Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 241Soru →

A logistics enterprise is designing its Google Cloud compute strategy for a mission-critical, core database engine running on Google Compute Engine. The database requires continuous 24/7 uptime, stable performance without interruptions, and predictable CPU and memory utilization. The financial operations team requires the most cost-effective pricing model for this long-term workload. Which compute provisioning strategy should you recommend?

Cevabı ve açıklamayı göster

Cevap: Provision standard Compute Engine instances for the database workload and purchase Committed Use Discounts (CUDs) for the baseline resource usage.

Cevap

Provision standard Compute Engine instances for the database workload and purchase Committed Use Discounts (CUDs) for the baseline resource usage.
The correct answer recommends provisioning standard Compute Engine instances combined with Committed Use Discounts (CUDs). Workloads that run continuously (24/7) with predictable resource demands benefit most from CUDs, which offer substantial cost savings without introducing any risk of preemption or interruption.

Adım Adım Çözüm

1
Analyze the workload characteristics
Identified a mission-critical, 24/7 continuous database requiring uninterruptible uptime and predictable resource usage.
Fault tolerance requirements dictate whether Spot/Preemptible instances can be used, while usage predictability dictates discount mechanisms.
2
Evaluate availability constraints against VM pricing models
Eliminated Spot VMs because unexpected preemption breaks mission-critical database SLAs.
Spot VMs are designed strictly for fault-tolerant batch processing and stateless scale-out workloads.
3
Select optimal cost reduction mechanism for steady-state workloads
Selected Committed Use Discounts (CUDs) for 1-year or 3-year resource commitments.
CUDs provide predictable, deep discounts without requiring changes to instance availability or operational restarts.

Anahtar Kavram

Selecting Compute Engine Instance Types and Discount Models for Continuous Workloads
Soru 242Soru →

An organization recently completed the acquisition of a startup and is integrating its standalone Google Cloud project (`analytics-pipeline-prod`) into the corporate environment. An SRE engineer has been tasked with unlinking this project from the startup's legacy credit card billing account and linking it to the parent company's primary corporate Cloud Billing account (`01A2B3-4C5D6E-7F8901`). Following Google Cloud least-privilege best practices, which minimal pair of predefined IAM roles must be granted to the SRE engineer to complete this billing link operation?

Cevabı ve açıklamayı göster

Cevap: Billing Account User (`roles/billing.user`) on the target Cloud Billing account and Project Billing Manager (`roles/resourcemanager.projectBillingManager`) on the project

Cevap

Granting Billing Account User (`roles/billing.user`) on the target Cloud Billing account and Project Billing Manager (`roles/resourcemanager.projectBillingManager`) on the target project.
Linking a Google Cloud project to a Cloud Billing account requires permissions on both resources simultaneously. The Billing Account User (`roles/billing.user`) role grants permission to link projects to the billing account (`billing.resourceAssociations.create`). The Project Billing Manager (`roles/resourcemanager.projectBillingManager`) role grants permission to attach or detach billing accounts on the specified project (`resourcemanager.projects.createBillingAssignment`). This combination satisfies least privilege.

Adım Adım Çözüm

1
Identify the required billing account permission.
The engineer requires `billing.resourceAssociations.create` on the target Cloud Billing account to attach projects to it.
Without permissions on the billing account itself, a user cannot authorize spending against that account.
2
Identify the required project permission.
The engineer requires `resourcemanager.projects.createBillingAssignment` on the target Google Cloud project to change its linked billing account.
Without permissions on the project, a user cannot modify the project's administrative configurations.
3
Map required permissions to minimal predefined roles adhering to least privilege.
Assign `roles/billing.user` on the billing account and `roles/resourcemanager.projectBillingManager` on the project.
These predefined roles contain the necessary API actions without granting excessive admin privileges like `roles/billing.admin` or `roles/owner`.

Anahtar Kavram

Dual-sided IAM requirements for linking GCP Billing Accounts to Projects under Least Privilege
Tahmini Süre:2m 0s
Soru 243Soru →

An enterprise logistics company needs to deploy a legacy image processing application on Google Cloud. The application requires specific custom kernel modules and low-level Linux operating system modifications that prevent it from being containerized. The application must run continuously 24 hours a day, 7 days a week, with a consistent workload footprint. Which compute deployment and cost management strategy should you recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy the application on standard Compute Engine virtual machines (VMs) and purchase a 1-year or 3-year Committed Use Discount (CUD) for the compute resources.

Cevap

Deploy the application on standard Compute Engine virtual machines (VMs) and purchase a 1-year or 3-year Committed Use Discount (CUD) for the compute resources.
Compute Engine Virtual Machines provide full OS access, allowing custom Linux kernel configurations that serverless or fully managed container platforms disallow. Because the workload runs continuously 24/7 with a predictable footprint, securing a 1-year or 3-year Committed Use Discount provides significant pricing reduction while guaranteeing instance availability.

Adım Adım Çözüm

1
Analyze OS and architectural requirements
The workload requires custom Linux kernel modules and OS-level modifications without containerization capabilities.
Managed container services (GKE Autopilot, Cloud Run) and serverless functions (Cloud Functions) do not allow kernel modifications or uncontainerized host OS access.
2
Select appropriate compute service
Compute Engine Virtual Machines (VMs) must be selected.
Compute Engine provides complete OS-level control, custom image support, and kernel module installation rights.
3
Evaluate workload pattern and pricing strategy
The application runs continuously 24/7 with steady resource usage, favoring Committed Use Discounts over Spot VMs.
Spot VMs risk unexpected terminations for non-fault-tolerant workloads, whereas Committed Use Discounts offer guaranteed availability with substantial cost reductions for steady-state usage.

Anahtar Kavram

Selecting GCP Compute Engine options and pricing models based on OS customization constraints and steady-state 24/7 runtime profiles.
Tahmini Süre:1m 30s
Soru 244Soru →

An enterprise organization manages its workloads in Google Cloud using a resource hierarchy consisting of an Organization node, a top-level Folder named 'Production-Apps', and a nested sub-folder named 'PCI-Compliant-Workloads'. An administrator previously granted an auditing group the 'Compute Viewer' (roles/compute.viewer) role at the 'Production-Apps' folder level. The security team now requires that this auditing group be prevented from viewing Compute Engine instances inside the 'PCI-Compliant-Workloads' folder, while maintaining their viewer access across all other projects in 'Production-Apps'. A cloud engineer attempts to remove the group's 'Compute Viewer' role binding directly on the 'PCI-Compliant-Workloads' folder, but group members are still able to list and view all Compute Engine resources within that sub-folder. Which statement accurately explains why this access persists and describes the correct administrative remedy?

Cevabı ve açıklamayı göster

Cevap: IAM permissions in Google Cloud are strictly additive and inherited down the resource hierarchy; inherited permissions cannot be revoked or denied at a lower hierarchy node. To restrict access, remove the folder-level role binding from 'Production-Apps' and grant 'Compute Viewer' only on the specific child projects or sub-folders where access is permitted.

Cevap

IAM permissions in Google Cloud are strictly additive and inherited down the resource hierarchy; inherited permissions cannot be revoked or denied at a lower hierarchy node. To restrict access, remove the folder-level role binding from 'Production-Apps' and grant 'Compute Viewer' only on the specific child projects or sub-folders where access is permitted.
In Google Cloud, IAM policy inheritance is strictly additive. Effective permissions for a resource are the union of the permissions granted at that resource level and all of its parent nodes in the resource hierarchy (Project, Folders, and Organization). Because the auditing group holds the Compute Viewer role on the parent folder, members inherit those permissions across all child folders and projects regardless of child policy edits. The correct solution is to unbind the role from the parent folder and assign it only to the specific child containers where access is intended.

Adım Adım Çözüm

1
Analyze how IAM permissions flow through the Google Cloud resource hierarchy.
Permissions granted at higher levels (Organization > Folder > Project > Resource) are automatically inherited by all child nodes beneath them.
Google Cloud IAM follows a deterministic additive inheritance model.
2
Evaluate why removing the role binding at the nested folder level failed to revoke access.
The policy on the child folder does not contain the role binding, but the evaluation engine checks all ancestor nodes up to the Organization level. Because the binding exists on the parent folder 'Production-Apps', access is granted.
Child resource IAM policies can add permissions to inherited ones, but cannot remove permissions inherited from parent nodes.
3
Determine the proper architecture to enforce the principle of least privilege.
Remove the 'Compute Viewer' role from the parent folder 'Production-Apps', and grant it explicitly on the individual projects or child folders where the auditing group is authorized.
Restricting access to a specific sub-tree requires scoping parent permissions down or reorganizing the folder structure.

Anahtar Kavram

Resource Hierarchy IAM Policy Inheritance and Additive Model
Tahmini Süre:2m 0s
Soru 245Soru →

A cloud engineer at a digital media firm is designing the serverless architecture for a web utility that processes image rendering requests. The application relies on a custom compiled C++ binary and specific Linux system libraries that are not included in standard language runtime environments. Additionally, the workload requires handling multiple concurrent HTTP requests per instance to optimize resource usage and reduce cold starts. Which Google Cloud serverless compute option should the engineer select?

Cevabı ve açıklamayı göster

Cevap: Cloud Run, because it allows deploying custom container images containing any system binary and supports setting concurrency to process multiple requests per container instance simultaneously.

Cevap

The cloud engineer should select Cloud Run because it supports custom container images with arbitrary compiled binaries and allows multi-concurrency per container instance.
Cloud Run is designed to execute stateless OCI-compliant container images. This allows developers to package custom C++ binaries, system libraries, and system configurations. Furthermore, Cloud Run instances can process multiple concurrent requests simultaneously on a single instance, meeting both operational requirements.

Adım Adım Çözüm

1
Analyze the workload requirements
Identified two main constraints: (1) requires custom compiled C++ binary and system libraries, (2) requires handling multiple concurrent HTTP requests per instance.
Serverless choice depends on runtime customization flexibility and concurrency capabilities.
2
Evaluate Google Cloud serverless compute options
Cloud Run accepts any OCI container image, allowing full control over the OS dependencies and binaries while supporting configurable request concurrency.
Cloud Functions relies primarily on standard language runtimes, whereas Cloud Run gives complete container environment control.

Anahtar Kavram

Selecting Cloud Run versus Cloud Functions based on containerization requirements, custom binaries, and request concurrency
Soru 246Soru →

A cloud engineer needs to enable the Secret Manager API (`secretmanager.googleapis.com`) for a newly created Google Cloud project named `security-vault-prod` using the `gcloud` CLI, ensuring that the target environment is configured before enablement and verified afterward. Place the administrative steps in the correct chronological sequence from start to finish.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence is: 1) Set the active `gcloud` project context to `security-vault-prod`, 2) Inspect currently enabled APIs to check state, 3) Execute the `gcloud services enable` command for `secretmanager.googleapis.com`, and 4) Verify successful activation by filtering enabled services.
The standard sequence for API management requires initializing the target CLI project context first, checking current state, enabling the service API, and validating activation upon completion.

Adım Adım Çözüm

1
Configure gcloud CLI target project context.
The CLI environment is bound to `security-vault-prod` (`gcloud config set project security-vault-prod`).
CLI commands act on the default configured project unless explicitly overridden, avoiding changes to the wrong project.
2
Inspect current API enablement state.
Run `gcloud services list --enabled` to verify active APIs.
Verifying existing configuration avoids redundant operational calls and establishes baseline state.
3
Enable the target API service.
Run `gcloud services enable secretmanager.googleapis.com`.
This enables the service API in Service Usage for the selected project.
4
Verify post-enablement API status.
Run `gcloud services list --enabled --filter="NAME:secretmanager.googleapis.com"` to verify output.
Confirmation validates that the service endpoint is active and ready for resource consumption.

Anahtar Kavram

Standard operational workflow for managing and enabling Google Cloud service APIs using the gcloud CLI tool.
Soru 247Soru →

An engineering team is planning Google Cloud infrastructure for two new workloads with distinct operational characteristics:

1. Workload 1: A stateful, single-node transactional database service that runs continuously 24/724/7 and requires high single-core performance with guaranteed compute uptime.
2. Workload 2: A stateless, fault-tolerant batch analysis service that processes asynchronous messages from Cloud Pub/Sub and can resume interrupted tasks automatically.

Which TWO provisioning and machine type strategies align with Google Cloud recommended practices for these workloads? (Select TWO answers.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision Workload 1 using standard virtual machines with Compute-Optimized (C2) or General-Purpose (N2) machine types and leverage Committed Use Discounts (CUDs).; Provision Workload 2 on Spot VMs within a Managed Instance Group (MIG) to significantly reduce batch compute costs.

Cevap

The team should provision Workload 1 using standard virtual machines with C2 or N2 machine types backed by Committed Use Discounts, and provision Workload 2 using Spot VMs within a Managed Instance Group.
Stateful 24/7 workloads require standard VM instances to guarantee availability, live migration support, and persistent attached storage durability; purchasing Committed Use Discounts optimizes long-term baseline cost. Conversely, stateless batch processing services that pull from decoupled queues are resilient to sudden interruptions and are ideal for Spot VMs, which provide deep discounts without risking data loss.

Adım Adım Çözüm

1
Analyze Workload 1 characteristics
Identified as a stateful, continuous 24/7 database requiring guaranteed single-core performance.
Stateful databases require high availability, live migration capabilities, and predictable performance, making standard VMs with Committed Use Discounts optimal.
2
Analyze Workload 2 characteristics
Identified as a stateless, fault-tolerant batch processing service.
Fault-tolerant batch processing can handle instance preemptions gracefully, allowing the use of heavily discounted Spot VMs in a Managed Instance Group.
3
Evaluate candidate strategies against Google Cloud best practices
Selected standard VMs with CUDs for Workload 1 and Spot VMs in a MIG for Workload 2.
Matches workload requirements precisely with Google Cloud cost optimization and reliability patterns.

Anahtar Kavram

Compute Engine Machine Type Selection and Spot VM vs. Committed Use Discount Suitability
Soru 248Soru →

A cloud administrator needs to ensure that team members receive email notifications whenever a Google Cloud project's monthly expenditures reach 50% and 90% of a target threshold. Which Google Cloud Billing configuration should be created to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Create a Cloud Billing budget scoped to the project and define threshold rules at 50% and 90% of the budgeted amount.

Cevap

Create a Cloud Billing budget scoped to the project and define threshold rules at 50% and 90% of the budgeted amount.
Creating a Cloud Billing budget and defining explicit threshold rules (e.g., 50% and 90%) is the standard Google Cloud method to send email notifications to billing admins and project owners when spend reaches designated limits.

Adım Adım Çözüm

1
Navigate to the Cloud Billing section in the Google Cloud Console.
Access the billing account associated with the project.
Budgets and alerts are managed under the Billing account context.
2
Select Budgets & alerts and create a new budget.
Specify the target scope (the specific project) and set the budget amount.
Scoping ensures tracking applies specifically to the intended project.
3
Configure alert threshold rules for 50% and 90% of actual or forecasted spend.
Email notifications are configured to trigger automatically when spend reaches those levels.
Threshold rules define when alert notifications are dispatched to recipients.

Anahtar Kavram

Cloud Billing Budgets and Threshold Alerts
Soru 249Soru →

A digital media engineering team is planning the serverless compute architecture for a new video processing microservice on Google Cloud. The workload relies on a custom-compiled C++ binary with specific Linux OS-level dynamic libraries. Individual processing requests take up to 40 minutes to finish, and to maintain cost efficiency, each deployed instance must process up to 8 concurrent requests simultaneously. Which serverless compute option should the team select to meet these technical requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy the application to Cloud Run using a custom container image that packages the binary and OS dependencies, setting the request timeout to 40 minutes and container concurrency to 8.

Cevap

Deploy the application to Cloud Run using a custom container image that packages the binary and OS dependencies, setting the request timeout to 40 minutes and container concurrency to 8.
Cloud Run is the optimal serverless platform for containerized applications requiring custom system dependencies (like C++ binaries and Linux libraries), long request timeouts (up to 60 minutes for HTTP requests), and configurable multi-concurrency per instance.

Adım Adım Çözüm

1
Analyze runtime and dependency constraints
The requirement specifies a custom-compiled C++ binary requiring specific OS-level dynamic libraries. Cloud Run allows arbitrary Docker container images, whereas standard serverless functions are constrained by standard language runtime buildpacks.
Containerization is required when custom binaries or system-level dependencies are present.
2
Evaluate execution timeout requirements
The workload requires a 40-minute execution timeout. Cloud Run supports HTTP request execution timeouts up to 60 minutes, whereas Cloud Functions (1st gen) caps HTTP timeouts at 9 minutes.
Long-running serverless request processing demands platforms supporting extended timeouts.
3
Evaluate concurrency requirements
Cloud Run allows configuring container concurrency so a single container instance can handle multiple requests (e.g., 8 requests) concurrently, optimizing resource utilization and cost.
Cloud Run provides explicit container concurrency controls.

Anahtar Kavram

Selecting Cloud Run versus Cloud Functions based on container customization, execution timeout limits, and concurrency settings
Tahmini Süre:2m 0s
Soru 250Soru →

A cloud engineering team is designing a Google Cloud Storage strategy for two separate workload requirements:
1. Active operational data that is read continuously throughout every business day.
2. Long-term compliance archives that are accessed less than once a year.

Which TWO Cloud Storage class selections will optimize cost for these respective workloads? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use Standard Storage for the active operational data to avoid data retrieval charges.; Use Archive Storage for the long-term compliance archives to minimize monthly storage charges.

Cevap

The correct selections are using Standard Storage for active operational data to eliminate retrieval fees, and using Archive Storage for long-term compliance archives to achieve the lowest monthly storage rates.
Selecting Standard Storage for active data prevents high data retrieval penalties, while selecting Archive Storage for rarely accessed compliance data minimizes monthly storage expenses.

Adım Adım Çözüm

1
Analyze the access frequency for active operational data.
Because active data is accessed continuously throughout every business day, retrieval fees must be avoided.
Standard Storage has zero retrieval costs and zero minimum storage duration, making it the most cost-effective choice for frequent access.
2
Analyze the access frequency and retention period for long-term compliance archives.
Because compliance data is stored long-term and accessed less than once a year, low per-gigabyte storage cost is the primary factor.
Archive Storage provides the lowest cost per gigabyte per month among Cloud Storage classes, ideal for data accessed less than once per year.

Anahtar Kavram

Selecting Cloud Storage classes based on access frequency, retrieval costs, and monthly storage rates.
Soru 251Soru →

An organization processes large genomic data files in Google Cloud Storage. The application architecture demands the following data access and lifecycle requirements:

1. Data is ingested and accessed heavily for immediate analytics during the first 30 days.
2. Between 30 days and 120 days, data access decreases to occasional monthly auditing.
3. After 120 days, data is rarely accessed (less than once per year) but must be retained for 5 years to meet regulatory compliance.
4. The solution must strictly prevent early transition or early deletion charges caused by violating Cloud Storage tier minimum storage duration policies (Nearline: 30 days, Coldline: 90 days, Archive: 365 days).

Which bucket default storage class and Object Lifecycle Management configuration achieves the lowest overall cost while satisfying all constraints without incurring minimum duration penalty fees?

Cevabı ve açıklamayı göster

Cevap: Set the default storage class to Standard. Create a lifecycle rule to transition objects to Nearline storage after 30 days of age, and a second rule to transition objects to Archive storage after 120 days of age.

Cevap

The optimal strategy is setting the default bucket storage class to Standard, transitioning objects to Nearline storage after 30 days of age, and subsequently transitioning objects to Archive storage after 120 days of age.
The correct strategy starts with Standard storage for high-frequency access during the first 30 days. Transitioning to Nearline at 30 days provides cost savings for monthly audit access. Transitioning to Archive at 120 days reduces long-term retention costs for 5 years. Because objects stay in Nearline for 90 days (from day 30 to day 120), the 30-day minimum storage duration of Nearline is satisfied, avoiding any early transition penalties.

Adım Adım Çözüm

1
Analyze the access pattern for the initial 30 days.
Heavy access during the first 30 days requires Standard storage to avoid data access and retrieval fees.
Coldline, Nearline, and Archive classes charge retrieval fees per GB, making them unsuitable for active analytics.
2
Evaluate storage class minimum durations against transition schedules.
Nearline storage requires a minimum duration of 30 days, Coldline requires 90 days, and Archive requires 365 days.
Transitioning or deleting an object before its tier's minimum storage duration incurs early deletion/transition charges equal to the remaining duration.
3
Validate the timeline for Nearline to Archive transition.
Objects reside in Nearline from day 30 to day 120 (a total of 90 days).
Since 90 days exceeds Nearline's 30-day minimum duration requirement, moving objects to Archive at day 120 incurs zero early transition penalties.

Anahtar Kavram

Cloud Storage Class Minimum Duration & Lifecycle Transition Optimization
Tahmini Süre:2m 0s
Soru 252Soru →

An enterprise architecture team is designing a cost estimation model in the Google Cloud Pricing Calculator for a nightly batch analytics pipeline. The workload requires 50 Compute Engine instances (`n2-standard-16`) operating continuously for 12 hours each night, totaling 365 hours per month per instance. The processing engine is stateless, fault-tolerant, and designed to resume from checkpoints without data loss if an instance is terminated unexpectedly. During the 12-hour operating window, the pipeline processes and updates 20 TB of active data daily, which is continuously read and written to Cloud Storage. Which parameter combination in the Pricing Calculator produces the most accurate configuration for achieving the lowest valid monthly cost estimate?

Cevabı ve açıklamayı göster

Cevap: Configure Compute Engine instances as Spot VMs running for 365 hours per month, and set the Cloud Storage bucket class to Standard storage.

Cevap

Configure Compute Engine instances as Spot VMs running for 365 hours per month, and set the Cloud Storage bucket class to Standard storage.
Selecting Spot VMs configured for 365 hours per month accurately reflects the part-time, fault-tolerant nature of the nightly batch job while capturing 60-90% compute cost reductions. Paired with Standard Cloud Storage, this avoids data retrieval fees for the 20 TB of data accessed and modified daily.

Adım Adım Çözüm

1
Evaluate Compute Engine instance provisioning type and duration based on workload resilience.
Because the batch workload is stateless, checkpoint-enabled, and fault-tolerant, Spot VMs (which offer 60-90% discounts) are the optimal choice. The hours parameter must be set to 365 hours/month (12 hours/day * 30.4 days).
Spot VMs significantly reduce compute costs compared to standard VMs or full-month CUDs when workloads can tolerate interruptions.
2
Evaluate discount combination rules in the GCP Pricing Calculator.
Committed Use Discounts (CUDs) require a continuous 1-year or 3-year commitment and cannot be stacked on top of Spot VM pricing.
Spot pricing already provides deep discounts; stacking CUDs on Spot instances is invalid in GCP pricing logic.
3
Evaluate Cloud Storage class based on access patterns and retrieval fees.
Standard Cloud Storage is required because 20 TB of data is actively read and written every single day.
Coldline, Nearline, and Archive classes charge per-GB data retrieval fees and have minimum retention periods. Daily active usage in colder tiers would incur high retrieval penalties exceeding any storage space savings.

Anahtar Kavram

Selecting optimal Compute Engine pricing models (Spot vs CUD vs SUD) and Cloud Storage classes based on runtime and data access patterns in the GCP Pricing Calculator.
Tahmini Süre:3m 0s
Soru 253Soru →

Your organization manages dozens of Google Cloud projects grouped under a single Folder named 'Workloads'. An operations team requires automated capabilities to start, stop, and reset Compute Engine virtual machine instances across all current and future projects within this Folder. According to compliance policies, members of this team must not be permitted to create new instances, modify VM disk configurations, or read object data stored in Cloud Storage buckets in any of these projects. Which strategy should you implement to grant the necessary permissions while adhering to Google Cloud best practices for resource access management?

Cevabı ve açıklamayı göster

Cevap: Define a custom IAM role containing compute.instances.start, compute.instances.stop, and compute.instances.reset permissions at the Folder level, and bind this custom role to the operations team group on the 'Workloads' Folder.

Cevap

Define a custom IAM role with only compute.instances.start, compute.instances.stop, and compute.instances.reset permissions at the Folder level, and bind it to the operations team on the 'Workloads' Folder.
The solution that defines a custom IAM role containing only instance start, stop, and reset permissions at the Folder level correctly enforces the principle of least privilege. Because IAM permissions in Google Cloud inherit downward through the resource hierarchy (Organization → Folder → Project → Resource), binding this role at the Folder level ensures all current and future child projects within the 'Workloads' folder inherit the policy without granting permissions to projects outside that folder or allowing actions beyond instance lifecycle state management.

Adım Adım Çözüm

1
Identify the minimum required permissions
The operations team only needs compute.instances.start, compute.instances.stop, and compute.instances.reset.
Predefined roles like Compute Admin grant excess permissions (creating instances, modifying disks, deleting instances) that violate compliance requirements.
2
Determine the optimal role type
Create a custom IAM role tailored specifically to the required instance lifecycle permissions.
Primitive roles (Viewer, Editor, Owner) and standard broad predefined roles exceed least privilege.
3
Determine the resource hierarchy binding level
Bind the custom IAM role at the Folder level ('Workloads').
Permissions bound at the Folder level automatically inherit down to all existing and future child projects in that folder without requiring per-project configuration or Organization-wide scope.

Anahtar Kavram

Principle of Least Privilege and IAM Resource Hierarchy Inheritance
Soru 254Soru →

A site reliability engineering team needs to enforce automated cost controls that disable billing or stop project resources when a project exceeds $10,000 in monthly spending. What is the correct sequence of steps required to configure programmatic budget notifications using Google Cloud services?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: first create the Cloud Pub/Sub topic, second deploy the Cloud Function subscribed to that Pub/Sub topic, third create the Cloud Billing budget scoped to the project, and fourth connect the Pub/Sub topic under the budget's programmatic notification settings.
To build an automated budget capping system, the messaging endpoint (Cloud Pub/Sub topic) must be created first. Next, the serverless handler (Cloud Function) is deployed and configured to trigger on messages from that Pub/Sub topic. Then, the Cloud Billing budget is created with the desired spending limits. Finally, the Pub/Sub topic is linked to the budget under the manage notification actions, establishing the workflow where budget threshold events trigger automated code execution.

Adım Adım Çözüm

1
Provision Pub/Sub infrastructure
A Cloud Pub/Sub topic exists to capture budget alert events.
Pub/Sub acts as the decoupled messaging bus between Cloud Billing and automated remediation logic.
2
Deploy programmatic consumer service
A Cloud Function with Cloud IAM permissions to manage project billing or stop instances is deployed and listening to the Pub/Sub topic.
The handler code must be active and bound to the topic before alert messages start publishing.
3
Define budget rule in Cloud Billing
A budget rule with specific monetary amounts ($10,000) and threshold percentages is established.
Establishes the financial boundary and triggers that send alert notifications.
4
Attach Pub/Sub notification action to budget
Cloud Billing streams JSON notification payloads to the topic when spending thresholds are breached.
Connects the financial threshold monitoring to the automated programmatic handler.

Anahtar Kavram

Cloud Billing Budgets do not automatically cap spending by default; automated enforcement requires linking a Cloud Billing budget to a Cloud Pub/Sub topic, which triggers serverless logic (such as a Cloud Function or Cloud Run service) to cap resources programmatically.
Soru 255Soru →

An enterprise operations team is preparing to launch an automated indexing service in project `prod-search-index`. The service requires provisioning 60 TB60\text{ TB} of `pd-ssd` storage in the `asia-east1` region. During deployment, Compute Engine returns a quota error indicating that the `SSD_TOTAL_GB` regional limit has been reached. A cloud engineer needs to assign a junior team member the minimal required permissions to view quota metrics and submit a quota increase request for this region using the Google Cloud Console. Which IAM role should be assigned to the user on the project?

Cevabı ve açıklamayı göster

Cevap: Quota Administrator (roles/servicemanagement.quotaAdmin)

Cevap

Assigning the Quota Administrator (roles/servicemanagement.quotaAdmin) role grants the user the specific permissions required to view quota limits, monitor resource consumption, and request quota increases in Google Cloud while respecting least-privilege access control.
The Quota Administrator role (roles/servicemanagement.quotaAdmin) delivers the minimum required permissions to inspect current project quotas and submit quota increase requests via the Cloud Quotas API or Google Cloud Console. This fulfills the requirement while adhering strictly to the principle of least privilege.

Adım Adım Çözüm

1
Identify the operational requirement and privilege constraints
The requirement is to view current usage metrics and submit a regional quota increase for SSD_TOTAL_GB in asia-east1 using least privilege.
Security best practices dictate providing only the permissions necessary to perform quota operations without granting broader resource modification rights.
2
Evaluate IAM roles related to resource quota management
The Quota Administrator role (roles/servicemanagement.quotaAdmin) provides the servicemanagement.quotaAdmin permission set required to view and request quota adjustments across GCP services.
Predefined roles like Quota Administrator isolate administrative quota tasks from billing or compute instance management.
3
Eliminate roles that violate least privilege or address unrelated services
Compute Admin and Project Editor over-privilege the user by granting full compute/resource management, while Billing Account Administrator targets billing configuration rather than service quota adjustments.
Resource quotas are managed through Service Management / Cloud Quotas and require specific quota administration privileges.

Anahtar Kavram

Least-privilege IAM configuration for GCP resource quota management
Tahmini Süre:2m 0s
Soru 256Soru →

A cloud engineer is tasked with onboarding a new telemetry analytics team into an existing Google Cloud Organization. The engineer must establish an isolated resource hierarchy branch, enable resource consumption, and delegate administrative access following Google Cloud recommended practices. Arrange the following administrative steps in the correct operational sequence from start to finish.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence is: 1) Create the environment folder under the Organization node, 2) Provision the new Cloud Project inside that folder, 3) Link an active Cloud Billing Account to the project, and 4) Grant predefined IAM roles to the engineering team at the project level.
The workflow follows logical GCP dependency requirements: the parent Folder must be provisioned first within the Organization hierarchy; the Project is then created as a child of that Folder; the Billing Account is attached to the Project to allow compute resource allocation; and finally, IAM role bindings are configured on the initialized Project resource to grant appropriate team access.

Adım Adım Çözüm

1
Execute `gcloud resource-manager folders create` specifying the Organization ID as the parent.
Establishes the container folder within the organization hierarchy.
Projects require a designated parent node (Organization or Folder) during creation.
2
Execute `gcloud projects create` specifying the newly created folder ID as the `--folder` flag.
Creates the project resource within the folder hierarchy.
The project must exist before billing can be linked or IAM policies attached.
3
Execute `gcloud billing projects link` with the project ID and billing account ID.
Associates the project with an active billing account.
Enables paid service resource provisioning within the newly created project.
4
Execute `gcloud projects add-iam-policy-binding` to assign predefined roles to the team group.
Delegates access permissions to team members.
Applies principle of least privilege access control to the operational project.

Anahtar Kavram

Resource Hierarchy Construction and Project Lifecycle Management
Tahmini Süre:1m 30s
Soru 257Soru →

A cloud engineer needs to grant a user permissions to inspect the configuration and operational status of Compute Engine virtual machine instances within a specific Google Cloud project. The user should not be granted any capabilities to modify, start, stop, or delete instances, nor read access to other project services. Following Google Cloud recommended security best practices for least privilege access control, which IAM role should be assigned to the user?

Cevabı ve açıklamayı göster

Cevap: Compute Viewer (roles/compute.viewer)

Cevap

Compute Viewer (roles/compute.viewer)
The Compute Viewer role (roles/compute.viewer) is a predefined role that grants read-only access to Compute Engine resources. It allows the user to view instance configurations and status without permitting modifications, instance state changes, or access to other services in the project, adhering strictly to the principle of least privilege.

Adım Adım Çözüm

1
Analyze the access requirement
The target user requires read-only access limited specifically to Compute Engine virtual machines.
Identifying the specific service and permission scope prevents over-granting access.
2
Evaluate role types against Google Cloud best practices
Predefined roles should always be selected over broad primitive roles (Owner, Editor, Viewer).
Primitive roles apply project-wide permissions across all services, violating the principle of least privilege.
3
Select the optimal predefined role for the service
Compute Viewer (roles/compute.viewer) precisely allows viewing Compute Engine resources without granting modify rights or access to other GCP services.
This matches the exact scope required for the task.

Anahtar Kavram

Principle of Least Privilege using Predefined IAM Roles
Soru 258Soru →

A cloud architecture team at a healthcare organization is evaluating Google Cloud serverless options for two distinct microservices:

1. Service A: A legacy enterprise Java application packaged as a custom Docker container image listening on port 8080. It requires request concurrency (handling multiple concurrent HTTP requests per instance) and high memory allocation (up to 16 GB RAM).
2. Service B: A lightweight event-driven background handler written in Node.js that runs for under 30 seconds to extract metadata whenever a new patient record file is uploaded to a Cloud Storage bucket.

Which TWO deployment decisions correctly align with Google Cloud serverless compute best practices for these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy Service A to Cloud Run because it supports custom container images, multi-request concurrency per instance, and high memory configurations.; Deploy Service B to Cloud Functions (or Cloud Functions 2nd gen) triggered by Cloud Storage bucket events to execute code directly without maintaining container infrastructure.

Cevap

The correct architectural decisions are deploying Service A to Cloud Run and deploying Service B to Cloud Functions.
Deploying Service A to Cloud Run is correct because Cloud Run fully supports custom Docker containers, configurable memory up to 32 GB, and request concurrency on a single instance. Deploying Service B to Cloud Functions is correct because it natively integrates with Cloud Storage events to execute lightweight event handlers without needing dedicated container builds or compute management.

Adım Adım Çözüm

1
Analyze the requirements for Service A
Service A requires deploying a custom Docker container listening on port 8080, handling concurrent requests per instance, and allocating up to 16 GB RAM.
Cloud Run is the appropriate serverless compute service for containerized workloads that require custom runtimes, high memory limits, and request concurrency.
2
Analyze the requirements for Service B
Service B is a short-running (under 30 seconds), lightweight Node.js event handler triggered directly by Cloud Storage object upload events.
Cloud Functions is optimized for event-driven snippets responding to cloud events without requiring container packaging or infrastructure management.
3
Evaluate the combined choices against Google Cloud serverless options
Selecting Cloud Run for Service A and Cloud Functions for Service B satisfies all technical constraints with minimum operational complexity.
Matching workload paradigms to service strengths ensures cost efficiency, scaling performance, and alignment with GCP best practices.

Anahtar Kavram

Selecting serverless compute execution paradigms based on container requirements, concurrency settings, and event trigger mechanisms.
Tahmini Süre:2m 0s
Soru 259Soru →

A company is planning to deploy a lightweight internal web portal on Google Cloud. The DevOps team wants Google Cloud to manage all underlying node infrastructure, including automatic provisioning, scaling, node maintenance, and security hardening, without needing to manually define or manage node pools. Which GKE mode of operation should the team choose to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: GKE Autopilot mode

Cevap

Deploying the workload using GKE Autopilot mode fulfills the requirement because Google Cloud manages the cluster nodes, sizing, security configuration, and node scaling automatically.
GKE Autopilot mode fully automates node provisioning, cluster scaling, node maintenance, and security hardening. Users focus solely on defining workload pod specifications, making it the ideal choice when zero node-management overhead is requested.

Adım Adım Çözüm

1
Identify the primary operational requirement from the scenario.
The team requires zero manual node pool configuration and complete infrastructure management by Google Cloud.
Choosing the correct GKE cluster architecture depends on evaluating operational overhead versus cluster customization control.
2
Evaluate GKE deployment modes against the operational requirement.
GKE Autopilot provisions and manages nodes automatically based on pod specifications, while GKE Standard requires manual management of node pools.
Autopilot shifts node provisioning, scaling, and maintenance responsibilities entirely to Google Cloud.

Anahtar Kavram

GKE Autopilot vs. Standard Operational Boundaries
Soru 260Soru →

A company is planning to store high-resolution website graphics in a Google Cloud Storage bucket. These image files will be accessed continuously throughout the day by active web applications requiring immediate, low-latency availability with no retrieval cost penalties. Which Google Cloud Storage class should be chosen for this bucket?

Cevabı ve açıklamayı göster

Cevap: Standard Storage

Cevap

Standard Storage is the optimal choice for active, frequently accessed data requiring immediate availability without access or retrieval fee penalties.
Standard Storage is intended for active, frequently accessed data. It provides high availability and low latency with no retrieval fees, matching the requirement for continuous web graphics serving.

Adım Adım Çözüm

1
Analyze the access pattern and operational requirements.
The workload requires continuous access throughout the day with low latency and zero retrieval fee penalties.
Choosing a storage class depends on access frequency, retention minimums, and retrieval charges.
2
Evaluate Google Cloud Storage class characteristics.
Standard Storage provides low latency for hot data with no minimum storage duration or per-GB retrieval fees.
Nearline, Coldline, and Archive storage classes charge per-GB retrieval fees and enforce minimum retention periods, making them cost-prohibitive for active workloads.

Anahtar Kavram

Selecting Cloud Storage Classes Based on Access Frequency and Retrieval Fees
ÖncekiSayfa 13 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin