Examkin

All practice questions

1591 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 1561Question →

A Cloud Engineer is tasked with long-term retention of audit logs across all projects in an organization. The engineer creates an Organization-level Log Router sink configured to export Cloud Audit Logs to a centralized Cloud Storage bucket in a dedicated security project. Shortly after setup, the engineer notices that no log entries are arriving in the destination bucket. What is the most likely cause of this issue and how should it be resolved?

Show answer & explanation

Answer: The writer identity service account associated with the log sink has not been granted the necessary IAM role on the destination Cloud Storage bucket.

Answer

The writer identity service account generated by the Log Router sink must be granted permission (such as the Storage Object Creator role) on the destination Cloud Storage bucket.
When creating a Log Router sink that exports logs to a destination (such as Cloud Storage, Pub/Sub, or BigQuery), Cloud Logging generates a writer identity service account. To complete the configuration, appropriate IAM write permissions (e.g., Storage Object Creator) must be explicitly granted to that service account on the destination resource.

Step-by-Step Solution

1
Identify how Log Router sinks authorize writes to export destinations.
Creating a Log Router sink generates a unique writer identity service account.
Cloud Logging uses service accounts to publish logs safely to sinks across projects or organizations.
2
Verify IAM permissions on the destination resource.
The writer identity must be granted write access on the destination Cloud Storage bucket.
Without explicit IAM permissions granted to the sink's writer identity, log routing fails silently or logs access denied errors.

Key Concept

Cloud Logging Log Router cross-project destination authorization using writer identities
Question 1562Question →

Your organization is deploying a fleet of Compute Engine virtual machines hosting a critical enterprise web application. To ensure effective operational monitoring, you need to collect guest OS-level metrics, such as memory utilization, as well as application log files from the file system into Cloud Observability. Which TWO configuration steps should you perform to enable this telemetry collection using Google recommended practices?

Select all that apply

Show answer & explanation

Answer: Install and configure the unified Google Cloud Ops Agent on each Compute Engine instance.; Attach a service account to the VM instances with the Monitoring Metric Writer (roles/monitoring.metricWriter) and Logs Writer (roles/logging.logWriter) predefined IAM roles.

Answer

Installing the unified Google Cloud Ops Agent on the VM instances and assigning the Monitoring Metric Writer and Logs Writer predefined roles to the VM service account.
To capture guest OS-level metrics like RAM usage alongside custom log files, Google Cloud requires installing the unified Ops Agent on Compute Engine instances. Furthermore, the attached service account must possess specific predefined roles (`roles/monitoring.metricWriter` and `roles/logging.logWriter`) to transmit telemetry data securely following least-privilege security practices.

Step-by-Step Solution

1
Identify agent requirements for OS memory metrics and log collection
Recognize that default Compute Engine telemetry does not capture guest OS memory or disk metrics without an agent, and the unified Ops Agent is the current standard.
The Ops Agent combines logging and metrics capabilities into a single binary for Compute Engine.
2
Determine least-privilege IAM configuration for telemetry ingestion
Select predefined roles: `roles/monitoring.metricWriter` and `roles/logging.logWriter` for the instance service account.
The Ops Agent runs under the identity of the VM's service account and requires explicit permissions to write metrics and logs to Google Cloud Observability.

Key Concept

Compute Engine Telemetry Collection with Google Cloud Ops Agent
Question 1563Question →

An operations engineer is responsible for maintaining system availability in a Google Cloud project named `prod-services`. The engineer currently holds the Monitoring Viewer (`roles/monitoring.viewer`) IAM role but receives a permission error when attempting to configure new alerting policies and notification channels in Cloud Monitoring. Following Google-recommended practices and the principle of least privilege, which action should be taken to resolve this issue?

Show answer & explanation

Answer: Grant the engineer the Monitoring Editor (`roles/monitoring.editor`) role on the `prod-services` project.

Answer

Grant the engineer the Monitoring Editor (`roles/monitoring.editor`) role on the `prod-services` project.
The Monitoring Editor (`roles/monitoring.editor`) predefined role includes all necessary permissions to create, update, and delete Cloud Monitoring alerting policies, uptime checks, and notification channels. It aligns with the principle of least privilege by scope-limiting access strictly to observability resources within the target project.

Step-by-Step Solution

1
Identify the missing IAM capability
The engineer currently holds `roles/monitoring.viewer`, which permits viewing monitoring data but restricts creating or updating alerting policies and notification channels.
Creating alerting policies requires `monitoring.alertPolicies.create` and related write permissions.
2
Evaluate role options against the principle of least privilege
Select `roles/monitoring.editor` which provides full control over Cloud Monitoring resources without granting unnecessary access to unrelated service resources.
Predefined roles tailor permissions strictly to the required operational scope.

Key Concept

Cloud Monitoring IAM Roles and Least Privilege Access Control
Question 1564Question →

A financial services organization is planning the Google Compute Engine infrastructure for a continuous, memory-intensive risk modeling service that operates 24/7. The application requires 6 vCPUs and 48 GB of RAM to maintain optimal throughput, but cannot tolerate unexpected node shutdowns or terminations. The team wants to ensure high availability while minimizing compute costs over a 3-year production deployment period. Which Compute Engine configuration strategy should you recommend?

Show answer & explanation

Answer: Provision a custom N2 machine type with 6 vCPUs and 48 GB of RAM, combined with a 3-year Committed Use Discount (CUD) for compute resources.

Answer

Provision a custom N2 machine type configured with 6 vCPUs and 48 GB of RAM, combined with a 3-year Committed Use Discount (CUD).
Configuring a custom machine type allows exact tailoring of vCPUs (6) and RAM (48 GB) to prevent overprovisioning costs. Combining this with a 3-year Committed Use Discount delivers the maximum possible cost reduction for uninterrupted, continuous production workloads.

Step-by-Step Solution

1
Analyze workload resource requirements and lifecycle constraints
Workload is continuous (24/7), requires explicit non-standard CPU-to-memory ratio (6 vCPUs to 48 GB RAM), and requires high availability (no preemption).
Matching exact workload characteristics prevents capacity overprovisioning and application failures.
2
Determine machine type sizing approach
Select a Custom N2 machine type with 6 vCPUs and 48 GB RAM.
Standard machine types follow rigid ratios (e.g. 1:4 vCPU-to-RAM ratio). Custom machine types avoid paying for unused vCPUs when exact memory targets are needed.
3
Select appropriate pricing optimization mechanism for 24/7 steady-state usage over 3 years
Apply a 3-year Committed Use Discount (CUD).
Committed Use Discounts offer the highest cost savings for steady-state continuous workloads, whereas Spot VMs are risky due to preemption and Sustained Use Discounts provide lower overall savings.

Key Concept

Compute Engine Custom Machine Types and Committed Use Discounts (CUDs)
Question 1565Question →

An administrator needs to organize multiple Google Cloud projects under a central structure and apply access control policies that automatically apply to all projects in the company. Which node represents the root level of the Google Cloud resource hierarchy?

Show answer & explanation

Answer: Organization

Answer

The Organization node is the root level of the Google Cloud resource hierarchy.
The Organization node represents the root of the Google Cloud resource hierarchy. IAM roles and Organization Policies assigned at the Organization level automatically inherit down through all child folders, projects, and resources.

Step-by-Step Solution

1
Identify the top-level entity in the Google Cloud resource hierarchy.
The hierarchy flows downward as Organization → Folders → Projects → Individual Resources.
Understanding the structural flow ensures policies are attached at the top-most appropriate boundary.
2
Evaluate the root node requirement.
The Organization node provides central ownership and serves as the root container.
All policies applied at the Organization level inherit down to folders, projects, and resources.

Key Concept

Google Cloud Resource Hierarchy Structure
Question 1566Question →

An IT operations team is planning the cloud compute infrastructure for a specialized application. The workload requires full administrative root access to modify operating system kernel parameters and load custom kernel modules. Which TWO Google Cloud compute deployment options meet these operational requirements? (Select TWO options.)

Select all that apply

Show answer & explanation

Answer: Compute Engine standard virtual machine instances; Google Kubernetes Engine (GKE) Standard clusters with custom node pools

Answer

Compute Engine standard virtual machine instances and Google Kubernetes Engine (GKE) Standard clusters with custom node pools are the correct choices because both options provide administrative access to configure node-level operating system settings and kernel parameters.
Compute Engine standard instances and GKE Standard clusters give administrators access to the underlying virtual machines, enabling full root privileges required to adjust kernel parameters (sysctl) and load custom kernel modules. GKE Standard node pools allow node OS customization, making both services suitable for workloads needing low-level OS control.

Step-by-Step Solution

1
Identify workload requirements
The application requires root privilege to adjust OS kernel settings and load custom kernel modules.
Serverless platforms abstract the underlying infrastructure, restricting OS kernel configuration.
2
Evaluate compute service management models
Compute Engine VMs and GKE Standard node pools grant root/SSH access to host operating systems, whereas GKE Autopilot, Cloud Run, and Cloud Functions enforce managed environments with restricted host OS access.
Assessing the boundary between fully managed infrastructure and customer-managed infrastructure determines service suitability.

Key Concept

Evaluating Infrastructure Control vs. Managed Compute Boundaries
Question 1567Question →

An organization is configuring access control across their Google Cloud resource hierarchy for a newly established 'Platform-Engineering' folder. The folder will contain multiple production and staging projects. You need to ensure that a CI/CD service account can deploy and manage infrastructure across all current and future projects in this folder, while developers have read-only access to view all resources in these projects. Following Google Cloud recommended practices and the principle of least privilege, which TWO configuration actions should you perform?

Select all that apply

Show answer & explanation

Answer: Bind the appropriate predefined administrative roles (such as Compute Admin and Storage Admin) to the CI/CD service account at the 'Platform-Engineering' folder level.; Bind the predefined Viewer role to the developers Google Group at the 'Platform-Engineering' folder level.

Answer

The correct configurations are to grant predefined administrative roles to the service account at the folder level and to grant the Viewer role to the developers group at the folder level.
In Google Cloud resource hierarchy, IAM policies defined at a folder node are inherited by all child projects within that folder. Granting predefined administrative roles to the service account and the Viewer role to the developers group at the folder level ensures consistent, scalable access management aligned with least privilege principles.

Step-by-Step Solution

1
Analyze resource hierarchy requirements for permissions scoping.
Applying policy bindings at the parent folder level ensures automatic downward inheritance to all current and future child projects.
Folder-level IAM administration eliminates the overhead of managing access on individual projects.
2
Select roles adhering to the principle of least privilege for the service account.
Specific predefined roles (such as Compute Admin and Storage Admin) provide necessary deployment capabilities without granting unnecessary organization-wide or owner permissions.
Primitive Owner roles at higher hierarchy levels over-grant administrative power.
3
Select roles adhering to the principle of least privilege for developers.
Binding the predefined Viewer role at the folder level grants read-only access to all resources within child projects.
IAM permissions are additive and inherited down the node hierarchy tree.

Key Concept

IAM Policy Inheritance and Predefined Roles in Google Cloud Resource Hierarchy
Question 1568Question →

A cloud architecture team is evaluating Google Cloud serverless compute options for a web microservice application. Which TWO requirements make Cloud Run a more suitable choice than Cloud Functions? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The application is packaged as a custom container image listening on an HTTP port.; Each instance must process multiple concurrent HTTP requests simultaneously.

Answer

Cloud Run is selected over Cloud Functions when deploying custom container images listening on an HTTP port and when requiring multiple concurrent requests to be processed per instance.
Cloud Run is optimized for executing stateless custom containers that listen on an HTTP port and can handle multiple concurrent requests per instance, reducing total instance footprint and cost.

Step-by-Step Solution

1
Identify compute packaging and concurrency requirements.
Cloud Run runs arbitrary OCI container images listening on an HTTP port and allows configuring concurrency so a single instance handles multiple simultaneous requests.
Cloud Functions focuses primarily on single-function code snippets rather than full custom web server containers with high concurrency configuration.
2
Evaluate event-handling and state persistence constraints.
Simple event handlers are ideal for Cloud Functions, and local disk persistence is not supported by either serverless platform due to stateless instance lifecycles.
Serverless instances auto-scale dynamically down to zero and replace ephemeral local disk storage upon restart.

Key Concept

Selecting serverless compute options based on container packaging, concurrency settings, and stateless design
Question 1569Question →

A software team is onboarding a new application project named `dev-analytics-prj` that requires access to Google Cloud Pub/Sub. To maintain strict security compliance, the team must be granted minimal necessary permissions to enable required APIs on this project, and the API must be enabled via the Cloud SDK CLI. Which of the following actions are necessary to successfully enable the Cloud Service API under these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Grant the development team the Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role on the target project `dev-analytics-prj`.; Execute `gcloud services enable pubsub.googleapis.com --project=dev-analytics-prj` using the Google Cloud CLI.

Answer

To enable the Pub/Sub API on project `dev-analytics-prj` following least privilege and CLI requirements, grant the Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role on project `dev-analytics-prj` and execute `gcloud services enable pubsub.googleapis.com --project=dev-analytics-prj`.
Enabling a Google Cloud Service API requires two key requirements: granting the principle-of-least-privilege IAM role (`roles/serviceusage.serviceUsageAdmin`) on the destination project, and targeting that project explicitly when running `gcloud services enable <service_name> --project=<project_id>`.

Step-by-Step Solution

1
Identify the minimum required IAM role for enabling APIs on a specific project.
The Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role provides permissions (`serviceusage.services.enable`) to manage APIs without granting unnecessary administrative permissions.
Security compliance requires using predefined roles according to the principle of least privilege instead of broad primitive roles like Owner.
2
Determine the proper gcloud CLI command and parameters to enable the targeted service.
Use `gcloud services enable pubsub.googleapis.com` with the `--project=dev-analytics-prj` flag.
Google Cloud service APIs must be explicitly enabled on the specific project consuming the service.

Key Concept

Enabling Cloud APIs requires the Service Usage Admin role scoped to the target project and explicit service activation using the gcloud CLI.
Question 1570Question →

A cloud engineering team is designing a serverless solution to host an HTTP web microservice written in Python. The service requires installing a custom Linux system library (`ffmpeg`) for media processing, and must handle up to 50 concurrent requests per container instance to reduce cold-start latency and lower operational costs. Which Google Cloud compute option should the team choose?

Show answer & explanation

Answer: Cloud Run, because it deploys container images allowing custom system libraries and supports handling multiple concurrent requests per container instance.

Answer

Cloud Run, because it deploys container images allowing custom system libraries and supports handling multiple concurrent requests per container instance.
Cloud Run is the optimal choice for this scenario because it runs arbitrary container images, allowing the installation of custom Linux packages like `ffmpeg`. Furthermore, Cloud Run allows configuring concurrency (up to 1000 requests per container), which satisfies the requirement to handle 50 concurrent requests per instance to reduce cold starts and cost.

Step-by-Step Solution

1
Analyze the workload requirements
The service needs a custom system dependency (`ffmpeg`) and must handle up to 50 concurrent requests per instance.
Custom OS dependencies require container customization, and handling multiple concurrent requests requires multi-concurrency serverless capabilities.
2
Evaluate Google Cloud serverless options
Cloud Run allows packaging any custom OS package inside a Docker container and natively supports setting concurrency per instance.
Cloud Run builds upon container standards, allowing custom container images and concurrent request processing per instance.

Key Concept

Selecting Cloud Run for containerized serverless microservices requiring custom OS binaries and multi-request concurrency.
Question 1571Question →

An administrator needs to configure granular, least-privilege access for an auditor who requires read access to application logs in a Google Cloud project. Put the following steps in the correct logical order to safely create and assign a custom IAM role.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with identifying the required granular permissions, followed by creating the custom IAM role at the project level, binding the role to the auditor's identity, and finally verifying that least-privilege access is functioning properly.
Following Google Cloud security best practices for custom IAM management requires establishing the least-privilege permission list first. Once the exact permissions are identified, the custom IAM role is formally created at the project level. Next, the administrator binds this custom role to the user's identity. Finally, access is verified to ensure compliance and proper functionality.

Step-by-Step Solution

1
Determine required granular permissions
A specific list of permissions (such as logging.viewer) is identified.
You must know what specific permissions are needed before bundling them into a role.
2
Create the custom role definition
A project-level custom IAM role containing only the required permissions is provisioned.
Custom roles must exist within the resource hierarchy before they can be assigned.
3
Bind the role to the principal
An IAM policy binding connects the custom role to the auditor's Google account or service account.
Permissions take effect for a user only when an explicit policy binding is established.
4
Verify access
Auditor access is tested to confirm intended permissions are granted without extraneous access.
Verification ensures administrative accuracy and compliance with least-privilege best practices.

Key Concept

Custom IAM Role Creation and Lifecycle Management
Question 1572Question →

A cloud administrator is planning a new Google Kubernetes Engine (GKE) cluster to host stateless web microservices. The primary objective is to minimize node management overhead so that Google fully manages the underlying worker node infrastructure and OS patching, while charging only for the resource requests of deployed Pods. Which TWO architectural choices or operational features should the administrator select to fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Deploy the cluster using GKE Autopilot mode.; Define explicit CPU, memory, and storage resource requests for each Pod specification.

Answer

The administrator should deploy the cluster using GKE Autopilot mode and specify explicit CPU, memory, and storage resource requests in the Pod manifests.
GKE Autopilot is Google Cloud's fully managed cluster mode where Google handles all node management, security patching, and infrastructure scaling. In Autopilot, billing is based directly on the CPU, memory, and storage requested in individual Pod manifests, eliminating payment for unused node capacity.

Step-by-Step Solution

1
Analyze the operational requirements for cluster management overhead.
GKE Autopilot fully automates node lifecycle management, OS patching, and node pool administration.
Choosing Autopilot shifts worker node management responsibility to Google.
2
Determine how billing and resource scheduling function in Autopilot mode.
Pod resource requests (CPU, memory, storage) define both billing boundaries and scheduling requirements.
Autopilot charges per Pod based on specified resource requests rather than paying for idle compute capacity on unmanaged worker nodes.

Key Concept

GKE Autopilot cluster architecture and Pod-based resource planning
Question 1573Question →

A cloud engineer is using the Google Cloud Pricing Calculator to estimate monthly Compute Engine expenses for a single virtual machine instance. The instance has an un-discounted rate of $0.04\$0.04 per hour. If the instance runs continuously for 730730 hours during a month and qualifies for a 20%20\% sustained use discount on its compute costs, what is the net estimated monthly cost of the instance in USD?

Show answer & explanation

Answer: 23.36

Answer

The net estimated monthly cost of the instance is $23.36\$23.36.
To estimate the total monthly cost, multiply the hourly rate of $0.04\$0.04 by 730730 hours to determine the gross monthly cost of $29.20\$29.20. Applying the 20%20\% sustained use discount reduces the total cost by $5.84\$5.84 ($29.20×0.20\$29.20 \times 0.20), resulting in a net monthly estimate of $23.36\$23.36.

Step-by-Step Solution

1
Calculate total gross monthly cost prior to discounts.
$29.20\$29.20
Multiply the hourly rate ($0.04\$0.04) by the number of continuous operational hours (730730).
2
Apply the 20%20\% sustained use discount factor.
$23.36\$23.36
Multiply the gross cost by 0.800.80 to account for a 20%20\% reduction.

Key Concept

Estimating Compute Engine continuous usage costs with sustained use discounts
Question 1574Question →

A financial engineering team generates daily transactional reconciliation files that must be stored in Google Cloud Storage. Analytical workloads read each file dozens of times daily for the first 45 days after creation. From day 46 through day 180, files are queried less than once a month for periodic reporting. After 180 days, files are retained solely for regulatory compliance and are retrieved fewer than once per year. Which Object Lifecycle Management policy minimizes overall expenses while accommodating this access pattern?

Show answer & explanation

Answer: Set the default bucket class to Standard storage, transition objects to Nearline storage after 45 days, and transition objects to Archive storage after 180 days.

Answer

The optimal strategy is setting the default bucket storage class to Standard, transitioning objects to Nearline storage after 45 days, and transitioning to Archive storage after 180 days.
Using Standard storage initially prevents data retrieval charges while files are read repeatedly during the first 45 days. Transitioning to Nearline at day 45 matches the reduced access pattern (< 1/month) while satisfying Nearline's 30-day minimum retention period before transitioning to Archive at day 180 for low-cost, long-term regulatory retention.

Step-by-Step Solution

1
Analyze access frequency for Days 1–45
Heavy daily reads occur during this period. Standard storage class has zero retrieval charges, making it the most cost-effective tier for high-frequency access.
Lower storage tiers (Nearline, Coldline, Archive) charge data retrieval fees per gigabyte, which would become prohibitively expensive under daily access.
2
Analyze access frequency and duration for Days 46–180
Access drops to less than once per month. Nearline storage is optimized for data accessed at most once a month and has a 30-day minimum storage duration.
Transitioning at day 45 allows data to reside in Nearline until day 180 (135 days total), well past the 30-day minimum retention requirement, avoiding early transition penalties.
3
Analyze long-term compliance retention for Day 181+
Files are kept for regulatory compliance and accessed less than once a year. Archive storage offers the lowest at-rest storage price per gigabyte.
Archive storage is designed for long-term disaster recovery and legal retention where data is rarely accessed.

Key Concept

Cloud Storage Class Selection & Lifecycle Optimization
Question 1575Question →

An organization is deploying an analytics pipeline in project `healthcare-analytics-prod` and requires additional Compute Engine regional SSD persistent disk capacity in `europe-west1` beyond the current limit. The administrator needs to request a quota increase following Google Cloud best practices. Which TWO actions must be completed to successfully request and manage this quota increase? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Navigate to IAM & Admin > Quotas in the Google Cloud Console, filter for the regional SSD persistent disk quota in `europe-west1`, and submit a quota increase request with the required capacity.; Ensure the user or service account submitting the request possesses appropriate administrative permissions, such as the Quotas Administrator role (`roles/servicemanagement.quotaAdmin`) or Service Usage Admin role.

Answer

To request and manage a GCP resource quota increase, the administrator must submit a formal quota increase request via the Quotas page in the Cloud Console (or via Cloud Quotas API) and hold an IAM role with quota management permissions, such as Quotas Administrator or Service Usage Admin.
Requesting a quota increase in Google Cloud requires submitting a request through the Quotas page in the Cloud Console (or via gcloud/APIs) for the specific regional resource, and ensuring the requesting identity holds an appropriate role such as Quotas Administrator (`roles/servicemanagement.quotaAdmin`) or Service Usage Admin.

Step-by-Step Solution

1
Identify the proper location for quota management
Determine that quota requests are handled under IAM & Admin > Quotas in the Cloud Console or through Cloud Quotas tools, not through billing budget settings.
GCP quotas are separate operational guardrails distinct from financial billing controls.
2
Verify IAM permission requirements
Confirm that the identity requesting the quota change has `roles/servicemanagement.quotaAdmin` or `roles/serviceusage.serviceUsageAdmin` on the target project.
Principle of least privilege requires specific quota admin permissions rather than general billing roles to modify project resource limits.

Key Concept

Managing and Requesting GCP Resource Quotas
Question 1576Question →

A cloud operations engineer is expanding an enterprise web application across multiple load balancers in the europe-west3 region within a Google Cloud project. During deployment, the engineer receives an error indicating that the project has reached its maximum quota limit for regional static external IP addresses in europe-west3. Additional static IP addresses are required to complete the infrastructure rollout. Which action should the engineer take to resolve this capacity constraint?

Show answer & explanation

Answer: Submit a quota increase request for regional static external IP addresses in europe-west3 via the Quotas section in the Google Cloud Console.

Answer

Submit a quota increase request for regional static external IP addresses in europe-west3 via the Quotas section in the Google Cloud Console.
Submitting a formal quota increase request through the IAM & Admin Quotas page in the Google Cloud Console is the standard, official mechanism to increase regional GCP resource limits such as static external IP addresses.

Step-by-Step Solution

1
Identify the constrained resource type and region.
Determined that the limit reached is the regional static external IP address quota in europe-west3.
GCP quotas are enforced at the project level per region or global scope depending on the resource.
2
Navigate to IAM & Admin > Quotas & System Limits in the Google Cloud Console.
Located the Static External IP Addresses entry filtered by region europe-west3.
Official quota management and increase workflows are handled through the Cloud Console or gcloud commands.
3
Select the quota line item and request an edit/increase to the desired limit.
Submitted the request with business justification for Google Cloud review.
Quota increases require explicit administrative request submission and evaluation by GCP.

Key Concept

Managing and requesting regional resource quota increases in GCP
Question 1577Question →

An Associate Cloud Engineer accidentally initiated the shutdown of a Google Cloud project named `analytics-prod-102` using the Cloud Console. The project contained several critical cloud resources. The team needs to immediately restore the project to an active state, and less than 7 days have elapsed since the shutdown request. Which command or procedure should be used to restore the project?

Show answer & explanation

Answer: Execute `gcloud projects undelete analytics-prod-102` within the 30-day recovery window.

Answer

Execute the command `gcloud projects undelete analytics-prod-102` before the 30-day soft-deletion recovery window expires.
When a Google Cloud project is shut down, it is marked for deletion and enters a 30-day grace period. During this time, the project can be recovered along with its resources by executing the `gcloud projects undelete [PROJECT_ID]` command.

Step-by-Step Solution

1
Identify the current lifecycle state of the shut-down project.
Confirm that the project was shut down less than 30 days ago and is currently in the `DELETE_REQUESTED` state.
Google Cloud holds deleted projects in a soft-deleted state for 30 days before permanent purging.
2
Execute the restoration command using the Google Cloud CLI.
Run `gcloud projects undelete analytics-prod-102`.
The `gcloud projects undelete` command reverses the shutdown process and restores the project and its resources to active status.

Key Concept

Project Lifecycle Management and Restoration
Question 1578Question →

An e-commerce platform needs to store daily financial transaction audit logs in Google Cloud Storage for compliance purposes. The compliance policy requires logs to be accessed frequently for the first 30 days for auditing, rarely accessed over the next 365 days, and preserved for 5 years total before deletion. The architecture team wants to minimize total storage and retrieval costs automatically without manual intervention. Which TWO configurations should you combine to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create a bucket with the default storage class set to Standard.; Configure an Object Lifecycle Management rule to transition objects to Coldline storage after 30 days and delete them after 1,825 days.

Answer

The optimal solution is to set the bucket's default storage class to Standard and configure Object Lifecycle Management rules to transition objects to Coldline storage after 30 days and delete objects after 1,825 days (5 years).
Selecting Standard storage as the default class ensures that frequent reads during the first 30 days do not incur retrieval penalties. Configuring Object Lifecycle Management to transition objects to Coldline after 30 days and delete them after 1,825 days automatically lowers long-term storage costs while adhering to the 5-year compliance retention requirement.

Step-by-Step Solution

1
Select the initial bucket storage class based on immediate access patterns.
Standard storage is chosen because data is accessed frequently during the initial 30-day auditing window, avoiding retrieval costs.
Choosing a lower storage tier initially (like Coldline or Archive) would incur high retrieval fees during frequent reads.
2
Configure Object Lifecycle Management rules for automated tiering and deletion.
A lifecycle rule transitions data to Coldline after 30 days and deletes objects after 5 years (1,825 days).
Coldline provides lower monthly storage fees for data accessed less than once a month, while automated deletion satisfies the compliance lifecycle.

Key Concept

Planning Cloud Storage Buckets and Storage Classes using Object Lifecycle Management
Question 1579Question →

An engineer needs to deploy a Global External HTTP Load Balancer in Google Cloud using gcloud CLI commands. Arrange the following deployment steps in the correct dependency order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for configuring a Global External HTTP Load Balancer is: 1) Create a health check, 2) Create a backend service and attach backends and health checks, 3) Create a URL map, 4) Create a target HTTP proxy, and 5) Create a global forwarding rule.
Deploying a Global External HTTP Load Balancer in Google Cloud follows a strict bottom-up dependency hierarchy. First, health checks are created to monitor backend instance health. Second, a backend service is created, binding instance groups and the health check. Third, a URL map is defined to route requests to the backend service. Fourth, a target HTTP proxy is created to reference the URL map. Finally, a global forwarding rule is established to map an external IP and port to the target proxy.

Step-by-Step Solution

1
Define the monitoring baseline for backend instances.
A HTTP health check resource is created in Google Cloud.
Backend services depend on existing health checks to evaluate instance health.
2
Construct the backend service container.
A backend service resource is created with backend instance groups and health check associated.
URL maps require a target backend service to route traffic.
3
Configure HTTP routing logic.
A URL map resource is created pointing to the backend service as default routing target.
Target proxies require a URL map to process request path rules.
4
Create the HTTP proxy handler.
A target HTTP proxy resource is created referencing the URL map.
Forwarding rules require a target proxy to receive incoming connections.
5
Expose the load balancer publicly.
A global forwarding rule is created linking the external IP address to the target proxy.
This completes the request path from client frontend to backend instances.

Key Concept

GCP Global External HTTP Load Balancer Deployment Hierarchy
Question 1580Question →

An enterprise cloud engineering team is evaluating Google Cloud database solutions and persistent block storage types for an infrastructure modernization project. Match each storage or database service on the left to the corresponding workload architecture requirement on the right.

Click a left item, then click its matching right item

Items

Cloud Spanner
Cloud Bigtable
Persistent Disk Balanced (pd-balanced)
Local SSD

Matches

Show answer & explanation

Answer

Cloud Spanner matches globally distributed relational ACID requirements; Cloud Bigtable matches high-throughput NoSQL time-series workloads; Persistent Disk Balanced matches cost-effective SSD general-purpose block storage; Local SSD matches ephemeral physically attached scratch storage.
Each service aligns directly with its fundamental design characteristics: Cloud Spanner handles global relational transactions; Cloud Bigtable provides scalable NoSQL high-throughput storage; pd-balanced delivers cost-effective durable block storage; Local SSD supplies ultra-fast ephemeral host storage.

Step-by-Step Solution

1
Identify the database requirements involving multi-region relational SQL and strict ACID transactions.
Map Cloud Spanner to the requirement for globally distributed ACID relational data.
Cloud Spanner is designed specifically for global scale while maintaining full relational capabilities and ACID transactions.
2
Identify high-throughput NoSQL ingestion and time-series analytical needs.
Map Cloud Bigtable to the low-latency high-throughput NoSQL requirement.
Bigtable handles massive throughput and large-scale NoSQL data with low latency.
3
Differentiate between durable network-attached block storage and ephemeral host-attached storage.
Map pd-balanced to general-purpose enterprise virtual machine storage and Local SSD to high-performance temporary scratch storage.
pd-balanced offers durable network block storage with balanced IOPS/cost, whereas Local SSD provides host-bound ephemeral performance.

Key Concept

Selecting GCP Managed Databases and Block Storage Options
PreviousPage 79 / 80Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin