Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 281Soru →

An infrastructure administrator must configure an automated CI/CD service account to provision new workload projects inside a designated parent folder named `Data-Ingestion-Platform` and link those projects to the enterprise billing account `012345-6789AB-CDEF01`. Which requirements and resource hierarchy behaviors apply to this setup according to Google Cloud best practices? (Select TWO choices.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The service account must be granted the Project Creator role (roles/resourcemanager.projectCreator) on the Data-Ingestion-Platform folder and the Billing Account User role (roles/billing.user) on the target billing account.; IAM roles granted on the Data-Ingestion-Platform folder are additively inherited by all child projects and cannot be overridden to restrict inherited access at the project level.

Cevap

The service account requires the Project Creator role on the target folder and the Billing Account User role on the billing account, and IAM permissions granted at the parent folder level are additively inherited by child projects without possibility of child-level revocation.
To create a project within a specific folder and link it to a billing account, the acting principal needs `roles/resourcemanager.projectCreator` on the parent folder and `roles/billing.user` on the billing account. Furthermore, Google Cloud IAM policy inheritance is additive: permissions granted on parent folders flow down to child projects and cannot be revoked at the child level.

Adım Adım Çözüm

1
Determine the required IAM roles for project creation and billing account linking under least privilege.
Creating projects inside a specific folder requires `roles/resourcemanager.projectCreator` on that folder. Linking projects to a billing account requires `roles/billing.user` on the billing account itself.
Permissions must be scoped precisely to the necessary resources and predefined roles rather than using broad primitive roles at the Organization level.
2
Analyze how IAM inheritance operates within the Google Cloud resource hierarchy (Organization > Folder > Project > Resource).
Policies inherited from parent folders apply to all descendant projects. Permissions are additive and cannot be denied or revoked at lower nodes.
Google Cloud IAM follows a strict additive union model where effective permissions on a resource are the union of permissions granted at the resource itself and all its parent nodes.

Anahtar Kavram

Resource Hierarchy IAM Inheritance & Project Provisioning Roles
Soru 282Soru →

A smart grid technology company is planning compute resources on Google Cloud for two distinct backend workload components:

1. Workload 1: A stateless REST API endpoint that receives unpredictable, bursty HTTP requests from smart meters. It requires automatic scaling down to zero instances during zero-traffic periods to eliminate idle resource costs.
2. Workload 2: A daily 4-hour batch data transformation pipeline that is completely stateless, fault-tolerant, and capable of saving state checkpoints externally to handle instance interruptions.

Which TWO compute service configurations should the cloud engineer select to satisfy these requirements cost-effectively?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy Workload 1 on Cloud Run to leverage containerized automatic scaling to zero instances when no HTTP traffic is present.; Provision Compute Engine Spot VMs for Workload 2 to significantly reduce compute costs for short-lived, fault-tolerant batch processing.

Cevap

The correct architecture decisions are deploying Workload 1 on Cloud Run to enable scale-to-zero capabilities for bursty HTTP requests, and provisioning Spot VMs on Compute Engine for Workload 2 to cost-effectively run fault-tolerant batch workloads.
Cloud Run is the optimal compute service for Workload 1 because it automatically scales containerized HTTP workloads down to zero when no traffic arrives, eliminating idle costs. For Workload 2, Spot VMs on Compute Engine provide massive cost reductions for batch jobs that are stateless and checkpointed to handle potential instance preemptions.

Adım Adım Çözüm

1
Analyze Workload 1 requirements
Workload 1 is a stateless HTTP REST API with bursty, unpredictable traffic that requires scale-to-zero when inactive.
Cloud Run natively supports containerized stateless microservices with automatic request-based scaling down to 0 instances, making it the most cost-efficient choice for bursty web APIs.
2
Analyze Workload 2 requirements
Workload 2 runs 4 hours daily, is stateless, fault-tolerant, and supports checkpointing.
Spot VMs provide significant cost savings (60–91%) for workloads that can tolerate preemption and run for short durations.
3
Evaluate invalid alternative options
Cloud Functions does not support multi-container stacks, Committed Use Discounts are inefficient for 4-hour daily tasks, and GKE Autopilot locks node OS configurations.
Selecting appropriate GCP compute options requires matching workload statefulness, scaling characteristics, and administrative boundaries against GCP product limitations.

Anahtar Kavram

Selecting GCP Compute Services Based on Workload Characteristics and Cost Efficiency
Soru 283Soru →

A lead software engineer at a telehealth organization needs to migrate the billing for an existing project, `care-telehealth-prod`, by linking it to a newly established central corporate Cloud Billing Account. The engineer has already been granted the Billing Account User role (`roles/billing.user`) on the target corporate Cloud Billing Account. However, when trying to change the project's billing account in the Google Cloud Console, the action is denied. Following Google Cloud's principle of least privilege, which IAM role should be assigned to the engineer on the `care-telehealth-prod` project resource to allow this linking?

Cevabı ve açıklamayı göster

Cevap: Project Billing Manager (`roles/billing.projectManager`)

Cevap

Project Billing Manager (`roles/billing.projectManager`) on the project
Linking an existing Google Cloud project to a Cloud Billing Account requires two distinct permissions: `roles/billing.user` on the billing account (which allows using the account) and `resourcemanager.projects.createBillingAssignment` on the project (which allows attaching billing to the project). The Project Billing Manager predefined role (`roles/billing.projectManager`) grants this exact project permission without conveying full project administration capabilities, adhering strictly to the principle of least privilege.

Adım Adım Çözüm

1
Identify dual-permission requirements for billing account linking
Linking a project requires permissions on both the target Cloud Billing Account and the specific Google Cloud Project.
Security controls require authorization to spend money from the billing account AND authorization to attach cost responsibilities to the project.
2
Evaluate existing permissions against requirements
The engineer already possesses the Billing Account User role (`roles/billing.user`) on the Cloud Billing Account, satisfying the billing side requirement.
The missing permission is on the project side (`resourcemanager.projects.createBillingAssignment`).
3
Select the appropriate predefined role enforcing least privilege
The Project Billing Manager role (`roles/billing.projectManager`) provides the exact project-level billing linkage permission without over-granting resource access.
Predefined roles should always be preferred over primitive roles like Owner.

Anahtar Kavram

Two-sided permission model for linking Google Cloud Projects to Cloud Billing Accounts
Soru 284Soru →

An enterprise logistics company is planning a serverless compute solution on Google Cloud for two distinct microservices:

1. Service 1: A gRPC-based route planning engine packaged as a custom C++ container binary that requires serving up to 80 concurrent requests per instance.
2. Service 2: A lightweight Python script that must execute automatically in response to file creation events in a Cloud Storage bucket.

Which of the following architectural deployment choices should the cloud engineer select for these workloads? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy Service 1 to Cloud Run because it supports custom container runtimes and per-instance request concurrency.; Deploy Service 2 to Cloud Functions using an Eventarc or Cloud Storage event trigger.

Cevap

The cloud engineer should deploy Service 1 to Cloud Run to support custom container binaries with high concurrency, and deploy Service 2 to Cloud Functions to leverage automatic Cloud Storage event triggers.
Deploying Service 1 to Cloud Run satisfies the requirements for a custom C++ container binary, gRPC protocol support, and multi-concurrency. Deploying Service 2 to Cloud Functions provides a seamless, serverless event-driven mechanism that triggers upon Cloud Storage file uploads.

Adım Adım Çözüm

1
Analyze Service 1 requirements.
Service 1 relies on a custom C++ container image, gRPC protocol, and requires multi-concurrency (up to 80 requests per instance).
Cloud Run is the optimal Google Cloud serverless product for custom containers requiring request concurrency and gRPC support.
2
Analyze Service 2 requirements.
Service 2 is a lightweight Python script triggered by object creation events in Cloud Storage.
Cloud Functions provides a simple, managed serverless environment tailored for light event handlers responding directly to Cloud Storage triggers.

Anahtar Kavram

Selecting between Cloud Run and Cloud Functions based on container customization, concurrency, and event-triggering models.
Soru 285Soru →

A cloud engineer needs to grant an external auditor access to inspect IAM policies for a specific Google Cloud project using the gcloud command-line interface. What is the correct sequence of command steps to authenticate, set the project context, assign the least-privilege predefined IAM role, and verify the assignment?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins with authenticating the session, selecting the target project configuration, applying the least-privilege IAM policy binding with gcloud projects add-iam-policy-binding, and finally inspecting the policy with gcloud projects get-iam-policy to verify access.
The workflow follows standard Google Cloud management practices: first establish user identity ('gcloud auth login'), target the appropriate resource scope ('gcloud config set project'), execute the security policy modification using least-privilege predefined roles ('gcloud projects add-iam-policy-binding'), and finally audit the change ('gcloud projects get-iam-policy').

Adım Adım Çözüm

1
Authenticate session credentials.
Obtain user authorization credentials for gcloud.
CLI tools require authentication before attempting resource configuration or IAM policy mutations.
2
Set active project ID context.
Target project set in local CLI profile configuration.
Establishing project context avoids accidentally modifying permissions on the wrong Google Cloud project.
3
Add IAM policy binding with a predefined role.
The role 'roles/iam.securityReviewer' is assigned to 'user:[email protected]'.
Google Cloud best practice requires granting least-privilege predefined roles rather than basic/primitive roles like Owner or Editor.
4
Retrieve project IAM policy.
Returns the updated IAM policy bindings array.
Verifying the IAM policy ensures the binding was persisted successfully without syntax or scope errors.

Anahtar Kavram

Managing IAM Roles and Resource Access Permissions via gcloud CLI
Soru 286Soru →

A system administrator needs to store software installation packages and container base images in a Google Cloud Storage bucket. These artifacts are downloaded multiple times per hour by CI/CD build pipelines and development teams. Which Cloud Storage class should be selected as the default storage class for the bucket to provide high availability without incurring retrieval fees?

Cevabı ve açıklamayı göster

Cevap: Standard Storage

Cevap

Standard Storage
Standard Storage is the optimal choice for active, frequently accessed data such as software dependencies and container images used in CI/CD pipelines because it provides low latency access without charging any data retrieval fees.

Adım Adım Çözüm

1
Analyze the workload data access pattern
The build artifacts are accessed continuously multiple times per hour.
Access frequency dictates the optimal Cloud Storage tier to minimize total cost of ownership.
2
Evaluate retrieval cost structures across storage classes
Standard Storage carries zero retrieval fee per GB, whereas Nearline, Coldline, and Archive impose retrieval fees.
For high-frequency read operations, data retrieval charges in colder storage classes quickly outweigh any at-rest storage savings.

Anahtar Kavram

Selecting Cloud Storage Classes Based on Access Frequency
Soru 287Soru →

A cloud engineer needs to set up a BigQuery billing export for detailed cost analysis across an organization. What is the correct sequence of steps to configure this Cloud Billing export?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with creating the BigQuery dataset, granting the Cloud Billing service account the BigQuery Data Editor IAM role on that dataset, navigating to Billing export in the Cloud Billing console, and finally configuring the Detailed usage cost export settings.
Setting up a BigQuery billing export requires preparing the destination environment first. Creating the dataset establishes the target container. Granting the Cloud Billing service account the BigQuery Data Editor role ensures Cloud Billing has permission to create tables and insert billing records. Navigating to the Cloud Billing export console and enabling the Detailed usage cost export with the dataset completes the process.

Adım Adım Çözüm

1
Create a BigQuery dataset in the target project.
A destination dataset is created to store billing export tables.
BigQuery requires a dataset to exist before data can be written or targeted by Cloud Billing.
2
Grant the BigQuery Data Editor role on the dataset to the Cloud Billing service account.
The automated Cloud Billing service account receives write authorization.
Without this permission, billing export operations will fail due to lack of write privileges.
3
Navigate to Cloud Billing > Billing export in the GCP Console.
The Cloud Billing export settings interface is displayed.
This is the management location for initiating BigQuery billing data exports.
4
Configure Detailed usage cost export by specifying the project and dataset, then save.
Daily automated billing data export begins streaming to BigQuery.
This links the billing account with the permissioned BigQuery dataset.

Anahtar Kavram

BigQuery Billing Export Setup Sequence and Service Account Authorization
Soru 288Soru →

An organization is planning its Google Compute Engine infrastructure for two new enterprise services with distinct operational profiles:

1. Workload 1: An offline rendering and data processing pipeline that runs daily. The application is stateless, fault-tolerant, and designed to checkpoint progress so it can be safely paused and resumed.
2. Workload 2: A core relational database instance requiring heavy RAM usage per vCPU that must run continuously 24/7 with zero unannounced downtime.

Which TWO architectural decisions correctly align with Google Cloud resource planning and pricing best practices for these workloads? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision Spot VMs for Workload 1 to minimize compute overhead for fault-tolerant batch jobs.; Provision a memory-optimized machine family instance combined with a 1-year or 3-year Committed Use Discount (CUD) for Workload 2.

Cevap

The two correct architectural decisions are: using Spot VMs for the stateless, fault-tolerant offline data processing pipeline (Workload 1), and provisioning a memory-optimized machine family with Committed Use Discounts for the continuous 24/7 relational database (Workload 2).
Deploying Spot VMs for fault-tolerant, checkpoint-enabled batch jobs takes advantage of extreme cost discounts without risking job completion. For steady-state 24/7 databases needing high RAM, selecting a memory-optimized machine family with Committed Use Discounts maximizes performance while securing the deepest contractual cost reduction.

Adım Adım Çözüm

1
Analyze the operational requirements of Workload 1.
Workload 1 is offline batch processing, stateless, checkpoint-enabled, and fault-tolerant.
Fault-tolerant workloads that can withstand instance termination are ideal candidates for Spot VMs, which offer up to 60-91% discounts compared to standard VM pricing.
2
Analyze the operational requirements of Workload 2.
Workload 2 requires high RAM density per vCPU and continuous, uninterrupted 24/7 uptime over a predictable multi-year lifecycle.
Memory-optimized machine families (e.g., M1/M2/M3) cater to RAM-intensive database engines. Committing to a 1-year or 3-year term via Committed Use Discounts yields much higher discounts than relying solely on automatic Sustained Use Discounts.
3
Evaluate and eliminate non-viable options.
Discard strategies recommending Spot VMs for persistent databases or relying on automatic Sustained Use Discounts for long-term predictable commitments.
Spot VMs risk data disruption for non-fault-tolerant databases, and Sustained Use Discounts yield lower savings compared to contractual Committed Use Discounts for predictable multi-year workloads.

Anahtar Kavram

Selecting machine families and pricing models based on fault tolerance, memory density, and uptime predictability.
Tahmini Süre:2m 0s
Soru 289Soru →

An organization is planning to connect its existing on-premises network, which uses the IP range 10.0.0.0/810.0.0.0/8, to Google Cloud using Cloud VPN. The cloud engineer must design a Virtual Private Cloud (VPC) network that prevents IP address collisions with the on-premises environment and allows precise control over subnet IP address allocations in specific regions. Which VPC network creation mode should the cloud engineer select?

Cevabı ve açıklamayı göster

Cevap: Create a custom-mode VPC network and manually define subnets with non-overlapping CIDR blocks.

Cevap

Create a custom-mode VPC network and manually define subnets with non-overlapping CIDR blocks.
Custom-mode VPC networks start with zero automatically created subnets. This grants administrators full control to define custom subnet names, regions, and explicit CIDR ranges that do not collide with on-premises networks or other cloud environments.

Adım Adım Çözüm

1
Analyze IP addressing requirements for hybrid connectivity.
Identified existing on-premises space (10.0.0.0/810.0.0.0/8) which overlaps with default GCP auto-mode ranges (10.128.0.0/910.128.0.0/9).
Preventing IP collisions is essential for routing traffic over Cloud VPN.
2
Evaluate VPC network modes (Auto vs. Custom).
Custom-mode VPC networks start with no subnets, giving total flexibility over subnet creation, regional placement, and IP range selection.
Auto-mode creates subnets in all regions automatically using fixed CIDRs, introducing conflict risks.
3
Select the optimal configuration mode.
Choose custom-mode VPC network creation.
It fulfills the requirement for strict control and collision prevention.

Anahtar Kavram

Custom-mode VPC networks allow complete control over subnet creation and IP address range allocation, which is necessary for hybrid cloud integrations.
Tahmini Süre:1m 0s
Soru 290Soru →

A cloud engineering team is planning a new Google Kubernetes Engine (GKE) deployment for a suite of stateless web microservices. The team needs to ensure the workload has high availability across multiple zones in a region while completely eliminating the operational overhead of provisioning, patching, and managing worker node infrastructure. Which TWO cluster architecture options should the team select to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the cluster using GKE Autopilot mode.; Configure a Regional cluster architecture.

Cevap

The cloud engineering team should select GKE Autopilot mode and configure a Regional cluster architecture.
Deploying in GKE Autopilot mode fulfills the requirement to eliminate node management overhead by allowing Google Cloud to handle node provisioning, security patching, and auto-scaling. Selecting a Regional cluster architecture ensures high availability by replicating the control plane across multiple zones in a region and running worker nodes across those zones.

Adım Adım Çözüm

1
Analyze the operational overhead requirement.
GKE Autopilot automates node management, OS patching, auto-repair, and scaling, eliminating worker node management overhead.
GKE Standard requires configuring and managing node pools, whereas Autopilot delegates cluster infrastructure operations fully to Google Cloud.
2
Analyze the availability requirement.
Selecting a Regional cluster deploys multiple control plane instances and node pools across several availability zones within the chosen GCP region.
Zonal clusters host control planes and nodes within a single zone, making them vulnerable to zonal outages.

Anahtar Kavram

GKE Autopilot Operational Model and Regional Cluster High Availability Topology
Soru 291Soru →

A department lead needs to delegate project creation rights to a team of developers. The developers must be allowed to create new Google Cloud projects within a designated folder named `Department-Dev` and link those newly created projects to the company's central billing account. However, they should not be able to create projects anywhere else in the organization or alter billing account settings. Following the principle of least privilege, which combination of IAM role assignments should be configured?

Cevabı ve açıklamayı göster

Cevap: Grant Project Creator (roles/resourcemanager.projectCreator) on the Department-Dev folder, and Billing Account User (roles/billing.user) on the central billing account.

Cevap

Grant Project Creator (roles/resourcemanager.projectCreator) on the Department-Dev folder, and Billing Account User (roles/billing.user) on the central billing account.
To create projects inside a specific folder and link them to a billing account under the principle of least privilege, a user requires `roles/resourcemanager.projectCreator` scoped to that target folder, as well as `roles/billing.user` scoped to the target Billing Account.

Adım Adım Çözüm

1
Determine the required permission for project creation within a specific folder.
Assign roles/resourcemanager.projectCreator directly on the target folder (`Department-Dev`).
Permissions inherit downward. Placing the role at the folder level limits project creation scope strictly to that folder.
2
Determine the required permission for linking projects to an enterprise billing account.
Assign roles/billing.user on the Billing Account resource.
Linking a project to a billing account requires `resourcemanager.projects.create` on the parent folder and `billing.resourceAssociations.create` on the billing account itself.

Anahtar Kavram

Folder-Scoped Project Creation and Billing Account IAM Scoping
Soru 292Soru →

A financial technology firm is deploying a real-time trading processing engine on Google Cloud consisting of two core workload components. Component 1 is a trading account management database requiring full SQL compliance, multi-table ACID transactions, automated regional failover, and high write performance. Component 2 is an ephemeral risk simulation pipeline performing transient parallel calculations requiring ultra-low sub-millisecond I/O latency, where scratchpad data can be re-generated if an instance terminates. Which TWO storage and database configurations should the solution architect implement to meet these requirements with minimal operational overhead? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision a Cloud SQL instance configured with High Availability (regional failover) using SSD Persistent Disk (pd-ssd) for the trading account management database.; Attach Local SSD storage to the Compute Engine virtual machines executing the transient risk simulation pipeline.

Cevap

The architect should deploy a High Availability Cloud SQL instance backed by SSD Persistent Disks for the relational account database, and attach Local SSDs to Compute Engine instances for the high-speed scratchpad risk simulation workload.
Cloud SQL configured with High Availability delivers an automated failover solution with full relational SQL and ACID transactional guarantees using SSD Persistent Disk storage. For transient high-performance scratchpad data, Local SSD delivers sub-millisecond latency and high IOPS directly attached to Compute Engine instances.

Adım Adım Çözüm

1
Analyze requirement for Component 1 (trading account database)
Identified needs: relational SQL, multi-table ACID compliance, regional automated failover, and high write throughput.
Cloud SQL with HA configuration in a regional deployment meets relational and regional failover needs, while pd-ssd provides required IOPS performance.
2
Analyze requirement for Component 2 (risk simulation pipeline)
Identified needs: sub-millisecond latency, extremely high IOPS, transient/ephemeral data retention.
Local SSD provides maximum IOPS and microsecond latency directly on the host instance, perfectly matching ephemeral scratchpad requirements.
3
Evaluate and eliminate non-compliant distractors
Cloud Bigtable lacks relational SQL/ACID features, and Coldline Cloud Storage introduces massive latency and per-operation retrieval costs for frequent transient data access.
Matching workload patterns against Google Cloud storage characteristics prevents architectural anti-patterns.

Anahtar Kavram

Selecting GCP Managed Databases and Storage Types based on Relational/ACID needs, latency, availability, and durability constraints.
Soru 293Soru →

A cloud solutions architect is planning a hybrid network topology for an enterprise migrating workloads to Google Cloud. The existing on-premises data center uses the RFC 1918 private IPv4 block 10.128.0.0/1410.128.0.0/14 for internal corporate services and will connect to Google Cloud via Cloud Interconnect. The cloud infrastructure requires Compute Engine instances deployed across multiple regions with dynamic routing enabled. The architect must ensure that network traffic routes seamlessly between on-premises systems and Google Cloud resources without IP routing collisions or overlap. Which network configuration strategy should the architect implement?

Cevabı ve açıklamayı göster

Cevap: Create a custom-mode Virtual Private Cloud (VPC) network and manually define subnets using non-overlapping IP address ranges such as 172.16.1.0/24172.16.1.0/24 in us-central1 and 172.16.2.0/24172.16.2.0/24 in europe-west1.

Cevap

The architect should create a custom-mode VPC network and manually define subnets using non-overlapping IP address ranges (such as 172.16.1.0/24172.16.1.0/24 and 172.16.2.0/24172.16.2.0/24) that do not conflict with the on-premises 10.128.0.0/1410.128.0.0/14 CIDR range.
Creating a custom-mode VPC network allows cloud engineers to explicitly define non-overlapping CIDR blocks for each regional subnet. Because auto-mode VPC networks allocate default subnet ranges strictly inside the 10.128.0.0/910.128.0.0/9 block, auto-mode would overlap with the on-premises 10.128.0.0/1410.128.0.0/14 network. Choosing custom mode with distinct ranges ensures clean hybrid IP routing over Cloud Interconnect.

Adım Adım Çözüm

1
Analyze the on-premises IP space constraint.
The on-premises network occupies 10.128.0.0/1410.128.0.0/14, which spans IP addresses from 10.128.0.010.128.0.0 to 10.131.255.25510.131.255.255.
Any VPC subnet overlapping this block will cause packet routing failures over Cloud Interconnect.
2
Evaluate GCP Auto-Mode VPC default behavior.
Auto-mode VPC automatically creates subnets in every region using default ranges within the 10.128.0.0/910.128.0.0/9 block (e.g., 10.128.0.0/2010.128.0.0/20, 10.132.0.0/2010.132.0.0/20, etc.).
Auto-mode ranges directly overlap with the enterprise on-premises 10.128.0.0/1410.128.0.0/14 network.
3
Determine the optimal VPC creation mode and IP range allocation.
Custom-mode VPC must be selected, allowing explicit definition of custom, non-overlapping subnet ranges outside 10.128.0.0/1410.128.0.0/14 (e.g., in the 172.16.0.0/12172.16.0.0/12 or non-conflicting 10.0.0.0/810.0.0.0/8 space).
Custom-mode VPCs provide complete control over subnet IP planning, meeting enterprise security and routing requirements.

Anahtar Kavram

VPC Custom Mode vs Auto Mode Subnet Planning in Hybrid Architectures
Tahmini Süre:2m 0s
Soru 294Soru →

An infrastructure engineer is expanding a high-throughput event processing platform in Google Cloud Project `telemetry-ingest-504`. When attempting to launch additional Compute Engine instances in the `europe-west3` region, instance creation fails with an error stating that the regional quota limit has been exceeded. Which TWO steps should the engineer take to resolve this issue and request additional capacity following Google Cloud best practices?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Submit a quota increase request for N2D vCPUs in the `europe-west3` region using the Google Cloud Console Quotas page.; Ensure the requesting IAM identity has the Quota Administrator (`roles/servicemanagement.quotaAdmin`) role granted.

Cevap

To resolve a regional compute quota limit failure, the engineer must ensure their IAM identity is assigned the Quota Administrator role (`roles/servicemanagement.quotaAdmin`) and submit a formal quota increase request for the specific region (`europe-west3`) and resource metric via the Cloud Console Quotas interface.
Resolving a regional resource quota limit requires submitting an explicit quota increase request for the affected metric in the target region (`europe-west3`) via the Cloud Console or gcloud CLI. Additionally, the user performing the request must hold the Quota Administrator (`roles/servicemanagement.quotaAdmin`) role to possess the required permissions.

Adım Adım Çözüm

1
Identify the required IAM permissions for quota management.
Determined that submitting quota increase requests requires the `servicemanagement.executes.sendQuotaRequest` permission, contained in the Quota Administrator role.
Principle of least privilege requires granting targeted quota administration roles rather than administrative billing or primitive roles.
2
Access the Google Cloud Console Quotas page and select the affected region and metric.
Formally submitted a request to increase N2D vCPUs in `europe-west3` for project `telemetry-ingest-504`.
GCP resource quotas restrict consumption per project/region to prevent unexpected usage and must be explicitly increased by Google Cloud support or automated review workflows.

Anahtar Kavram

GCP Resource Quota Request Procedures and IAM Requirements
Soru 295Soru →

A cloud engineering team needs to expand the primary IP range of a subnet within an auto-mode Virtual Private Cloud (VPC) network in Google Cloud to accommodate new Compute Engine instances without disrupting existing network traffic. Place the steps required to safely convert the network mode and expand the subnet IP range into the correct sequential order.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order begins with verifying that the target expanded CIDR range will not cause IP address overlap, followed by switching the VPC network from auto mode to custom mode using the gcloud compute networks update command. Next, expand the primary subnet range using gcloud compute networks subnets expand-ip-range, and finally verify the updated configuration and deploy workloads into the expanded subnet space.
Expanding a subnet primary IP range in Google Cloud requires IP planning first to avoid collisions, followed by converting an auto-mode VPC to custom mode, executing the gcloud expand-ip-range command, and finally verifying the change before deploying workloads.

Adım Adım Çözüm

1
Perform IP range planning and overlap checks.
Ensures the prospective enlarged CIDR block does not collide with connected VPN/Interconnect routes or other VPC subnets.
Expanding a subnet into an already routed or overlapping CIDR range breaks routing and network communication.
2
Switch the VPC network mode from auto to custom.
The VPC network transition completes, enabling custom subnet management capabilities.
Google Cloud auto-mode VPC networks have predefined /20 subnets per region that cannot be manually expanded until switched to custom mode.
3
Expand the primary IP range of the target subnet.
The subnet's netmask is broadened (e.g., from /24 to /23), making more IP addresses available.
Subnet expansion can only increase the primary range (reduce prefix length) and must be contiguous with the current starting IP address.
4
Validate the expanded subnet and provision resources.
New Compute Engine instances are successfully assigned IP addresses from the newly expanded range.
Verifying status ensures the operation finished cleanly before launching new production workloads.

Anahtar Kavram

Auto-mode to custom-mode VPC conversion and primary IPv4 subnet expansion
Soru 296Soru →

An organization configures a Google Cloud billing budget of 1,000permonthwithathresholdalertsetat1001,000 per month with a threshold alert set at 100% of the budget. What happens by default when the project's actual expenditures reach 1,000 within a single billing cycle?

Cevabı ve açıklamayı göster

Cevap: Email notifications are sent to Billing Account Administrators and Billing Account Users, while project resources continue running uninterrupted.

Cevap

Email notifications are sent to Billing Account Administrators and Billing Account Users, while project resources continue running uninterrupted.
In Google Cloud, creating a billing budget with threshold rules sends email notifications to Billing Account Administrators and Billing Account Users by default when cost thresholds are met. It does not perform destructive actions, cap billing, or interrupt active services.

Adım Adım Çözüm

1
Analyze the default functionality of Google Cloud Billing budgets.
Identify that Cloud Billing budgets are alerting mechanisms intended to provide cost transparency.
By default, reaching a threshold rule sends notification emails to role-based recipients (Billing Account Administrators and Billing Account Users).
2
Evaluate the effect on running workload resources.
Confirm that Google Cloud does not terminate resources or cap spending automatically upon budget limit breach.
Automated resource enforcement requires configuring Pub/Sub notifications integrated with automated Cloud Functions or Cloud Run handlers.

Anahtar Kavram

Cloud Billing Budget Alerts Default Behavior
Soru 297Soru →

An enterprise organization is establishing a secure sandbox environment for external partners. A automated service account needs to provision new Google Cloud projects inside a designated folder named 'Partner-Sandboxes' and immediately link each new project to the organization's central Billing Account. The security policy requires enforcing the principle of least privilege without granting excessive administrative permissions across the billing account or folder resource hierarchy. Which pair of predefined IAM roles should be granted to the service account to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Project Creator (roles/resourcemanager.projectCreator) on the 'Partner-Sandboxes' folder and Billing Account User (roles/billing.user) on the target Billing Account

Cevap

Project Creator (roles/resourcemanager.projectCreator) on the 'Partner-Sandboxes' folder and Billing Account User (roles/billing.user) on the target Billing Account
Linking a project to a Cloud Billing Account requires two distinct privileges: the permission to create or manage billing links on the target project/folder (satisfied by Project Creator on the folder) and the permission to link projects to the billing account (satisfied by Billing Account User on the billing account). This combination satisfies least privilege.

Adım Adım Çözüm

1
Identify the project creation requirement
The identity requires Project Creator (roles/resourcemanager.projectCreator) scoped to the specific folder to create new projects.
Permissions must be scoped to the targeted folder resource rather than higher levels in the hierarchy.
2
Identify the billing account linking requirement
The identity requires Billing Account User (roles/billing.user) on the specific Cloud Billing Account.
Linking a project to a billing account requires explicit permission on the billing account resource itself to spend against that billing account.
3
Combine requirements enforcing least privilege
Pairing Project Creator on the folder with Billing Account User on the billing account provides the minimal necessary permissions without granting full billing administration rights.
Both role assignments together satisfy the dual-permission check enforced by Google Cloud resource management for billing association.

Anahtar Kavram

Two-sided permission model for linking Google Cloud projects to Cloud Billing Accounts
Soru 298Soru →

A company is planning the Google Compute Engine architecture for two distinct workloads. Workload A is a nightly 4-hour batch processing job that is fault-tolerant and can resume from checkpoints if interrupted. Workload B is a 24/7 production relational database requiring steady, predictable vCPU performance with zero tolerance for abrupt termination. Which Compute Engine resource strategy minimizes total cost while meeting the operational requirements for both workloads?

Cevabı ve açıklamayı göster

Cevap: Provision Spot VMs for Workload A, and provision standard VM instances with Committed Use Discounts (CUDs) for Workload B.

Cevap

Provision Spot VMs for Workload A, and provision standard VM instances with Committed Use Discounts (CUDs) for Workload B.
Spot VMs are designed specifically for fault-tolerant, batch, or checkpointed workloads like Workload A, offering heavy discounts without risking service SLA. For continuous 24/7 workloads like Workload B, standard VM instances paired with Committed Use Discounts (CUDs) deliver predictable cost savings without preemption risk.

Adım Adım Çözüm

1
Analyze the operational requirements of Workload A
Workload A runs for 4 hours nightly, is fault-tolerant, and supports checkpointing.
Fault-tolerant batch jobs that can handle interruptions are ideal candidates for Spot VMs, which provide discount rates up to 60-90% off standard pricing.
2
Analyze the operational requirements of Workload B
Workload B is a 24/7 production relational database requiring steady vCPU availability.
Continuous baseline stateful workloads must avoid preemption and can achieve optimal financial savings by committing to 1-year or 3-year Committed Use Discounts (CUDs).
3
Select the optimal combination
Pair Spot VMs for Workload A with CUD-backed standard VMs for Workload B.
This strategy maximizes cost optimization while strictly respecting the availability constraints of both services.

Anahtar Kavram

Compute Engine Resource Planning & Spot VM Suitability vs Committed Use Discounts
Soru 299Soru →

A company is configuring a multi-tier Google Cloud resource hierarchy. A centralized platform infrastructure team requires authorization to provision new cloud projects exclusively within a dedicated folder named `Production-Apps` and to associate these newly created projects with the corporate Billing Account `019283-475610-892014`. The security manager mandates adhering strictly to the principle of least privilege without granting permissions over unrelated folders or full billing administration privileges. Which set of IAM role assignments must be configured for the platform infrastructure team?

Cevabı ve açıklamayı göster

Cevap: Grant Project Creator (`roles/resourcemanager.projectCreator`) on the `Production-Apps` folder and Billing Account User (`roles/billing.user`) on the Billing Account `019283-475610-892014`.

Cevap

Grant Project Creator (`roles/resourcemanager.projectCreator`) on the `Production-Apps` folder and Billing Account User (`roles/billing.user`) on the Billing Account `019283-475610-892014`.
To create projects inside a specific folder while associating them with a billing account under least-privilege constraints, two distinct role bindings are required: Project Creator (`roles/resourcemanager.projectCreator`) scoped on the destination Folder, and Billing Account User (`roles/billing.user`) scoped directly on the target Billing Account.

Adım Adım Çözüm

1
Identify the minimum required IAM role for project creation within a specific folder.
Assigning `roles/resourcemanager.projectCreator` scoped directly to the target folder allows project creation within that folder only.
Permissions inherit downward from the folder level, isolating creation capabilities to the intended scope.
2
Identify the minimum required IAM role for linking newly created projects to a billing account.
Assigning `roles/billing.user` directly on the Billing Account resource permits linking projects to that billing account.
Billing Accounts exist outside the resource hierarchy container structure, so billing roles must be assigned directly on the Billing Account object itself.
3
Combine both scoped predefined roles to meet least-privilege requirements.
The platform team receives exact project creation rights in `Production-Apps` and billing linking rights on `019283-475610-892014`.
This avoids granting broad primitive roles or organization-wide administration rights.

Anahtar Kavram

Managing Google Cloud Resource Hierarchy and Billing Account IAM Scoping
Soru 300Soru →

A healthcare startup is deploying a containerized RESTful API microservice to Google Cloud. The application experiences unpredictable HTTP traffic spikes throughout the day and prolonged periods of zero traffic at night. The team requires a compute solution that automatically scales to zero when idle, executes existing container images without code refactoring, and requires zero cluster or server management overhead. Which compute solution should the cloud engineer select?

Cevabı ve açıklamayı göster

Cevap: Deploy the microservice container directly to Cloud Run.

Cevap

Deploy the microservice container directly to Cloud Run.
Deploying the container to Cloud Run satisfies all scenario requirements. Cloud Run runs stateless container images directly without code changes, automatically scales down to zero instances when idle to minimize costs, handles rapid spikes in HTTP traffic, and abstracts away all cluster management and node maintenance.

Adım Adım Çözüm

1
Analyze the workload characteristics and operational constraints.
The application is a containerized HTTP microservice requiring scale-to-zero capabilities, support for sudden traffic bursts, and zero server/cluster management.
Identifying container support, scaling behavior, and management overhead constraints guides the selection of the optimal Google Cloud compute platform.
2
Evaluate potential compute platforms against the requirements.
Compute Engine requires OS/VM maintenance and cannot scale to zero. GKE Standard involves node pool cluster operations. Cloud Functions requires refactoring containerized multi-route APIs into event-driven code snippets. Cloud Run supports existing containers, scales down to zero, and is fully managed.
Cloud Run fits all criteria without requiring code changes or infrastructure administration.

Anahtar Kavram

Selecting serverless compute services (Cloud Run vs. GKE vs. Compute Engine) for containerized HTTP workloads based on operational overhead and scaling requirements.
ÖncekiSayfa 15 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin