Examkin

All practice questions

491 questions

All types1,591Multiple choice816Multiple select491Numeric12Matching10Ordering262
Question 1Question →

An organization is evaluating Google Cloud compute solutions for two newly developed application components:
1. An overnight data transformation batch job that is stateless, fault-tolerant, and capable of resuming progress if interrupted.
2. A containerized HTTP microservice that experiences unpredictable traffic bursts and requires scaling down to zero when idle to minimize compute expenses.

Which TWO deployment options should the Cloud Engineer select to satisfy these requirements while optimizing costs and minimizing operational overhead? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision Compute Engine Spot VMs for the overnight batch job.; Deploy the containerized HTTP microservice on Cloud Run.

Answer

Select the option to provision Compute Engine Spot VMs for the overnight batch job and the option to deploy the containerized HTTP microservice on Cloud Run.
Compute Engine Spot VMs offer substantial discounts for workloads that are stateless and fault-tolerant, such as nightly batch processing. Cloud Run allows containerized HTTP applications to run in a fully managed serverless environment that automatically scales down to zero instances when idle, fulfilling both operational efficiency and cost targets.

Step-by-Step Solution

1
Analyze the requirements for Component 1 (nightly batch job).
Identified as fault-tolerant, stateless, and interrupted-safe.
Fault-tolerant batch jobs should leverage Compute Engine Spot VMs to maximize cost savings.
2
Analyze the requirements for Component 2 (HTTP microservice).
Identified as a containerized web service with bursty traffic requiring scale-to-zero capability.
Cloud Run provides serverless container hosting that automatically scales down to zero instances during idle periods with no node management.

Key Concept

Selecting GCP compute solutions based on workload fault tolerance, containerization, and scaling characteristics.
Question 2Question →

An enterprise logistics company is redesigning its Google Cloud container infrastructure to support two distinct workload profiles. The first profile consists of stateless web APIs that experience highly variable traffic, where the operations team requires zero node management responsibility and pod-level SLA guarantees. The second profile consists of a batch analytics engine executing fault-tolerant, short-lived jobs that require deep customization of worker node kernel parameters (sysctl) and maximum cost reduction. Which TWO GKE cluster architecture decisions should the cloud architect implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision a GKE Autopilot cluster for the stateless web APIs to offload node configuration, maintenance, and node autoscaling to Google.; Provision a GKE Standard cluster with a Spot VM node pool configured with custom sysctl settings for the batch analytics engine.

Answer

The correct decisions are to deploy a GKE Autopilot cluster for the stateless web APIs and a GKE Standard cluster with a Spot VM node pool featuring custom sysctl configurations for the batch analytics engine.
Deploying GKE Autopilot for the stateless web APIs fulfills the zero node management overhead requirement, as Google manages the underlying nodes. Deploying GKE Standard with a Spot VM node pool for the batch analytics engine permits custom sysctl kernel configurations while minimizing compute costs for fault-tolerant workloads.

Step-by-Step Solution

1
Analyze the operational requirements for the stateless web APIs.
The requirements demand zero node management overhead and automated node maintenance. GKE Autopilot completely manages underlying infrastructure, making it the ideal fit.
GKE Autopilot abstracts node management away from the operator while guaranteeing pod-level SLAs.
2
Analyze the technical requirements for the batch analytics engine.
The batch analytics engine requires custom sysctl kernel configurations and maximum cost optimization for fault-tolerant workloads.
Custom node-level sysctl configurations require GKE Standard, while Spot VMs supply deep discounts for fault-tolerant compute.
3
Evaluate architectural separation.
Combining both requirements into Autopilot fails because Autopilot blocks custom node kernel modifications. Standard is required for node OS level customization.
Operational boundaries in Autopilot enforce strict security constraints preventing node-level privileged modifications.

Key Concept

Selecting between GKE Autopilot and GKE Standard based on node OS customization boundaries and choosing Spot VMs for cost-sensitive, fault-tolerant workloads.
Estimated Time:3m 0s
Question 3Question →

An enterprise application produces daily operation logs that require frequent, immediate access for troubleshooting during the first 14 days. After 14 days, the logs are accessed infrequently for routine audits for another 90 days before being deleted. Which Cloud Storage configuration actions should be planned to optimize costs and performance? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Set the default storage class of the bucket to Standard Storage to accommodate initial frequent access without incurring retrieval fees.; Configure an Object Lifecycle Management rule to transition objects to Nearline Storage after 14 days.

Answer

The correct configurations are setting the initial bucket class to Standard Storage and creating an Object Lifecycle Management rule to transition objects to Nearline Storage after 14 days.
Standard Storage handles active troubleshooting during the first 14 days without retrieval charges. Transitioning to Nearline Storage after 14 days via Object Lifecycle Management lowers storage costs for infrequently audited data while adhering to storage lifecycle best practices.

Step-by-Step Solution

1
Analyze access frequency for the initial 14-day window.
Since logs are accessed frequently for active troubleshooting, Standard Storage is selected to avoid data retrieval charges.
Standard Storage provides high availability and no retrieval fees for active data.
2
Analyze access frequency and retention requirements after 14 days.
Logs are accessed infrequently during the subsequent 90 days, making Nearline Storage (designed for access once a month or less with a 30-day minimum duration) the optimal choice.
Nearline Storage reduces monthly storage costs while keeping retrieval fees minimal for occasional audit queries.
3
Automate storage class transition.
An Object Lifecycle Management action condition (Age = 14 days) automates the transition from Standard to Nearline Storage.
Lifecycle rules eliminate manual management overhead for object state transitions.

Key Concept

Selecting Cloud Storage classes based on access frequency and setting Object Lifecycle Management rules for automated tier transitions.
Question 4Question →

A DevOps engineer is deploying a newly containerized Flask web application named `inventory-api` to Google Cloud Run using the `gcloud run deploy` command. The application is configured to listen internally on TCP port 5000 rather than the standard default port. The application needs to be accessible directly from the public internet without requiring IAM authentication header tokens. Which two configuration actions or `gcloud` command flags must be used to successfully deploy this service? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Include the `--port=5000` flag during deployment to direct Cloud Run routing to the application's listening port.; Include the `--allow-unauthenticated` flag during deployment to enable public HTTP access.

Answer

To successfully deploy the containerized web application to Cloud Run with public access and custom port routing, you must use the `--port=5000` flag to inform Cloud Run which port the container receives requests on, and use the `--allow-unauthenticated` flag to allow public ingress without authentication.
Deploying containerized applications to Cloud Run requires configuring container ingress port contract and access control. Specifying the flag `--port=5000` ensures Cloud Run routes incoming container requests to port 5000 where Flask is listening. Specifying `--allow-unauthenticated` allows public HTTP clients to invoke the Cloud Run URL without providing GCP authentication credentials.

Step-by-Step Solution

1
Identify container port routing requirements.
Cloud Run injects the `PORT` environment variable (default 8080). If the application listens on port 5000, passing `--port=5000` sets `PORT=5000` and configures ingress traffic to target port 5000.
If Cloud Run attempts to send requests to 8080 while the process listens on 5000, startup probes will fail.
2
Identify public access invocation requirements.
Adding `--allow-unauthenticated` configures IAM policy bindings on the deployed service to allow `allUsers` invocation.
By default, new Cloud Run services require IAM authentication headers unless unauthenticated invocations are explicitly allowed.

Key Concept

Cloud Run Container Port Binding and Ingress Access Control
Estimated Time:1m 30s
Question 5Question →

A cloud engineer is deploying a custom-mode Virtual Private Cloud (VPC) network named `corp-network` in Google Cloud to host multi-region microservices. The engineer needs to configure subnets in `us-central1` and `europe-west1` and ensure that internal Compute Engine virtual machines across these subnets can communicate with each other over TCP port 8080. Which TWO configurations accurately reflect Google Cloud VPC subnet and firewall rule deployment behaviors? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Creating custom-mode subnets requires manually defining non-overlapping primary IPv4 CIDR ranges for each region, which can later be expanded without recreating the subnet.; Custom firewall ingress rules with priorities between 0 and 65534 must be explicitly created to allow internal TCP port 8080 traffic, because the implied ingress rule denies all incoming traffic.

Answer

Custom-mode subnets require manual definition of non-overlapping primary IPv4 ranges that can be expanded later, and custom ingress firewall rules with higher precedence (0-65534) must be created to allow port 8080 traffic because VPC networks feature an implied deny-all ingress rule.
The correct responses state that custom-mode VPC subnets require manual definition of non-overlapping IP ranges (which can be expanded later) and that explicit ingress firewall rules (priority 0-65534) are required to allow internal port 8080 traffic due to the implied deny-all ingress rule.

Step-by-Step Solution

1
Evaluate custom-mode VPC subnet provisioning requirements.
Identify that custom-mode VPC networks do not generate automatic subnets per region; subnets must be created manually with explicit, non-overlapping IP ranges.
Unlike auto-mode VPC networks which automatically create subnets in all regions, custom-mode VPC networks give full control to administrators to define subnets as required.
2
Evaluate default VPC firewall behavior for ingress communication.
Determine that an explicit ingress firewall rule allowing TCP port 8080 must be deployed.
Google Cloud VPC networks contain an implied 'deny all ingress' rule at priority 65535. Any incoming traffic, even between subnets in the same VPC, requires an explicit allow rule with higher priority (lower numerical value).

Key Concept

Deploying custom VPC networks, subnet expansion rules, and VPC firewall rule evaluation precedence.
Estimated Time:1m 30s
Question 6Question →

An organization is deploying a multi-region workload in a custom-mode Virtual Private Cloud (VPC) network named `analytics-vpc`. Compute Engine virtual machines without external public IP addresses are located in `us-east4` (tagged `db-backend`) and `europe-west1` (tagged `app-frontend`). The security policy requires that `db-backend` instances accept incoming TCP traffic on port 5432 exclusively from `app-frontend` instances. Additionally, all virtual machines must be able to reach Google Cloud service endpoints without being assigned public IP addresses. Which TWO configuration steps are required to implement this architecture? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Private Google Access on the subnets containing the virtual machines.; Create an ingress firewall rule specifying target tag `db-backend`, source tag `app-frontend`, protocol TCP, and port 5432 with an allow action.

Answer

The two required configuration steps are enabling Private Google Access on the subnets and creating an ingress firewall rule targeting 'db-backend' with source tag 'app-frontend' for TCP port 5432.
Enabling Private Google Access on subnets allows VM instances with only private internal IP addresses to reach Google Cloud APIs and services. Creating an ingress firewall rule with target tag 'db-backend' and source tag 'app-frontend' for TCP port 5432 correctly restricts traffic between the front-end and database instances according to security requirements.

Step-by-Step Solution

1
Enable Private Google Access at the subnet level
Virtual machine instances without external IP addresses can reach Google APIs and services using internal routes.
By default, instances without external IPs cannot reach public Google service endpoints unless Private Google Access is enabled on their subnet.
2
Configure an ingress VPC firewall rule using network tags
Only instances tagged with 'app-frontend' are permitted to send TCP traffic on port 5432 to instances tagged with 'db-backend'.
GCP firewall rules evaluate ingress traffic based on target and source tags, ensuring least-privilege network isolation.

Key Concept

VPC Subnet Private Google Access & Firewall Network Tag Rules
Question 7Question →

A cloud administrator needs to configure access for an external automated pipeline running on a self-hosted server so that it can read log files stored in a Cloud Storage bucket named `analytics-logs`. To comply with company security policies, the administrator must set up a dedicated user-managed service account using short-lived credentials via service account impersonation rather than using long-lived exported JSON keys.

Which of the following steps must the administrator take to implement this configuration securely? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a user-managed service account within the project housing the Cloud Storage bucket.; Grant the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the service account to the external pipeline's authenticated identity.

Answer

The administrator must create a user-managed service account in the GCP project hosting the storage bucket, and grant the Service Account Token Creator role on that service account to the external workload's identity.
To grant access via impersonation without static keys, an administrator creates a dedicated user-managed service account in the GCP project and grants the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on that service account to the calling identity. This allows the calling identity to mint short-lived security tokens dynamically.

Step-by-Step Solution

1
Provision a user-managed service account in the GCP project where the resources reside.
Establishes a dedicated GCP identity specifically for the external workload.
Dedicated service accounts allow precise role bindings and auditing for specific applications.
2
Assign the Service Account Token Creator role on the service account to the external identity.
Enables short-lived token generation via IAM service account impersonation.
Short-lived tokens eliminate the security risks associated with static long-lived key exports.

Key Concept

Creating User-Managed Service Accounts & Service Account Impersonation
Estimated Time:1m 30s
Question 8Question →

An organization requires a centralized observability strategy across multiple Google Cloud projects. The compliance team mandates aggregating all Cloud Audit Logs from every project into a single Cloud Storage bucket for long-term retention. Additionally, the operations team needs to collect guest operating system memory utilization telemetry from a fleet of Compute Engine instances and trigger alerts if memory usage exceeds threshold limits. Which TWO steps should the cloud engineer implement to satisfy these operational requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an aggregated Log Router sink at the organization level with an inclusion filter for audit logs, designating the centralized Cloud Storage bucket as the sink destination.; Install the Google Cloud Ops Agent on all Compute Engine instances and configure a Cloud Monitoring alerting policy based on the agent's memory utilization metric.

Answer

To meet both compliance and telemetry requirements, the engineer must create an aggregated Log Router sink at the organization level targeting the centralized Cloud Storage bucket, and install the Google Cloud Ops Agent on Compute Engine instances to collect memory metrics for alerting policies.
The solution requires two distinct actions: organization-level log routing and guest OS metric collection. An aggregated Log Router sink configured at the organization node automatically captures audit logs from all underlying projects into a single Cloud Storage bucket. Meanwhile, guest OS memory usage is not visible to the hypervisor by default, so installing the Google Cloud Ops Agent on the virtual machines is required to send memory metrics to Cloud Monitoring for alerting.

Step-by-Step Solution

1
Configure centralized audit log aggregation
An aggregated Log Router sink at the organization scope captures audit logs from all current and future projects and routes them to Cloud Storage.
Organization-level aggregated sinks remove the maintenance overhead of configuring individual sinks per project.
2
Deploy telemetry agent for OS-level metrics
The Ops Agent collects system metrics such as RAM utilization from inside the virtual machine operating system.
Hypervisor-level telemetry cannot inspect guest memory usage without an in-guest agent.
3
Set up alerting policies in Cloud Monitoring
Alerting policies monitor the Ops Agent memory utilization metric and trigger notifications when the specified threshold is exceeded.
Cloud Monitoring alerting policies actively notify operations teams when telemetry metrics cross predefined operational boundaries.

Key Concept

Centralized Log Router Sinks and Ops Agent Telemetry Collection
Question 9Question →

A financial analytics firm is planning the compute deployment on Google Compute Engine for two distinct workloads:

1. Workload 1: A stateless Monte Carlo risk simulation engine that runs overnight batch jobs. The application is highly fault-tolerant and saves state checkpoints every 5 minutes.
2. Workload 2: A core customer backend service operating continuous 24/7 traffic with precise memory demands requiring 8 vCPUs and 52 GB of RAM to prevent memory spilling.

Which TWO machine type selection and provisioning strategies should the Cloud Engineer implement to optimize cost and performance for these workloads? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Provision Workload 1 using Spot Virtual Machines (Spot VMs) to obtain deep discounts for fault-tolerant, interruptible batch processing.; Configure Workload 2 on an N2 custom machine type with 8 vCPUs and 52 GB RAM, and purchase a 1-year or 3-year Committed Use Discount (CUD) for predictable resource usage.

Answer

The Cloud Engineer should provision Workload 1 using Spot VMs for cost-effective batch execution, and deploy Workload 2 on a custom N2 machine type (8 vCPUs, 52 GB RAM) backed by Committed Use Discounts (CUDs).
Stateless, checkpointed batch jobs are perfectly suited for Spot VMs because they can tolerate interruptions in exchange for massive price reductions. Meanwhile, 24/7 production workloads with precise CPU-to-memory needs benefit from custom machine types to avoid over-provisioning, paired with Committed Use Discounts to secure the maximum possible savings on predictable baseline usage.

Step-by-Step Solution

1
Analyze the requirements for Workload 1
Workload 1 is stateless, checkpointed, and runs batch operations overnight. These characteristics make it ideal for Spot VMs, which offer deep discounts in exchange for preemptibility.
Fault-tolerant batch jobs do not require continuous SLA guarantees and can resume work after preemptions.
2
Analyze the requirements for Workload 2
Workload 2 requires custom resource sizing (8 vCPUs, 52 GB RAM) and continuous 24/7 operation.
Standard machine types (such as n2-standard-8 with 32 GB RAM or n2-highmem-8 with 64 GB RAM) would either lack sufficient RAM or waste paid capacity. Custom machine types fit the exact workload requirements.
3
Determine the optimal pricing model for continuous baseline usage
Purchasing a 1-year or 3-year Committed Use Discount (CUD) provides significantly higher cost reductions than relying on automatic Sustained Use Discounts.
CUDs commit to resource usage for 1 or 3 years in exchange for maximum predictable pricing reductions on baseline compute.

Key Concept

Compute Engine Machine Type Selection and Pricing Model Optimization
Question 10Question →

An organization is designing a high-throughput video processing service on Compute Engine. The processing application is stateless, fault-tolerant, and designed to auto-resume from checkpoints if interrupted. Benchmark testing indicates that each processing worker node performs optimally when allocated exactly 14 vCPUs14\text{ vCPUs} and 28 GB28\text{ GB} of RAM. Standard predefined machine types with 14 vCPUs14\text{ vCPUs} are unavailable, and larger predefined instances would result in significant unused vCPU and memory capacity. Which TWO architectural and provisioning strategies should the cloud engineering team select to optimize cost and resource utilization? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure Custom Machine Types specifying 14 vCPUs14\text{ vCPUs} and 28 GB28\text{ GB} of RAM for the Compute Engine instance templates.; Deploy the worker instances using Spot VMs within a Managed Instance Group (MIG).

Answer

The team should configure Custom Machine Types with 14 vCPUs14\text{ vCPUs} and 28 GB28\text{ GB} of RAM, and deploy the instances using Spot VMs inside a Managed Instance Group.
The correct strategy involves two steps: First, configuring Custom Machine Types allows provisioning exact custom core counts (14 vCPUs14\text{ vCPUs}) and memory allocations (28 GB28\text{ GB}), eliminating the waste of upgrading to a 16-vCPU16\text{-vCPU} predefined instance. Second, since the workload is stateless and checkpointed, deploying on Spot VMs within a Managed Instance Group yields maximum cost savings while preserving operational resiliency.

Step-by-Step Solution

1
Analyze resource ratio requirements
The target requirement is 14 vCPUs14\text{ vCPUs} and 28 GB28\text{ GB} of RAM (2 GB2\text{ GB} per vCPU). Predefined types jump from 8 to 16 vCPUs. Creating a Custom Machine Type avoids paying for unneeded vCPUs and memory.
Custom Machine Types allow customized vCPU and memory combinations in increments allowed by the machine family.
2
Evaluate workload fault tolerance for cost optimization
Because the video processing workload is stateless, checkpointed, and fault-tolerant, it can handle VM preemptions without data loss.
Spot VMs provide significant cost reductions (60-91%) for fault-tolerant batch workloads.

Key Concept

Compute Engine Custom Machine Types and Spot VM Suitability
Question 11Question →

A financial analytics firm is designing a cost-effective Google Cloud compute environment for two distinct workloads:

1. A nightly batch calculation task that is fully fault-tolerant, can resume from checkpoints if interrupted, requires specific custom OS kernel modules, and runs for 6 hours.
2. An event-driven microservice that receives unpredictable HTTP webhooks throughout the day and requires scaling down to zero instances during idle periods with minimal management overhead.

Which TWO compute configurations should the engineering team select to satisfy these operational and architectural requirements?

Select all that apply

Show answer & explanation

Answer: Deploy Compute Engine Spot VM instances configured with a custom VM image for the nightly batch calculation task.; Deploy Cloud Run to host the event-driven microservice receiving unpredictable HTTP webhooks.

Answer

Select Compute Engine Spot VMs with custom images for the fault-tolerant batch task requiring custom kernel modules, and select Cloud Run for the HTTP webhook microservice that needs automatic scale-to-zero capabilities.
Compute Engine Spot VMs offer up to 90% cost reduction for fault-tolerant jobs while permitting full OS kernel customization. Cloud Run provides zero-management HTTP container execution with automatic scale-to-zero capabilities.

Step-by-Step Solution

1
Analyze the workload requirements for the nightly batch calculation.
The task runs for 6 hours, is fault-tolerant/checkpointable, and requires custom OS kernel modules.
Fault-tolerant batch processing aligns with Spot VMs for maximum cost savings, and OS kernel customization requires Compute Engine Virtual Machines where full OS access is permitted.
2
Analyze the requirements for the event-driven microservice.
The service handles unpredictable HTTP webhooks, requires scaling down to zero when idle, and demands low operational overhead.
Cloud Run natively supports containerized HTTP requests, scales down to zero automatically during idle windows, and abstracts server management.
3
Evaluate why alternative compute options fail the specified constraints.
GKE Autopilot restricts OS kernel customization; Cloud Functions cannot run 6-hour jobs due to timeout limits; 3-year Committed Use Discounts incur unnecessary continuous costs for intermittent 6-hour daily jobs.
Architectural trade-offs dictate selecting service boundaries matched strictly to statefulness, execution duration, and OS customization level.

Key Concept

Selecting GCP compute services based on OS access requirements, workload fault tolerance, execution time limits, and autoscaling characteristics.
Estimated Time:2m 30s
Question 12Question →

An enterprise telemetry team is designing a serverless architecture on Google Cloud to handle two distinct workload components:

1. An HTTP webhook ingestion endpoint that receives high-concurrency bursty web traffic and depends on a custom compiled C++ shared library binary.
2. An event-driven data transformation pipeline that processes incoming files uploaded to Cloud Storage, where individual file transformation runs take up to 25 minutes to complete.

You need to recommend a serverless compute architecture that minimizes operational overhead while satisfying all technical limits and runtime dependencies. Which TWO architectural decisions should you recommend? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Deploy the HTTP webhook ingestion service to Cloud Run using a custom container image configured to handle multiple concurrent requests per instance.; Deploy the 25-minute data transformation workload to Cloud Run triggered asynchronously by Cloud Storage object creation events via Eventarc.

Answer

The correct architecture uses Cloud Run with a custom container image for the HTTP webhook service to support multi-concurrency and native C++ binary dependencies, and uses Cloud Run triggered via Eventarc for the 25-minute Cloud Storage data transformation pipeline to exceed the 9-minute event-driven function limit.
The design correctly pairs Cloud Run with both requirements: first, Cloud Run accepts custom container images containing custom compiled binary dependencies (like C++) while allowing request concurrency per instance; second, Cloud Run supports request/task timeouts up to 60 minutes when invoked asynchronously via Eventarc for Cloud Storage events, bypassing the 9-minute event timeout restriction of Cloud Functions.

Step-by-Step Solution

1
Analyze requirement 1 (HTTP webhook with C++ binary dependency and high concurrency)
Cloud Run allows packaging any runtime environment or binary inside a Docker container image and supports up to 1000 concurrent requests per container instance, making it ideal for high-throughput HTTP endpoints with custom system dependencies.
Cloud Functions zip deployments only support standard high-level language runtimes and do not support low-level custom compiled binaries or full OS environment customization.
2
Analyze requirement 2 (25-minute file processing triggered by Cloud Storage)
Event-driven Cloud Functions (both 1st and 2nd gen) have a hard maximum timeout limit of 9 minutes (540 seconds) for event triggers. Workloads exceeding 9 minutes triggered by Cloud Storage events must run on Cloud Run services or Cloud Run jobs via Eventarc, which support HTTP/event timeouts up to 60 minutes.
Attempting to configure a 30-minute timeout on an event-driven Cloud Function violates GCP platform quota boundaries.

Key Concept

Selecting Cloud Run vs Cloud Functions based on custom binary dependencies, concurrency capabilities, and event-driven timeout boundaries.
Estimated Time:3m 0s
Question 13Question →

An enterprise organization is setting up a centralized governance model in Google Cloud. A financial operations specialist needs to create new GCP projects within a specific organizational folder and associate those newly created projects with the company's master Cloud Billing account. The security policy mandates strict adherence to the principle of least privilege, preventing the user from managing billing account permissions, modifying organization policies, or gaining administrative control over existing projects. Which TWO Identity and Access Management (IAM) roles must be granted to the specialist to enable these actions? Select 2 options.

Select all that apply

Show answer & explanation

Answer: Billing Account User (roles/billing.user) on the target Cloud Billing account; Project Creator (roles/resourcemanager.projectCreator) on the target organizational Folder

Answer

To allow creating projects and linking them to a billing account under least-privilege access, grant the Billing Account User role on the Cloud Billing account and the Project Creator role on the parent Folder.
Linking a project to a Cloud Billing account requires two sets of rights: project-level permissions (granted automatically upon project creation to the creator) and billing account-level permissions. The Billing Account User role on the billing account grants permission to attach projects to that billing account, while the Project Creator role on the folder provides the ability to create projects within that folder scope.

Step-by-Step Solution

1
Identify the project creation requirement.
Creating new projects within a specific resource hierarchy container requires the Project Creator role (roles/resourcemanager.projectCreator) bound at the target Folder or Organization level.
This predefined role grants resourcemanager.projects.create permission without exposing broader folder management capabilities.
2
Identify the billing association requirement.
Linking a GCP project to a billing account requires permissions on both the billing account and the project.
The user automatically becomes Project Owner of newly created projects, giving them project-level billing permissions. To associate the project with the master billing account, they must explicitly hold the Billing Account User role (roles/billing.user) on that billing account.
3
Verify least-privilege constraints.
Combining Billing Account User on the billing account and Project Creator on the folder fulfills all operational requirements while preventing unauthorized administration.
Broader roles like Billing Account Administrator or primitive Owner roles violate strict security requirements.

Key Concept

Dual IAM Permission Requirement for Project Billing Account Association
Question 14Question →

A cloud administrator is configuring a new organizational folder structure for an enterprise application suite. The central deployment team requires authorization to create new Google Cloud projects inside the 'Payments-Production' folder and link those projects to the organization's central billing account. Furthermore, the organization enforces a constraint at the organization root node restricting external IP addresses on Compute Engine instances.

Which of the following statements regarding GCP resource hierarchy management, IAM permissions, and policy enforcement are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The deployment team requires the Project Creator role on the target folder and the Billing Account User role on the central billing account to successfully create and link projects.; Organization policies inherited from parent nodes enforce restrictive constraints that cannot be bypassed or overridden by granting IAM roles at lower resource hierarchy levels.

Answer

The correct statements are that project creation and billing linking require permissions on both the parent container (Project Creator role on the folder) and the billing account (Billing Account User role on the billing account), and that organization policies inherited from parent nodes cannot be overridden by granting lower-level IAM roles.
Project creation within a folder container requires the Project Creator role on that folder, and attaching a project to a billing account requires the Billing Account User role on the billing account. In addition, Organization Policy constraints enforced at upper hierarchy levels define absolute configuration limits that IAM role assignments cannot override.

Step-by-Step Solution

1
Analyze project creation and billing linkage administrative requirements across resource hierarchy levels.
Creating projects inside a specific folder requires project creation permissions scoped to that container, while associating projects with billing requires access permissions on the target billing account resource.
Google Cloud separates IAM permissions for resource hierarchy containers from permissions governing billing account usage.
2
Evaluate the interaction between IAM permission assignments and Organization Policy inheritance.
Organization Policy constraints set at parent hierarchy nodes (such as the Organization root) establish programmatic guardrails that apply regardless of IAM role grants at project or resource levels.
IAM determines who can perform actions on resources, whereas Organization Policies determine what configurations are allowed across the resource hierarchy.
3
Apply the principle of least privilege to role selection.
Assigning fine-grained predefined roles (Project Creator on folder, Billing Account User on billing account) fulfills operational needs without granting unnecessary organization-wide broad access.
Primitive roles (Owner, Editor) at the organization level grant excessive access and violate operational security guidelines.

Key Concept

Managing Google Cloud projects, billing account linkage permissions, least privilege roles, and organization policy inheritance rules across the resource hierarchy.
Question 15Question →

A telemetry engineering team is setting up a dedicated workload project named `data-analytics-prod`. The developers need to enable the Cloud Monitoring API (`monitoring.googleapis.com`) and Cloud Logging API (`logging.googleapis.com`) for their services. Additionally, load testing is expected to exceed the default API rate limits during peak operations, requiring quota management. Security policy strictly mandates applying the principle of least privilege without granting broad resource ownership or billing management rights. Which TWO configuration steps should the team take to meet these access control and quota requirements following Google Cloud best practices? (Select TWO answers.)

Select all that apply

Show answer & explanation

Answer: Grant the developer team the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) on the data-analytics-prod project.; Submit a quota increase request for the affected API metrics through the IAM & Admin Quotas interface within the data-analytics-prod project.

Answer

The team should grant the Service Usage Admin role on the target project to allow API enablement under least privilege, and submit a quota increase request via the IAM & Admin Quotas interface within the project when default limits are insufficient.
To satisfy least privilege while allowing API enablement, the Service Usage Admin role should be assigned on the target project because it grants permissions to view and enable APIs without granting full control over project assets. In addition, when traffic demands exceed standard API thresholds, a formal quota increase request must be submitted within the target project's Quotas section.

Step-by-Step Solution

1
Identify the minimum required IAM role for API enablement
Determined that Service Usage Admin (roles/serviceusage.serviceUsageAdmin) grants serviceusage.services.enable permissions on the project.
Primitive roles like Owner or Editor grant excessive broad permissions across all project resources.
2
Determine the proper location for API enablement and quota requests
APIs and quotas are scoped at the specific project level (data-analytics-prod).
Enabling APIs in parent or host projects does not enable them for workload projects, nor does it raise workload project quotas.
3
Formulate the correct workflow for capacity bottlenecks
Submit a formal quota increase request in the Cloud Console under IAM & Admin > Quotas for the target project.
API quotas are enforced by Google Cloud and cannot be bypassed merely by increasing administrative IAM privileges.

Key Concept

API enablement using Service Usage Admin and project-level quota increase request workflows
Estimated Time:2m 0s
Question 16Question →

An online gaming company is planning its Google Cloud Compute Engine architecture for two distinct operational workloads: a continuous, low-latency in-memory leaderboard service that runs 24/7 and cannot tolerate sudden terminations, and an overnight batch analytics pipeline that parses telemetry log files, runs for 6 hours, is stateless, and can resume from checkpoints if interrupted. You need to design a compute provisioning strategy that optimizes cost while satisfying the reliability requirements for both workloads. Which TWO compute configuration strategies should you implement?

Select all that apply

Show answer & explanation

Answer: Provision the continuous, low-latency leaderboard service using standard Compute Engine instances backed by Committed Use Discounts (CUDs).; Provision the overnight batch analytics pipeline using Spot VMs in a Managed Instance Group (MIG).

Answer

The optimal strategy requires provisioning the 24/7 baseline leaderboard service using standard Compute Engine virtual machines backed by Committed Use Discounts (CUDs), while provisioning the fault-tolerant overnight batch processing pipeline on Spot VMs within a Managed Instance Group (MIG).
For continuous baseline workloads running 24/7, Committed Use Discounts (CUDs) provide guaranteed resource reservation and substantial cost savings without risking preemption. For stateless, fault-tolerant batch jobs that can withstand sudden interruptions, Spot VMs offer the maximum possible pricing discount on Compute Engine.

Step-by-Step Solution

1
Analyze the operational requirements of the continuous leaderboard workload
Identified as a continuous, 24/7, non-fault-tolerant service requiring high availability.
Workloads with predictable 24/7 uptime requirements qualify for Committed Use Discounts (CUDs) to maximize savings without risking unexpected instance preemption.
2
Analyze the operational requirements of the overnight batch processing pipeline
Identified as a stateless, fault-tolerant batch workload that runs intermittently and can resume from checkpoints.
Fault-tolerant, stateless batch processing jobs are ideal candidates for Spot VMs, which offer up to 60-91% discounts off standard instance pricing.
3
Evaluate GCP pricing discount rules and constraints
Confirmed that Spot VMs do not receive Sustained Use Discounts (SUDs) or Committed Use Discounts (CUDs).
Understanding discount exclusivity prevents miscalculating cost savings when planning Compute Engine resource commitments.

Key Concept

Compute Engine Machine Type Selection and Cost Optimization Strategies
Question 17Question →

A cloud administrator is managing project lifecycles and governance across an enterprise Google Cloud resource hierarchy. The administrator must protect a critical security project named `shared-sec-ops` from accidental deletion, even by users holding the primitive Owner role. Additionally, an automated pipeline service account must be configured with the necessary permissions to move projects from the `Staging` folder to the `Production` folder. Which TWO configurations or actions fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Create a project lien on `shared-sec-ops` specifying the `resourcemanager.projects.delete` restriction.; Grant the service account permissions to move projects on the source folder, the destination folder, and the target project.

Answer

To protect a project from accidental deletion, place a project lien restricting `resourcemanager.projects.delete`. To move a project between folders, ensure the service account has appropriate project move permissions across the source folder, destination folder, and project.
Creating a project lien with the `resourcemanager.projects.delete` restriction prevents the project from being deleted even by users with the primitive Owner role until the lien is removed. Furthermore, moving projects between folders requires `resourcemanager.projects.move` permissions across the source folder, destination folder, and the target project.

Step-by-Step Solution

1
Configure project deletion protection using liens
A project lien is placed on `shared-sec-ops` restricting `resourcemanager.projects.delete`.
Project liens explicitly prevent anyone (including Project Owners) from deleting the project until the lien is removed.
2
Configure project relocation permissions
The service account is assigned permissions to move the project on the source `Staging` folder, target `Production` folder, and the project being moved.
Moving resources within the Google Cloud hierarchy requires authorization on both the source container, the destination container, and the resource itself.

Key Concept

GCP Project Lifecycle Management and Resource Hierarchy Security
Estimated Time:1m 30s
Question 18Question →

A cloud engineer is designing Google Cloud compute infrastructure for a healthcare organization with two distinct application requirements:

1. Workload 1: An asynchronous, fault-tolerant batch image processing pipeline that can resume cleanly if an instance is terminated unexpectedly.
2. Workload 2: A 24/7 mission-critical relational database with high RAM requirements that demands uninterrupted execution and high availability.

Which TWO deployment and machine type strategies should the engineer select to meet performance requirements while minimizing costs? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision Spot VMs for Workload 1 to significantly reduce compute expenses while accommodating instance preemptions.; Provision memory-optimized standard VMs with Committed Use Discounts (CUDs) for Workload 2.

Answer

The architect should select Spot VMs for the fault-tolerant batch processing workload and memory-optimized standard VM instances with Committed Use Discounts for the 24/7 mission-critical database.
Spot VMs provide significant cost reductions for fault-tolerant, asynchronous batch jobs that tolerate preemption. For steady-state 24/7 high-memory database workloads, memory-optimized standard VMs secured with Committed Use Discounts (CUDs) provide guaranteed uptime alongside maximum cost optimization.

Step-by-Step Solution

1
Analyze Workload 1 operational characteristics
Identified as fault-tolerant, stateless, and asynchronous batch processing.
Fault-tolerant batch jobs can withstand abrupt node terminations without data loss, making them perfect candidates for deep-discounted Spot VMs.
2
Analyze Workload 2 operational characteristics
Identified as a continuous, 24/7 mission-critical high-memory database.
Stateful databases require predictable uptime and continuous memory capacity. They should use standard (non-preemptible) memory-optimized instances coupled with Committed Use Discounts (CUDs) for predictable 24/7 workloads.
3
Evaluate and eliminate non-viable compute options
Eliminated Spot VMs for databases (risk of unannounced outage) and Cloud Functions for heavy batch jobs (timeout and binary limits).
Matching workload SLA requirements with appropriate compute families prevents service outages and compute framework mismatches.

Key Concept

Planning Compute Engine machine types, Spot VM suitability, and discount strategies based on workload SLA and resource profile
Question 19Question →

A centralized platform security team is auditing permission boundaries for an infrastructure automation service account (`[email protected]`). The service account is designated solely to attach newly onboarded, existing Google Cloud projects to the enterprise Cloud Billing Account without possessing permissions to modify billing account financial settings or manage compute workloads inside the projects.

Which TWO predefined IAM roles represent the minimum necessary privileges required for this service account to successfully link the projects to the Cloud Billing Account? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Billing Account User (`roles/billing.user`) on the Cloud Billing Account; Project Billing Manager (`roles/billing.projectManager`) on the target projects or parent folder

Answer

To link an existing Google Cloud project to a Cloud Billing Account under the principle of least privilege, a principal requires Billing Account User (`roles/billing.user`) on the billing account and Project Billing Manager (`roles/billing.projectManager`) on the target project or parent resource container.
Linking a project to a Cloud Billing Account requires permissions on both sides of the relationship: the Billing Account User role grants the necessary `billing.resourceAssociations.create` permission on the billing account, while the Project Billing Manager role grants `resourcemanager.projects.createBillingAssignment` on the target project without exposing underlying workload resources or payment settings.

Step-by-Step Solution

1
Identify the required billing account permission for project linking.
The principal needs `billing.resourceAssociations.create` on the target Cloud Billing Account.
Linking a project requires explicit permission on the billing account to associate it with resource costs.
2
Select the least-privilege predefined role for the billing account.
Billing Account User (`roles/billing.user`) provides `billing.resourceAssociations.create` without granting full administrative privileges.
Adhering to least-privilege security mandates avoids broad management roles when association access is sufficient.
3
Identify the required project-level permission for billing assignment.
The principal needs `resourcemanager.projects.createBillingAssignment` on the target project or folder level.
Linking a project also requires explicit authorization on the project side to modify its billing account attachment.
4
Select the least-privilege predefined role for the project level.
Project Billing Manager (`roles/billing.projectManager`) provides project billing configuration rights without granting primitive Owner or Editor permissions.
Project Billing Manager allows attaching or detaching billing accounts without granting access to manage underlying compute resources.

Key Concept

Dual-sided IAM requirement and least-privilege role selection for linking Google Cloud projects to Cloud Billing Accounts
Question 20Question →

A cloud engineer is planning the Google Compute Engine architecture for a specialized genomics research platform that consists of two distinct workloads:

1. Workload 1: A mission-critical, stateful primary database service running continuous 24/7 operations with steady, predictable memory and CPU utilization.
2. Workload 2: A batch alignment pipeline that processes queue-based genomic data blocks. The pipeline is stateless, fully fault-tolerant, saves progress checkpoints to Cloud Storage every 5 minutes, and can handle abrupt node terminations.

Which TWO deployment and resource planning choices should the engineer recommend to satisfy operational requirements while optimizing total cost of ownership? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Provision standard Compute Engine VM instances backed by Committed Use Discounts (CUDs) for Workload 1.; Provision Spot VM instances within Managed Instance Groups (MIGs) for Workload 2.

Answer

The optimal solution is to provision standard Compute Engine instances with Committed Use Discounts for the continuous stateful primary database (Workload 1) and to provision Spot VM instances within Managed Instance Groups for the fault-tolerant batch alignment pipeline (Workload 2).
The combination of standard instances backed by Committed Use Discounts for the continuous stateful database workload and Spot VMs inside Managed Instance Groups for the stateless batch processing pipeline aligns perfectly with Google Cloud compute optimization best practices.

Step-by-Step Solution

1
Analyze operational characteristics of Workload 1
Identified Workload 1 as a mission-critical 24/7 stateful database needing high availability and predictable continuous compute.
Stateful 24/7 workloads require standard non-preemptible VM instances. Applying 1-year or 3-year Committed Use Discounts (CUDs) offers substantial pricing discounts for predictable baseline resource needs.
2
Analyze operational characteristics of Workload 2
Identified Workload 2 as a stateless, fault-tolerant batch workload capable of resuming from Cloud Storage checkpoints.
Fault-tolerant batch jobs that process queue-based work items can tolerate sudden instance preemptions, making Spot VMs in Managed Instance Groups the best choice to achieve up to 60-91% cost reduction.
3
Evaluate and reject anti-pattern distractors
Rejected using Spot VMs for stateful databases and relying on Sustained Use Discounts on a single large instance for batch jobs.
Spot VMs violate SLA requirements for stateful continuous workloads, while Sustained Use Discounts do not provide the extreme cost savings offered by Spot instances for checkpointed batch operations.

Key Concept

Compute Engine Resource Planning: Spot VMs vs. Committed Use Discounts (CUDs)
Page 1 / 25Next
All practice questions — Google Cloud Associate Cloud Engineer | Examkin