the bucket level
Principals acquire bucket-level IAM authorization
Uniform Bucket-Level Access relies entirely on IAM policies; granting IAM roles first ensures uninterrupted authorization.
3
Activate Uniform Bucket-Level Access
Bucket access control is standardized to IAM; object ACLs are ignored
Enforces security compliance and uniform bucket management across all objects.
4
Validate application operations
Confirmed successful object read and write access under IAM control
Ensures post-migration stability and operational health.

Key Concept

Transitioning a bucket to Uniform Bucket-Level Access requires mapping ACL permissions to equivalent bucket-level IAM roles prior to enabling UBLA to prevent access disruption.
Question 1451Question →

An operations team manages a Virtual Private Cloud (VPC) network in Google Cloud. An existing ingress firewall rule named `deny-all-app-ingress` with priority `1000` denies all incoming TCP traffic on port `8080` across all instances in the VPC. The team needs to grant temporary access on TCP port `8080` specifically for management traffic originating from the IP range `10.10.0.0/24`. The administrator creates a new ingress firewall rule named `allow-mgmt-ingress` targeted at the same instances. Which priority configuration must be assigned to `allow-mgmt-ingress` to ensure management traffic is allowed without deleting or modifying `deny-all-app-ingress`?

Show answer & explanation

Answer: A priority number less than 1000 (such as 500)

Answer

Assign a priority number less than 1000 (such as 500) to the new rule so that it is evaluated prior to the existing priority 1000 deny rule.
In Google Cloud VPC networks, firewall rules are evaluated based on priority numbers ranging from 0 to 65535. Lower numerical values have higher evaluation precedence. Assigning a priority number less than 1000 (such as 500) guarantees that incoming traffic from 10.10.0.0/24 on port 8080 will match the allow rule first and be permitted before reaching the deny rule set at priority 1000.

Step-by-Step Solution

1
Understand GCP firewall evaluation order
Firewall rule priorities range from 0 to 65535, where 0 has the highest precedence and lower numerical values evaluate before higher ones.
Traffic matching is determined by the first rule evaluated that matches the packet criteria.
2
Compare priority numbers relative to the existing deny rule
The existing rule `deny-all-app-ingress` has priority 1000. To override it for matching source traffic (`10.10.0.0/24`), the new allow rule must have a priority strictly less than 1000 (e.g., 500).
A rule with priority 500 will be matched and applied first, allowing the management traffic before the rule with priority 1000 can deny it.

Key Concept

VPC Firewall Rule Precedence and Priority Evaluation
Estimated Time:1m 30s
Question 1452Question →

An e-commerce platform runs its order-processing microservices across a fleet of Compute Engine virtual machines. The operations lead notices that standard Compute Engine CPU metrics do not provide visibility into OS-level memory utilization or custom file-based application logs. The team must configure telemetry collection and ensure the instances have appropriate access permissions. Which configuration steps should the operations team perform?

Show answer & explanation

Answer: Install the unified Google Cloud Ops Agent on the Compute Engine instances and attach a service account granted the Monitoring Metric Writer and Logs Writer roles.

Answer

Install the unified Google Cloud Ops Agent on the Compute Engine instances and attach a service account granted the Monitoring Metric Writer and Logs Writer roles.
The correct answer specifies installing the unified Google Cloud Ops Agent, which is Google's standard agent for gathering memory, swap, and disk metrics alongside log files from virtual machines. Additionally, attaching a service account with predefined roles (Monitoring Metric Writer and Logs Writer) enforces the security principle of least privilege.

Step-by-Step Solution

1
Identify the telemetry requirement
Recognize that OS-level memory metrics and custom log files require agent-based telemetry collection beyond standard hypervisor metrics.
Default Compute Engine metrics only cover hypervisor-visible statistics like CPU utilization and disk I/O.
2
Select the correct agent
Choose the Google Cloud Ops Agent over legacy Stackdriver agents.
The Ops Agent is Google's recommended unified solution for collecting system metrics and logging on Compute Engine.
3
Determine IAM permissions according to least privilege
Grant roles/monitoring.metricWriter and roles/logging.logWriter to the VM service account.
Predefined roles provide the exact permissions necessary to write telemetry data without granting unnecessary project administration rights.

Key Concept

Unified Ops Agent Telemetry and Least Privilege IAM Roles
Question 1453Question →

An organization administrator needs to enforce security controls on Google Cloud Compute Engine resources across a multi-tier resource hierarchy consisting of an Organization node, a 'Production' folder, and several project nodes. The organization policy currently restricts external IP addresses on Compute Engine instances at the Organization node using `constraints/compute.vmExternalIpAccess`. The administrator wants to allow external IP access exclusively for virtual machines within a single designated project under the 'Production' folder, while ensuring that interactive serial port access (`constraints/compute.disableGlobalSerialPortAccess`) remains blocked across all projects in the organization. Which TWO policy management actions must the administrator perform to achieve these requirements?

Select all that apply

Show answer & explanation

Answer: Override the inherited list constraint on the designated project by setting `constraints/compute.vmExternalIpAccess` to allow external IP access for that specific project.; Configure the boolean constraint `constraints/compute.disableGlobalSerialPortAccess` to Enforce at the Organization root level.

Answer

To achieve the security policy requirements, the administrator must override the list constraint `constraints/compute.vmExternalIpAccess` on the designated project to allow external IP access, and enforce the boolean constraint `constraints/compute.disableGlobalSerialPortAccess` at the Organization root node so it inherits down to all child resources.
Organization policies follow resource hierarchy inheritance rules. Setting a list constraint override at the project level allows specific exceptions to organization-wide restrictions, while setting a boolean constraint at the root organization node ensures default enforcement across all descendant folders and projects. Neither IAM role assignments nor role revocations alter organization policy evaluation.

Step-by-Step Solution

1
Analyze policy inheritance for list constraints.
List constraints set at parent nodes apply down the hierarchy by default, but can be overridden at a child node by defining project-specific allowed lists.
Project-level policy overrides allow explicit exceptions to organization-wide list constraints.
2
Analyze policy inheritance for boolean constraints.
Enforcing a boolean constraint at the Organization root node sets the policy baseline across all descendant folders and projects.
Child nodes inherit the enforced state of boolean policy constraints unless a lower-level node explicitly alters the enforcement state.
3
Evaluate distractor choices regarding IAM roles and organization policy interactions.
IAM roles manage access control for principals, whereas Organization Policies establish guardrails on resources. Assigning or revoking IAM roles cannot alter or bypass Organization Policy constraints.
Organization Policy guardrails evaluate independently of IAM permissions.

Key Concept

Organization Policy Inheritance and Enforcement across the GCP Resource Hierarchy
Estimated Time:2m 0s
Question 1454Question →

A DevOps engineer needs to grant a third-party monitoring service account access to inspect Cloud Pub/Sub topic and subscription configurations within project `proj-telemetry-prod`. The service account must not be granted permissions to publish or acknowledge message content, nor should it have access to unrelated resources in the project. Which IAM role assignment adheres to the principle of least privilege?

Show answer & explanation

Answer: Grant the Cloud Pub/Sub Viewer (`roles/pubsub.viewer`) role on project `proj-telemetry-prod`.

Answer

Granting the Cloud Pub/Sub Viewer (`roles/pubsub.viewer`) role on project `proj-telemetry-prod` adheres to the principle of least privilege by scope-limiting access to the target project and granting only necessary resource metadata read permissions.
The Cloud Pub/Sub Viewer (`roles/pubsub.viewer`) role provides permissions to inspect topics and subscriptions without allowing message data payload access or permissions on other GCP services, perfectly matching the project-scoped least-privilege requirement.

Step-by-Step Solution

1
Identify the required permissions and target resources
The requirement asks for viewing Pub/Sub topic and subscription metadata without message data access or broader resource access.
Adhering to least privilege requires selecting a specific predefined role over general primitive roles.
2
Evaluate role granularity
The predefined role `roles/pubsub.viewer` permits inspecting Pub/Sub resources without message publishing or consumption rights.
Primitive roles like Viewer (`roles/viewer`) or Editor (`roles/editor`) grant broad access to all project resources.
3
Evaluate resource hierarchy binding scope
Binding the role at the project level (`proj-telemetry-prod`) limits access strictly to the requested project.
Binding at the organization level causes broad inheritance across all projects in the hierarchy.

Key Concept

Principle of Least Privilege and Resource Hierarchy Scope in IAM
Question 1455Question →

An Associate Cloud Engineer needs to deploy a new version of a stateless web application running on an existing regional Managed Instance Group (MIG) with zero downtime using the gcloud CLI. Order the steps required to execute this deployment correctly from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: first, create the updated Instance Template; second, assign the template to the Managed Instance Group; third, launch the rolling update action; and fourth, monitor instance health and deployment completion.
The Google Cloud recommended workflow for updating a Managed Instance Group requires creating an immutable Instance Template first, attaching that template to the target MIG, triggering the rolling update action to replace existing VMs, and finally verifying instance health.

Step-by-Step Solution

1
Run 'gcloud compute instance-templates create' with the new image tag/configuration.
A new instance template resource is created in the project.
Managed Instance Groups cannot update running VMs without a target instance template defining the desired state.
2
Run 'gcloud compute instance-groups managed set-instance-template' pointing to the new template.
The MIG metadata is updated to point to the new template.
The group manager needs to know which template to use when launching new VM instances.
3
Run 'gcloud compute instance-groups managed rolling-action start-update' with desired surge and availability parameters.
The MIG control plane begins replacing old instances with new instances in batches.
This initiates the actual rolling replacement process while preserving minimum operational capacity.
4
Run 'gcloud compute instance-groups managed list-instances' to observe instance status flags.
Confirms that all instances reach the RUNNING state and pass health checks.
Continuous verification ensures the update completed successfully without application degradation.

Key Concept

Managed Instance Group Rolling Updates via gcloud CLI
Question 1456Question →

An organization is configuring VPC Network Peering to connect two Virtual Private Cloud (VPC) networks, `prod-vpc` and `shared-services-vpc`, across different projects in Google Cloud. Which of the following statements regarding VPC Network Peering behavior and operational requirements are correct?

Select all that apply

Show answer & explanation

Answer: The VPC Network Peering connection must be created in both directions—from `prod-vpc` to `shared-services-vpc` and from `shared-services-vpc` to `prod-vpc`—before communication between the networks is established.; Transitive peering is not supported; traffic cannot route from `prod-vpc` through `shared-services-vpc` to reach a third peered network without a direct peering connection.

Answer

The two correct statements are that VPC Network Peering must be configured in both directions to become active, and that transitive peering is not supported in Google Cloud VPC networks.
VPC Network Peering requires both sides to establish a peering configuration to move the connection state to ACTIVE. Additionally, peering is non-transitive, meaning traffic cannot hop through a peered network to reach a third network.

Step-by-Step Solution

1
Analyze peering creation workflow requirement
Determine that both network administrators must initiate peering for the state to transition to ACTIVE.
Google Cloud enforces explicit bidirectional peering configuration to prevent unauthorized network access.
2
Evaluate network transitivity rules
Confirm that intermediate network routing across peered networks is blocked.
VPC Network Peering strictly limits reachability exclusively to direct peers.
3
Examine subnet CIDR overlap constraints
Identify that overlapping subnet IP ranges prevent peering initialization.
Google Cloud VPC validation prevents peering setup when IP address space conflicts exist.
4
Examine firewall rule enforcement scope
Verify that firewall rules are enforced per-VPC and never exported.
Each VPC network maintains its own distinct security boundary and firewall configuration.

Key Concept

VPC Network Peering capabilities and configuration constraints
Question 1457Question →

A cloud security engineer needs to enforce strict security baselines for all new Google Cloud projects created within a resource hierarchy folder named `Production-Workloads`. Specifically, the policy must ensure two outcomes across all current and future projects in that folder: default VPC networks are not created during project initialization, and default service accounts are not automatically granted the primitive Editor role upon creation. Which TWO organization policy constraints must be enforced at the `Production-Workloads` folder level to achieve these requirements?

Select all that apply

Show answer & explanation

Answer: Enforce the boolean constraint `constraints/compute.skipDefaultVpcCreation`.; Enforce the boolean constraint `constraints/iam.automaticIamGrantsForDefaultServiceAccounts`.

Answer

The correct configurations are enforcing the boolean organization policy constraints `constraints/compute.skipDefaultVpcCreation` and `constraints/iam.automaticIamGrantsForDefaultServiceAccounts` at the `Production-Workloads` folder level.
To prevent the default VPC from being automatically created during project provision, Google Cloud provides the `constraints/compute.skipDefaultVpcCreation` organization policy. To prevent default service accounts from automatically receiving the Editor role when APIs are enabled, Google Cloud provides the `constraints/iam.automaticIamGrantsForDefaultServiceAccounts` organization policy. Applying both boolean policies at the target folder level ensures all nested projects inherit these security constraints.

Step-by-Step Solution

1
Identify the requirement to disable automatic default VPC creation upon project provisioning.
Recognize that `constraints/compute.skipDefaultVpcCreation` is the predefined Google Cloud Organization Policy constraint designed for this exact purpose.
Applying this constraint at a folder level ensures all child projects inherit the restriction.
2
Identify the requirement to block automatic primitive Editor role grants to default service accounts.
Recognize that `constraints/iam.automaticIamGrantsForDefaultServiceAccounts` is the standard Organization Policy constraint used to suppress automatic IAM role grants.
This enforces the principle of least privilege for newly provisioned compute and API service accounts.
3
Differentiate Organization Policies from IAM roles and access grants.
Select the two boolean Organization Policy constraint options and exclude IAM role management or revocation choices.
IAM permissions control WHO can do WHAT, whereas Organization Policies govern WHAT configurations resources can have.

Key Concept

Organization Policy boolean constraints control resource creation behavior and defaults hierarchically across folders and projects.
Question 1458Question →

A cloud engineer needs to grant a service account read access to files stored in a Cloud Storage bucket named `customer-analytics-data`. Uniform Bucket-Level Access is currently enabled on the bucket. When an automated script attempts to apply fine-grained object Access Control Lists (ACLs) to grant read permission, the operation fails. Which action should the engineer take to properly grant the service account read access while adhering to Google Cloud security best practices?

Show answer & explanation

Answer: Grant the predefined Cloud Storage IAM role `roles/storage.objectViewer` to the service account at the bucket level.

Answer

Grant the predefined Cloud Storage IAM role `roles/storage.objectViewer` to the service account at the bucket level.
When Uniform Bucket-Level Access is enabled on a Cloud Storage bucket, access control lists (ACLs) are disabled, and Cloud IAM becomes the sole access control mechanism. The standard Google Cloud security recommendation is to grant predefined IAM roles (such as Storage Object Viewer) at the bucket level to provide necessary access following the principle of least privilege.

Step-by-Step Solution

1
Identify the cause of the failure
Uniform Bucket-Level Access (UBLA) explicitly disables ACL evaluation and rejects per-object ACL operations.
UBLA simplifies security by ensuring all permissions are managed strictly through Cloud IAM.
2
Select the appropriate IAM permission model
Use Cloud IAM bucket-level role binding instead of object ACLs.
IAM roles apply uniformly to all objects in the bucket when UBLA is enabled.
3
Apply the principle of least privilege
Assign `roles/storage.objectViewer` to the specific service account at the bucket level rather than granting primitive roles at the project level.
Predefined roles restrict access specifically to Cloud Storage objects without exposing other project resources.

Key Concept

Uniform Bucket-Level Access & Cloud IAM Best Practices
Question 1459Question →

An infrastructure team is provisioning Compute Engine instances using the gcloud command-line tool. The workload consists of stateless batch processing tasks running on Spot VMs, and each VM requires execution of a local shell script during boot. Which TWO gcloud configuration practices are correct for this scenario?

Select all that apply

Show answer & explanation

Answer: Set `--on-host-maintenance=TERMINATE` for the Spot VM instances because they do not support live migration.; Use `--metadata-from-file=startup-script=path/to/script.sh` to supply a startup script from a file on the local machine.

Answer

The two correct choices are to set the host maintenance policy to terminate for Spot VMs (`--on-host-maintenance=TERMINATE`) and to use `--metadata-from-file=startup-script=path/to/script.sh` to read and pass a local startup script.
Spot instances do not support live migration during host maintenance events and require setting the maintenance policy to terminate. Additionally, supplying a startup script located on the local filesystem requires using `--metadata-from-file` so gcloud reads the contents of the file before sending the request to the Compute Engine API.

Step-by-Step Solution

1
Evaluate availability and host maintenance requirements for Spot instances.
Spot VMs cannot undergo live migration during host updates and must be set to terminate on host maintenance.
Google Cloud rules prohibit live migration for pre-emptible and Spot instances.
2
Determine the proper gcloud flag for uploading a local startup script file during instance creation.
`--metadata-from-file=startup-script=path/to/script.sh` correctly reads file contents from the local disk.
Using `--metadata` only passes the path string literally, whereas `--metadata-from-file` extracts and attaches the file's text contents.

Key Concept

Compute Engine instance deployment flags, Spot VM maintenance policies, and metadata configuration via gcloud CLI.
Estimated Time:1m 30s
Question 1460Question →

An infrastructure engineering team needs to set up a new isolated environment in Google Cloud using the `gcloud` CLI. Place the operational commands in the correct sequential order required to provision the custom VPC network, create a regional subnet, apply a targeted firewall rule, and launch a Compute Engine VM instance.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with initializing the custom-mode VPC network, followed by creating a regional subnet inside that network, defining a targeted ingress firewall rule on the network, and finally launching a Compute Engine VM instance attached to the subnet with matching network tags.
Provisioning Google Cloud networking resources requires adhering to strict infrastructure dependencies. A custom-mode VPC network must be instantiated first (`gcloud compute networks create --subnet-mode=custom`). Next, custom subnets must be provisioned inside that network (`gcloud compute networks subnets create`). Firewall rules bound to the VPC network must then be defined (`gcloud compute firewall-rules create`). Finally, Compute Engine VM instances can be deployed by binding them to the regional subnet and attaching network tags specified in the firewall rules (`gcloud compute instances create`).

Step-by-Step Solution

1
Execute `gcloud compute networks create enterprise-vpc --subnet-mode=custom` to create the custom-mode VPC network.
The VPC network `enterprise-vpc` is instantiated without default subnets.
Parent VPC network infrastructure must exist prior to defining subnets or network firewalls.
2
Execute `gcloud compute networks subnets create app-subnet-east --network=enterprise-vpc --region=us-east1 --range=10.1.0.0/24` to provision the subnet.
Subnet `app-subnet-east` is established within region `us-east1`.
In custom-mode VPC networks, virtual machine deployment requires pre-existing subnets in the target region.
3
Execute `gcloud compute firewall-rules create allow-app-ingress --network=enterprise-vpc --allow=tcp:8080 --source-ranges=10.1.0.0/24 --target-tags=app-backend` to apply firewall policies.
Ingress traffic on port 8080 is permitted for instances tagged `app-backend` on `enterprise-vpc`.
Firewall rules are associated directly with a VPC network and target specific instance tags.
4
Execute `gcloud compute instances create app-vm-1 --zone=us-east1-b --subnet=app-subnet-east --tags=app-backend` to deploy the VM instance.
Compute Engine instance `app-vm-1` is launched and receives an internal IP from `app-subnet-east`.
VM provisioning references the created subnet in the region and applies the network tag to inherit access rules.

Key Concept

Resource Dependency Order for Custom VPC Networks, Subnets, Firewalls, and Compute Instances
PreviousPage 73 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin