Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 461Soru →

An enterprise is designing a multi-region Google Cloud network topology for two workloads: a public-facing static web portal and a private internal microservices application using gRPC over HTTP/2. The network design must satisfy the following architectural constraints:
1. The public static web portal requires global SSL termination, edge content caching, and web application firewall protection.
2. The internal gRPC microservices must be accessible exclusively from on-premises systems over Dedicated Interconnect and from authorized internal VPC subnets, requiring layer 7 content-based routing and internal load balancing across multiple regions.

Which TWO network architectural components should be included in the design to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Global External Application Load Balancer configured with Cloud CDN and Cloud Armor security policies for the web portal backend.; Internal Application Load Balancer configured with proxy-only subnets in each targeted region to handle gRPC and HTTP/2 internal traffic.

Cevap

The architecture requires a Global External Application Load Balancer integrated with Cloud CDN and Cloud Armor for the public portal, alongside an Internal Application Load Balancer utilizing proxy-only subnets for private gRPC internal routing.
The solution requires two distinct load balancer types. The public portal demands Layer 7 services (SSL termination, Cloud CDN caching, and Cloud Armor WAF protection), which are features exclusive to External Application Load Balancers. The private gRPC service requires Layer 7 internal routing over HTTP/2 and Cloud Interconnect, which is provided by Internal Application Load Balancers utilizing proxy-only subnets.

Adım Adım Çözüm

1
Analyze public static web portal requirements.
Identified Layer 7 requirements: SSL termination, Cloud CDN edge caching, and Cloud Armor WAF integration. Only External Application Load Balancers (Layer 7) support Cloud CDN integration.
Passthrough Layer 4 load balancers cannot evaluate HTTP headers or integrate directly with Cloud CDN edge proxies.
2
Analyze internal gRPC microservices requirements.
Identified Layer 7 internal requirements: HTTP/2 and gRPC protocol support, internal VPC and Cloud Interconnect reachability.
Internal Application Load Balancing provides Layer 7 capabilities for internal traffic and requires proxy-only subnets to deliver traffic to backends.
3
Evaluate candidate GCP load balancing products.
Selected Global External Application Load Balancer and Internal Application Load Balancer as the two correct solutions.
Matches all protocol, caching, security, and private reachability constraints according to Google Cloud recommended practices.

Anahtar Kavram

Selecting GCP Load Balancers based on traffic scope (Internal vs External), protocol layer (L4 vs L7), and feature integrations (Cloud CDN, Cloud Armor, proxy-only subnets).
Soru 462Soru →

An organization needs to expand an existing subnet within a custom-mode Virtual Private Cloud (VPC) network in Google Cloud to accommodate new virtual machines. The target subnet currently uses the primary IP CIDR block 10.50.4.0/2410.50.4.0/24. The VPC network is connected via VPC Network Peering to a partner network using the CIDR block 10.50.8.0/2210.50.8.0/22 (10.50.8.010.50.8.0 to 10.50.11.25510.50.11.255). Which extended CIDR range can be configured to expand the existing subnet without causing an IP address collision or violating GCP subnet expansion rules?

Cevabı ve açıklamayı göster

Cevap: 10.50.4.0/23

Cevap

10.50.4.0/23 is the valid expansion range because it encompasses the current range, adheres to CIDR alignment rules, and avoids overlapping with the peered network.
Expanding a primary subnet range in Google Cloud VPC requires choosing a larger prefix block (smaller prefix length) that encloses the original block and aligns with standard netmask boundaries without overlapping any peered VPC ranges. Expanding from 10.50.4.0/24 to 10.50.4.0/23 provides IPs 10.50.4.0 through 10.50.5.255, satisfying all expansion and non-overlap rules.

Adım Adım Çözüm

1
Analyze current subnet range and constraints
Current range is 10.50.4.0/24 (IPs 10.50.4.0–10.50.4.255). Peered range is 10.50.8.0/22 (IPs 10.50.8.0–10.50.11.255).
GCP subnets can only be expanded (prefix number reduced) and cannot overlap with peered networks.
2
Evaluate candidate expansion CIDRs for overlap and validity
10.50.4.0/23 spans 10.50.4.0–10.50.5.255. It contains the original /24 range, is properly aligned on a binary boundary, and does not reach the 10.50.8.0/22 boundary.
Expanding to /23 doubles the IP capacity without conflicting with existing routing rules or peered CIDR blocks.

Anahtar Kavram

Subnet IP Range Expansion in Google Cloud VPC
Tahmini Süre:1m 30s
Soru 463Soru →

An enterprise security engineer must configure conditional IAM access for a cloud operational team at the project level. The access must grant the Cloud Functions Developer predefined role (`roles/cloudfunctions.developer`) only for resources whose names start with `prod-`. What is the correct sequential order of steps to programmatically apply and verify this conditional IAM policy update using the `gcloud` CLI?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence is: 1) Export the current project policy to a JSON file, 2) Edit the JSON file to append the predefined role binding with the resource name condition, 3) Write the updated policy back to the project using `set-iam-policy`, and 4) Verify the updated policy bindings using `get-iam-policy` with a filter.
The complete workflow requires retrieving the current live policy via `gcloud projects get-iam-policy` into a local JSON file to safeguard existing permissions, modifying the JSON structure to include the predefined role and condition block, writing the policy back using `gcloud projects set-iam-policy`, and verifying the binding with a filtered `get-iam-policy` command.

Adım Adım Çözüm

1
Export existing IAM policy to JSON
A local file named `policy.json` populated with existing policy bindings
Because `gcloud projects set-iam-policy` overwrites the entire policy object, existing bindings must be retrieved first to avoid inadvertently removing access.
2
Add conditional IAM role binding to JSON file
An updated `policy.json` containing the predefined role, group principal, and `resource.name.startsWith()` condition
Declarative policy updates allow precise definition of least-privilege attribute-based access control rules.
3
Apply policy back to the GCP project
The project IAM policy is updated live in Google Cloud
Running `gcloud projects set-iam-policy` commits the edited JSON file back to the resource hierarchy.
4
Verify applied policy binding
CLI output verifying active presence of `roles/cloudfunctions.developer` and condition expression
Inspecting live policy state ensures that syntax or condition validation errors did not silently fail policy enforcement.

Anahtar Kavram

Managing IAM Roles and Resource Access Permissions via gcloud CLI Policy Files
Soru 464Soru →

A DevOps engineer needs to request a regional Compute Engine GPU quota increase for a production project using the Google Cloud Console. What is the correct sequence of steps to perform this request?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct procedural order is: first, navigate to IAM & Admin > Quotas & System Limits in the Cloud Console; second, filter for the specific regional GPU quota metric; third, select the quota item and click Edit Quotas; fourth, enter the new limit value with business justification and submit.
Requesting a quota increase requires navigating to IAM & Admin > Quotas & System Limits, locating the specific regional metric using search filters, opening the modification form via Edit Quotas, and entering the desired limit alongside a valid business justification.

Adım Adım Çözüm

1
Open IAM & Admin > Quotas & System Limits
Displays all GCP service limits and current usage for the active project.
Quota management is centralized under IAM & Admin settings.
2
Filter for the target GPU metric and region
Isolates the exact regional GPU quota line item.
Quotas are segmented by service, metric name, and region.
3
Select the line item and click Edit Quotas
Opens the request side panel for adjusting quota limits.
The Edit Quotas action triggers the formal request workflow.
4
Specify new quota limit, add justification, and submit
Submits the quota increase request to GCP support/automation.
Justification is required for GCP review teams to evaluate capacity requests.

Anahtar Kavram

Requesting GCP Resource Quota Increases via Google Cloud Console
Soru 465Soru →

A DevOps team needs to optimize storage costs for an application logs bucket named `app-logs-prod` by automatically transitioning objects older than 30 days to Nearline Storage and deleting objects older than 365 days. The configuration must be applied using Google Cloud's current recommended CLI tooling. Which command should the team run to apply the local lifecycle configuration file named `lifecycle.json` to the bucket?

Cevabı ve açıklamayı göster

Cevap: gcloud storage buckets update gs://app-logs-prod --lifecycle-file=lifecycle.json

Cevap

The command `gcloud storage buckets update gs://app-logs-prod --lifecycle-file=lifecycle.json` correctly updates the Cloud Storage bucket with the lifecycle rules.
The command starting with `gcloud storage buckets update` correctly specifies the bucket resource group and uses the `--lifecycle-file` flag to attach a JSON lifecycle configuration to an existing Cloud Storage bucket following current GCP CLI best practices.

Adım Adım Çözüm

1
Identify the recommended CLI tool
Google Cloud recommends using `gcloud storage` commands rather than legacy `gsutil` commands.
gcloud storage offers faster performance and consistent gcloud CLI flags.
2
Determine the targeted resource tier and flag
Lifecycle policies are bucket-level configurations applied using `gcloud storage buckets update` with the `--lifecycle-file` flag.
Bucket properties govern object management rules automatically across all matching objects in that bucket.

Anahtar Kavram

Deploying Cloud Storage Bucket Lifecycle Configurations with gcloud CLI
Soru 466Soru →

A lead researcher at a university data lab creates a new Google Cloud project to analyze genomic datasets. The researcher has already been granted the Project Owner role (roles/owner) on the new project. However, when attempting to link the project to the university's centralized Cloud Billing Account, the researcher receives a permission error. Following Google Cloud least-privilege best practices, which IAM role must the central billing administrator grant to the researcher on the Billing Account?

Cevabı ve açıklamayı göster

Cevap: Billing Account User (roles/billing.user) on the Billing Account

Cevap

Billing Account User (roles/billing.user) on the Billing Account
Linking a Google Cloud project to a billing account requires permissions on both resources: project-level permission to assign billing and billing account-level permission to associate projects. Because the researcher already possesses Project Owner rights on the project, granting Billing Account User (roles/billing.user) on the target Billing Account provides the exact least-privilege permission required to complete the association.

Adım Adım Çözüm

1
Identify the dual-permission requirement for linking a Google Cloud project to a Billing Account.
The user requires permissions on both the Project (resourcemanager.projects.createBillingAssignment) and the Billing Account (billing.resourceAssociations.create).
Linking a resource requires authorization on both the source project and target billing destination.
2
Evaluate the user's existing permissions on the project.
The researcher is already a Project Owner (roles/owner), which satisfies the project-level requirement.
Project Owner includes project billing assignment rights.
3
Determine the minimum required role on the Billing Account level.
Granting Billing Account User (roles/billing.user) provides billing.resourceAssociations.create on the billing account.
This enforces least privilege by permitting project association without exposing billing administrative capabilities.

Anahtar Kavram

Dual-permission authorization model for GCP project billing account linking
Soru 467Soru →

An infrastructure team is preparing to deploy a specialized network monitoring workload to Google Kubernetes Engine (GKE). The workload container requires running in privileged mode (`securityContext.privileged: true`) and modifying node-level kernel `sysctl` settings. Which GKE cluster operational mode should the team select to accommodate this requirement?

Cevabı ve açıklamayı göster

Cevap: Deploy a GKE Standard cluster and configure a node pool that permits privileged containers.

Cevap

Deploy a GKE Standard cluster and configure a node pool that permits privileged containers.
GKE Standard allows cluster administrators full control over node management, custom node pools, and container security contexts, enabling workloads to run with privileged capabilities and modify kernel parameters.

Adım Adım Çözüm

1
Analyze workload security requirements
Identified that the workload requires elevated capabilities, specifically privileged mode (`securityContext.privileged: true`) and host kernel modification.
Understanding workload requirements determines which GKE operational model is compatible.
2
Compare GKE Autopilot and GKE Standard operational boundaries
GKE Autopilot enforces locked-down node configurations and strict security policies, blocking privileged containers. GKE Standard provides full node management control.
Autopilot manages node infrastructure fully and restricts administrative node-level access, whereas Standard allows node OS customization.
3
Select the appropriate cluster operational model
Choose GKE Standard to support host-level kernel modifications and privileged containers.
GKE Standard is required whenever workloads need administrative host capabilities or non-standard node kernel parameters.

Anahtar Kavram

GKE Autopilot vs Standard Operational Boundaries
Soru 468Soru →

An operations team is establishing deployment workflows and node architecture for a new fault-tolerant, stateless batch-processing workload on Google Kubernetes Engine (GKE). Engineers need to manage cluster resources from local administrative workstations while minimizing compute infrastructure costs. Which TWO actions should the team implement to fulfill these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Execute `gcloud container clusters get-credentials` on local workstations to generate and update cluster credentials in the `kubeconfig` file.; Provision a node pool configured with Spot Virtual Machines to host the stateless batch-processing workload at reduced cost.

Cevap

The team must run `gcloud container clusters get-credentials` to configure local workstation authentication and deploy a Spot VM node pool for the stateless batch processing service.
Executing `gcloud container clusters get-credentials` updates the local `kubeconfig` file with the required control plane endpoint and certificate data so `kubectl` can issue commands to the cluster. Additionally, provisioning a node pool with Spot Virtual Machines allows fault-tolerant, stateless batch workloads to run at significantly reduced compute costs while handling preemption gracefully.

Adım Adım Çözüm

1
Establish cluster authentication on local administrative workstations.
The local `~/.kube/config` file is updated with API server endpoints and security tokens.
The `kubectl` CLI relies on `kubeconfig` entries generated by `gcloud container clusters get-credentials` to securely communicate with the GKE control plane.
2
Select and provision the compute node pool model for the stateless batch processing workload.
A Spot VM node pool is added to the cluster.
Spot VMs offer substantial cost savings and are ideal for stateless, fault-tolerant batch workloads capable of handling sudden node termination.

Anahtar Kavram

GKE Workstation Credential Configuration and Spot VM Node Pools
Tahmini Süre:2m 0s
Soru 469Soru →

A cloud operations team needs to enforce automated governance by deploying a serverless remediation pipeline that triggers whenever a GCP billing account exceeds defined financial thresholds. In what order should the engineer execute the configuration steps to establish this automated budget notification and remediation workflow?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with creating the Cloud Pub/Sub topic, granting the Cloud Billing Service Agent the Pub/Sub Publisher role on that topic, deploying the serverless remediation workload subscribed to the topic, and finally creating the Cloud Billing budget with the Pub/Sub programmatic notification channel attached.
To build a functional automated remediation pipeline, infrastructure dependencies must be established in order: first create the message queue (Cloud Pub/Sub topic), second grant the Cloud Billing service identity permission to publish to that queue, third deploy the consumer service that executes remediation actions upon receiving messages, and finally define the budget with the Pub/Sub notification channel connected.

Adım Adım Çözüm

1
Establish the event bus infrastructure
A Cloud Pub/Sub topic is available to ingest programmatic alert payloads.
Downstream IAM policies and budget channel bindings require a valid target Pub/Sub topic resource.
2
Configure publisher IAM permissions for Cloud Billing
The Cloud Billing system identity receives permissions to publish messages to the Pub/Sub topic.
Without `roles/pubsub.publisher` assigned to the Cloud Billing Service Agent on the topic, message publishing will fail silently upon threshold breaches.
3
Deploy and connect the automated remediation subscriber
A Cloud Function or Cloud Run service is active and listening for pub/sub messages.
The automated handler must be listening to handle incoming JSON budget payloads to alter project states or quotas.
4
Configure the Cloud Billing budget and attach the programmatic notification channel
The budget rule is actively monitoring spending and linked to the Pub/Sub message stream.
Attaching the Pub/Sub topic to the budget completes the integration.

Anahtar Kavram

Automated Budget Remediation Architecture and Cloud Billing Pub/Sub Integration Sequence
Tahmini Süre:2m 0s
Soru 470Soru →

An Associate Cloud Engineer is tasked with setting up a new isolated environment for a financial analytics team under an existing Google Cloud Organization. The team requires a dedicated workspace where organization policies are pre-enforced before any project is provisioned, and team leads are granted permissions to create projects only within their assigned scope. Place the following administrative steps in the correct sequence to establish this resource hierarchy according to Google Cloud best practices.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with creating the parent folder under the Organization, enforcing Organization Policy constraints on the folder, delegating the Project Creator IAM role to the team leads scoped to that folder, and finally creating the workload project inside the folder.
The correct administrative sequence follows top-down governance: first establish the parent container (Folder), apply security guardrails (Organization Policies) to the container, delegate creation authority (IAM roles) at the folder scope, and finally instantiate child resources (Projects). This ensures all projects are created inside a pre-secured container.

Adım Adım Çözüm

1
Provision the parent Folder container
Establishes a structural node in the GCP resource hierarchy under the Organization.
Folders must exist before policy constraints or folder-scoped IAM permissions can be applied.
2
Set Organization Policy constraints on the newly created Folder
Establishes security guardrails at the folder scope.
Configuring constraints prior to project creation guarantees that newly provisioned projects inherit compliance policies immediately upon instantiation.
3
Delegate IAM Project Creator role to team leads at the Folder level
Gives team leads project creation capabilities restricted strictly to the Finance-Analytics folder.
Least privilege dictates granting project creation access on specific folder nodes rather than across the entire organization.
4
Provision the target Project within the Folder container
The project is created inside the folder with inherited folder-level governance.
Project creation occurs last after the container hierarchy, security constraints, and identity permissions are operational.

Anahtar Kavram

Resource Hierarchy Provisioning Sequence and IAM/Policy Inheritance
Soru 471Soru →

An organization operates a custom-mode Virtual Private Cloud (VPC) network connected to an on-premises data center. A critical application deployed in the `us-east4` region resides within a primary subnet using the IP range 172.16.12.0/22172.16.12.0/22. Due to an influx of new microservice instances, the cloud engineering team needs to double the IP capacity of this primary subnet without recreating the subnet, causing service downtime, or altering the IP addresses of running Virtual Machines (VMs). Which primary subnet expansion configuration meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Expand the primary IP address range of the existing subnet to 172.16.8.0/21172.16.8.0/21.

Cevap

Expand the primary IP address range of the existing subnet to 172.16.8.0/21172.16.8.0/21.
Expanding the primary IP address range to 172.16.8.0/21172.16.8.0/21 adheres to Google Cloud's subnet expansion rules. A /21/21 subnet contains 2,048 addresses spanning 172.16.8.0172.16.8.0 to 172.16.15.255172.16.15.255. Because this range fully includes the original 172.16.12.0/22172.16.12.0/22 range (172.16.12.0172.16.12.0 to 172.16.15.255172.16.15.255) and starts on a valid /21/21 CIDR boundary (172.16.8.0172.16.8.0), the expansion can be performed online without modifying existing instance IPs.

Adım Adım Çözüm

1
Analyze the existing primary subnet CIDR block and capacity requirements.
The current primary range is 172.16.12.0/22172.16.12.0/22, spanning host addresses 172.16.12.0172.16.12.0 through 172.16.15.255172.16.15.255 (1,024 total IP addresses). Doubling capacity requires a /21/21 prefix (2,048 total IP addresses).
Expanding a primary subnet in GCP VPC requires decreasing the prefix length (e.g., from /22/22 to /21/21) while keeping existing IP addresses intact.
2
Identify valid /21/21 CIDR block boundaries that encompass 172.16.12.0/22172.16.12.0/22.
A /21/21 block spans 8 contiguous /24/24 subnets (e.g., 172.16.0.0/21172.16.0.0/21 covers 0.0−7.2550.0-7.255, and 172.16.8.0/21172.16.8.0/21 covers 8.0−15.2558.0-15.255). The block 172.16.8.0/21172.16.8.0/21 contains the original 172.16.12.0/22172.16.12.0/22 range.
GCP subnet expansion rules mandate that the new range must align with standard network boundaries and completely encompass the existing primary IP address range.
3
Evaluate compliance with non-disruptive expansion guidelines.
Expanding the subnet range to 172.16.8.0/21172.16.8.0/21 requires no instance recreation, causes no downtime, and retains existing VM IP addresses.
In-place subnet range expansion in Google Cloud is an online operation as long as the new prefix is larger (smaller netmask) and encompasses the original block.

Anahtar Kavram

GCP VPC Primary Subnet Expansion CIDR Boundary Alignment
Soru 472Soru →

An organization wants to delegate resource quota management responsibilities for a production Google Cloud project to a junior operations analyst. The analyst must be able to view current resource quotas and submit formal quota increase requests, but must not be granted permissions to create, modify, or delete infrastructure resources within the project. Which IAM role should be assigned to the analyst to adhere to the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Quota Administrator (roles/servicemanagement.quotaAdmin)

Cevap

Assign the Quota Administrator role (roles/servicemanagement.quotaAdmin) to allow viewing and requesting adjustments to GCP resource quotas while restricting broader infrastructure access.
The predefined IAM role Quota Administrator (`roles/servicemanagement.quotaAdmin`) grants the exact permissions required to view quota usage and request quota adjustments for services within a project. It enforces the principle of least privilege by not granting administrative control over resource creation, modification, or deletion.

Adım Adım Çözüm

1
Identify the operational requirement.
The user needs to view current quotas and request quota increases for project resources.
Quota management requires specific Service Management permissions.
2
Evaluate access security policies.
The solution must adhere to the principle of least privilege by withholding infrastructure edit permissions.
Primitive roles like Editor or Owner grant excess privileges across all project services.
3
Select the specific predefined IAM role for quota administration.
The predefined role Quota Administrator (roles/servicemanagement.quotaAdmin) provides exact capabilities for viewing and updating quotas.
Predefined roles isolate permissions to single operational responsibilities.

Anahtar Kavram

Least Privilege Access for GCP Resource Quota Management
Tahmini Süre:1m 15s
Soru 473Soru →

A financial technology enterprise generates daily transaction report files. These files are queried continuously by automated analytics pipelines during the first 30 days after creation. Between day 31 and day 90, the files are accessed infrequently for monthly audit checks. After 90 days, the files are rarely accessed but must be retained for 5 years to meet regulatory compliance requirements. Which TWO configuration steps should a Cloud Engineer implement to minimize total storage and data retrieval costs? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set the default storage class of the Cloud Storage bucket to Standard Storage.; Configure an Object Lifecycle Management rule to transition objects to Archive Storage after 90 days.

Cevap

The cloud engineer should set the bucket's default storage class to Standard Storage for initial ingestion and create an Object Lifecycle Management rule to transition objects to Archive Storage after 90 days.
Setting the bucket's default storage class to Standard Storage ensures high-frequency analytics reads during the first 30 days incur zero retrieval fees. Transitioning objects to Archive Storage after 90 days places the data into the lowest-cost storage tier for long-term 5-year compliance retention, where access is near zero.

Adım Adım Çözüm

1
Analyze access frequency and retrieval cost implications for the initial 30-day ingestion phase.
Files are accessed continuously for 30 days. Standard Storage avoids all retrieval charges for frequently read objects.
Coldline and Archive classes charge per-GB retrieval fees, making them cost-prohibitive for active daily reads.
2
Evaluate long-term retention and storage cost optimization after day 90.
Files are kept for 5 years with near-zero access. Archive Storage provides the lowest storage cost per GB-month.
Archive Storage is designed for cold data accessed less than once a year.

Anahtar Kavram

Selecting Cloud Storage classes and Object Lifecycle Management rules based on access frequency and data retrieval costs.
Soru 474Soru →

An organization is deploying a global gaming application on Google Cloud that uses a custom binary non-HTTP protocol over TCP. Clients worldwide must connect to the service with encrypted TLS sessions. To minimize latency, the solution must terminate TLS at Google's global edge network using Google-managed SSL certificates and distribute the decrypted raw TCP traffic to backend Compute Engine instance groups located in multiple regions. Which load balancing architecture should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure a Global External Proxy Network Load Balancer with an SSL proxy target proxy and backend services in each region.

Cevap

Configure a Global External Proxy Network Load Balancer with an SSL proxy target proxy and backend services in each region.
The Global External Proxy Network Load Balancer configured with an SSL proxy target proxy is specifically designed for non-HTTP raw TCP traffic requiring global TLS termination at Google's edge network and routing across multiple backend regions.

Adım Adım Çözüm

1
Analyze protocol requirements
The application uses a custom non-HTTP binary protocol over raw TCP with TLS encryption.
Layer 7 HTTP(S) Application Load Balancers cannot handle arbitrary raw TCP protocols.
2
Analyze network topology and TLS termination requirements
Traffic originates globally and requires TLS termination at Google's edge network prior to forwarding to multi-region backends.
Regional passthrough load balancers cannot terminate TLS at the edge or distribute traffic globally from a single Anycast IP.
3
Select the appropriate GCP load balancer family
Choose Global External Proxy Network Load Balancers using SSL proxy mode.
SSL Proxy terminates TLS at Google edge network for raw TCP traffic and routes to multi-region backend instance groups.

Anahtar Kavram

Selecting GCP Load Balancers based on Traffic Scope (Global vs Regional), Protocol (HTTP vs Raw TCP), and TLS Offloading Needs
Tahmini Süre:2m 0s
Soru 475Soru →

Place the following steps in the correct chronological sequence to deploy and verify a Compute Engine virtual machine configured with an automated web server startup script.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: Write the local startup script -> Execute gcloud compute instances create with --metadata-from-file -> Run gcloud compute instances list to get the external IP -> Access the external IP in a browser to verify deployment.
The standard deployment workflow starts with authoring the startup script locally. Next, the VM is created using `gcloud compute instances create` while passing `--metadata-from-file startup-script=...`. After creation, `gcloud compute instances list` is used to discover the instance's public IP address. Finally, navigating to the IP address validates that the script executed successfully and the web server is running.

Adım Adım Çözüm

1
Prepare the startup script locally
A bash script file containing package installation commands is stored on disk.
The file must be present locally so gcloud can read its contents during provisioning.
2
Provision the Compute Engine virtual machine
Google Cloud creates the VM instance and executes the script during initial startup.
Using `gcloud compute instances create` with `--metadata-from-file startup-script=...` attaches the script to the instance metadata.
3
Retrieve network details
The public external IP address of the instance is identified.
The `gcloud compute instances list` command displays running instances and their allocated external IP addresses.
4
Verify application health
The web server response confirms successful provisioning and execution.
Testing the endpoint verifies end-to-end connectivity and verifies that the startup script completed.

Anahtar Kavram

Deploying Compute Engine virtual machines with startup scripts using the gcloud CLI
Soru 476Soru →

A cloud engineer is tasked with estimating monthly infrastructure costs using the Google Cloud Pricing Calculator for a mission-critical, high-availability PostgreSQL database running 24/724/7 on Compute Engine instances. The workload requires persistent data storage with daily automated backups that will be accessed regularly by automated audit scripts. Which approach in the Pricing Calculator correctly applies GCP billing mechanics and pricing options for this workload?

Cevabı ve açıklamayı göster

Cevap: Model the database instances as Standard Compute Engine VMs with Committed Use Discounts (CUDs) applied, and select Standard Cloud Storage for the daily backup bucket.

Cevap

Model the database instances as Standard Compute Engine VMs with Committed Use Discounts (CUDs) applied, and select Standard Cloud Storage for the daily backup bucket.
Modeling the workload as Standard Compute Engine VMs with Committed Use Discounts accurately reflects the baseline pricing for a continuous 24/724/7 database, while Standard Cloud Storage accommodates frequent backup reads without incurring high retrieval charges.

Adım Adım Çözüm

1
Analyze the VM workload operational requirements.
The database operates 24/7 and requires high availability. Spot VMs are subject to sudden preemption and are unsuited for persistent database instances.
Mission-critical databases require predictable uptime guarantees.
2
Determine the appropriate discount mechanism for 24/7 Compute Engine VMs.
Committed Use Discounts (CUDs) offer significant savings for baseline 1-year or 3-year continuous workloads. Sustained Use Discounts (SUDs) only apply to non-committed on-demand usage and cannot be combined with CUDs.
CUDs override SUDs; the pricing calculator correctly excludes SUDs when a commitment is selected.
3
Evaluate Cloud Storage classes based on access frequency.
Because backups are accessed regularly by automated audit scripts, Standard Cloud Storage avoids early deletion penalties and retrieval charges associated with Archive storage.
Choosing Archive storage for frequently read data results in high unexpected retrieval fees.

Anahtar Kavram

Accurate cost estimation for continuous database workloads requires selecting Committed Use Discounts for compute instances and evaluating access pattern retrieval costs when choosing storage classes in the GCP Pricing Calculator.
Tahmini Süre:2m 0s
Soru 477Soru →

A digital publishing firm is designing a new containerized document transformation pipeline on Google Cloud. The workload consists of stateless microservices that process uploaded files. The engineering team wants to minimize operational overhead by eliminating the need to manage, size, or patch underlying cluster nodes and node pools. The application does not require custom Linux kernel parameters or privileged container access. Which Google Kubernetes Engine (GKE) cluster architecture should the cloud engineer select to satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy a GKE Autopilot cluster, allowing Google Cloud to fully manage node provisioning, OS patching, and cluster infrastructure scaling.

Cevap

Deploy a GKE Autopilot cluster, allowing Google Cloud to fully manage node provisioning, OS patching, and cluster infrastructure scaling.
GKE Autopilot is designed for operational efficiency by managing the entire node infrastructure, including node creation, automatic scaling, security updates, and OS maintenance. Because the application consists of standard stateless microservices without custom kernel requirements, Autopilot fulfills all requirements while eliminating administrative overhead.

Adım Adım Çözüm

1
Analyze the operational requirements provided in the scenario.
Identified key constraints: stateless microservices, desire to eliminate node management overhead (sizing, patching, maintenance), and no requirement for custom Linux kernel settings.
Evaluating cluster management requirements guides the choice between GKE Autopilot and GKE Standard.
2
Compare GKE Autopilot against GKE Standard cluster operational models.
GKE Autopilot provides a fully managed environment where Google manages nodes, security patching, and node pool scaling, reducing cluster management overhead to zero.
GKE Standard requires administrative management of node pools, updates, and node configurations.
3
Select the GKE architectural mode that fulfills all constraints.
GKE Autopilot satisfies the goal of minimal management overhead while supporting standard stateless microservices.
Since custom node-level kernel tuning is not required, Autopilot is the recommended Google Cloud architecture.

Anahtar Kavram

GKE Autopilot vs. Standard Operational Boundaries
Tahmini Süre:1m 30s
Soru 478Soru →

A cloud engineer needs to deploy a containerized application to a newly provisioned Google Kubernetes Engine (GKE) cluster from a local workstation. What is the correct sequence of steps to configure cluster access, deploy the workload, and verify pod execution?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: 1) Fetch cluster credentials using `gcloud container clusters get-credentials`, 2) Deploy the workload using `kubectl apply -f deployment.yaml`, and 3) Verify pod execution using `kubectl get pods`.
The workflow begins with configuring local cluster credentials via `gcloud container clusters get-credentials`, followed by creating cluster objects using `kubectl apply -f deployment.yaml`, and concludes by checking container state with `kubectl get pods`.

Adım Adım Çözüm

1
Retrieve cluster access configuration for the workstation.
Local `kubeconfig` is updated with credentials and API server endpoint info.
The `kubectl` CLI requires cluster context details provided by `gcloud container clusters get-credentials` before it can communicate with GKE.
2
Deploy the application resource manifest.
Kubernetes API server receives the manifest and creates Deployment and Pod resources.
Once `kubectl` is authenticated against the cluster, resources defined in `deployment.yaml` can be created using `kubectl apply`.
3
Confirm workload deployment status.
Pod lifecycle status and container health are displayed.
Executing `kubectl get pods` provides verification that container instances have been scheduled and are actively running.

Anahtar Kavram

Deploying workloads to Google Kubernetes Engine requires establishing CLI cluster context with gcloud container clusters get-credentials prior to applying resource manifests and inspecting pod status with kubectl.
Tahmini Süre:1m 0s
Soru 479Soru →

An enterprise platform team is provisioning Google Kubernetes Engine (GKE) infrastructure for two application components. Component 1 is a daemon daemonset that requires privileged kernel capabilities (`CAP_SYS_ADMIN`) and custom hostPath volume mounts to load proprietary kernel modules on the underlying node. Component 2 is a stateless, fault-tolerant data ingestion pipeline designed to handle sudden instance terminations gracefully. Which cluster architecture and node pool strategy correctly supports both components while optimizing cost and operational overhead?

Cevabı ve açıklamayı göster

Cevap: Deploy Component 1 on a GKE Standard node pool allowing custom node configurations, and deploy Component 2 on a GKE Standard Spot node pool.

Cevap

Deploy the privileged kernel workload (Component 1) on a GKE Standard node pool and the fault-tolerant pipeline (Component 2) on a GKE Standard Spot node pool.
GKE Standard node pools allow node-level customizations, privileged security capabilities (`CAP_SYS_ADMIN`), and raw hostPath mounts required by kernel monitoring software. Concurrently, utilizing GKE Standard Spot node pools for stateless, fault-tolerant batch workloads provides significant cost savings without risking application state loss during node preemption.

Adım Adım Çözüm

1
Analyze security and operational constraints for Component 1
Component 1 requires privileged execution (`CAP_SYS_ADMIN`) and custom hostPath kernel mounts.
GKE Autopilot manages node security and disallows privileged containers, host networking, or hostPath kernel modifications. Therefore, GKE Standard node pools are mandatory for Component 1.
2
Evaluate workload fault tolerance and cost requirements for Component 2
Component 2 is stateless and handles unexpected node termination cleanly.
Spot node pools provision excess Compute Engine capacity at up to an 80% discount. Because Component 2 is fault-tolerant, deploying it on Spot node pools maximizes cost efficiency.
3
Select the optimal cluster and node pool architectural combination
GKE Standard cluster with a dedicated standard node pool for Component 1 and a Spot node pool for Component 2.
This strategy satisfies all security and system configuration constraints while keeping compute costs low.

Anahtar Kavram

GKE Autopilot vs. Standard Operational Boundaries and Spot Node Pool Selection
Tahmini Süre:2m 30s
Soru 480Soru →

A Cloud Engineer needs to deploy a Cloud SQL for PostgreSQL instance that connects exclusively via private IP to a Virtual Private Cloud (VPC) network and supports regional High Availability (HA). Which TWO configuration actions must be performed to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Establish a Private Services Access connection by allocating an internal IP range and creating a VPC peering connection in the target VPC.; Specify the flag --availability-type=REGIONAL during instance creation.

Cevap

To deploy a Cloud SQL instance with private IP connectivity and High Availability, you must allocate an internal IP range to set up Private Services Access via VPC peering and specify the REGIONAL availability type during deployment.
Establishing a Private Services Access connection configures VPC peering and internal IP allocation for private connectivity. Specifying the REGIONAL availability type ensures a standby replica is provisioned in another zone for high availability failover.

Adım Adım Çözüm

1
Configure Private Services Access in the target VPC network.
An internal IP range is reserved and VPC network peering is established with Google services.
Cloud SQL instances reside in a Google-managed VPC, requiring Private Services Access for private IP routing.
2
Deploy the Cloud SQL instance with regional availability enabled.
Cloud SQL creates a primary database instance in one zone and a synchronous standby replica in a second zone.
The REGIONAL availability configuration provides high availability with automatic failover across zones.

Anahtar Kavram

Deploying Cloud SQL with Private IP and High Availability
ÖncekiSayfa 24 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin