Tüm alıştırma soruları

A developer in project `media-transcoder-dev` needs to enable the Cloud Video Intelligence API for a new video processing pipeline. When executing `gcloud services enable videointelligence.googleapis.com`, the command fails with a permission denied error. The developer currently holds the Service Usage Consumer (`roles/serviceusage.serviceUsageConsumer`) role on the project. Following the principle of least privilege, which action should the cloud administrator take to resolve this issue?

An operations administrator is estimating monthly expenses in the Google Cloud Pricing Calculator for a Compute Engine virtual machine instance that will run continuously 24 hours a day, 7 days a week. Which pricing mechanism does Google Cloud automatically factor into the calculation for workloads running continuously for most of the billing month?

A digital health platform is designing a Google Kubernetes Engine (GKE) architecture to run two workloads with contrasting operational requirements:

• Workload 1: A legacy telemetry engine that requires custom Linux kernel (sysctl) parameters for network socket optimization.
• Workload 2: A batch data analysis service that is stateless, fault-tolerant, and requires rapid scaling at minimal cost.

The engineering team wants to minimize infrastructure management where possible while fully supporting both workloads. Which cluster architecture and node pool strategy should the cloud engineer select?

A cloud engineer needs to onboard a new business unit into an existing Google Cloud organization. The engineer must set up a dedicated environment that inherits organization policies, enable necessary infrastructure services, ensure resource usage is billed appropriately, and grant access to the development team while enforcing the principle of least privilege. In what sequential order should the engineer execute these setup operations?

A cloud engineer must create a new project named `finance-analytics-prod` within a corporate folder and link it to an existing Cloud Billing Account (`012345-6789AB-CDEF01`) using the `gcloud` CLI while following Google Cloud least-privilege IAM principles. What is the correct sequence of steps required to successfully provision the project and establish the billing connection?

An organization is evaluating Google Cloud compute solutions for two newly developed application components:
1. An overnight data transformation batch job that is stateless, fault-tolerant, and capable of resuming progress if interrupted.
2. A containerized HTTP microservice that experiences unpredictable traffic bursts and requires scaling down to zero when idle to minimize compute expenses.

Which TWO deployment options should the Cloud Engineer select to satisfy these requirements while optimizing costs and minimizing operational overhead? (Select TWO.)

An administrator needs to expand the IP range of an existing subnet in a Google Cloud Virtual Private Cloud (VPC) network. The current subnet is configured with the primary IP address range $10.1.0.0/24$. Which of the following IP ranges is valid for expanding this subnet?

An enterprise logistics company is redesigning its Google Cloud container infrastructure to support two distinct workload profiles. The first profile consists of stateless web APIs that experience highly variable traffic, where the operations team requires zero node management responsibility and pod-level SLA guarantees. The second profile consists of a batch analytics engine executing fault-tolerant, short-lived jobs that require deep customization of worker node kernel parameters (sysctl) and maximum cost reduction. Which TWO GKE cluster architecture decisions should the cloud architect implement to meet these requirements? (Select TWO.)

A CI/CD automated deployment pipeline uses a dedicated service account to link newly provisioned workload projects to an enterprise Cloud Billing Account. To comply with corporate compliance policies following the principle of least privilege, which pair of predefined IAM roles must be granted to this service account?

An enterprise application produces daily operation logs that require frequent, immediate access for troubleshooting during the first 14 days. After 14 days, the logs are accessed infrequently for routine audits for another 90 days before being deleted. Which Cloud Storage configuration actions should be planned to optimize costs and performance? (Select TWO)

An organization wants to configure a daily export of detailed Cloud Billing data to a BigQuery dataset located in a dedicated cost-management project. A cloud engineer is assigned to set up this export. Which IAM roles must be granted to the cloud engineer to successfully configure the Cloud Billing export to BigQuery?

An enterprise security team requires that Compute Engine virtual machines in the 'Data-Processing' folder be prevented from enabling IP forwarding (acting as routers or network gateways), except for one specialized project named 'gw-prod-100' located inside that folder. A cloud engineer must implement this guardrail using the Google Cloud resource hierarchy while granting the explicit exception. Which configuration should the engineer apply?

A security mandate for a Google Cloud project named `analytics-prod` prohibits developers from generating or downloading long-lived JSON service account keys. A cloud engineer using the identity `[email protected]` needs temporary authorization to mint short-lived OAuth 2.0 access tokens for an existing service account named `[email protected]`. Which command should an administrator run to grant the engineer the necessary permission directly on the service account using the principle of least privilege?

A DevOps engineer is deploying a newly containerized Flask web application named `inventory-api` to Google Cloud Run using the `gcloud run deploy` command. The application is configured to listen internally on TCP port 5000 rather than the standard default port. The application needs to be accessible directly from the public internet without requiring IAM authentication header tokens. Which two configuration actions or `gcloud` command flags must be used to successfully deploy this service? (Select TWO.)

A security administrator needs to allow internal HTTPS traffic on TCP port 443 strictly to a set of Compute Engine virtual machines running a financial application within the custom VPC network `finance-vpc`. To prevent instance administrators from bypassing security policy by modifying instance network tags, the security team mandates that the firewall rule must be enforced based on the service identity of the virtual machines rather than arbitrary metadata tags. Which parameter should the administrator specify when configuring the ingress firewall rule?

A DevOps engineer needs to configure automated real-time alerts whenever a specific error pattern (`[ERROR] Database connection failed`) is written to a custom application log file on a fleet of Compute Engine virtual machines. The solution must adhere to current Google Cloud recommended practices and follow the principle of least privilege. Which set of steps should the engineer execute?

A cloud engineer is deploying a custom-mode Virtual Private Cloud (VPC) network named `corp-network` in Google Cloud to host multi-region microservices. The engineer needs to configure subnets in `us-central1` and `europe-west1` and ensure that internal Compute Engine virtual machines across these subnets can communicate with each other over TCP port 8080. Which TWO configurations accurately reflect Google Cloud VPC subnet and firewall rule deployment behaviors? (Select TWO answers.)

An enterprise Google Cloud environment enforces the boolean Organization Policy constraint `constraints/compute.disableGlobalSerialPortAccess` (Enforced: True) at the root Organization node. A DevOps engineer who holds the primitive `roles/owner` IAM role on a child project within a subfolder attempts to enable interactive serial console access on a Compute Engine instance in that project using the Google Cloud CLI. Which statement correctly describes the outcome of this operational request and the underlying policy enforcement mechanism?

An organization is establishing strict compliance guardrails for service account administration in Google Cloud. A dedicated security team created a custom service account named `[email protected]` in project `proj-backend`. Developers in the project need to attach this service account to newly deployed Cloud Run services. However, security policy strictly forbids developers from modifying service account permissions, creating key files, or managing other service accounts in the project. Which IAM role configuration meets these security requirements while applying the principle of least privilege?

An enterprise security policy requires that an external automated CI/CD pipeline operating outside of Google Cloud deploy infrastructure into a project named `prod-app-services`. To eliminate security risks associated with long-lived credentials, a cloud administrator creates a dedicated deployment service account named `[email protected]` and configures Workload Identity Federation. Which IAM role configuration should the administrator apply to grant the external workload permission to act as the service account while following Google Cloud security best practices?