All practice questions

1591 questions

Question 1581Question

An organization needs to deploy a Compute Engine virtual machine instance to run an automated batch data-cleansing job every evening. The job saves checkpoint state incrementally to Cloud Storage, allowing it to safely resume if interrupted. The primary requirement is to minimize compute costs for this batch workload. Which instance configuration should the cloud engineer use?

Show answer & explanation

Answer: Provision a Compute Engine VM with the Spot provisioning model (`--provisioning-model=SPOT`) and `--on-host-maintenance=TERMINATE`.

Answer

Provision a Compute Engine VM with the Spot provisioning model (`--provisioning-model=SPOT`) and host maintenance set to terminate.
Spot VMs offer substantial cost savings (typically 60-91% off standard prices) for workloads that are fault-tolerant and can resume from checkpoints if preempted by Google Cloud. When configuring Spot VMs, the host maintenance policy must be set to terminate.

Step-by-Step Solution

1
Analyze workload requirements
The job is a fault-tolerant batch process that saves state incrementally and prioritizes cost reduction.
Fault-tolerant batch jobs that can handle interruptions are prime candidates for Spot VMs.
2
Select appropriate GCP Compute Engine feature
Spot VMs (or Preemptible VMs) offer up to 60-91% discounts compared to standard pricing.
Google Cloud allows reclaim of excess capacity used by Spot VMs, making them significantly cheaper for interruption-tolerant tasks.
3
Verify host maintenance configuration for Spot VMs
Spot VMs require `--on-host-maintenance=TERMINATE`.
Spot instances cannot live migrate to another host during infrastructure maintenance events.

Key Concept

Deploying Spot/Preemptible Compute Engine Instances for Cost-Optimized Fault-Tolerant Workloads
Question 1582Question

An enterprise organization maintains a Google Cloud resource hierarchy containing an Organization root node, a Production Folder, and several workload projects. An Organization Policy enforcing the `constraints/compute.vmExternalIpAccess` constraint with a policy rule set to `Deny All` is applied at the Organization root. A security administrator must enable virtual machines in one specific project (`Project-Web`), located under the Production Folder, to be assigned external IP addresses, while ensuring that all other existing and future projects in the hierarchy remain restricted from allocating external IPs. Which TWO statements correctly describe how Organization Policies and IAM permissions must be configured to achieve this architecture?

Select all that apply

Show answer & explanation

Answer: An explicit Organization Policy must be applied directly at the `Project-Web` level to override the inherited parent constraint, setting rules to allow external IP allocation for that specific project.; Users or service accounts provisioning VM instances in `Project-Web` still require appropriate IAM roles (such as Compute Admin) because Organization Policies define guardrails rather than granting operational access permissions.

Answer

To allow external IP assignment on virtual machines in a single project while keeping all other projects restricted, an administrator must override the inherited constraint by configuring a policy directly at the target project level, and ensure principals possess requisite IAM roles since Organization Policies establish constraints rather than grant permissions.
The correct statements correctly identify the mechanism of policy inheritance and the distinction between IAM and Organization Policies. Child resource nodes (like specific projects) can explicitly override inherited parent list constraints to grant localized exemptions. Furthermore, Organization Policies set system boundaries and do not replace IAM roles, so users must still be granted proper IAM permissions to create resources.

Step-by-Step Solution

1
Analyze resource hierarchy evaluation for Organization Policies.
Realize that Organization Policies inherit downward from Organization Root down through Folders to Projects.
By default, child resources inherit parent restrictions unless a specific policy rule is applied at the child level to override the inherited parent configuration.
2
Configure the project-level Organization Policy override.
Apply an explicit policy at the target project level for the external IP constraint to allow allocations for that project only.
Overriding the policy at the target project scope selectively opens external IP provisioning for that project while leaving the root constraint enforcing restriction across all other projects under the folder and root.
3
Evaluate the relationship between Organization Policies and IAM roles.
Verify that deployment principals hold appropriate Compute Engine IAM permissions.
Organization Policies function as declarative guardrails restricting resource configurations; they do not grant identity permissions to execute GCP API calls.

Key Concept

Organization Policy Hierarchy Inheritance and IAM Separation of Concerns
Question 1583Question

A system administrator needs to deploy a new Compute Engine virtual machine instance named `analytics-node-1` in zone `us-central1-a` using the `gcloud` CLI. The instance must run using a custom service account named `[email protected]`. To adhere to Google Cloud security best practices, access control should be strictly managed by the IAM roles assigned to the service account rather than restricted by access scopes. Which `gcloud compute instances create` command correctly configures the instance with these access settings?

Show answer & explanation

Answer: gcloud compute instances create analytics-node-1 --zone=us-central1-a --service-account=analytics-sa@my-project.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/cloud-platform

Answer

The command that uses --service-account=analytics-sa@my-project.iam.gserviceaccount.com along with --scopes=https://www.googleapis.com/auth/cloud-platform correctly attaches the custom service account while allowing IAM roles to control API access permissions.
The correct approach attaches the custom service account via the `--service-account` flag and grants it the `cloud-platform` access scope via `--scopes`. This ensures that GCP API access limits are not artificially restricted by legacy scopes, allowing the IAM roles assigned to the service account to determine exact permissions.

Step-by-Step Solution

1
Identify the CLI flag used to attach a custom service account to a Compute Engine VM instance
The correct flag is `--service-account=<SA_EMAIL>`.
The service account identity must be assigned directly at creation or instance update using its specific CLI flag.
2
Determine the recommended access scope setting for custom service accounts
Assign the `cloud-platform` scope (`https://www.googleapis.com/auth/cloud-platform`).
Google Cloud best practice recommends enabling full API access (`cloud-platform` scope) on the VM level and using IAM roles on the service account to enforce the principle of least privilege.

Key Concept

Attaching Service Accounts and Scopes to Compute Engine Instances
Question 1584Question

A DevOps engineer is configuring a Python application running on a Compute Engine virtual machine in project `project-app`. The application must read log objects stored in a Cloud Storage bucket named `analytics-data-archive` located in project `project-data`. Following Google Cloud security best practices and the principle of least privilege, which TWO actions should be performed to configure access for the virtual machine?

Select all that apply

Show answer & explanation

Answer: Attach a dedicated user-managed service account to the Compute Engine virtual machine instance.; Grant the user-managed service account the Storage Object Viewer role (`roles/storage.objectViewer`) on the `analytics-data-archive` bucket.

Answer

The correct configuration requires attaching a dedicated user-managed service account to the Compute Engine virtual machine and granting that service account the Storage Object Viewer role (`roles/storage.objectViewer`) directly on the specific Cloud Storage bucket.
Google Cloud security best practices dictate attaching a dedicated user-managed service account to the Compute Engine VM so that applications automatically authenticate via Application Default Credentials (ADC). Furthermore, applying the predefined Storage Object Viewer role (`roles/storage.objectViewer`) directly to the target bucket ensures cross-project access is granted strictly according to the principle of least privilege.

Step-by-Step Solution

1
Create and attach a user-managed service account to the Compute Engine instance.
The application automatically leverages Application Default Credentials (ADC) via the metadata server without needing explicit service account keys.
Running workloads inside Google Cloud infrastructure should utilize attached service accounts rather than long-lived service account JSON keys.
2
Grant the service account `roles/storage.objectViewer` on `gs://analytics-data-archive`.
The service account gains read access exclusively to the objects inside the target bucket in the secondary project.
Applying predefined IAM roles at the resource level enforces the principle of least privilege.

Key Concept

Cross-project service account access using attached service accounts and least-privilege resource-level role bindings.
Question 1585Question

An operations team is scaling up an application running on Google Compute Engine in region us-central1 to accommodate seasonal traffic. When attempting to increase the target size of the Managed Instance Group (MIG), the operation fails with a vCPU QUOTA_EXCEEDED error. Which action should the team take to successfully increase the compute capacity in us-central1?

Show answer & explanation

Answer: Submit an explicit quota increase request for Compute Engine vCPUs in region us-central1 through the Google Cloud Console or gcloud CLI.

Answer

Submitting an explicit quota increase request for Compute Engine vCPUs in region us-central1 through the Google Cloud Console or gcloud CLI is the correct approach.
When a Google Cloud resource expansion fails due to a QUOTA_EXCEEDED error, the standard and official procedure is to request a quota increase through the IAM & Admin > Quotas section of the Google Cloud Console or by using gcloud commands. Google Cloud evaluates quota requests based on project history and resource availability.

Step-by-Step Solution

1
Identify the cause of the operational failure during MIG expansion.
The operation failed because the project reached its regional vCPU quota limit in us-central1.
Google Cloud enforces quotas to prevent unexpected resource consumption and ensure system stability.
2
Select the appropriate resolution workflow according to GCP best practices.
Request a quota increase for the specific region and metric.
Quotas cannot be bypassed by network reconfiguration, IAM role modification, or instance type changes without having sufficient quota allocated.

Key Concept

Managing GCP resource quota limits and requesting quota increases for Compute Engine operational scaling.
Question 1586Question

A DevOps team configures a central Cloud Storage bucket named `invoice-processing-2026` to store incoming billing documents. To comply with corporate security standards, Uniform Bucket-Level Access (UBLA) has been enabled on the bucket. Shortly after, an automated data ingestion script fails with a permissions error when attempting to upload a document while specifying a fine-grained object Access Control List (ACL). Which action should the cloud engineer take to enable successful uploads while maintaining compliance with the security policy?

Show answer & explanation

Answer: Update the ingestion script to omit object-level ACL requests and ensure the service account is granted an appropriate IAM role, such as Storage Object Creator, on the bucket.

Answer

Update the ingestion script to omit object-level ACL requests and ensure the service account is granted an appropriate IAM role, such as Storage Object Creator, on the bucket.
Enabling Uniform Bucket-Level Access (UBLA) unifies access control under Cloud IAM and disables legacy per-object ACLs. To resolve upload failures caused by an application specifying object ACLs, the application code must be updated to upload objects without ACL parameters, and the service account must be granted an appropriate predefined IAM role (such as Storage Object Creator).

Step-by-Step Solution

1
Analyze the error context
Identify that Uniform Bucket-Level Access (UBLA) explicitly disables Access Control Lists (ACLs) across all objects in the bucket.
When UBLA is active, any attempt to set or modify fine-grained ACLs on objects causes an API error.
2
Remediate application client behavior
Remove flags or parameters requesting canned or specific ACLs from the upload request in the ingestion script.
Client applications must use standard object uploads without specifying object-level ACLs when target buckets enforce UBLA.
3
Verify and grant IAM access
Assign the predefined IAM role Storage Object Creator (roles/storage.objectCreator) or Storage Object Admin to the uploading service account.
IAM is the unified access control mechanism for buckets with Uniform Bucket-Level Access enabled.

Key Concept

Uniform Bucket-Level Access (UBLA) disables fine-grained Object ACLs in favor of centralized Cloud IAM policies.
Question 1587Question

A cloud administrator is tasked with setting up telemetry collection and long-term analytics for a fleet of Compute Engine virtual machines. The requirements state that custom application log files must be exported to BigQuery for analytical querying, and host-level system metrics must be continuously monitored in Cloud Monitoring. Which TWO actions must the administrator perform to satisfy these operational requirements?

Select all that apply

Show answer & explanation

Answer: Install and configure the unified Ops Agent on the Compute Engine instances to ingest system metrics and application logs from specified file paths.; Configure a Cloud Logging Log Router sink with an inclusion filter for the application logs, specifying a BigQuery dataset as the destination.

Answer

The administrator must install the unified Ops Agent on the Compute Engine instances to gather metrics and logs, and configure a Cloud Logging Log Router sink pointing to a BigQuery dataset with an inclusion filter matching the application logs.
To collect host metrics and application logs from Compute Engine virtual machines, Google Cloud recommends installing the unified Ops Agent. To route these logs to BigQuery for long-term analytics, a Cloud Logging Log Router sink must be configured with an inclusion filter targeting the application logs and specifying the BigQuery dataset as the sink destination.

Step-by-Step Solution

1
Deploy telemetry collection on virtual machines
System metrics and guest application log files are ingested into Cloud Monitoring and Cloud Logging.
The unified Google Cloud Ops Agent replaces legacy standalone agents and is recommended by Google Cloud for managing Compute Engine VM telemetry.
2
Configure log routing to BigQuery
Matching application logs are continuously exported to the designated BigQuery dataset.
Cloud Logging Log Router sinks evaluate incoming logs against inclusion filters and route them to analytics storage destinations like BigQuery.

Key Concept

Telemetry collection using the Google Cloud Ops Agent and long-term log export via Cloud Logging Log Router sinks.
Question 1588Question

An internal investigation team needs to analyze Cloud Audit Logs for a critical Google Cloud project. The team members require read-only access to inspect both standard Admin Activity logs (such as resource creation and configuration changes) and sensitive Data Access audit logs (such as object reads in Cloud Storage) within Logs Explorer. To adhere strictly to the principle of least privilege, which predefined IAM roles must be assigned to the team? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Logs Viewer (roles/logging.viewer); Private Logs Viewer (roles/logging.privateLogViewer)

Answer

The correct roles are Logs Viewer (roles/logging.viewer) and Private Logs Viewer (roles/logging.privateLogViewer).
Viewing standard Admin Activity audit logs requires Logs Viewer (roles/logging.viewer), while inspecting sensitive Data Access logs requires Private Logs Viewer (roles/logging.privateLogViewer). Combining these two specific predefined roles satisfies both viewing requirements without granting administrative or broad resource access.

Step-by-Step Solution

1
Identify the requirement for standard Admin Activity log inspection in Logs Explorer.
Assigning Logs Viewer (roles/logging.viewer) allows users to view standard log entries, including Admin Activity logs.
Standard audit logs do not contain private user payload data and are accessible via standard log viewing roles.
2
Identify the requirement for sensitive Data Access audit log inspection.
Assigning Private Logs Viewer (roles/logging.privateLogViewer) enables permission to view Data Access audit logs.
Data Access audit logs are explicitly restricted to prevent unauthorized viewing of sensitive read operations and require private log viewing privileges.
3
Evaluate least privilege against broader or administrative roles.
Avoid granting primitive Viewer or administrative roles like Logging Admin.
Administrative roles grant unnecessary write and configuration capabilities, while primitive roles grant excessive visibility into non-logging services.

Key Concept

Cloud Audit Logs access control requires combining Logs Viewer for standard Admin Activity logs and Private Logs Viewer for sensitive Data Access logs under least privilege.
Estimated Time:1m 30s
Question 1589Question

A software engineering team is deploying a containerized microservice on a Compute Engine VM instance in the `finance-prod` project. The microservice needs permission to write log entries to Cloud Logging. Google Cloud security policies require following the principle of least privilege and avoiding long-lived credential exports for workloads hosted inside GCP. Which set of actions follows Google Cloud best practices to provision and grant access for this microservice?

Show answer & explanation

Answer: Create a user-managed service account named `app-logger-sa`, grant it the `roles/logging.logWriter` predefined role on project `finance-prod`, and attach the service account to the Compute Engine VM instance.

Answer

Create a user-managed service account named `app-logger-sa`, grant it the `roles/logging.logWriter` predefined role on project `finance-prod`, and attach the service account to the Compute Engine VM instance.
The solution that creates a dedicated service account, assigns the narrow `roles/logging.logWriter` predefined role, and attaches it directly to the VM instance follows both least privilege and GCP identity security standards by using default instance metadata authentication rather than static key files.

Step-by-Step Solution

1
Identify the required identity type and role
A dedicated user-managed service account with the predefined `roles/logging.logWriter` role provides the exact minimum permissions required to write log entries.
Applying predefined roles instead of primitive roles enforces the security principle of least privilege.
2
Determine the authentication mechanism for GCP-hosted workloads
Attach the service account directly to the Compute Engine instance metadata service upon VM creation or update.
Workloads running on Google Cloud infrastructure obtain short-lived tokens automatically via the metadata server, eliminating the operational security risk of exported long-lived JSON keys.

Key Concept

Service Account Creation and Least-Privilege Identity Management
Estimated Time:1m 30s
Question 1590Question

A site reliability engineer (SRE) manages a web microservice deployed on Cloud Run. The team needs to track specific application error events appearing in the execution logs (`jsonPayload.errorCode = "ERR_DATABASE_TIMEOUT"`) and trigger automated notifications to a Webhook endpoint and a Pub/Sub topic whenever these errors exceed 10 occurrences within a 5-minute period. Which TWO steps should the engineer perform to implement this observability requirement in Google Cloud? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a counter log-based metric in Cloud Logging using a log filter matching the specific error code.; Create a Cloud Monitoring alerting policy based on the log-based metric threshold and configure Webhook and Pub/Sub notification channels.

Answer

To measure log occurrence frequencies and trigger automated alerts in Google Cloud, the engineer must create a counter log-based metric in Cloud Logging filtered for the specific error payload, and then configure a Cloud Monitoring alerting policy targeting that metric with the appropriate notification channels attached.
Creating a counter log-based metric extracts numerical data from matching log patterns, allowing Cloud Monitoring to evaluate the occurrence rate. Setting up an alerting policy tied to this metric triggers notifications to configured Webhook and Pub/Sub channels when the count threshold is exceeded within the 5-minute window.

Step-by-Step Solution

1
Define a filter in Cloud Logging for the target log entries and extract them as a metric.
A counter log-based metric named after the error is created in Cloud Logging.
Log-based metrics convert log data matching specific query filters into numeric metric time-series data readable by Cloud Monitoring.
2
Configure an alerting policy in Cloud Monitoring.
An alert condition monitors the counter metric, triggering when count > 10 over a 5-minute rolling window.
Cloud Monitoring alerting policies evaluate metric thresholds and route incident alerts to configured Webhook and Pub/Sub notification channels.

Key Concept

Log-based metrics bridge Cloud Logging and Cloud Monitoring by converting specific log search patterns into numerical time-series metrics suitable for alerting policies.
Question 1591Question

An organization configures a Cloud Logging Log Router sink in an application project (`prod-app-project`) to route high-severity security logs to a Pub/Sub topic located in a centralized security project (`sec-audit-project`). After creating the sink, the engineer observes that log entries are not appearing in the Pub/Sub topic. Which configuration step must be performed to allow log entries to be successfully delivered to the destination?

Show answer & explanation

Answer: Copy the writer identity service account generated by the Log Router sink and grant it the Pub/Sub Publisher role on the Pub/Sub topic in `sec-audit-project`.

Answer

The Log Router sink's unique writer identity service account must be granted the Pub/Sub Publisher role on the destination topic in the centralized security project.
When a Log Router sink is created in Google Cloud Logging, it generates a unique service account called a writer identity. For cross-project log routing to a Pub/Sub topic, this specific service account must explicitly be granted the Pub/Sub Publisher role on the target topic in the destination project.

Step-by-Step Solution

1
Identify the service account identity assigned to the Log Router sink.
Obtained the unique writer identity string (e.g., `serviceAccount:[email protected]`).
Log Router sinks use dedicated service accounts to write logs to destinations, especially when routing logs across projects.
2
Navigate to the destination resource in the central auditing project and update IAM policy bindings.
The Pub/Sub Publisher role (`roles/pubsub.publisher`) is granted to the sink's writer identity on the target Pub/Sub topic.
Cross-project log exporting requires explicit IAM permissions for the sink's writer identity on the destination resource in the receiving project.

Key Concept

Cloud Logging Log Router Sinks and Cross-Project Writer Identity Permissions
PreviousPage 80 / 80
All practice questions — Google Cloud Associate Cloud Engineer | Examkin