Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 1481Question →

An enterprise cloud team needs to configure an automated nightly backup script running on an on-premises server to upload database backups to a Cloud Storage bucket in Google Cloud project `prod-data-vault`. Following Google Cloud security best practices, the team wants to eliminate long-lived service account keys while enforcing the principle of least privilege. Which TWO configuration steps should the cloud engineer implement?

Select all that apply

Show answer & explanation

Answer: Configure Workload Identity Federation between the on-premises Identity Provider and Google Cloud to allow the script to authenticate using short-lived tokens.; Grant the dedicated service account the Storage Object Creator role (`roles/storage.objectCreator`) directly on the destination Cloud Storage bucket.

Answer

To securely allow an on-premises backup script to upload files to a Cloud Storage bucket without long-lived keys and with minimum privilege, you must configure Workload Identity Federation for keyless authentication and grant the service account the Storage Object Creator role directly on the target bucket.
Configuring Workload Identity Federation allows on-premises workloads to authenticate with Google Cloud using short-lived federated credentials, avoiding exported long-lived service account keys. Furthermore, granting the Storage Object Creator role directly on the target bucket ensures that the service account receives only the permissions necessary to write objects into that specific destination.

Step-by-Step Solution

1
Establish keyless authentication for external workloads
Workload Identity Federation is configured to trust the on-premises Identity Provider, exchanging external tokens for short-lived GCP service account credentials.
Eliminates the security risk of managing and storing long-lived service account JSON key files on external infrastructure.
2
Configure targeted IAM permissions
The dedicated service account is granted the Storage Object Creator role on the specific destination bucket.
Enforces least privilege by granting write-only access to upload objects to the intended bucket rather than granting broad project-level permissions.

Key Concept

Workload Identity Federation and Least-Privilege IAM Bindings for Service Accounts
Question 1482Question →

A DevOps engineer needs to create an ingress firewall rule in a Virtual Private Cloud (VPC) network named `production-vpc` to allow HTTPS traffic (TCP port 443) to Compute Engine virtual machines tagged as `secure-app`. An existing firewall rule with a priority of 1000 currently denies all ingress traffic to instances with the `secure-app` tag. The new rule must take precedence over the existing deny rule to allow HTTPS traffic. Which `gcloud` command should the engineer run?

Show answer & explanation

Answer: `gcloud compute firewall-rules create allow-https-secure --network=production-vpc --action=ALLOW --direction=INGRESS --rules=tcp:443 --target-tags=secure-app --priority=500`

Answer

The command specifying `--priority=500` is correct because Google Cloud VPC firewall rules process lower priority numbers before higher numbers, allowing priority 500 to override the existing priority 1000 deny rule.
In Google Cloud Platform, firewall rules are processed sequentially based on priority numbers, where a lower numerical value indicates higher priority (higher precedence). A rule with priority 500 is evaluated before a rule with priority 1000. When traffic matches the allow rule at priority 500, processing stops, effectively overriding the deny rule at priority 1000.

Step-by-Step Solution

1
Analyze GCP firewall priority ordering rules.
GCP firewall rule priorities range from 0 to 65535, where lower numerical values represent higher precedence in rule evaluation.
To override an existing firewall rule with priority 1000, the new rule must be assigned a priority number strictly less than 1000 (such as 500).
2
Construct the required `gcloud` CLI command flags.
Specify `--action=ALLOW`, `--direction=INGRESS`, `--rules=tcp:443`, `--target-tags=secure-app`, and `--priority=500` on the network `production-vpc`.
These flags properly define the target VMs, allowed protocol/port, network scope, and precedence order.

Key Concept

GCP Firewall Priority Ordering and Rule Precedence
Question 1483Question →

An organization is setting up telemetry collection and audit log retention for a fleet of Compute Engine virtual machines deployed across multiple GCP projects. The operations team needs to collect OS-level memory utilization metrics from the instances and automatically export application audit logs to a centralized BigQuery dataset located in a dedicated security governance project. Which of the following configuration steps are required to achieve this operational objective according to Google-recommended practices? (Select TWO options.)

Select all that apply

Show answer & explanation

Answer: Install and configure the Google Cloud Ops Agent on the Compute Engine virtual machine instances.; Create a Log Router sink targeting the central BigQuery dataset with an appropriate log inclusion filter.

Answer

Installing the Google Cloud Ops Agent on the instances and creating a Log Router sink directed to the BigQuery dataset are the required Google-recommended steps.
To collect extended telemetry like memory metrics from Compute Engine VMs, the Google Cloud Ops Agent must be installed inside the guest OS. To export audit logs across projects to BigQuery, a Log Router sink with an inclusion filter and BigQuery sink destination must be created.

Step-by-Step Solution

1
Identify the required agent for collecting extended OS system metrics such as memory utilization.
Determine that the unified Google Cloud Ops Agent is the current recommended agent for Compute Engine telemetry.
Compute Engine hypervisor metrics do not include OS-level memory utilization without an in-guest agent.
2
Identify the proper Cloud Logging feature for routing audit logs to a central BigQuery dataset.
Determine that a Log Router sink configured with a BigQuery destination and log filter is required.
Log Router sinks manage the aggregation and export of log records to storage or analytics destinations.
3
Evaluate access control requirements for log routing.
Ensure least-privilege predefined roles (like BigQuery Data Editor) are assigned to the sink writer identity rather than primitive roles.
Primitive roles grant excessive privileges across the target project.

Key Concept

Google Cloud Monitoring agent architecture and Log Router sink export configuration
Question 1484Question →

An organization has configured Data Access audit logging for sensitive Cloud Storage buckets and BigQuery datasets in a security-restricted project. An internal auditor requires access to analyze both standard Admin Activity audit logs and Data Access audit logs. The auditor must not be given permissions to edit log sinks or manage logging configurations. Which TWO IAM predefined roles must be granted to the auditor to adhere to the principle of least privilege?

Select all that apply

Show answer & explanation

Answer: Logs Viewer (roles/logging.viewer); Private Logs Viewer (roles/logging.privateLogViewer)

Answer

The auditor requires both Logs Viewer (roles/logging.viewer) and Private Logs Viewer (roles/logging.privateLogViewer) to view standard Admin Activity logs and sensitive Data Access audit logs under the principle of least privilege.
Viewing Admin Activity audit logs requires Logs Viewer (roles/logging.viewer), while viewing Data Access audit logs requires Private Logs Viewer (roles/logging.privateLogViewer). Combining these two predefined roles provides read access to all requested audit logs while maintaining least privilege.

Step-by-Step Solution

1
Identify the audit log types to be accessed.
The requirement specifies reading both Admin Activity audit logs and Data Access audit logs.
Admin Activity logs are standard logs accessible via default logging viewer roles, whereas Data Access audit logs require explicit private log viewing rights due to sensitive data payload potential.
2
Evaluate required permissions for reading standard audit logs.
Logs Viewer (roles/logging.viewer) grants access to read standard project logs and Admin Activity logs.
It provides necessary read access to Cloud Logging without allowing administrative modifications.
3
Evaluate required permissions for reading Data Access audit logs.
Private Logs Viewer (roles/logging.privateLogViewer) grants access to view private log entries such as Data Access logs.
By default, Logs Viewer does not grant permissions to inspect private Data Access log payloads.

Key Concept

Cloud Audit Logs access control requires distinguishing standard log viewing roles from Private Logs Viewer permissions for inspecting Data Access logs under least privilege.
Estimated Time:2m 0s
Question 1485Question →

An organization manages two distinct Compute Engine workloads in the `us-central1` region. Workload 1 consists of batch analytics processing jobs that are fault-tolerant and can tolerate unexpected interruptions. Workload 2 is a single standalone VM hosting a monitoring tool that requires automated daily backups of its boot persistent disk. Which TWO management actions should an Associate Cloud Engineer take to satisfy these operational requirements according to Google-recommended practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision Compute Engine instances for Workload 1 using Spot VMs to reduce compute costs.; Create a scheduled snapshot resource policy in Compute Engine and attach it to the persistent disk of Workload 2.

Answer

The correct actions are to provision Spot VMs for the fault-tolerant batch processing workload and to create a scheduled snapshot resource policy attached to the persistent disk of the standalone monitoring VM.
Provisioning Spot VMs for fault-tolerant batch analytics minimizes costs because the workload can recover from preemption. Automating persistent disk backups using a scheduled snapshot resource policy ensures reliable daily backups of the standalone VM without manual intervention.

Step-by-Step Solution

1
Evaluate cost-optimization options for fault-tolerant batch processing workloads.
Identify that Spot VMs provide low-cost compute capacity ideal for workloads that can tolerate preemption.
Spot VMs provide up to 60-91% discounts compared to standard VM pricing for fault-tolerant jobs.
2
Evaluate backup automation options for persistent disks on Compute Engine instances.
Identify that a scheduled snapshot resource policy attached to the persistent disk automates daily backups.
Compute Engine resource policies define snapshot frequency, retention, and schedule directly at the disk level.

Key Concept

Compute Engine Resource Management and Cost Optimization
Question 1486Question →

An enterprise administrator is configuring governance policies across a Google Cloud resource hierarchy comprising an Organization node, a Development folder, and several child projects. The security policy mandates two constraints:
1. Disable serial port access for Compute Engine virtual machines globally across all projects.
2. Restrict external IP addresses on Compute Engine instances across the organization, except for a specific project named 'dev-bastion-proj' located in the Development folder which requires external network connectivity.

Which two organization policy configurations must the administrator implement to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enforce the boolean constraint constraints/compute.disableSerialPortAccess at the Organization root node.; Configure the list constraint constraints/compute.vmExternalIpAccess to Deny All at the Organization root node, and define an override policy on the dev-bastion-proj project node to allow external IP allocation.

Answer

Enforce constraints/compute.disableSerialPortAccess at the Organization root node, and set constraints/compute.vmExternalIpAccess to Deny All at the Organization root with a project-level override on dev-bastion-proj.
Organization policies enforce guardrails across the GCP resource hierarchy. Enforcing constraints/compute.disableSerialPortAccess at the Organization root guarantees global compliance across all child projects. For constraints/compute.vmExternalIpAccess, setting Deny All at the Organization root establishes an enterprise baseline, while configuring an explicit policy override at the dev-bastion-proj project node creates a controlled exception for external networking requirements.

Step-by-Step Solution

1
Identify global restriction requirements
Disabling serial port access globally requires enforcing the boolean constraint constraints/compute.disableSerialPortAccess at the root Organization node so that all folders and projects inherit the restriction.
Organization policies applied at higher hierarchy levels inherit down to all child resources.
2
Configure organization-wide default policy with selective exception
Apply constraints/compute.vmExternalIpAccess with Deny All at the Organization root node to secure all projects by default, then set an explicit policy override on the dev-bastion-proj project node to permit external IPs.
Resource hierarchy inheritance allows lower-level resource nodes (projects) to override list policy constraints inherited from parent nodes when permitted.

Key Concept

Organization Policy Constraints and Resource Hierarchy Inheritance
Question 1487Question →

A cloud engineer needs to configure access for an application running on a Compute Engine VM in project `prod-app-project`. The application must publish messages to a Cloud Pub/Sub topic in the same project. Following Google Cloud security best practices, access must follow the principle of least privilege without generating long-lived service account keys. Which set of `gcloud` commands correctly creates the service account and grants the minimum required access?

Show answer & explanation

Answer: Execute `gcloud iam service-accounts create app-runner-sa --display-name="App Runner SA"` and then run `gcloud projects add-iam-policy-binding prod-app-project --member="serviceAccount:[email protected]" --role="roles/pubsub.publisher"`.

Answer

Create the custom service account using `gcloud iam service-accounts create` and grant the specific predefined role `roles/pubsub.publisher` using `gcloud projects add-iam-policy-binding`.
Creating a dedicated service account and binding the `roles/pubsub.publisher` predefined role directly at the project level complies with security mandates by adhering to the principle of least privilege. Furthermore, attaching this service account directly to the VM eliminates the security risks associated with exported service account key files.

Step-by-Step Solution

1
Identify the proper IAM identity strategy
Use a dedicated user-managed service account attached to the Compute Engine instance instead of default service accounts or static JSON keys.
Attaching a custom service account avoids managing security keys manually and adheres to GCP identity recommendations.
2
Select the least-privilege predefined IAM role
`roles/pubsub.publisher` grants permissions to publish messages to Cloud Pub/Sub topics.
Primitive roles like Editor or overly broad administrative roles like Pub/Sub Admin grant unnecessary permissions.
3
Formulate the exact `gcloud` CLI commands
`gcloud iam service-accounts create` creates the account, and `gcloud projects add-iam-policy-binding` binds the IAM role to the service account member.
This establishes the identity and enforces resource permissions at the appropriate project scope.

Key Concept

Creating User-Managed Service Accounts and Assigning Predefined Least-Privilege Roles via gcloud
Estimated Time:1m 30s
Question 1488Question →

An organization is deploying an application on Compute Engine that writes confidential audit logs to a Cloud Storage bucket using Customer-Managed Encryption Keys (CMEK). The compliance policy mandates strict separation of duties: security administrators must handle key creation and policy configuration, but must not be able to encrypt or decrypt data. Conversely, the application service account must only be able to encrypt and decrypt data using the key. Which TWO IAM configurations fulfill these requirements according to Google Cloud best practices?

Select all that apply

Show answer & explanation

Answer: Grant the security administrators the Cloud KMS Admin role (roles/cloudkms.admin) on the Key Ring, and grant the Cloud Storage Service Agent the Cloud KMS CryptoKey Encrypter/Decrypter role (roles/cloudkms.cryptoKeyEncrypterDecrypter) on the CryptoKey.

Answer

Granting the Cloud KMS Admin role to security administrators allows administrative key operations without data encryption/decryption capabilities. Granting the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage Service Agent allows the service to perform CMEK cryptographic operations for the bucket.
The correct security baseline mandates granting the predefined Cloud KMS Admin role to key managers so they can manage permissions and key settings without ability to inspect encrypted data. Concurrently, assigning the Cloud KMS CryptoKey Encrypter/Decrypter role specifically to the Cloud Storage Service Agent allows automated CMEK bucket operations under least privilege.

Step-by-Step Solution

1
Identify role requirements for security administrators based on separation of duties
Security administrators require key administration (creating keys, managing IAM permissions) but must not possess data encryption/decryption capabilities.
The predefined role 'Cloud KMS Admin' (roles/cloudkms.admin) provides key management access without granting 'cloudkms.cryptoKeyVersions.useToEncrypt' or 'cloudkms.cryptoKeyVersions.useToDecrypt'.
2
Identify service account CMEK permissions required for Cloud Storage
The Cloud Storage Service Agent (not the compute engine default service account or admin user) requires cryptographic permissions to use the key for CMEK operations.
When configuring CMEK on Cloud Storage buckets, Google Cloud uses the Cloud Storage Service Agent identity to perform encryption and decryption tasks using the Cloud KMS CryptoKey Encrypter/Decrypter role.
3
Evaluate distractor configurations against least privilege and GCP KMS constraints
Primitive roles like Owner grant overly broad privileges, broad inheritance violates separation of duties, and Key Rings cannot be deleted in GCP.
Cloud KMS resources are immutable in terms of object deletion, and least privilege rules mandate using specific predefined roles.

Key Concept

Cloud KMS Separation of Duties and CMEK IAM Roles
Estimated Time:2m 0s
Question 1489Question →

A DevOps engineer is configuring observability for a fleet of Compute Engine instances running a specialized media processing application. The operations team requires real-time memory usage metrics and operating system log collection in Google Cloud Observability, as standard hypervisor metrics do not capture OS-level memory consumption. Which action should the engineer take to meet these telemetry requirements?

Show answer & explanation

Answer: Install and configure the unified Google Cloud Ops Agent on all Compute Engine instances.

Answer

Install and configure the unified Google Cloud Ops Agent on all Compute Engine instances.
The Google Cloud Ops Agent is the primary unified agent for Compute Engine virtual machines. It combines logging and metric collection into a single agent, capturing guest OS telemetry such as detailed memory usage, swap space, disk metrics, and system logs, which are inaccessible via standard hypervisor metrics.

Step-by-Step Solution

1
Identify missing telemetry requirements
Hypervisor metrics provided by Compute Engine do not include internal operating system details such as RAM/memory utilization or internal application/syslog files.
Hypervisors monitor hardware resources from the outside and cannot inspect guest OS memory allocations directly.
2
Select the current Google Cloud recommended agent
Identify the Google Cloud Ops Agent as the active unified solution combining metric and log collection.
Google Cloud Ops Agent replaces legacy Monitoring and Logging agents, offering a single combined telemetry pipeline.
3
Deploy and verify agent execution
Install the Ops Agent on the VM instances to stream memory metrics to Cloud Monitoring and system logs to Cloud Logging.
The Ops Agent gathers system-level diagnostics from within the guest OS and transmits them securely to Google Cloud Observability.

Key Concept

Compute Engine VM Observability and Google Cloud Ops Agent Deployment
Question 1490Question →

A cloud engineering team is using a continuous integration service account to automate infrastructure deployment in Google Cloud. The deployment pipeline must create Cloud KMS key rings and crypto keys, as well as configure key rotation schedules. However, security policy strictly prohibits this service account from having permissions to encrypt or decrypt data payloads, enforcing the principle of least privilege. Which identity and access management strategy meets these requirements?

Show answer & explanation

Answer: Grant the Cloud KMS Admin role (roles/cloudkms.admin) to the service account on the specific project or key ring.

Answer

Granting the Cloud KMS Admin role (roles/cloudkms.admin) to the service account allows it to create and manage key rings and crypto keys without granting data encryption or decryption permissions.
The Cloud KMS Admin role (roles/cloudkms.admin) grants administrative control over Cloud KMS resources (creating key rings, keys, setting rotation schedules) without granting permissions to perform encryption or decryption operations (which require roles/cloudkms.cryptoKeyEncrypterDecrypter or similar). This achieves separation of duties and adheres to the principle of least privilege.

Step-by-Step Solution

1
Identify the required permissions for the service account
The service account requires administration rights (creating key rings, keys, and rotation schedules) but must not have cryptographic data access (encrypter/decrypter).
Security policy enforces separation of duties and least privilege.
2
Evaluate Google Cloud KMS IAM roles
The predefined role roles/cloudkms.admin permits key management operations while explicitly omitting cryptographic data operations such as cloudkms.cryptoKeyVersions.useToEncrypt and useToDecrypt.
Predefined roles split key management responsibilities from key usage responsibilities.

Key Concept

Separation of duties in Cloud KMS IAM roles
Question 1491Question →

A security compliance auditor needs to inspect Data Access audit logs in a Google Cloud project to investigate access patterns for sensitive Cloud KMS keys. The auditor currently holds the Logs Viewer (roles/logging.viewer) role at the project level, but queries in Logs Explorer return no results for Data Access logs. Following the principle of least privilege, which action should you take to enable the auditor to view these logs?

Show answer & explanation

Answer: Grant the auditor the Private Logs Viewer (roles/logging.privateLogViewer) role at the project level.

Answer

Grant the auditor the Private Logs Viewer (roles/logging.privateLogViewer) role at the project level.
In Google Cloud Observability, Data Access audit logs are restricted because they may contain sensitive user data or API metadata. While the Logs Viewer role allows reading standard system logs and Admin Activity audit logs, reading Data Access audit logs requires the Private Logs Viewer (roles/logging.privateLogViewer) role, which includes the logging.privateLogEntries.list permission.

Step-by-Step Solution

1
Identify the specific audit log category requested.
The scenario requires analyzing Data Access audit logs, which contain sensitive access metadata.
Data Access audit logs are restricted separately from standard logs and Admin Activity logs.
2
Evaluate the current IAM permissions.
The existing Logs Viewer (roles/logging.viewer) role lacks the logging.privateLogEntries.list permission.
Without explicit private log permissions, Data Access log entries are filtered out from query results.
3
Select the appropriate role adhering to least privilege.
Assigning Private Logs Viewer (roles/logging.privateLogViewer) supplies the necessary permission without granting unnecessary administrative permissions.
This role targets private log entry viewing specifically.

Key Concept

Data Access Audit Logs IAM Permissions
Question 1492Question →

A system administrator configures two custom ingress firewall rules on a VPC network named `production-vpc` to manage access to a group of internal web servers tagged `web-server`:

1. Rule `allow-internal-web`: Priority 1000, Action: Allow, Target tags: `web-server`, Source tags: `internal-client`, Protocols/ports: `tcp:8080`
2. Rule `deny-web-all`: Priority 800, Action: Deny, Target tags: `web-server`, Source IP ranges: `0.0.0.0/0`, Protocols/ports: `tcp:8080`

During testing, instances tagged `internal-client` are unable to reach instances tagged `web-server` on port 8080. Which configuration change will allow traffic from `internal-client` to `web-server` on TCP port 8080 while continuing to block all other ingress traffic?

Show answer & explanation

Answer: Change the priority of the rule `allow-internal-web` to a value lower than 800, such as 700.

Answer

Change the priority of the rule allow-internal-web to a numerical value lower than 800 (for example, priority 700).
Google Cloud VPC firewall rules are processed strictly by priority order, where lower numbers have higher precedence. Currently, the deny rule (priority 800) takes precedence over the allow rule (priority 1000), blocking all traffic on TCP port 8080 including traffic from `internal-client`. Changing the priority of `allow-internal-web` to a value lower than 800 (such as 700) ensures that packets from `internal-client` match the allow rule first and are permitted, while non-matching traffic falls through to priority 800 and is denied.

Step-by-Step Solution

1
Analyze firewall rule evaluation order in Google Cloud VPC.
Google Cloud evaluates firewall rules by priority, where lower numerical values represent higher precedence (0 is highest priority, 65535 is lowest).
Understanding priority ordering determines which rule takes action when multiple rules match incoming traffic.
2
Compare current priorities of conflicting rules.
The `deny-web-all` rule has priority 800 and matches all source IPs (`0.0.0.0/0`), so it matches `internal-client` traffic first and denies it before `allow-internal-web` (priority 1000) is evaluated.
Rule matching stops at the first rule encountered in order of precedence.
3
Adjust priority so the specific allow rule takes precedence over the general deny rule.
Lowering the priority number of `allow-internal-web` below 800 (e.g., to 700) ensures legitimate internal client traffic matches the allow rule first.
Traffic from internal-client will hit the priority 700 rule and be allowed, while all other traffic will fall through to priority 800 and be denied.

Key Concept

VPC Firewall Rule Priority and Evaluation Precedence
Estimated Time:1m 30s
Question 1493Question →

An engineer needs to provision a dedicated Google Cloud service account for an internal reporting application running on a Compute Engine virtual machine instance. The application needs read-only access to objects in a specific Cloud Storage bucket. Place the following gcloud CLI operations in the correct chronological order required to create the service account, grant it the necessary IAM role, and attach it to the virtual machine instance during creation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is to first create the service account identity, second bind the storage object viewer IAM role to the service account on the Cloud Storage bucket, and third create the Compute Engine VM attached to the configured service account.
To properly set up a non-human identity in Google Cloud, you must follow the lifecycle dependency order: first, define the service account principal (`gcloud iam service-accounts create`); second, grant it specific permissions via IAM bindings (`gcloud storage buckets add-iam-policy-binding`); and third, associate the fully configured identity with the compute infrastructure (`gcloud compute instances create --service-account=...`).

Step-by-Step Solution

1
Create the Service Account identity
The identity `[email protected]` is established in Cloud IAM.
You cannot grant roles to or attach a non-existent service account principal.
2
Grant Least-Privilege IAM Access
The service account is assigned `roles/storage.objectViewer` on the targeted Cloud Storage bucket.
Configuring access rules before launching the workload ensures the application has immediate authorization upon VM startup.
3
Attach the Service Account to Compute Engine VM
The Compute Engine VM boots up configured to authenticate as the custom service account with full `cloud-platform` access scopes.
Attaching the service account during VM creation binds the custom identity to the VM metadata server for automatic application default credential resolution.

Key Concept

Creating and binding a custom service account to a Compute Engine virtual machine instance following least-privilege security principles.
Question 1494Question →

An infrastructure team manages a workload running on Compute Engine virtual machines that requires autoscaling based on system memory utilization. Currently, Cloud Monitoring only displays default hypervisor-level metrics, which do not include internal RAM usage. Which action should the team take to collect guest memory metrics and enable autoscaling for the instance group?

Show answer & explanation

Answer: Install the Google Cloud Ops Agent on the virtual machines, and configure the autoscaling policy using the memory metrics exported to Cloud Monitoring.

Answer

Install the Google Cloud Ops Agent on the virtual machines, and configure the autoscaling policy using the memory metrics exported to Cloud Monitoring.
Hypervisor metrics natively collected by Compute Engine do not include internal operating system details like memory usage. To collect RAM utilization, the Google Cloud Ops Agent must be installed inside the guest OS. This agent streams telemetry to Cloud Monitoring, allowing the Managed Instance Group (MIG) autoscaler to scale based on memory utilization.

Step-by-Step Solution

1
Analyze metric availability
Determine that memory utilization is an internal guest OS metric not captured by default hypervisor metrics.
Compute Engine hypervisors only capture host-level metrics such as CPU utilization and disk I/O.
2
Select the appropriate telemetry agent
Deploy the Google Cloud Ops Agent onto the virtual machine instances.
The Google Cloud Ops Agent is the Google-recommended solution for gathering guest system metrics and logs.
3
Configure Managed Instance Group autoscaling
Set the autoscaling policy target metric to the Ops Agent memory utilization metric in Cloud Monitoring.
MIG autoscalers can scale based on custom metrics or Ops Agent telemetry ingested into Cloud Monitoring.

Key Concept

Managing Compute Engine Resources with Telemetry and Autoscaling
Question 1495Question →

A cloud administrator manages a Google Cloud resource hierarchy consisting of an Organization root, a 'Finance' folder, and several child projects. An Organization Policy set at the Organization root uses the list constraint `constraints/gcp.resourceLocations` with allowed values configured to `in:us-locations`. To satisfy local compliance mandates, all newly provisioned GCP resources within projects under the 'Finance' folder must be strictly restricted to the `asia-east1` region, overriding the inherited Organization Policy. Which action should the administrator take to achieve this governance requirement?

Show answer & explanation

Answer: Apply an Organization Policy on the 'Finance' folder for `constraints/gcp.resourceLocations`, set the rules to replace parent policies, and add `asia-east1` as the allowed location value.

Answer

Apply an Organization Policy on the 'Finance' folder for `constraints/gcp.resourceLocations`, set the rules to replace parent policies, and add `asia-east1` as the allowed location value.
Organization Policies allow administrators to enforce constraints across the resource hierarchy. For list constraints like `constraints/gcp.resourceLocations`, setting a policy at a child folder level with the rule to replace parent policy values ensures that inherited constraints are overridden and only the newly defined allowed location (`asia-east1`) is enforced.

Step-by-Step Solution

1
Identify the constraint type and target resource node
The target is the 'Finance' folder, and the constraint is `constraints/gcp.resourceLocations`.
Organization Policies evaluated at child nodes (folders/projects) inherit parent constraints by default unless explicitly overridden.
2
Configure list constraint behavior to override inheritance
Set the policy rule on the 'Finance' folder to 'Replace' parent policy rather than 'Merge' with parent values.
Replacing parent policy ensures that inherited allowed locations (`in:us-locations`) are ignored for this folder subtree.
3
Specify allowed values for the folder policy
Add `asia-east1` to the allowed values list for `constraints/gcp.resourceLocations`.
This restricts resource deployment under the 'Finance' folder exclusively to `asia-east1`.

Key Concept

Organization Policy List Constraint Hierarchy Inheritance & Override Rules
Estimated Time:1m 30s
Question 1496Question →

A security policy requires that an application hosted on a Compute Engine virtual machine in Project-Analytics read log files stored in a Cloud Storage bucket located in Project-Logs. Following Google Cloud security best practices for access control, which setup should you implement?

Show answer & explanation

Answer: Create a user-managed service account in Project-Analytics, grant it the Storage Object Viewer role on the bucket in Project-Logs, and attach this service account to the VM instance.

Answer

Create a user-managed service account in Project-Analytics, grant it the Storage Object Viewer role on the specific bucket in Project-Logs, and attach that service account to the Compute Engine VM.
Attaching a user-managed service account to a Compute Engine instance and granting that service account the predefined Storage Object Viewer role on the specific bucket in the destination project is the recommended, secure pattern for cross-project resource access inside GCP.

Step-by-Step Solution

1
Create a dedicated service account
A dedicated identity is established in the project where the compute resource resides (Project-Analytics).
Dedicated user-managed service accounts allow fine-grained permission assignment tailored specifically to the workload.
2
Bind the minimal required IAM role on the target resource
The service account gains read-only access (`roles/storage.objectViewer`) strictly for the bucket located in Project-Logs.
Granting resource-level permissions follows Google Cloud security best practices for cross-project access.
3
Attach the service account to the VM instance
Application Default Credentials (ADC) on the VM automatically fetch short-lived tokens from the metadata server.
This avoids generating or managing long-lived service account key files.

Key Concept

Cross-Project Service Account Management and Least Privilege
Question 1497Question →

An organization is configuring Google Cloud KMS to manage Customer-Managed Encryption Keys (CMEK) for sensitive data stored in Cloud Storage. The security policy mandates strict separation of duties between administrators who manage key policies and workloads that perform cryptographic operations, as well as adherence to standard Cloud KMS key lifecycle management rules. Which of the following configurations and operational practices align with Google Cloud security standards? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the Cloud KMS CryptoKey Encrypter/Decrypter role to the workload service account while granting the Cloud KMS Admin role to key management personnel.; Plan key lifecycle operations around the standard constraint that Cloud KMS Key Rings and CryptoKeys cannot be deleted once created, though individual key versions can be disabled or scheduled for destruction.

Answer

The correct practices are: (1) Granting the Cloud KMS CryptoKey Encrypter/Decrypter role to workload service accounts while assigning the Cloud KMS Admin role to administrators, and (2) Designing key lifecycles around the fact that Cloud KMS Key Rings and CryptoKeys cannot be deleted, but key versions can be disabled or destroyed.
The correct responses recognize the strict separation of duties achieved by separating key administrative roles from key usage roles, as well as the fundamental architectural constraint that Cloud KMS Key Rings and CryptoKeys are immutable and cannot be deleted once created.

Step-by-Step Solution

1
Evaluate role assignment requirements for separation of duties.
Identified that granting Cloud KMS Admin to security personnel and Cloud KMS CryptoKey Encrypter/Decrypter to application service accounts enforces principle of least privilege without over-granting permissions.
Administrators should manage keys without having access to encrypt/decrypt payload data, and workloads should perform crypto operations without permission to alter key rotation or permissions.
2
Review Cloud KMS resource lifecycle rules regarding key deletion.
Confirmed that Key Rings and CryptoKeys are immutable and cannot be deleted from a project once created.
Google Cloud enforces this immutability for cryptographic tracking, audit transparency, and prevention of accidental data loss.

Key Concept

Cloud KMS Separation of Duties and Key Lifecycle Immutability
Estimated Time:1m 30s
Question 1498Question →

An infrastructure team needs to collect OS-level memory metrics and system logs from a fleet of Compute Engine virtual machines running Linux. The solution must align with Google-recommended security and observability best practices. Which TWO actions should you perform?

Select all that apply

Show answer & explanation

Answer: Install and configure the Google Cloud Ops Agent on each Compute Engine instance.; Assign the Monitoring Metric Writer and Logs Writer roles to the service account attached to the Compute Engine instances.

Answer

To collect system memory metrics and logs securely according to Google Cloud best practices, you should install the unified Google Cloud Ops Agent on each VM instance and ensure the VM's service account has the specific predefined roles: Monitoring Metric Writer and Logs Writer.
The unified Google Cloud Ops Agent is Google's recommended agent for collecting telemetry (metrics and logs) from Compute Engine instances. To write this telemetry data to Google Cloud Observability tools safely, the VM's associated service account only requires the specific predefined roles Monitoring Metric Writer and Logs Writer.

Step-by-Step Solution

1
Identify the primary telemetry agent for GCP Compute Engine VMs
Determine that the Google Cloud Ops Agent combines logging and metric collection into a single supported package.
The legacy agents are deprecated, and the Ops Agent provides unified support for system metrics like memory and swap space.
2
Identify the required IAM permissions following least privilege principles
Determine that Monitoring Metric Writer (roles/monitoring.metricWriter) and Logs Writer (roles/logging.logWriter) are required.
Avoid using broad primitive roles (such as Editor or Owner) to maintain a secure IAM baseline.

Key Concept

Compute Engine telemetry collection requires installing the Google Cloud Ops Agent and assigning minimal predefined IAM roles to the instance service account.
Question 1499Question →

An Associate Cloud Engineer needs to update the container image running on a regional Managed Instance Group (MIG) without incurring downtime. Order the steps required to safely execute a rolling update of the MIG using the Google Cloud CLI.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Create a new instance template with the updated container image, 2) Update the Managed Instance Group to target the new instance template, 3) Issue the `gcloud compute instance-groups managed rolling-action start-update` command, and 4) Verify completion using `gcloud compute instance-groups managed wait-until --stable`.
To update a Managed Instance Group without downtime, you must first create a new instance template since templates are immutable. Next, update the MIG target template setting to point to the new version. Then, initiate the rolling update via `gcloud compute instance-groups managed rolling-action start-update`. Finally, execute `gcloud compute instance-groups managed wait-until --stable` to verify that all instances reach a healthy, updated state.

Step-by-Step Solution

1
Create a new Compute Engine instance template with the updated configuration.
A new immutable instance template resource is created in the GCP project.
Compute Engine instance templates cannot be edited once created.
2
Associate the new template with the Managed Instance Group.
The target instance template property of the MIG is updated.
The MIG manager requires an updated template reference before performing a rolling deployment.
3
Initiate the rolling update via gcloud CLI.
The MIG manager begins stopping and recreating instances according to the update policy.
Rolling updates replace instances systematically to preserve application availability.
4
Wait for the instance group to stabilize.
Confirmation that all instances in the group have been successfully updated and are passing health checks.
Verifying stability guarantees the update finished successfully without rolling back or stalling.

Key Concept

Managed Instance Group Rolling Updates and Instance Template Immutability
Question 1500Question →

A security audit team for a digital healthcare provider needs to enforce strict network perimeter controls across all Compute Engine virtual machines residing in a specific folder named 'Data Processing'. They want to ensure no instances in this folder receive external IP addresses and that policy administrative duties follow the principle of least privilege. Which TWO actions should the team take to meet these governance requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Set the `constraints/compute.vmExternalIpAccess` list constraint on the 'Data Processing' folder to deny external IP address allocation for child VM instances.; Grant the Organization Policy Admin role (`roles/orgpolicy.policyAdmin`) to the security auditors so they can configure hierarchy constraints without full administrative ownership.

Answer

The correct actions are enforcing the `constraints/compute.vmExternalIpAccess` list constraint on the folder level and assigning the Organization Policy Admin (`roles/orgpolicy.policyAdmin`) role to the security auditors.
To restrict external IP configuration on VMs within a folder while following least privilege, administrators must apply the `constraints/compute.vmExternalIpAccess` list constraint directly to the target folder and grant administrators the specialized Organization Policy Admin role (`roles/orgpolicy.policyAdmin`).

Step-by-Step Solution

1
Identify the appropriate Organization Policy constraint to restrict external IP access on Compute Engine VMs.
The `constraints/compute.vmExternalIpAccess` constraint effectively blocks public IP assignment across all project instances under the folder hierarchy.
Organization Policies enforce physical resource configuration restrictions top-down through the resource hierarchy.
2
Determine the least-privilege IAM role required for managing Organization Policies.
Assigning `roles/orgpolicy.policyAdmin` allows security engineers to define constraint policies without giving them full primitive ownership.
Predefined roles limit permission scope to specific operational tasks compared to broad primitive roles.

Key Concept

Configuring Organization Policies and Resource Hierarchy Constraints with Least Privilege IAM Roles
PreviousPage 75 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin