Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 201Soru →

A digital health enterprise is designing a compute architecture to process incoming HTTP webhooks containing patient telemetry. The application is packaged as a custom container image requiring specific system-level C++ binaries. Traffic is highly unpredictable, spiking during daytime hours and dropping to zero overnight. The organization requires a solution with zero infrastructure management overhead that automatically scales to zero instances when idle to minimize costs. Which Google Cloud compute solution best satisfies these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy the application using Cloud Run.

Cevap

Deploying the application using Cloud Run is the optimal solution because it supports custom container images with specialized system dependencies, requires zero server administration, and scales down to zero when no webhooks are received.
Cloud Run is a fully managed serverless compute platform that automatically scales HTTP webhooks from zero to handle unpredictable traffic spikes without requiring node management or cluster maintenance. Because it runs standard container images, it accommodates custom OS-level binaries and C++ libraries while ensuring costs are only incurred during active request processing.

Adım Adım Çözüm

1
Analyze workload packaging and dependency requirements.
The application requires custom Linux system libraries packaged inside a container image.
Standard serverless function platforms without full container runtime support cannot accommodate custom system C++ libraries easily.
2
Evaluate scaling behavior and infrastructure management constraints.
The workload must scale to zero instances overnight and demand zero operational management.
Virtual machine pools and GKE Standard clusters require infrastructure management and maintain minimum node resources that incur costs even when idle.
3
Select the matching serverless container execution platform.
Cloud Run meets all criteria: full container customizability, fully managed infrastructure, and scale-to-zero HTTP scaling.
Cloud Run allows container execution while eliminating cluster node maintenance and billing when no traffic is present.

Anahtar Kavram

Selecting serverless compute platforms based on workload packaging, scaling behavior, and operational overhead.
Soru 202Soru →

A cloud administrator is organizing resources for a team in Google Cloud. Which TWO statements correctly describe the fundamental rules of the Google Cloud resource hierarchy and IAM policy inheritance? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: IAM policies applied at a parent node in the resource hierarchy are automatically inherited by all child resources underneath it.; Projects can be contained inside Folders or directly under the Organization node within the resource hierarchy.

Cevap

Permissions granted at a parent node are inherited by all child resources, and Projects can be placed inside Folders or directly under the Organization node.
The resource hierarchy in Google Cloud flows from Organization > Folder > Project > Resource. IAM policy inheritance is strictly additive, meaning child resources automatically inherit all permissions granted on parent folders or the organization. Additionally, projects can be child nodes of either a folder or the organization node directly.

Adım Adım Çözüm

1
Analyze how IAM policy inheritance works in the Google Cloud resource hierarchy.
IAM permissions flow downward from Organization to Folders to Projects and resources in an additive manner.
Understanding additive inheritance confirms that parent node permissions cannot be revoked at lower levels.
2
Evaluate valid structural parent-child relationships in the Google Cloud resource hierarchy.
Projects can exist directly under the Organization root or grouped inside Folders.
Folders provide grouping mechanisms, but projects can also sit directly under the organization.

Anahtar Kavram

Google Cloud Resource Hierarchy Structure and Additive IAM Inheritance
Soru 203Soru →

A company's cloud operations team is configuring access control within their Google Cloud resource hierarchy. The hierarchy contains an Organization node with top-level folders for different business units, including a folder named Retail Operations. The team needs to allow a lead developer to create new projects inside the Retail Operations folder only, while preventing them from creating projects in other folders or managing folder policies. Which IAM role configuration meets these requirements while adhering to the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Grant the Project Creator role (roles/resourcemanager.projectCreator) to the lead developer on the Retail Operations folder node.

Cevap

Grant the Project Creator role (roles/resourcemanager.projectCreator) to the lead developer on the Retail Operations folder node.
Assigning the Project Creator predefined role (roles/resourcemanager.projectCreator) specifically on the Retail Operations folder node grants the required permission to provision projects under that folder. Because IAM policies inherit downwards in the Google Cloud resource hierarchy, binding the role at the folder level ensures the developer cannot create projects in sibling or parent nodes, adhering strictly to the principle of least privilege.

Adım Adım Çözüm

1
Identify the specific task required.
The user needs to create new Google Cloud projects.
Selecting the predefined role specifically designed for project creation requires the Project Creator role (roles/resourcemanager.projectCreator).
2
Determine the correct resource hierarchy level for scoping access.
Scope the IAM binding to the Retail Operations folder node.
In GCP resource hierarchy (Organization > Folder > Project > Resource), IAM policies inherit downward. Scoping the binding to the target folder limits project creation rights strictly to that folder.
3
Evaluate against the principle of least privilege.
The configuration grants only project creation within the designated folder.
Avoid broad primitive roles (Owner) or higher-level administrative roles (Folder Admin, Organization Admin) to prevent over-privileging.

Anahtar Kavram

Resource Hierarchy IAM Policy Scoping and Inheritance
Tahmini Süre:1m 30s
Soru 204Soru →

An organization wants to automatically stop running Compute Engine instances in a specific Google Cloud project whenever project spending exceeds 100% of its designated monthly budget limit. You need to design an automated cost-control workflow while accounting for GCP billing budget capabilities and limitations. Which implementation strategy should you choose?

Cevabı ve açıklamayı göster

Cevap: Configure the Cloud Billing budget to publish alert notifications to a Cloud Pub/Sub topic, subscribe a Cloud Function that executes Compute Engine stop API calls upon receiving budget messages, and account for eventual consistency since billing data processing includes an inherent reporting latency.

Cevap

Publish Cloud Billing budget alert notifications to a Cloud Pub/Sub topic, subscribe a Cloud Function to execute Compute Engine stop API calls upon notification, and account for reporting latency.
The correct strategy requires recognizing that Google Cloud billing budgets do not natively stop resources or cap costs. To achieve automated cost control, budget alerts must publish messages to a Cloud Pub/Sub topic, which triggers a serverless function (such as Cloud Functions) to invoke Compute Engine APIs to halt running instances. Additionally, billing data processing involves inherent latency, so automated remediation is asynchronously executed rather than instantaneous.

Adım Adım Çözüm

1
Identify billing budget notification limits
Recognize that GCP billing budgets only generate notifications and do not automatically stop running resources or cap spending.
GCP Cloud Billing budgets are informational alerting tools rather than automated resource governors.
2
Connect programmatic alerting mechanisms
Attach a Cloud Pub/Sub topic to the Cloud Billing budget to receive JSON notification payloads when spending threshold percentages are crossed.
Pub/Sub serves as the event bus between billing threshold events and downstream programmatic remediation scripts.
3
Implement programmatic resource management
Deploy a Cloud Function or Cloud Run service triggered by the Pub/Sub topic to call Compute Engine APIs and stop instance workloads.
Custom code is required to translate the notification event into active GCP infrastructure modifications.
4
Factor in billing telemetry latency
Acknowledge that billing metrics and cost processing incur a delay (typically a few hours), meaning automated actions mitigate overruns rather than providing hard real-time caps.
Billing data processing is asynchronously batch-aggregated across Google Cloud infrastructure.

Anahtar Kavram

Automated Budget Notification Handling via Pub/Sub and Cloud Functions
Soru 205Soru →

An organization isolates client vulnerability assessments inside dedicated Google Cloud projects. A newly onboarded security engineer, assigned the Cloud Identity identity `[email protected]`, needs to associate an existing project (`client-eval-sec-99`) with the centralized Cloud Billing account (`01AB23-45CD67-89EF01`). The engineer has already been granted the Billing Account User (`roles/billing.user`) role directly on the Cloud Billing account. When running the `gcloud beta billing projects link` command, the request fails with an IAM permission denied error on the project resource. Following Google Cloud's principle of least privilege, which IAM role should be granted to `[email protected]` on the target project to resolve this failure?

Cevabı ve açıklamayı göster

Cevap: Project Billing Manager (roles/billing.projectManager) on the target project

Cevap

Granting Project Billing Manager (`roles/billing.projectManager`) on the target project resource provides the minimum necessary permission (`resourcemanager.projects.createBillingAssignment`) required to link an existing project to a billing account.
Linking a Cloud Billing account to a project requires permissions on both sides of the association. On the billing account side, `roles/billing.user` grants `billing.resourceAssociations.create`. On the project side, the user must have `resourcemanager.projects.createBillingAssignment`. The predefined role Project Billing Manager (`roles/billing.projectManager`) provides this exact project permission without conferring unnecessary management capabilities over compute, storage, or security settings.

Adım Adım Çözüm

1
Analyze the permission requirements for project-billing linking
Linking a project requires `billing.resourceAssociations.create` on the Billing Account AND `resourcemanager.projects.createBillingAssignment` on the Project.
Google Cloud IAM enforces dual-sided authorization to prevent unauthorized projects from consuming billing account credits.
2
Evaluate the user's existing permissions
The user already has `roles/billing.user` on the Billing Account, providing `billing.resourceAssociations.create`.
The missing permission is on the target project resource side (`resourcemanager.projects.createBillingAssignment`).
3
Apply the principle of least privilege to select the target role
Assign `roles/billing.projectManager` on the target project.
`roles/billing.projectManager` grants `resourcemanager.projects.createBillingAssignment` without granting broad primitive permissions like Owner or Editor.

Anahtar Kavram

Dual-sided IAM permissions for linking Google Cloud projects to Cloud Billing accounts under least privilege
Soru 206Soru →

A platform automation service account named `[email protected]` is tasked with creating new Google Cloud projects under the `Engineering` folder and associating them with the enterprise Billing Account `01A2B3-456C78-9DEF01`. The service account has already been granted the Project Creator (`roles/resourcemanager.projectCreator`) role on the `Engineering` folder. However, automated deployments fail when attempting to link newly created projects to the billing account. Following the principle of least privilege, which additional IAM role configuration is required to enable the service account to complete project-to-billing linking?

Cevabı ve açıklamayı göster

Cevap: Grant the service account the Billing Account User (`roles/billing.user`) role directly on Billing Account `01A2B3-456C78-9DEF01`.

Cevap

Grant the service account the Billing Account User (`roles/billing.user`) role directly on Billing Account `01A2B3-456C78-9DEF01`.
To link a Google Cloud project to a billing account, an identity must hold specific permissions on both target resources: Project Creator (or Project Owner/Editor) on the parent folder or project, and Billing Account User (`roles/billing.user`) on the specific billing account. Granting `roles/billing.user` directly on the billing account fulfills the least privilege principle while enabling the required association capability.

Adım Adım Çözüm

1
Analyze the permission requirements for linking a Google Cloud project to a billing account.
Linking requires dual permissions: project creation/management rights on the project/folder AND billing association rights on the billing account.
Security boundary isolation ensures that project administrators cannot arbitrarily attach projects to billing accounts without explicit authorization on the billing resource.
2
Evaluate existing service account permissions.
The service account has `roles/resourcemanager.projectCreator` on the target folder, satisfying the folder-level project creation requirement.
This allows project instantiation under the `Engineering` folder but does not grant rights on external billing account resources.
3
Determine the least-privilege predefined role needed on the billing account.
Assigning `roles/billing.user` directly on the billing account provides `billing.resourceAssociations.create` without over-granting billing administrative access.
This role grants permission to link projects to the specified billing account without giving rights to manage billing account payment methods or user access.

Anahtar Kavram

Dual-permission requirement for GCP Billing Account linking across the Resource Hierarchy
Soru 207Soru →

An online retail organization is designing a serverless backend infrastructure on Google Cloud to handle two distinct operational workloads:
1. Workload A: A high-throughput API gateway service packaged as a custom Docker container image that must handle up to 80 concurrent HTTP requests per instance to optimize resource utilization.
2. Workload B: A lightweight event processor executing a single JavaScript file whenever a new PDF invoice is generated and saved to a Cloud Storage bucket.

Which two architectural decisions should the cloud engineer select to meet these requirements with minimal operational overhead? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy Workload A to Cloud Run and configure container concurrency to allow multiple requests per instance.; Deploy Workload B as a Cloud Function configured with a Cloud Storage event trigger.

Cevap

Deploy Workload A to Cloud Run with multi-request concurrency configured, and deploy Workload B to Cloud Functions triggered directly by Cloud Storage events.
Cloud Run is the optimal platform for Workload A because it allows deploying custom Docker containers with configured concurrency to process up to 80 requests simultaneously per container instance. Cloud Functions is the optimal choice for Workload B because it natively integrates with Cloud Storage events to execute lightweight code snippets without needing container maintenance.

Adım Adım Çözüm

1
Evaluate Workload A requirements against GCP serverless compute options.
Workload A requires running a custom Docker container with explicit support for serving multiple concurrent HTTP requests per instance.
Cloud Run supports containerized applications with configurable request concurrency up to 1000 requests per instance, making it the correct choice for Workload A.
2
Evaluate Workload B requirements against GCP serverless compute options.
Workload B requires executing a simple JavaScript file in response to Cloud Storage object creation events.
Cloud Functions provides a fully managed, event-driven runtime specifically designed for executing code snippets triggered by Google Cloud infrastructure events.

Anahtar Kavram

Differentiating serverless compute platforms (Cloud Run vs. Cloud Functions) based on containerization, concurrency capabilities, and event trigger mechanisms.
Soru 208Soru →

A digital media engineering team needs to run long-running video transcoding processing tasks using a custom compiled C++ binary on Google Cloud. The workload requires maximum single-thread CPU clock speeds, consistent processor performance, and runs uninterrupted in contiguous 12-hour job windows. If a node terminates mid-job, the entire 12-hour transcoding process fails and must restart from the beginning. Which Compute Engine resource planning strategy should the cloud engineer recommend?

Cevabı ve açıklamayı göster

Cevap: Provision Compute-optimized (C2 or C3) machine family instances running as standard Virtual Machines.

Cevap

Provision Compute-optimized machine family instances (such as C2 or C3) configured as standard Compute Engine virtual machines.
Compute-optimized machine types (C2 and C3) provide high per-core CPU performance and high clock frequencies tailored for CPU-intensive compute workloads like video encoding. Using standard VMs ensures uninterrupted execution, satisfying the strict requirement that the 12-hour process must not be interrupted.

Adım Adım Çözüm

1
Analyze workload compute profile requirements.
The application requires high single-thread CPU performance and sustained high clock frequency for CPU-bound video transcoding tasks.
Matching CPU performance profiles to Google Cloud machine families requires picking Compute-optimized (C2/C3) machines rather than General-purpose or Memory-optimized types.
2
Evaluate fault tolerance and availability constraints.
The job runs continuously for 12 hours and fails completely if interrupted.
Because the workload cannot recover from sudden termination, Spot/Preemptible VMs must be ruled out in favor of standard Compute Engine VMs.
3
Verify execution environment limits for alternative cloud offerings.
Serverless functions (Cloud Functions) cannot be used due to strict 9-minute execution timeouts.
Long-running batch workloads exceeding serverless timeouts must run on Compute Engine virtual instances.

Anahtar Kavram

Compute Engine Machine Family Selection and Spot VM Suitability
Tahmini Süre:1m 30s
Soru 209Soru →

A cloud administration team is planning Compute Engine resource configurations for two distinct applications:

1. A stateless, fault-tolerant batch image processing worker service that can easily resume processing if interrupted.
2. A memory-intensive caching service that requires continuous uptime and high RAM-to-vCPU ratios.

Which TWO deployment options represent recommended Compute Engine resource planning decisions for these workloads? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision Spot VMs for the stateless batch image processing worker service to optimize compute costs.; Select a memory-optimized machine type for the high-throughput caching service to fulfill high memory demand.

Cevap

The team should provision Spot VMs for the stateless batch processing service and select a memory-optimized machine type for the high-throughput caching service.
Selecting Spot VMs for stateless, fault-tolerant batch processing reduces compute expenses significantly while ensuring the batch job can withstand preemption. Choosing a memory-optimized machine family for the caching service ensures adequate RAM per core for memory-intensive workloads while maintaining reliable continuous operation.

Adım Adım Çözüm

1
Analyze the requirements for the batch image processing worker service.
The service is stateless, fault-tolerant, and batch-oriented.
Fault-tolerant workloads that tolerate preemption are ideal candidates for Spot VMs to maximize cost savings.
2
Analyze the requirements for the caching service.
The service requires continuous uptime and high memory capacity.
Memory-optimized machine families provide the required RAM ratio without needing standard Compute instances to be over-provisioned with excess CPU.

Anahtar Kavram

Selecting machine families based on memory demands and choosing Spot VMs for fault-tolerant batch processing.
Tahmini Süre:1m 0s
Soru 210Soru →

A software engineering team is planning the deployment architecture for an internal HTTP REST API on Google Cloud. The application requires a custom Go runtime packaged alongside specific Linux system libraries compiled directly into a container image. To optimize operational costs during traffic spikes, the service must support handling up to 80 concurrent HTTP requests on each active instance. Which serverless compute option should the team select?

Cevabı ve açıklamayı göster

Cevap: Deploy the container image to Cloud Run, as it natively supports custom container runtimes and configurable multi-concurrency per instance.

Cevap

Deploy the container image to Cloud Run, as it natively supports custom container runtimes and configurable multi-concurrency per instance.
Cloud Run is Google Cloud's serverless platform for deploying arbitrary container images that listen for incoming HTTP/gRPC requests. It allows teams to bring custom binaries and system libraries in a Dockerfile while supporting multi-concurrency configuration (handling multiple simultaneous requests on a single instance) for high efficiency.

Adım Adım Çözüm

1
Identify key technical and operational requirements
The application needs custom container image support (Linux system libraries compiled with Go) and configurable multi-concurrency (80 requests per instance) over HTTP.
Understanding runtime requirements and concurrency needs is critical when choosing between serverless options on GCP.
2
Evaluate GCP serverless platform capabilities
Cloud Run executes any container image that listens on the PORT environment variable and allows configuring concurrency up to 1000 requests per container instance.
Cloud Functions focuses on deploying source code snippets for event processing, whereas Cloud Run is designed for arbitrary containerized web applications.
3
Select the optimal compute solution
Cloud Run is the correct platform because it fulfills both container customization and multi-concurrency requirements.
Cloud Run provides serverless autoscaling without server management while supporting custom containerized environments.

Anahtar Kavram

Planning Serverless Compute Options (Cloud Run vs Cloud Functions)
Soru 211Soru →

A logistics enterprise is planning the serverless architecture for two distinct microservices on Google Cloud:

1. Microservice A: A public order-receiving REST service experiencing bursty, unpredictable traffic. To optimize memory usage and reduce cost, the application must handle up to 80 concurrent HTTP requests per instance within a custom container environment.
2. Microservice B: An event-driven processing script that executes short Python logic whenever a new shipment manifest file is uploaded to a specific Cloud Storage bucket.

Which serverless deployment plan aligns with Google Cloud architectural best practices to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy Microservice A to Cloud Run to utilize multi-concurrency within container instances, and deploy Microservice B to Cloud Functions (2nd gen) triggered directly by Cloud Storage events.

Cevap

Deploy Microservice A to Cloud Run to utilize multi-concurrency within container instances, and deploy Microservice B to Cloud Functions (2nd gen) triggered directly by Cloud Storage events.
Cloud Run is designed to host stateless containerized microservices and supports configurable request concurrency (up to 80 concurrent requests per instance in this scenario), allowing multiple requests to share CPU and memory resources. Cloud Functions (2nd gen) offers seamless integration with Eventarc and Cloud Storage event triggers for single-purpose event handlers like processing uploaded manifest files.

Adım Adım Çözüm

1
Analyze Microservice A requirements
Microservice A requires a containerized environment and must process up to 80 concurrent HTTP requests per instance.
Cloud Run natively supports request concurrency (up to 1000 requests per instance) for containerized web microservices, reducing container footprint and total cost.
2
Analyze Microservice B requirements
Microservice B is a lightweight, single-purpose Python script triggered by file uploads in a Cloud Storage bucket.
Cloud Functions (2nd gen) built on Eventarc is designed specifically for lightweight event-driven execution responding to Cloud Storage state changes.
3
Evaluate and combine serverless choices
Cloud Run for Microservice A and Cloud Functions for Microservice B.
This combination leverages the unique strengths of each Google Cloud serverless compute platform while meeting all operational constraints.

Anahtar Kavram

Planning Serverless Compute Options: Cloud Run vs. Cloud Functions Concurrency and Triggers
Tahmini Süre:2m 0s
Soru 212Soru →

A system architect is using the Google Cloud Pricing Calculator to model monthly infrastructure costs for a major system migration. The architectural design comprises two primary compute workloads: a critical relational transactional database that must run continuously with 99.99% availability on dedicated Compute Engine instances, and a highly fault-tolerant, stateless batch processing pipeline designed to handle sudden instance terminations without data loss. Additionally, transactional backups will be stored long-term but must be read hourly by automated compliance validation scripts. Which configuration strategy in the Google Cloud Pricing Calculator correctly reflects Google Cloud pricing rules to provide the lowest valid cost estimate?

Cevabı ve açıklamayı göster

Cevap: Configure 3-year Committed Use Discounts (CUDs) for the transactional database Compute Engine instances, select Spot VMs without Committed Use Discounts for the batch processing pipeline, and assign Standard Storage for the hourly accessed transaction backups.

Cevap

Configure 3-year Committed Use Discounts for predictable stateful database instances, leverage Spot VMs without stacking CUDs for fault-tolerant stateless processing, and use Standard Storage for frequently read log backups.
The option advocating 3-year Committed Use Discounts for the 24/7 database, Spot VMs for the stateless batch processing pipeline, and Standard Storage for hourly-accessed backups accurately aligns with Google Cloud pricing structures. CUDs maximize savings for steady-state databases, Spot VMs drastically reduce costs for interruptible tasks without invalid stacking, and Standard Storage avoids costly retrieval fees incurred by accessing colder storage classes on an hourly basis.

Adım Adım Çözüm

1
Evaluate workload operational requirements for compute resource pricing models.
The transactional database requires constant 99.99% uptime, making it eligible for steady-state baseline discounts like 1-year or 3-year Committed Use Discounts (CUDs). The batch processing pipeline is stateless and fault-tolerant, making it an ideal candidate for Spot VMs.
Spot VMs provide up to 60-91% savings over standard pricing for interruptible workloads, while CUDs provide up to 57-70% savings for steady 24/7 compute workloads.
2
Validate discount stacking and applicability rules in the Pricing Calculator.
CUDs apply to standard, non-preemptible compute usage and cannot be combined or stacked on top of Spot VM pricing.
Applying CUDs to Spot VMs in cost estimations leads to an inaccurate and artificially reduced estimate.
3
Analyze storage class lifecycle and retrieval cost trade-offs.
Because compliance scripts read the transaction backups hourly, the data access pattern is frequent. Standard Cloud Storage must be selected.
Coldline or Archive storage classes incur high retrieval fees per gigabyte when accessed continuously, making total costs higher than Standard Storage despite lower per-gigabyte storage pricing.

Anahtar Kavram

GCP Pricing Calculator Discount Rules and Storage Tier Retrieval Mechanics
Soru 213Soru →

An enterprise cloud engineering team is planning a new Google Kubernetes Engine (GKE) cluster architecture. The application workload includes high-throughput network microservices that require custom host Linux kernel sysctl parameters to be configured on the underlying nodes. The team also wants to minimize node management operational overhead where possible and utilize Spot VMs to reduce costs for stateless, fault-tolerant background workloads. Which GKE cluster setup and node pool strategy best satisfies these operational requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy a GKE Standard cluster with dedicated node pools, configure the custom sysctl parameters via node pool configuration, and create a separate node pool using Spot VMs for the fault-tolerant background workloads.

Cevap

Deploy a GKE Standard cluster with dedicated node pools, configure the custom sysctl parameters via node pool configuration, and create a separate node pool using Spot VMs for the fault-tolerant background workloads.
GKE Standard provides complete node configuration control, enabling administrators to set custom Linux kernel sysctl parameters for specialized microservices. Utilizing separate node pools allows non-critical, fault-tolerant background workloads to run on low-cost Spot VMs while keeping primary services on resilient standard nodes.

Adım Adım Çözüm

1
Analyze the operational boundary between GKE Autopilot and GKE Standard regarding host OS kernel customizations.
GKE Autopilot fully manages nodes and locks down host security configurations, preventing custom Linux kernel sysctl modifications. Therefore, GKE Standard must be selected.
Security boundaries in GKE Autopilot restrict elevated node access and custom host kernel parameter tuning.
2
Analyze the node pool design requirements for cost optimization and workload separation.
Core microservices should run on standard On-Demand node pools, while fault-tolerant background processing jobs are placed on a separate node pool configured with Spot VMs.
Spot VMs offer significant cost savings for stateless, fault-tolerant workloads that can handle unexpected node preemption.

Anahtar Kavram

Evaluating GKE Autopilot vs. Standard operational boundaries for node OS kernel customization and implementing dedicated node pool architectures with Spot VMs.
Soru 214Soru →

A media analytics firm processes daily log archives in Google Cloud Storage. Engineers access these log files frequently during the first 7 days to analyze performance anomalies. After 7 days, access decreases to approximately once every six months for regulatory compliance checks, but when accessed, the data must be available in milliseconds. The compliance policy requires preserving all log files for exactly 365 days from creation before permanently removing them. Which Cloud Storage lifecycle configuration minimizes total storage and retrieval costs while satisfying all latency and retention requirements?

Cevabı ve açıklamayı göster

Cevap: Store objects in the Standard storage class initially, set an Object Lifecycle Management rule to transition objects to Coldline storage after 7 days, and set a lifecycle rule to delete objects after 365 days.

Cevap

Store objects in the Standard storage class initially, set an Object Lifecycle Management rule to transition objects to Coldline storage after 7 days, and set a lifecycle rule to delete objects after 365 days.
The correct strategy starts objects in Standard storage to eliminate retrieval costs during the initial high-access 7-day window. Moving objects to Coldline after 7 days reduces ongoing capacity costs while maintaining millisecond retrieval latency for semi-annual queries. Because objects remain in Coldline for 358 days (from day 7 to day 365), the 90-day minimum storage duration for Coldline is satisfied, avoiding any early deletion fees.

Adım Adım Çözüm

1
Analyze access frequency and latency constraints
Heavy access during days 1–7 requires Standard storage to avoid retrieval costs. Millisecond access needed after day 7 rules out offline tape-like storage.
Standard storage has no retrieval fee, making it ideal for active data.
2
Evaluate storage class minimum durations and access patterns
Accessing once every 6 months aligns with Coldline storage (designed for data accessed at most once per quarter).
Coldline provides low monthly storage costs with millisecond access latency and a 90-day minimum storage commitment.
3
Calculate lifecycle transition and deletion timelines
Transitioning to Coldline at day 7 and deleting at day 365 retains data in Coldline for 358 days, easily surpassing Coldline's 90-day minimum storage duration without early deletion penalties.
Transitioning to Archive at day 90 and deleting at day 365 would mean only 275 days in Archive, triggering early deletion fees for Archive's 365-day commitment.

Anahtar Kavram

Cloud Storage Classes and Lifecycle Management Cost Optimization
Soru 215Soru →

An enterprise organization manages data across multiple Google Cloud projects. A data engineer needs to run automated BigQuery jobs in Project B (`analytics-prod`) that extract log files from a specific Cloud Storage bucket in Project A (`logs-archive`) and write the processed results into a dataset in Project B. The engineer must also be able to execute query jobs in Project B, but must not be granted permissions to modify bucket configurations in Project A or alter IAM access controls in either project. Which IAM role assignment strategy follows Google's recommended security practices and strictly adheres to the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Grant `roles/storage.objectViewer` on the specific Cloud Storage bucket in Project A, and grant `roles/bigquery.dataEditor` on the target BigQuery dataset and `roles/bigquery.jobUser` at the project level in Project B.

Cevap

Grant `roles/storage.objectViewer` on the specific Cloud Storage bucket in Project A, and grant `roles/bigquery.dataEditor` on the target BigQuery dataset and `roles/bigquery.jobUser` at the project level in Project B.
The optimal solution assigns predefined roles at the narrowest possible resource scope. Assigning `roles/storage.objectViewer` on the specific bucket grants read-only access to objects in Project A. Assigning `roles/bigquery.dataEditor` on the dataset in Project B allows table manipulation, while `roles/bigquery.jobUser` at the Project B level allows job execution. This combination perfectly satisfies all operational requirements while honoring the principle of least privilege.

Adım Adım Çözüm

1
Analyze source storage requirements in Project A
The engineer only needs to read files from a specific Cloud Storage bucket.
Granting `roles/storage.objectViewer` at the bucket level provides read access to objects without granting project-wide storage permissions or bucket modification rights.
2
Analyze destination data writing requirements in Project B
The engineer needs to write processed data into a BigQuery dataset in Project B.
Granting `roles/bigquery.dataEditor` scoped specifically to the target dataset allows table creation and updates without exposing other datasets in the project.
3
Analyze job execution requirements in Project B
Running BigQuery queries consumes compute resources in Project B.
The `roles/bigquery.jobUser` role at the project level is required to run query jobs and allocate compute resources in Project B.

Anahtar Kavram

Least Privilege IAM Role Scoping Across Projects
Soru 216Soru →

A platform engineering team is setting up a new Google Cloud project named `customer-insights-prod`. An automated deployment pipeline using a dedicated service account must enable the Cloud Pub/Sub API (`pubsub.googleapis.com`) and the Cloud SQL Admin API (`sqladmin.googleapis.com`) within this target project. Which of the following actions must be taken to ensure the APIs are enabled successfully using the principle of least privilege? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the deployment service account the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on the `customer-insights-prod` project.; Execute `gcloud services enable pubsub.googleapis.com sqladmin.googleapis.com --project=customer-insights-prod` in the CLI environment.

Cevap

Granting the deployment service account the Service Usage Admin role on the target project and executing the gcloud command with the --project flag enables the required APIs with appropriate permissions.
To enable Google Cloud APIs, an identity requires the `serviceusage.services.enable` permission provided by `roles/serviceusage.serviceUsageAdmin` on the target project. Furthermore, APIs must be enabled at the project level by executing `gcloud services enable` with the full service names and the `--project` flag specified.

Adım Adım Çözüm

1
Identify the required IAM permissions for API enablement.
The service account requires a role containing `serviceusage.services.enable`, which is provided by the predefined Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`).
Principle of least privilege dictates granting Service Usage Admin rather than broad primitive roles like Owner or Editor.
2
Determine the correct CLI syntax to enable the service APIs.
Execute `gcloud services enable pubsub.googleapis.com sqladmin.googleapis.com --project=customer-insights-prod`.
APIs are enabled specifically per Google Cloud project using their full service identifiers.

Anahtar Kavram

Enabling Cloud Service APIs via IAM and gcloud CLI
Tahmini Süre:1m 30s
Soru 217Soru →

A financial analytics company is evaluating Google Cloud compute solutions for a stateless web application containerized with Docker. The application receives unpredictable, bursty HTTP traffic throughout the day and experiences long stretches of complete inactivity during off-peak hours. The operations team requires a fully managed solution that automatically scales instances to zero during inactive periods to eliminate idle infrastructure costs, while eliminating the operational overhead of managing Kubernetes clusters or virtual machine instance groups. Which compute service best meets these operational and financial requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy the container image to Cloud Run.

Cevap

Deploy the container image to Cloud Run.
Cloud Run is the optimal Google Cloud compute choice for deploying stateless containerized web applications that experience bursty traffic and idle periods. It provides automatic scaling down to zero instances when no HTTP requests are being processed, ensuring zero idle infrastructure cost, while completely abstracting away cluster and virtual machine management.

Adım Adım Çözüm

1
Analyze workload characteristics and deployment artifact.
The application is packaged as a standard Docker container image, is stateless, and handles HTTP traffic.
Container packaging requires a runtime environment capable of launching arbitrary container images.
2
Evaluate scaling and financial constraints.
The application must scale down to zero instances during inactive periods to ensure zero cost when idle.
Serverless container platforms like Cloud Run charge only for compute resources consumed during request execution, whereas cluster-based or VM-based architectures incur baseline platform costs.
3
Evaluate operational management overhead requirements.
The team explicitly requested avoiding cluster management and virtual machine administration.
Cloud Run eliminates the need to configure Kubernetes control planes, node pools, or virtual machine operating systems.

Anahtar Kavram

Selecting serverless container execution paradigms for stateless web applications to minimize operational overhead and idle costs.
Tahmini Süre:2m 0s
Soru 218Soru →

An associate cloud engineer is designing a Google Cloud Storage solution for a media processing application. The application requires immediate, frequent access to newly uploaded video files during the first month, and automated cost optimization for files older than 30 days. Which TWO storage planning decisions should the engineer implement? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use Standard Storage as the default storage class for the bucket to accommodate frequent daily access without data retrieval charges.; Implement an Object Lifecycle Management policy with a rule to transition objects to Nearline Storage after 30 days.

Cevap

The correct decisions are to select Standard Storage as the default storage class for active daily media processing and to set an Object Lifecycle Management rule transitioning files to Nearline Storage after 30 days.
Standard Storage is the correct choice for frequently accessed active uploads because it carries no data retrieval fees. Nearline Storage is the correct tier for data accessed once a month or less, matching the 30-day lifecycle transition boundary.

Adım Adım Çözüm

1
Determine initial storage class based on access pattern
Newly uploaded media files are accessed daily, making Standard Storage optimal because it has zero retrieval fees.
Frequent data retrieval under Nearline, Coldline, or Archive classes would incur extra operation costs.
2
Configure lifecycle policy for secondary storage phase
Files older than 30 days with infrequent access should transition to Nearline Storage.
Nearline Storage provides lower at-rest storage costs and requires a minimum storage duration of 30 days.

Anahtar Kavram

Selecting optimal Cloud Storage classes based on data access frequency and setting automated Object Lifecycle Management rules.
Soru 219Soru →

A cloud administrator needs to grant a user the minimum predefined IAM roles required to link an existing Google Cloud project to an active Cloud Billing account. Which combination of IAM roles should be assigned to fulfill this requirement according to the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Billing Account User (roles/billing.user) on the billing account and Project Billing Manager (roles/billing.projectManager) on the project

Cevap

Assigning Billing Account User on the billing account and Project Billing Manager on the project provides the minimum required permissions to link a project to an existing billing account.
Linking an existing project to a Cloud Billing account requires permissions on both resources: Billing Account User (roles/billing.user) grants authority to associate the billing account with projects, while Project Billing Manager (roles/billing.projectManager) grants authority to manage the billing link on the project itself. This combination adheres strictly to the principle of least privilege.

Adım Adım Çözüm

1
Identify the permission required on the billing account
The principal requires billing.accounts.get and billing.accounts.usePermissions, provided by the predefined role Billing Account User (roles/billing.user).
Users must be authorized to attach charges to the target billing account.
2
Identify the permission required on the target project
The principal requires resourcemanager.projects.createBillingAssignment permission, provided by the predefined role Project Billing Manager (roles/billing.projectManager).
Users must be authorized to modify the billing association on the specific project.
3
Evaluate options for least privilege compliance
Combining Billing Account User and Project Billing Manager satisfies both permission requirements without granting excess primitive or administrative access.
Google Cloud security best practices dictate using specific predefined roles over broad administrative or primitive roles.

Anahtar Kavram

Least-privilege IAM roles required for linking Google Cloud projects to billing accounts
Tahmini Süre:45s
Soru 220Soru →

An enterprise cloud engineering team needs to enforce financial governance across their Google Cloud organization. They are tasked with two primary objectives: first, executing automated, custom remediation code whenever project spending exceeds a specific budget threshold; second, performing continuous, detailed SQL analytics on billing data. Which TWO configuration steps are required to implement this architecture? (Select TWO answers.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach a Cloud Pub/Sub topic to the Cloud Billing budget notification settings, and configure an event-driven subscriber such as a Cloud Function to execute automated remediation logic.; Grant the user or service account configuring the BigQuery billing export the Billing Account Administrator role on the billing account and the BigQuery Data Editor role on the project hosting the destination dataset.

Cevap

To implement programmatic budget remediation and detailed cost analysis, administrators must connect the budget alerts to a Cloud Pub/Sub topic (which triggers serverless functions) and assign both the Billing Account Administrator role on the billing account and BigQuery Data Editor role on the export destination project.
The correct requirements involve two distinct configurations: First, Google Cloud Billing budgets do not halt billing or terminate workloads natively when a threshold is crossed. To execute programmatic actions, the budget must publish messages to a Cloud Pub/Sub topic, which triggers a serverless application (such as a Cloud Function) to disable billing or delete resources. Second, configuring BigQuery billing export requires proper authorization across both scope boundaries: the Billing Account Administrator role on the billing account to configure the export, and the BigQuery Data Editor (or Admin) role on the project hosting the dataset to store the exported tables.

Adım Adım Çözüm

1
Analyze the requirement for automated remediation upon budget threshold breach.
Identify that Google Cloud Billing budgets are strictly notification mechanisms and do not shut down services natively.
To automate actions (e.g., stopping VMs or capping API usage), budget notifications must be published to Cloud Pub/Sub and consumed by a Cloud Function or Cloud Run service.
2
Analyze the IAM role requirements for setting up BigQuery billing exports.
Determine that permissions are required on both the source billing account and the destination project dataset.
Configuring the export pipeline requires Billing Account Administrator on the billing account to initiate export, and BigQuery Data Editor (or Admin) on the target project to write the tables.
3
Evaluate the incorrect options regarding budget capabilities and primitive permissions.
Reject native budget auto-capping and granting blanket Project Owner roles.
Budget rules lack native auto-cap controls, and least-privilege IAM mandates specific predefined billing and BigQuery roles.

Anahtar Kavram

Programmatic Billing Budget Enforcement and BigQuery Billing Export IAM Permissions
ÖncekiSayfa 11 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin