All practice questions
816 questions
A developer in project `media-transcoder-dev` needs to enable the Cloud Video Intelligence API for a new video processing pipeline. When executing `gcloud services enable videointelligence.googleapis.com`, the command fails with a permission denied error. The developer currently holds the Service Usage Consumer (`roles/serviceusage.serviceUsageConsumer`) role on the project. Following the principle of least privilege, which action should the cloud administrator take to resolve this issue?
An operations administrator is estimating monthly expenses in the Google Cloud Pricing Calculator for a Compute Engine virtual machine instance that will run continuously 24 hours a day, 7 days a week. Which pricing mechanism does Google Cloud automatically factor into the calculation for workloads running continuously for most of the billing month?
A digital health platform is designing a Google Kubernetes Engine (GKE) architecture to run two workloads with contrasting operational requirements:
• Workload 1: A legacy telemetry engine that requires custom Linux kernel (sysctl) parameters for network socket optimization.
• Workload 2: A batch data analysis service that is stateless, fault-tolerant, and requires rapid scaling at minimal cost.
The engineering team wants to minimize infrastructure management where possible while fully supporting both workloads. Which cluster architecture and node pool strategy should the cloud engineer select?
An administrator needs to expand the IP range of an existing subnet in a Google Cloud Virtual Private Cloud (VPC) network. The current subnet is configured with the primary IP address range . Which of the following IP ranges is valid for expanding this subnet?
A CI/CD automated deployment pipeline uses a dedicated service account to link newly provisioned workload projects to an enterprise Cloud Billing Account. To comply with corporate compliance policies following the principle of least privilege, which pair of predefined IAM roles must be granted to this service account?
An organization wants to configure a daily export of detailed Cloud Billing data to a BigQuery dataset located in a dedicated cost-management project. A cloud engineer is assigned to set up this export. Which IAM roles must be granted to the cloud engineer to successfully configure the Cloud Billing export to BigQuery?
An enterprise security team requires that Compute Engine virtual machines in the 'Data-Processing' folder be prevented from enabling IP forwarding (acting as routers or network gateways), except for one specialized project named 'gw-prod-100' located inside that folder. A cloud engineer must implement this guardrail using the Google Cloud resource hierarchy while granting the explicit exception. Which configuration should the engineer apply?
A security mandate for a Google Cloud project named `analytics-prod` prohibits developers from generating or downloading long-lived JSON service account keys. A cloud engineer using the identity `[email protected]` needs temporary authorization to mint short-lived OAuth 2.0 access tokens for an existing service account named `[email protected]`. Which command should an administrator run to grant the engineer the necessary permission directly on the service account using the principle of least privilege?
A security administrator needs to allow internal HTTPS traffic on TCP port 443 strictly to a set of Compute Engine virtual machines running a financial application within the custom VPC network `finance-vpc`. To prevent instance administrators from bypassing security policy by modifying instance network tags, the security team mandates that the firewall rule must be enforced based on the service identity of the virtual machines rather than arbitrary metadata tags. Which parameter should the administrator specify when configuring the ingress firewall rule?
A DevOps engineer needs to configure automated real-time alerts whenever a specific error pattern (`[ERROR] Database connection failed`) is written to a custom application log file on a fleet of Compute Engine virtual machines. The solution must adhere to current Google Cloud recommended practices and follow the principle of least privilege. Which set of steps should the engineer execute?
An enterprise Google Cloud environment enforces the boolean Organization Policy constraint `constraints/compute.disableGlobalSerialPortAccess` (Enforced: True) at the root Organization node. A DevOps engineer who holds the primitive `roles/owner` IAM role on a child project within a subfolder attempts to enable interactive serial console access on a Compute Engine instance in that project using the Google Cloud CLI. Which statement correctly describes the outcome of this operational request and the underlying policy enforcement mechanism?
An organization is establishing strict compliance guardrails for service account administration in Google Cloud. A dedicated security team created a custom service account named `[email protected]` in project `proj-backend`. Developers in the project need to attach this service account to newly deployed Cloud Run services. However, security policy strictly forbids developers from modifying service account permissions, creating key files, or managing other service accounts in the project. Which IAM role configuration meets these security requirements while applying the principle of least privilege?
An enterprise security policy requires that an external automated CI/CD pipeline operating outside of Google Cloud deploy infrastructure into a project named `prod-app-services`. To eliminate security risks associated with long-lived credentials, a cloud administrator creates a dedicated deployment service account named `[email protected]` and configures Workload Identity Federation. Which IAM role configuration should the administrator apply to grant the external workload permission to act as the service account while following Google Cloud security best practices?
A cloud engineer is configuring customer-managed encryption keys (CMEK) in Google Cloud KMS for a sensitive Cloud Storage bucket residing in the us-central1 region. The organization requires strict separation of duties: security administrators must manage keys and IAM policies without being able to encrypt or decrypt data, whereas the Cloud Storage service account requires permissions solely to perform cryptographic encryption and decryption operations. Additionally, an operator asks to permanently delete an outdated Cloud KMS Key Ring to clean up resources. Which configuration correctly satisfies these requirements while adhering to Google Cloud KMS operational capabilities?
A cloud administrator manages resource constraints across an enterprise Google Cloud hierarchy. An Organization Policy using the Boolean constraint constraints/compute.vmCanIpForward is set to Enforced at the Analytics folder level to prevent virtual machines from enabling IP forwarding. A specific workload inside this folder, located in the Network-Appliance project, requires a virtual machine to act as a router with IP forwarding enabled. How should the administrator configure the environment to allow IP forwarding specifically for the Network-Appliance project while maintaining the constraint for all other projects in the folder?
A software team deployed an application to Compute Engine that processes images uploaded to a Cloud Storage bucket named `media-processing-prod`. The security team recently enabled Uniform Bucket-Level Access on the bucket to meet organizational compliance requirements. Following this change, the application throws an error whenever it attempts to grant fine-grained permissions using object Access Control Lists (ACLs). According to Google Cloud security best practices, which action should the cloud administrator take to resolve the application errors and properly manage access?
An enterprise software team manages multiple environment folders under their Google Cloud organization. In the Staging folder, service account JSON key creation is currently permitted to support legacy integration tests. However, for a newly created high-security project named finance-vault-prod residing inside the Staging folder, security compliance mandates that service account key creation must be blocked completely. Which action should a Cloud Engineer take to enforce this security restriction on finance-vault-prod without modifying the policy settings for other projects in the Staging folder?
A cloud security engineer receives an alert that a specific key version of a CryptoKey in Cloud KMS may have been exposed. The security policy dictates that no new data should be encrypted using this compromised key version, but existing backup files encrypted with prior key versions must remain decryptable by authorized service accounts. Additionally, to clean up the project resources, the engineer attempts to remove the parent KeyRing that holds the CryptoKey. Which action correctly fulfills the security requirement while reflecting Cloud KMS resource capabilities?
An enterprise organization is migrating a legacy batch processing and simulation application to Google Cloud Compute Engine. The application operates continuously 24/7 as a steady-state workload and requires a non-standard resource ratio of 1 vCPU to 8 GB of RAM to prevent paying for unneeded compute processing power. Furthermore, the application performs synchronous state writes to attached disks and cannot tolerate abrupt or ungraceful instance terminations. The infrastructure team must minimize total cost of ownership over a 3-year horizon while ensuring full operational stability and exact resource fit. Which compute planning strategy best meets these requirements?
A logistics platform is evaluating Google Cloud compute options for two application services with distinct operational and cost constraints:
1. Workload X: A stateless, containerized REST API that experiences unpredictable traffic spikes and extended idle periods. It requires automatic scaling down to zero instances to eliminate ongoing infrastructure expenses.
2. Workload Y: A 4-hour batch processing job that analyzes historical GPS telemetry. The job is fault-tolerant, regularly checkpoints its state, and must execute at the lowest possible per-hour compute cost.
Which deployment strategy best meets the requirements for both workloads while minimizing operational overhead and cost?