Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 1541Question →

An engineering team runs an automated batch processing pipeline on a Compute Engine virtual machine residing in `project-analytics`. The script needs to read raw log files stored in a Cloud Storage bucket inside `project-data`. Following Google Cloud security best practices for least privilege and identity management, which approach should be taken to grant the VM access to the storage bucket?

Show answer & explanation

Answer: Create a dedicated service account in `project-analytics`, grant it the Storage Object Viewer role (`roles/storage.objectViewer`) on the target bucket in `project-data`, and attach this service account to the VM instance.

Answer

Create a dedicated service account in the source project (`project-analytics`), assign it the predefined `roles/storage.objectViewer` role scoped to the target bucket in `project-data`, and attach the service account to the Compute Engine VM instance.
The correct response adheres to Google Cloud security best practices by creating a dedicated user-managed service account, assigning only the minimum required predefined role (`roles/storage.objectViewer`) directly on the Cloud Storage bucket resource in the destination project, and attaching the service account directly to the Compute Engine VM. This avoids using exported service account keys while strictly enforcing least privilege.

Step-by-Step Solution

1
Identify the authentication mechanism for Google Cloud workloads.
Determine that workloads running inside Compute Engine should use attached user-managed service accounts rather than exported JSON keys.
Attaching a service account directly to the VM leverages automatic metadata server token generation, eliminating long-lived key storage.
2
Determine the necessary IAM role adhering to the principle of least privilege.
Select the predefined `roles/storage.objectViewer` role instead of broad primitive roles like Editor or Owner.
The workload only requires read permissions for Cloud Storage objects.
3
Scope the IAM role binding to the appropriate resource node.
Bind the service account to the target Cloud Storage bucket resource in `project-data`.
Cross-project access is securely achieved by granting resource-level permissions in the target project to a service account identity living in the source project.

Key Concept

Cross-Project Service Account Access and IAM Least Privilege Best Practices
Estimated Time:1m 30s
Question 1542Question →

An infrastructure team hosts a critical enterprise order processing application on a fleet of Compute Engine Linux virtual machines. The team needs to collect both guest operating system memory utilization metrics and application logs from a custom log file path at `/var/log/orders/process.log`, forwarding all telemetry to Cloud Logging and Cloud Monitoring using Google's current recommended practices. Which two actions should the team perform to fulfill this requirement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Install the Google Cloud Ops Agent on each Compute Engine virtual machine instance.; Configure the Ops Agent configuration file (`config.yaml`) to add a custom logging receiver for `/var/log/orders/process.log` and ensure the host metrics pipeline is enabled.

Answer

The correct actions are installing the unified Google Cloud Ops Agent on the VM instances and editing its `config.yaml` configuration file to include a logging receiver for the custom log path while enabling host metrics collection.
To collect custom log files and guest OS memory metrics from Compute Engine virtual machines, Google Cloud recommends deploying the unified Google Cloud Ops Agent. Once installed, customizing `/etc/google-cloud-ops-agent/config.yaml` allows administrators to configure custom file receivers for non-standard log paths like `/var/log/orders/process.log` and ensure memory metric collection is active.

Step-by-Step Solution

1
Identify telemetry collection requirements
Memory metrics (guest OS) and custom application log files (`/var/log/orders/process.log`) are required from Compute Engine VMs.
Standard Compute Engine metrics do not capture internal guest OS memory without an agent installed.
2
Select the appropriate telemetry agent
Choose the Google Cloud Ops Agent as recommended by Google Cloud.
The Ops Agent combines logging and monitoring into a single daemon and supersedes legacy separate agents.
3
Configure the agent pipeline
Edit `/etc/google-cloud-ops-agent/config.yaml` to define a `files` logging receiver for `/var/log/orders/process.log` and verify the metrics pipeline.
The Ops Agent relies on YAML configuration files to specify non-default log locations and metrics pipelines.

Key Concept

Google Cloud Ops Agent Unified Telemetry Collection
Estimated Time:1m 30s
Question 1543Question →

A lead infrastructure engineer is setting up audit log access for a developer team working within a Google Cloud project. The developers currently possess permissions to view standard Admin Activity audit logs, but they are unable to view Data Access audit logs required for troubleshooting data interactions. Following Google Cloud security best practices and the principle of least privilege, which IAM role should be assigned to the developers?

Show answer & explanation

Answer: Private Logs Viewer (roles/logging.privateLogViewer)

Answer

The Private Logs Viewer role (roles/logging.privateLogViewer) should be assigned to the developers.
Data Access audit logs contain sensitive API call data and user-provided data. Google Cloud restricts visibility of these logs so that standard log viewers (using roles/logging.viewer) cannot view them. To view Data Access audit logs while maintaining least privilege, users must be granted the Private Logs Viewer role (roles/logging.privateLogViewer).

Step-by-Step Solution

1
Identify the specific type of audit logs requested.
The requirement asks specifically for viewing Data Access audit logs.
Data Access audit logs contain sensitive resource access and API operation details, which are restricted compared to standard Admin Activity logs.
2
Evaluate IAM role capabilities for Cloud Logging under least privilege.
The standard Logs Viewer role (roles/logging.viewer) only permits reading non-private log entries and Admin Activity logs. Private Logs Viewer (roles/logging.privateLogViewer) is required for Data Access logs.
Granting Private Logs Viewer provides necessary read permissions for Data Access logs while adhering to least privilege without escalating permissions to administrative or primitive roles.

Key Concept

Cloud Audit Logs access control and least privilege role assignment for Data Access logs
Question 1544Question →

A cloud operations team recently deployed a set of database virtual machines on Compute Engine. While reviewing the Cloud Monitoring dashboard, they observe that hypervisor-level metrics like CPU utilization and network traffic are visible, but guest OS memory utilization and disk space usage metrics are unavailable. Which action should the team take to collect these missing metrics in accordance with Google-recommended practices?

Show answer & explanation

Answer: Install the Google Cloud Ops Agent on the virtual machine instances.

Answer

Install the Google Cloud Ops Agent on the virtual machine instances.
Compute Engine hypervisors natively collect host-level metrics like CPU utilization and network I/O. However, memory utilization and guest file system usage are internal to the operating system. Installing the Google Cloud Ops Agent inside the VM instance captures these guest OS metrics and transfers them to Cloud Monitoring according to Google-recommended practices.

Step-by-Step Solution

1
Identify the missing telemetry types.
Memory utilization and disk space usage are guest operating system level metrics, whereas CPU utilization is provided by default by the Compute Engine hypervisor.
Hypervisors cannot view internal OS memory allocation without in-guest software.
2
Select the current Google-recommended telemetry collection software.
The Google Cloud Ops Agent is the primary unified agent for collecting metrics, logs, and traces from Compute Engine instances.
Legacy Stackdriver agents are deprecated in favor of the unified Ops Agent.

Key Concept

Google Cloud Ops Agent vs. Hypervisor Metrics
Estimated Time:1m 30s
Question 1545Question →

A cloud engineer needs to set up secure, keyless authentication for an external CI/CD pipeline to deploy containerized microservices to Google Cloud Run using Workload Identity Federation. In what order should the engineer perform the following steps to configure the service account identity and authorization according to GCP security best practices?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins by creating the dedicated service account, granting it the required deployment roles, provisioning the Workload Identity Pool and Provider for external OIDC trust, and finally binding the Workload Identity User role on the service account to the external principal.
Establishing keyless deployment via Workload Identity Federation follows a clear dependency sequence: create the target GCP service account identity, grant it specific predefined permissions needed for the workload, set up the Workload Identity Pool/Provider to validate external OIDC tokens, and grant the external workload principal the Workload Identity User role on the service account to allow secure impersonation.

Step-by-Step Solution

1
Create the user-managed service account using `gcloud iam service-accounts create`.
A new service account resource is created in the project.
An explicit GCP service account identity is required before permissions can be assigned or external identities bound.
2
Assign required predefined IAM roles to the service account using `gcloud projects add-iam-policy-binding`.
The service account receives specific resource management permissions.
Following the principle of least privilege ensures the service account can only perform designated deployment actions.
3
Configure the Workload Identity Pool and Provider using `gcloud iam workload-identity-pools` commands.
GCP IAM establishes federated trust with the external OIDC identity provider.
The pool and provider define how external tokens are validated and mapped to GCP attributes.
4
Grant `roles/iam.workloadIdentityUser` on the service account to the external identity using `gcloud iam service-accounts add-iam-policy-binding`.
The external workload identity gains authorization to impersonate the service account.
This step enables keyless authentication without requiring exportable, long-lived JSON service account keys.

Key Concept

Workload Identity Federation Service Account Configuration Sequence
Question 1546Question →

An organization requires all Cloud Audit Logs from a production project to be exported to a central BigQuery dataset in a dedicated security project for long-term retention and analysis. Which TWO of the following configurations are required to complete this log routing setup successfully? Select two.

Select all that apply

Show answer & explanation

Answer: Create a log sink in the production project specifying the BigQuery dataset as the destination.; Grant the log sink's writer service account the BigQuery Data Editor role on the destination dataset.

Answer

Exporting Cloud Audit Logs to an external BigQuery dataset requires creating a log sink in the source project configured with the BigQuery destination URI, and granting the sink's generated writer service account the BigQuery Data Editor role on the target dataset.
To route Cloud Audit Logs across projects to BigQuery, a log sink must be configured in the source project pointing to the target BigQuery dataset. Additionally, Cloud Logging provisions a dedicated writer identity (service account) for the sink, which must be granted the BigQuery Data Editor role on the destination BigQuery dataset to authorize table creation and log entry writes.

Step-by-Step Solution

1
Define the export route
A log sink is created in the production project pointing to the target BigQuery dataset URI.
Log sinks filter and route incoming audit logs to supported external destinations.
2
Retrieve writer identity
Cloud Logging automatically generates a unique service account identity (writerIdentity) for the sink.
Log sinks authorize writes using service account impersonation rather than user credentials.
3
Configure destination permissions
The BigQuery Data Editor role (roles/bigquery.dataEditor) is granted to the sink's writer service account on the target dataset.
The service account requires explicit write access to stream audit log entries into BigQuery tables.

Key Concept

Routing Cloud Audit Logs to BigQuery using Log Sinks and Service Account Identities
Estimated Time:1m 30s
Question 1547Question →

A security audit workload needs to periodically list and view all user-managed service accounts and their associated keys within a Google Cloud project named `corp-analytics-prod`. The workload must be granted only the minimum necessary permissions to view service account configurations without the ability to create, delete, modify, or impersonate any service account. Following Google Cloud security best practices and the principle of least privilege, which action should you take?

Show answer & explanation

Answer: Create a dedicated service account for the workload and grant it the predefined `roles/iam.serviceAccountViewer` role on the project.

Answer

Create a dedicated service account for the workload and grant it the predefined `roles/iam.serviceAccountViewer` role on the project.
The correct option grants the predefined role `roles/iam.serviceAccountViewer` to the dedicated service account. This predefined role includes the specific read-only permissions (`iam.serviceAccounts.get`, `iam.serviceAccounts.list`, `iam.serviceAccountKeys.get`, `iam.serviceAccountKeys.list`) required to audit service account configurations while preventing any modifications, key creations, or impersonation actions.

Step-by-Step Solution

1
Identify the specific access requirements for the workload.
The workload requires read-only access to inspect service accounts and service account keys in the project, with no management or impersonation rights.
Security guidelines dictate granting only the exact permissions needed to perform the required task.
2
Evaluate Google Cloud Identity and Access Management (IAM) roles against the least privilege principle.
The `roles/iam.serviceAccountViewer` role provides permissions such as `iam.serviceAccounts.list`, `iam.serviceAccounts.get`, and `iam.serviceAccountKeys.list` without administrative or execution rights.
Predefined IAM roles target specific resource permissions better than broad primitive roles like Viewer or administrative roles.
3
Select the appropriate role assignment.
Assigning `roles/iam.serviceAccountViewer` to the dedicated service account at the project level fulfills the auditing requirement securely.
This enforces least privilege while satisfying all inspection requirements.

Key Concept

Least Privilege Service Account Management
Estimated Time:1m 30s
Question 1548Question →

A security compliance team needs to provide access for an external vulnerability scanner running in an on-premises data center. The scanner must read compute instance details within the project `sec-ops-prod`. Which strategy should the team implement to adhere to Google Cloud security best practices?

Show answer & explanation

Answer: Create a user-managed service account, grant it the Compute Viewer (roles/compute.viewer) predefined role on the project, and configure Workload Identity Federation for keyless authentication.

Answer

Create a user-managed service account, grant it the Compute Viewer (roles/compute.viewer) predefined role on the project, and configure Workload Identity Federation for keyless authentication.
The recommended security approach for on-premises or external workloads accessing Google Cloud resources is to create a dedicated user-managed service account, grant the minimal predefined IAM role (roles/compute.viewer) restricted to the target project scope, and authenticate using Workload Identity Federation to avoid managing service account JSON keys.

Step-by-Step Solution

1
Identify identity management requirements for external workloads
Workload Identity Federation should be selected over static service account JSON keys to enable keyless authentication from external environments.
Service account keys create security risks due to long life spans and potential leaks.
2
Select the appropriate IAM role adhering to least privilege
Assign the predefined role roles/compute.viewer rather than a broad primitive role like Editor or granting access at the organization level.
Predefined roles limit access to the specific resources and permissions needed by the workload.

Key Concept

Creating service accounts with predefined roles and keyless authentication via Workload Identity Federation
Question 1549Question →

A compliance auditor needs to inspect all Cloud Audit Logs for a target Google Cloud project, including sensitive Data Access logs containing personally identifiable information (PII). Following the principle of least privilege, the auditor must be granted read access to these logs without being given access to inspect resource data or perform administrative changes. Which IAM role should be assigned to the auditor?

Show answer & explanation

Answer: Private Logs Viewer (roles/logging.privateLogViewer)

Answer

Granting the Private Logs Viewer (roles/logging.privateLogViewer) role provides read access to all log entries, including restricted Data Access logs, without granting unnecessary permissions.
The Private Logs Viewer role (roles/logging.privateLogViewer) is explicitly designed to allow users to view all log entries in Cloud Logging, including restricted Data Access logs that contain sensitive or PII information, fulfilling security and compliance auditing needs under least privilege.

Step-by-Step Solution

1
Identify audit log access requirements
The requirement specifies reading Cloud Audit Logs, specifically including Data Access logs containing sensitive PII.
Data Access logs are restricted by default and cannot be accessed using standard logging viewer roles.
2
Evaluate Google Cloud IAM predefined roles for Cloud Logging
The Private Logs Viewer role (roles/logging.privateLogViewer) includes permissions for `logging.privateLogEntries.list` required to read Data Access logs.
Standard Logs Viewer (roles/logging.viewer) lacks permissions to view private log entries.
3
Apply the principle of least privilege
Assigning Private Logs Viewer grants exactly the necessary logging permissions without exposing project resources or configuration modification rights.
Primitive roles like Viewer or broader scopes at the organization level violate least privilege.

Key Concept

Cloud Audit Logs access control requires Private Logs Viewer (roles/logging.privateLogViewer) to view Data Access logs containing sensitive information.
Estimated Time:1m 15s
Question 1550Question →

An operations team has created a log-based metric in Google Cloud Logging to measure HTTP 5xx response counts for an application deployed on Cloud Run. The team needs to ensure on-call engineers receive immediate automated alerts via a webhook when the rate of 5xx errors breaches a specific operational threshold. Which action should the cloud engineer take to complete this configuration?

Show answer & explanation

Answer: Create an alerting policy in Cloud Monitoring conditioned on the log-based metric and attach a webhook notification channel to it.

Answer

Create an alerting policy in Cloud Monitoring conditioned on the log-based metric and attach a webhook notification channel to it.
To send real-time alerts based on a log-based metric, you must define an alerting policy in Cloud Monitoring that monitors the metric condition and routes notifications to a configured webhook channel.

Step-by-Step Solution

1
Identify the existing telemetry source
The log-based metric is already capturing 5xx error events from Cloud Run logs in Cloud Logging.
Log-based metrics extract numerical data from log entries and expose them as custom metrics in Cloud Monitoring.
2
Define threshold conditions and notification target
An alerting policy is configured to monitor the rate of the log-based metric against the target threshold.
Cloud Monitoring alerting policies evaluate metric values over specified alignment windows and trigger incidents when conditions are violated.
3
Bind the notification channel
The webhook notification channel receives automated payloads whenever an alert incident is opened or closed.
Notification channels specify where Cloud Monitoring routes incident alerts.

Key Concept

Cloud Monitoring Alerting Policies and Log-Based Metrics Integration
Estimated Time:1m 30s
Question 1551Question →

A cloud engineering team is deploying an automated data ingestion workload on Compute Engine virtual machine instances in a staging project. The workload must read source files from Google Cloud Storage buckets located in a separate production analytics project. Following Google Cloud security best practices for managing service accounts and IAM access, which two configuration steps should the team perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a user-managed service account in the staging project and attach it to the Compute Engine VM instances.; Grant the service account the predefined Storage Object Viewer role on the specific Cloud Storage buckets in the production project.

Answer

The correct steps are to create a user-managed service account in the staging project, attach it to the Compute Engine VM instances, and grant that service account the predefined Storage Object Viewer role directly on the production Cloud Storage buckets.
The correct configuration requires creating a dedicated user-managed service account in the staging project housing the Compute Engine VMs and attaching it directly to the instances. Access to the external production Cloud Storage buckets is provided by granting the service account the specific predefined Storage Object Viewer role on those buckets, ensuring least privilege and secure credential management via instance metadata.

Step-by-Step Solution

1
Identify workload identity requirement
Determine that Compute Engine VMs should run under a dedicated user-managed service account configured in their hosting project.
Attaching a service account to a VM allows Google Cloud to provide application default credentials via instance metadata, avoiding manual key management.
2
Configure cross-project least-privilege IAM permissions
Grant the Storage Object Viewer role to the staging service account on the production storage buckets.
IAM roles can be granted across project boundaries to service account principals. Using predefined read-only roles on specific buckets enforces the principle of least privilege.

Key Concept

Best practices for creating user-managed service accounts, attaching them to Compute Engine workloads, and configuring cross-project IAM access using least privilege without service account keys.
Question 1552Question →

A security analyst must investigate object access patterns on a sensitive Google Cloud Storage bucket. Place the steps required to grant necessary access, configure audit logging, generate test events, and analyze the resulting logs in the correct sequential order.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: 1) Grant the Private Logs Viewer role to the analyst, 2) Enable 'Data Read' Data Access audit logs for Cloud Storage under IAM & Admin Audit Logs, 3) Perform a read operation on the target bucket objects, 4) Execute the `gcloud logging read` command filtering for the data_access logName and bucket resource.
The workflow follows a logical security lifecycle: first establish least privilege permissions (Private Logs Viewer role), second activate the audit logging policy for Cloud Storage Data Read actions, third generate sample traffic by reading bucket objects, and finally retrieve the resulting Data Access audit log entries using gcloud CLI.

Step-by-Step Solution

1
Ensure IAM access permissions are configured.
The analyst receives permissions to view private audit logs via `roles/logging.privateLogViewer`.
Standard `roles/logging.viewer` cannot view Data Access audit logs containing PII/sensitive details.
2
Enable Data Access audit logging for Google Cloud Storage.
Cloud Storage begins writing DATA_READ audit log entries.
Except for BigQuery, Data Access audit logs are disabled by default in GCP to reduce log storage costs.
3
Trigger bucket access activity.
Cloud Storage generates a `cloudaudit.googleapis.com/data_access` log entry.
Audit events are created only when operations happen after the feature configuration is active.
4
Query the generated logs via gcloud CLI.
The analyst retrieves and reviews the structured JSON audit entries.
Running a filter targeted at `logName` and `resource.type` isolates the specific Cloud Storage Data Access logs.

Key Concept

Viewing and Analyzing Cloud Audit Logs
Estimated Time:1m 30s
Question 1553Question →

An organization manages a fleet of Linux Compute Engine instances hosting an internal application. The operations team needs to collect both system memory utilization metrics and custom log files from these instances. Additionally, they must forward high-severity application error logs to a Pub/Sub topic located in a centralized auditing project. Which TWO actions should the cloud engineer take to implement this solution? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Install and configure the unified Google Cloud Ops Agent on the Compute Engine VM instances.; Create a Log Router sink with a severity filter in Cloud Logging, set its destination to the central Pub/Sub topic, and grant the sink's service account the Pub/Sub Publisher role.

Answer

The cloud engineer must install the Google Cloud Ops Agent on the instances and create a Log Router sink with a severity filter that routes logs to the centralized Pub/Sub topic while granting the sink's writer identity the Pub/Sub Publisher role.
To collect guest OS metrics like memory and custom logs from Compute Engine, the Google Cloud Ops Agent must be installed on the VM instances. To route high-severity logs to an external Pub/Sub topic, a Cloud Logging Log Router sink with an appropriate filter must be created, and the sink's unique service account must be granted the Pub/Sub Publisher role on the destination topic.

Step-by-Step Solution

1
Deploy Telemetry Collection Agent
System memory metrics and custom log files are collected from Compute Engine instances
Compute Engine default metrics do not include guest OS memory usage or custom log files without installing the unified Google Cloud Ops Agent.
2
Configure Centralized Log Export
High-severity logs are routed to the central Pub/Sub topic with necessary permissions
Log Router sinks evaluate log entries against inclusion filters and route them to destinations like Pub/Sub topics across projects, requiring the sink's unique writer identity to hold the Pub/Sub Publisher role.

Key Concept

Monitoring Compute Engine guest telemetry using Google Cloud Ops Agent and configuring Log Router sinks with least-privilege IAM roles for Pub/Sub export.
Question 1554Question →

A company hosts an e-commerce platform across a fleet of Linux Compute Engine virtual machines. The operations team needs to set up an alert whenever system memory utilization exceeds 80%. When configuring a Cloud Monitoring alerting policy, they observe that memory metrics are missing from the available resource metrics list. Which action should you take to make system memory metrics available in Cloud Monitoring?

Show answer & explanation

Answer: Install and configure the Google Cloud Ops Agent on the Compute Engine virtual machines.

Answer

Install and configure the Google Cloud Ops Agent on the Compute Engine virtual machines.
Compute Engine hypervisor metrics include CPU, network, and disk I/O, but do not inspect internal guest OS memory usage. Installing the unified Google Cloud Ops Agent allows the OS to report guest-level metrics like memory usage directly to Cloud Monitoring.

Step-by-Step Solution

1
Identify missing telemetry type
Recognize that memory utilization is a guest Operating System metric, not a default hypervisor metric.
Compute Engine hypervisors only capture host-level metrics like CPU utilization and network traffic without guest OS visibility.
2
Select recommended telemetry agent
Choose the Google Cloud Ops Agent for VM metrics and logging.
The Ops Agent combines logging and metrics collection into a single agent, replacing legacy agents according to Google Cloud best practices.

Key Concept

Compute Engine Guest OS Telemetry Collection via Google Cloud Ops Agent
Question 1555Question →

A team of external compliance reviewers needs permission to inspect Admin Activity audit logs for a target Google Cloud project to verify infrastructure modification events. The reviewers must not be able to view sensitive Data Access audit logs containing user payloads, nor should they receive read or write permissions for project compute and storage resources. Following Google Cloud security best practices and the principle of least privilege, which IAM role configuration should be implemented?

Show answer & explanation

Answer: Grant the Logs Viewer (roles/logging.viewer) role to the compliance team directly on the target project.

Answer

Grant the Logs Viewer (roles/logging.viewer) role to the compliance team directly on the target project.
Granting the predefined Logs Viewer (roles/logging.viewer) role on the project provides the exact permissions required to inspect Admin Activity logs, System Event logs, and Access Transparency logs. It explicitly excludes access to sensitive Data Access logs (which require Private Logs Viewer) and does not grant any read/write permissions to underlying GCP resources.

Step-by-Step Solution

1
Identify the required audit log visibility requirements.
The requirement specifies access to Admin Activity logs only, while strictly restricting access to Data Access audit logs and GCP resource states.
Admin Activity logs record administrative configuration actions and are accessible by default to log viewing roles, whereas Data Access logs require private log access.
2
Evaluate predefined Logging IAM roles against least privilege.
The Logs Viewer (roles/logging.viewer) role grants permission to view standard audit logs (Admin Activity) but excludes Data Access logs (which require roles/logging.privateLogViewer).
Selecting predefined roles scoped specifically to logging prevents granting unnecessary permissions to underlying infrastructure components.
3
Verify resource hierarchy inheritance rules.
Assigning the role at the target project level ensures exact scope boundary enforcement without triggering inherited access issues from parent folders or organization nodes.
Google Cloud IAM follows additive policy inheritance where parent permissions cannot be revoked at lower levels.

Key Concept

Least Privilege IAM Access for Cloud Audit Logs
Estimated Time:1m 30s
Question 1556Question →

A security analyst needs to review Cloud Audit Logs for a Google Cloud project to investigate access to sensitive data stored in Cloud Storage. The analyst must be able to view both standard logs and Data Access audit logs containing private log entries in the Logs Explorer, while adhering strictly to the principle of least privilege without granting access to project resources or administrative configurations. Which TWO IAM roles should be granted to the security analyst?

Select all that apply

Show answer & explanation

Answer: Logs Viewer (roles/logging.viewer); Private Logs Viewer (roles/logging.privateLogViewer)

Answer

Granting Logs Viewer (roles/logging.viewer) and Private Logs Viewer (roles/logging.privateLogViewer) allows viewing both standard log entries and restricted Data Access audit logs following the principle of least privilege.
Viewing Data Access audit logs requires the `logging.privateLogEntries.list` permission provided by the Private Logs Viewer role, while standard logs Explorer features require the Logs Viewer role. Combining these two predefined roles ensures full visibility into Cloud Audit Logs under the principle of least privilege.

Step-by-Step Solution

1
Identify log access requirements
The scenario specifies viewing standard audit logs (Admin Activity) alongside restricted Data Access audit logs.
Data Access audit logs contain sensitive data access records and require elevated logging permissions beyond standard viewer roles.
2
Select predefined IAM logging roles for audit access
Combine the Logs Viewer role for standard logs with the Private Logs Viewer role for Data Access audit logs.
The Logs Viewer role provides access to standard logs, while the Private Logs Viewer role explicitly grants the `logging.privateLogEntries.list` permission required for Data Access logs.
3
Validate against least privilege guidelines
Avoid broad primitive roles like Project Viewer or administrative roles like Logs Configuration Writer.
Predefined logging roles ensure necessary visibility into log entries without exposing underlying GCP resource contents or log management configurations.

Key Concept

Cloud Audit Log Access and Least Privilege IAM Roles
Question 1557Question →

A cloud engineering team needs to capture memory utilization metrics and custom file logs from a fleet of Compute Engine virtual machines, sending the logs to a central security project. Which TWO actions should the team perform to meet these requirements using Google Cloud best practices? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Install and configure the Google Cloud Ops Agent on the Compute Engine virtual machines.; Grant the Logs Writer role (roles/logging.logWriter) on the central security project to the service account attached to the Compute Engine instances.

Answer

The correct actions are installing the Google Cloud Ops Agent on the virtual machines and granting the Logs Writer role (roles/logging.logWriter) on the target central project to the VM service account.
Deploying the Ops Agent provides a unified solution for gathering guest memory metrics and custom log files from Compute Engine VMs. Assigning the predefined Logs Writer role on the destination project adheres to the principle of least privilege while permitting log ingestion.

Step-by-Step Solution

1
Select the correct telemetry agent for Compute Engine memory and log collection.
Identify the Google Cloud Ops Agent as the single unified agent required for system metrics and log collection.
Legacy agents are deprecated and do not support modern unified configuration patterns.
2
Determine the minimal required IAM role for sending logs across projects.
Select the predefined Logs Writer role (roles/logging.logWriter) on the central log storage project.
Security best practices demand using targeted predefined roles over broad primitive roles like Owner.

Key Concept

Google Cloud Ops Agent deployment and least-privilege IAM configuration for centralized Cloud Logging
Question 1558Question →

A cloud engineer needs to configure a Compute Engine virtual machine to securely export application logs to Cloud Logging using a dedicated service account and least privilege access. What is the correct sequence of steps to establish this service account authentication flow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins by creating the user-managed service account identity, binding the required least-privilege IAM role (`roles/logging.logWriter`) to that identity at the project level, attaching the service account to the target Compute Engine VM instance, and finally configuring application code to authenticate using Application Default Credentials (ADC).
Establishing a service account workflow follows a strict lifecycle: first, the identity must be created in IAM. Next, access permissions (the predefined `roles/logging.logWriter` role) are bound to the service account. After authorization is configured, the identity is attached to the virtual machine instance so the metadata server can issue tokens. Finally, the application consumes these tokens seamlessly via Application Default Credentials without downloading explicit key files.

Step-by-Step Solution

1
Create the Service Account
A unique service account identity email is generated within the Google Cloud project.
An identity must exist before IAM policy bindings or resource attachments can reference it.
2
Delegate IAM Roles
The service account is granted `roles/logging.logWriter` on the target project resource.
Least-privilege authorization must be established so the identity has permission to write logs when authenticated.
3
Attach to Compute Engine Instance
The VM instance metadata server is configured to provide access tokens for the dedicated service account.
Attaching the service account allows workloads running on the virtual machine to inherit its identity securely.
4
Leverage Application Default Credentials
Application code automatically retrieves short-lived OAuth 2.0 access tokens from the local instance metadata server.
Using ADC avoids exporting and managing persistent service account JSON keys.

Key Concept

Creating, granting permissions to, attaching, and consuming user-managed service accounts using Application Default Credentials on Compute Engine.
Question 1559Question →

A cloud engineer is configuring identity management for a new background processing workload in Google Cloud. The engineer needs to create a new user-managed service account named `data-processor` within the project `analytics-prod` using the Google Cloud CLI (`gcloud`). Which command should the engineer execute to correctly create this service account?

Show answer & explanation

Answer: gcloud iam service-accounts create data-processor --display-name="Data Processing Service Account" --project=analytics-prod

Answer

The command `gcloud iam service-accounts create data-processor --display-name="Data Processing Service Account" --project=analytics-prod` correctly creates a user-managed service account in Google Cloud.
The command starting with `gcloud iam service-accounts create` accurately specifies the positional argument for the service account ID (`data-processor`) along with optional metadata flags (`--display-name`) and project target (`--project`). This creates the service account identity in the specified project.

Step-by-Step Solution

1
Identify the target gcloud tool and component group for service account management.
The correct command group under gcloud is `gcloud iam service-accounts`.
Service account resource operations are located under the IAM service-accounts subcommand branch.
2
Select the correct action verb for creation.
The action verb to instantiate a new service account is `create`.
The `create` verb initializes a new service account identity within the target project.
3
Specify the service account ID and descriptive flags.
Provide `data-processor` as the positional argument along with `--display-name` and `--project` flags.
This sets the unique service account ID and descriptive metadata in the designated project.

Key Concept

Creating User-Managed Service Accounts with gcloud CLI
Question 1560Question →

An operations team needs to track the frequency of specific application error messages captured in Google Cloud Logging from Compute Engine instances and receive email notifications whenever the error rate exceeds a defined threshold. Which TWO actions must be performed to fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Create a custom counter log-based metric in Cloud Logging filtered by the specific application error log text.; Create an alerting policy in Cloud Monitoring conditioned on the log-based metric and attach an email notification channel.

Answer

To track log frequencies and trigger alerts based on log content, you must create a custom counter log-based metric in Cloud Logging matching the log pattern, and then configure an alerting policy in Cloud Monitoring using that metric with an attached email notification channel.
To alert on specific log events in Google Cloud, log entries must first be converted into a metric using Cloud Logging counter log-based metrics. Once the metric exists, Cloud Monitoring can evaluate its values against threshold conditions and send alerts to designated notification channels like email.

Step-by-Step Solution

1
Define a counter log-based metric in Cloud Logging
Cloud Logging converts log entry counts matching the filter into a time-series metric accessible by Cloud Monitoring.
Log entries themselves cannot directly trigger metric threshold alerts until converted into a log-based metric.
2
Configure a Cloud Monitoring alerting policy
An alerting policy monitors the newly created log-based metric and notifies administrators via email when the threshold is breached.
Cloud Monitoring handles threshold detection, condition evaluation, and notification delivery.

Key Concept

Log-based metrics and alerting policy integration in Google Cloud Observability
PreviousPage 78 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin