All practice questions
1591 questions
An organization needs to deploy a Compute Engine virtual machine instance to run an automated batch data-cleansing job every evening. The job saves checkpoint state incrementally to Cloud Storage, allowing it to safely resume if interrupted. The primary requirement is to minimize compute costs for this batch workload. Which instance configuration should the cloud engineer use?
An enterprise organization maintains a Google Cloud resource hierarchy containing an Organization root node, a Production Folder, and several workload projects. An Organization Policy enforcing the `constraints/compute.vmExternalIpAccess` constraint with a policy rule set to `Deny All` is applied at the Organization root. A security administrator must enable virtual machines in one specific project (`Project-Web`), located under the Production Folder, to be assigned external IP addresses, while ensuring that all other existing and future projects in the hierarchy remain restricted from allocating external IPs. Which TWO statements correctly describe how Organization Policies and IAM permissions must be configured to achieve this architecture?
Select all that apply
A system administrator needs to deploy a new Compute Engine virtual machine instance named `analytics-node-1` in zone `us-central1-a` using the `gcloud` CLI. The instance must run using a custom service account named `[email protected]`. To adhere to Google Cloud security best practices, access control should be strictly managed by the IAM roles assigned to the service account rather than restricted by access scopes. Which `gcloud compute instances create` command correctly configures the instance with these access settings?
A DevOps engineer is configuring a Python application running on a Compute Engine virtual machine in project `project-app`. The application must read log objects stored in a Cloud Storage bucket named `analytics-data-archive` located in project `project-data`. Following Google Cloud security best practices and the principle of least privilege, which TWO actions should be performed to configure access for the virtual machine?
Select all that apply
An operations team is scaling up an application running on Google Compute Engine in region us-central1 to accommodate seasonal traffic. When attempting to increase the target size of the Managed Instance Group (MIG), the operation fails with a vCPU QUOTA_EXCEEDED error. Which action should the team take to successfully increase the compute capacity in us-central1?
A DevOps team configures a central Cloud Storage bucket named `invoice-processing-2026` to store incoming billing documents. To comply with corporate security standards, Uniform Bucket-Level Access (UBLA) has been enabled on the bucket. Shortly after, an automated data ingestion script fails with a permissions error when attempting to upload a document while specifying a fine-grained object Access Control List (ACL). Which action should the cloud engineer take to enable successful uploads while maintaining compliance with the security policy?
A cloud administrator is tasked with setting up telemetry collection and long-term analytics for a fleet of Compute Engine virtual machines. The requirements state that custom application log files must be exported to BigQuery for analytical querying, and host-level system metrics must be continuously monitored in Cloud Monitoring. Which TWO actions must the administrator perform to satisfy these operational requirements?
Select all that apply
An internal investigation team needs to analyze Cloud Audit Logs for a critical Google Cloud project. The team members require read-only access to inspect both standard Admin Activity logs (such as resource creation and configuration changes) and sensitive Data Access audit logs (such as object reads in Cloud Storage) within Logs Explorer. To adhere strictly to the principle of least privilege, which predefined IAM roles must be assigned to the team? (Select TWO answers.)
Select all that apply
A software engineering team is deploying a containerized microservice on a Compute Engine VM instance in the `finance-prod` project. The microservice needs permission to write log entries to Cloud Logging. Google Cloud security policies require following the principle of least privilege and avoiding long-lived credential exports for workloads hosted inside GCP. Which set of actions follows Google Cloud best practices to provision and grant access for this microservice?
A site reliability engineer (SRE) manages a web microservice deployed on Cloud Run. The team needs to track specific application error events appearing in the execution logs (`jsonPayload.errorCode = "ERR_DATABASE_TIMEOUT"`) and trigger automated notifications to a Webhook endpoint and a Pub/Sub topic whenever these errors exceed 10 occurrences within a 5-minute period. Which TWO steps should the engineer perform to implement this observability requirement in Google Cloud? (Select TWO.)
Select all that apply
An organization configures a Cloud Logging Log Router sink in an application project (`prod-app-project`) to route high-severity security logs to a Pub/Sub topic located in a centralized security project (`sec-audit-project`). After creating the sink, the engineer observes that log entries are not appearing in the Pub/Sub topic. Which configuration step must be performed to allow log entries to be successfully delivered to the destination?