Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 41Soru →

A cloud administrator is managing project lifecycles and governance across an enterprise Google Cloud resource hierarchy. The administrator must protect a critical security project named `shared-sec-ops` from accidental deletion, even by users holding the primitive Owner role. Additionally, an automated pipeline service account must be configured with the necessary permissions to move projects from the `Staging` folder to the `Production` folder. Which TWO configurations or actions fulfill these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a project lien on `shared-sec-ops` specifying the `resourcemanager.projects.delete` restriction.; Grant the service account permissions to move projects on the source folder, the destination folder, and the target project.

Cevap

To protect a project from accidental deletion, place a project lien restricting `resourcemanager.projects.delete`. To move a project between folders, ensure the service account has appropriate project move permissions across the source folder, destination folder, and project.
Creating a project lien with the `resourcemanager.projects.delete` restriction prevents the project from being deleted even by users with the primitive Owner role until the lien is removed. Furthermore, moving projects between folders requires `resourcemanager.projects.move` permissions across the source folder, destination folder, and the target project.

Adım Adım Çözüm

1
Configure project deletion protection using liens
A project lien is placed on `shared-sec-ops` restricting `resourcemanager.projects.delete`.
Project liens explicitly prevent anyone (including Project Owners) from deleting the project until the lien is removed.
2
Configure project relocation permissions
The service account is assigned permissions to move the project on the source `Staging` folder, target `Production` folder, and the project being moved.
Moving resources within the Google Cloud hierarchy requires authorization on both the source container, the destination container, and the resource itself.

Anahtar Kavram

GCP Project Lifecycle Management and Resource Hierarchy Security
Tahmini Süre:1m 30s
Soru 42Soru →

An organization is designing a custom mode Virtual Private Cloud (VPC) network in Google Cloud that connects to an on-premises data center via Cloud VPN. The on-premises network utilizes the IP address block 10.100.0.0/1610.100.0.0/16. Within the GCP VPC network, an engineer creates a primary subnet named `prod-subnet-us` in the `us-central1` region with an initial CIDR range of 10.1.0.0/2010.1.0.0/20. To accommodate incoming application workloads, the team needs to expand the primary IP range of `prod-subnet-us`. Which of the following expansion plans complies with Google Cloud VPC subnet expansion rules without causing IP range overlaps or routing conflicts with the on-premises network?

Cevabı ve açıklamayı göster

Cevap: Expand the primary IP range of `prod-subnet-us` to 10.1.0.0/1910.1.0.0/19.

Cevap

Expanding the primary IP range of `prod-subnet-us` to 10.1.0.0/1910.1.0.0/19 is the correct choice.
Expanding the primary subnet range to 10.1.0.0/1910.1.0.0/19 follows GCP subnet expansion rules: the prefix length decreases (from /20/20 to /19/19), the new range (10.1.0.010.1.0.0 - 10.1.31.25510.1.31.255) strictly encloses the existing range (10.1.0.010.1.0.0 - 10.1.15.25510.1.15.255), and it does not overlap with the on-premises range 10.100.0.0/1610.100.0.0/16.

Adım Adım Çözüm

1
Analyze Google Cloud subnet expansion rules
In GCP, expanding a primary IP range requires choosing a smaller netmask prefix (e.g., from /20/20 to /19/19) such that the new range completely encloses the original range.
Google Cloud subnets cannot be shrunk, nor can their starting IP address be arbitrarily changed outside valid CIDR supernet alignment.
2
Calculate CIDR boundary for the expanded range 10.1.0.0/1910.1.0.0/19
The range 10.1.0.0/1910.1.0.0/19 spans 10.1.0.010.1.0.0 through 10.1.31.25510.1.31.255, which fully encompasses 10.1.0.0/2010.1.0.0/20 (10.1.0.010.1.0.0 through 10.1.15.25510.1.15.255).
This verifies technical compliance with GCP VPC primary subnet expansion criteria.
3
Verify hybrid network non-overlap requirement
The on-premises network uses 10.100.0.0/1610.100.0.0/16 (10.100.0.010.100.0.0 - 10.100.255.25510.100.255.255). The expanded GCP range 10.1.0.0/1910.1.0.0/19 has no overlap with 10.100.0.0/1610.100.0.0/16.
Preventing overlapping CIDR blocks between GCP VPCs and on-premises networks connected via VPN is necessary for proper BGP routing and traffic delivery.

Anahtar Kavram

Subnet IP Range Expansion and Overlap Prevention in Custom Mode VPCs
Soru 43Soru →

A cloud engineer is designing Google Cloud compute infrastructure for a healthcare organization with two distinct application requirements:

1. Workload 1: An asynchronous, fault-tolerant batch image processing pipeline that can resume cleanly if an instance is terminated unexpectedly.
2. Workload 2: A 24/7 mission-critical relational database with high RAM requirements that demands uninterrupted execution and high availability.

Which TWO deployment and machine type strategies should the engineer select to meet performance requirements while minimizing costs? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision Spot VMs for Workload 1 to significantly reduce compute expenses while accommodating instance preemptions.; Provision memory-optimized standard VMs with Committed Use Discounts (CUDs) for Workload 2.

Cevap

The architect should select Spot VMs for the fault-tolerant batch processing workload and memory-optimized standard VM instances with Committed Use Discounts for the 24/7 mission-critical database.
Spot VMs provide significant cost reductions for fault-tolerant, asynchronous batch jobs that tolerate preemption. For steady-state 24/7 high-memory database workloads, memory-optimized standard VMs secured with Committed Use Discounts (CUDs) provide guaranteed uptime alongside maximum cost optimization.

Adım Adım Çözüm

1
Analyze Workload 1 operational characteristics
Identified as fault-tolerant, stateless, and asynchronous batch processing.
Fault-tolerant batch jobs can withstand abrupt node terminations without data loss, making them perfect candidates for deep-discounted Spot VMs.
2
Analyze Workload 2 operational characteristics
Identified as a continuous, 24/7 mission-critical high-memory database.
Stateful databases require predictable uptime and continuous memory capacity. They should use standard (non-preemptible) memory-optimized instances coupled with Committed Use Discounts (CUDs) for predictable 24/7 workloads.
3
Evaluate and eliminate non-viable compute options
Eliminated Spot VMs for databases (risk of unannounced outage) and Cloud Functions for heavy batch jobs (timeout and binary limits).
Matching workload SLA requirements with appropriate compute families prevents service outages and compute framework mismatches.

Anahtar Kavram

Planning Compute Engine machine types, Spot VM suitability, and discount strategies based on workload SLA and resource profile
Soru 44Soru →

A centralized platform security team is auditing permission boundaries for an infrastructure automation service account (`[email protected]`). The service account is designated solely to attach newly onboarded, existing Google Cloud projects to the enterprise Cloud Billing Account without possessing permissions to modify billing account financial settings or manage compute workloads inside the projects.

Which TWO predefined IAM roles represent the minimum necessary privileges required for this service account to successfully link the projects to the Cloud Billing Account? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Billing Account User (`roles/billing.user`) on the Cloud Billing Account; Project Billing Manager (`roles/billing.projectManager`) on the target projects or parent folder

Cevap

To link an existing Google Cloud project to a Cloud Billing Account under the principle of least privilege, a principal requires Billing Account User (`roles/billing.user`) on the billing account and Project Billing Manager (`roles/billing.projectManager`) on the target project or parent resource container.
Linking a project to a Cloud Billing Account requires permissions on both sides of the relationship: the Billing Account User role grants the necessary `billing.resourceAssociations.create` permission on the billing account, while the Project Billing Manager role grants `resourcemanager.projects.createBillingAssignment` on the target project without exposing underlying workload resources or payment settings.

Adım Adım Çözüm

1
Identify the required billing account permission for project linking.
The principal needs `billing.resourceAssociations.create` on the target Cloud Billing Account.
Linking a project requires explicit permission on the billing account to associate it with resource costs.
2
Select the least-privilege predefined role for the billing account.
Billing Account User (`roles/billing.user`) provides `billing.resourceAssociations.create` without granting full administrative privileges.
Adhering to least-privilege security mandates avoids broad management roles when association access is sufficient.
3
Identify the required project-level permission for billing assignment.
The principal needs `resourcemanager.projects.createBillingAssignment` on the target project or folder level.
Linking a project also requires explicit authorization on the project side to modify its billing account attachment.
4
Select the least-privilege predefined role for the project level.
Project Billing Manager (`roles/billing.projectManager`) provides project billing configuration rights without granting primitive Owner or Editor permissions.
Project Billing Manager allows attaching or detaching billing accounts without granting access to manage underlying compute resources.

Anahtar Kavram

Dual-sided IAM requirement and least-privilege role selection for linking Google Cloud projects to Cloud Billing Accounts
Soru 45Soru →

A cloud engineer is using the Google Cloud Pricing Calculator to estimate the base monthly cost of a Compute Engine virtual machine instance. The pricing calculator specifies an hourly rate of $0.12\$0.12 for the selected machine configuration. Assuming the instance runs continuously for 730730 hours in a 30-day month, what is the total estimated baseline cost in USD before applying any sustained use or committed use discounts?

Cevabı ve açıklamayı göster

Cevap: 87.6

Cevap

The baseline cost for running the instance continuously for 730730 hours is $87.60\$87.60.
Multiplying the base rate of $0.12\$0.12 per hour by 730730 monthly hours gives $87.60\$87.60, which represents the raw cost prior to any discount structures.

Adım Adım Çözüm

1
Determine operational hours and hourly price
Hourly price = $0.12\$0.12, total monthly runtime = 730730 hours
The pricing calculator baseline estimate uses standard monthly operational hours multiplied by the hourly resource rate.
2
Compute total monthly compute charge
$0.12×730=$87.60\$0.12 \times 730 = \$87.60
Multiplying hourly cost by total elapsed running hours gives the total un-discounted monthly cost.

Anahtar Kavram

Baseline monthly Compute Engine cost calculation in the GCP Pricing Calculator
Soru 46Soru →

A cloud engineer is planning the Google Compute Engine architecture for a specialized genomics research platform that consists of two distinct workloads:

1. Workload 1: A mission-critical, stateful primary database service running continuous 24/7 operations with steady, predictable memory and CPU utilization.
2. Workload 2: A batch alignment pipeline that processes queue-based genomic data blocks. The pipeline is stateless, fully fault-tolerant, saves progress checkpoints to Cloud Storage every 5 minutes, and can handle abrupt node terminations.

Which TWO deployment and resource planning choices should the engineer recommend to satisfy operational requirements while optimizing total cost of ownership? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision standard Compute Engine VM instances backed by Committed Use Discounts (CUDs) for Workload 1.; Provision Spot VM instances within Managed Instance Groups (MIGs) for Workload 2.

Cevap

The optimal solution is to provision standard Compute Engine instances with Committed Use Discounts for the continuous stateful primary database (Workload 1) and to provision Spot VM instances within Managed Instance Groups for the fault-tolerant batch alignment pipeline (Workload 2).
The combination of standard instances backed by Committed Use Discounts for the continuous stateful database workload and Spot VMs inside Managed Instance Groups for the stateless batch processing pipeline aligns perfectly with Google Cloud compute optimization best practices.

Adım Adım Çözüm

1
Analyze operational characteristics of Workload 1
Identified Workload 1 as a mission-critical 24/7 stateful database needing high availability and predictable continuous compute.
Stateful 24/7 workloads require standard non-preemptible VM instances. Applying 1-year or 3-year Committed Use Discounts (CUDs) offers substantial pricing discounts for predictable baseline resource needs.
2
Analyze operational characteristics of Workload 2
Identified Workload 2 as a stateless, fault-tolerant batch workload capable of resuming from Cloud Storage checkpoints.
Fault-tolerant batch jobs that process queue-based work items can tolerate sudden instance preemptions, making Spot VMs in Managed Instance Groups the best choice to achieve up to 60-91% cost reduction.
3
Evaluate and reject anti-pattern distractors
Rejected using Spot VMs for stateful databases and relying on Sustained Use Discounts on a single large instance for batch jobs.
Spot VMs violate SLA requirements for stateful continuous workloads, while Sustained Use Discounts do not provide the extreme cost savings offered by Spot instances for checkpointed batch operations.

Anahtar Kavram

Compute Engine Resource Planning: Spot VMs vs. Committed Use Discounts (CUDs)
Soru 47Soru →

A healthcare analytics firm ingests large volumes of patient diagnostic images into a Google Cloud Storage bucket. The access pattern is defined as follows:
- During the first 30 days after ingestion, images are accessed frequently by machine learning pipelines for daily analysis.
- Between 31 days and 365 days, images are accessed infrequently (less than once per quarter) for occasional patient follow-ups, but sub-second retrieval performance is still required.
- After 365 days, images must be retained for 7 years to meet regulatory compliance, with an expected access frequency of less than once per year.

Which TWO Object Lifecycle Management rules should you configure on the bucket to minimize total cost of ownership while adhering to minimum storage duration requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Transition objects to Coldline Storage when their age reaches 30 days.; Transition objects to Archive Storage when their age reaches 365 days.

Cevap

The correct lifecycle actions are to transition objects to Coldline Storage at 30 days of age, and transition objects to Archive Storage at 365 days of age.
Transitioning objects to Coldline Storage at day 30 aligns with the requirement for access less than once per quarter, utilizing a tier with a 90-day minimum storage duration. Transitioning to Archive Storage at day 365 matches the compliance pattern of less than once per year access, utilizing the lowest-cost tier with a 365-day minimum duration.

Adım Adım Çözüm

1
Analyze initial 30-day access pattern and storage class requirements.
Heavy access during the first 30 days requires keeping objects in Standard Storage to avoid retrieval fees.
Standard Storage has no minimum retention duration and no retrieval charges for active reading.
2
Evaluate storage class selection for the 31-day to 365-day window.
Coldline Storage is selected for transition at 30 days.
Access frequency is less than once a quarter. Coldline Storage provides low-cost storage with a 90-day minimum duration, which easily fits within the 335-day window before the 1-year mark.
3
Evaluate long-term retention requirements beyond 365 days.
Archive Storage is selected for transition at 365 days.
Regulatory compliance requires 7-year storage with access expected less than once a year. Archive Storage provides the lowest storage cost per gigabyte with a 365-day minimum duration requirement.

Anahtar Kavram

Google Cloud Storage Class Selection and Object Lifecycle Management
Soru 48Soru →

A global logistics provider is designing a Google Cloud Storage solution for digital freight documentation and bills of lading. The data access profile is as follows:
- High-frequency reads and updates occur during the first 30 days after shipment creation.
- Access drops to infrequent administrative queries (less than once per month) between day 31 and day 90.
- After 90 days, files are rarely accessed but must be retained for 5 years to comply with international trade regulations.
- Regulatory mandates require strict immutability, ensuring files cannot be modified or deleted by any user or administrator during the 5-year retention window.

Which TWO architectural actions should you combine to optimize storage costs while satisfying all compliance requirements? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an Object Lifecycle Management rule to transition objects from Standard to Nearline storage class after 30 days, and from Nearline to Archive storage class after 90 days.; Define a bucket retention policy of 5 years (1,825 days) and lock the policy using Bucket Lock.

Cevap

The optimal solution combines using Object Lifecycle Management rules to transition objects from Standard to Nearline at day 30 and to Archive at day 90, alongside defining and locking a 5-year Bucket Lock retention policy on the bucket.
Transitioning objects dynamically from Standard to Nearline after 30 days and to Archive after 90 days minimizes storage costs while preventing high access charges during active processing phases. Locking a 5-year retention policy on the bucket guarantees legal immutability so files cannot be altered or deleted prior to the compliance threshold.

Adım Adım Çözüm

1
Analyze access frequency and minimum storage durations across storage classes.
Initial 30 days require Standard storage (frequent updates, no retrieval fees). Days 31-90 suit Nearline (30-day minimum duration satisfied). Beyond 90 days suits Archive (lowest cost for rare retrieval, 365-day minimum duration satisfied).
Aligning data lifecycle transitions with access patterns avoids high data access/retrieval charges while minimizing gigabyte-month storage costs.
2
Evaluate compliance and immutability requirements.
Immutability requires a bucket retention policy locked with Bucket Lock.
Bucket Lock prevents deletion or editing of objects even by Project Owners, ensuring strict regulatory WORM compliance.

Anahtar Kavram

Cloud Storage Class Lifecycle Planning and Bucket Lock Retention Policies
Soru 49Soru →

A financial risk analysis firm is planning the Google Compute Engine architecture for a new quantitative modeling platform. The platform consists of two distinct components:

1. A high-performance simulation engine executing millions of stateless, fault-tolerant Monte Carlo calculations that can be restarted if terminated unexpectedly.
2. A continuous, uninterrupted auditing microservice requiring a non-standard memory ratio of 1 vCPU to 8 GB of RAM to run reliably 24/7.

Which TWO compute resource strategies should you recommend to optimize cost and fulfill workload requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision Spot Virtual Machines for the simulation engine compute fleet.; Configure custom machine types for the continuous auditing microservice.

Cevap

Select the option to provision Spot Virtual Machines for the simulation engine compute fleet, and the option to configure custom machine types for the continuous auditing microservice.
Stateless, fault-tolerant compute workloads like Monte Carlo simulations are ideal candidates for Spot Virtual Machines because they can sustain interruptions while drastically reducing compute costs. Furthermore, workloads requiring non-standard memory-to-vCPU ratios benefit from custom machine types, allowing precise resource allocation without paying for unused vCPUs or RAM in standard predefined machine families.

Adım Adım Çözüm

1
Analyze the workload characteristics of the Monte Carlo simulation engine.
The workload is stateless, batch-oriented, and fault-tolerant.
Fault-tolerant batch processing can leverage Spot VMs to achieve massive cost reductions without compromising overall task completion.
2
Analyze the resource requirements of the continuous auditing microservice.
The service runs 24/7 uninterrupted and requires a non-standard 1 vCPU to 8 GB memory ratio.
Custom machine types allow specifying exact vCPU and RAM requirements to fit non-standard resource ratios economically without selecting an oversized standard machine family.

Anahtar Kavram

Selecting optimal Compute Engine machine types and VM lifecycle options based on workload fault tolerance and resource ratios.
Soru 50Soru →

A bioinformatics research organization is planning its compute architecture on Google Cloud for two upcoming workloads:
1. Genomic Pipeline: Interruptible, stateless batch jobs that process large genomic dataset files overnight and can resume from checkpoints if interrupted.
2. Patient Portal API: A continuous 24/7 web application backend with predictable, steady-state resource utilization throughout the year.

Which TWO strategies should the cloud engineer implement to optimize cost and performance for these Compute Engine resources?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision Spot VMs for the genomic processing batch jobs to achieve significant cost savings on fault-tolerant workloads.; Purchase Committed Use Discounts (CUDs) for the vCPU and memory baseline required by the patient portal API.

Cevap

Provision Spot VMs for the genomic processing batch jobs and purchase Committed Use Discounts (CUDs) for the patient portal API vCPU and memory baseline.
The correct strategy combines Spot VMs for interruptible batch workloads and Committed Use Discounts (CUDs) for continuous steady-state baseline workloads. Spot VMs deliver deep discounts for batch jobs that tolerate preemption, while CUDs provide predictable cost savings for 24/7 web API workloads without preemption risks.

Adım Adım Çözüm

1
Analyze the Genomic Pipeline workload requirements.
Identified as a stateless, fault-tolerant batch processing job with checkpointing support.
Fault-tolerant workloads can withstand instance preemption, making them ideal candidates for Spot VMs to maximize cost savings.
2
Analyze the Patient Portal API workload requirements.
Identified as a continuous 24/7 steady-state production service.
Predictable continuous baseline workloads benefit most from Committed Use Discounts (CUDs) without risk of service disruption.
3
Evaluate and reject anti-patterns.
Spot VMs are inappropriate for stateful databases, and Cloud Functions cannot run multi-container legacy applications directly.
Database backends require steady availability, and multi-container workloads exceed Cloud Functions architectural scope.

Anahtar Kavram

Planning Compute Engine Workload Cost Optimization Strategy
Soru 51Soru →

A cloud engineer is using the Google Cloud Pricing Calculator to estimate the monthly compute expenses for a company migrating a multi-tier application. The workload requirements specify two distinct operational profiles:

1. A set of web frontend virtual machines running continuously 24 hours a day, 7 days a week, with a predictable baseline resource demand planned for a 3-year operational lifecycle.
2. A cluster of batch processing worker instances that execute non-critical, fault-tolerant data transformation jobs intermittently whenever spare capacity is available.

Which combination of VM pricing configurations should the engineer select in the Pricing Calculator to achieve the most accurate and cost-effective estimate for these components?

Cevabı ve açıklamayı göster

Cevap: Configure 3-Year Committed Use Discounts (CUDs) for the continuous web frontend instances, and select Spot Virtual Machines for the fault-tolerant batch processing workers.

Cevap

The correct option specifies configuring 3-Year Committed Use Discounts (CUDs) for the continuous web frontend instances and selecting Spot Virtual Machines for the fault-tolerant batch processing workers.
The correct strategy combines 3-Year Committed Use Discounts (CUDs) for predictable 24/7 baseline compute resources with Spot VMs for fault-tolerant, intermittent batch jobs. CUDs deliver the maximum savings for long-term continuous workloads, whereas Spot VMs offer steep discounts for non-critical tasks that can sustain interruptions.

Adım Adım Çözüm

1
Analyze the resource consumption pattern of the web frontend workload.
The web frontend runs 24/7 with predictable resource demand over a 3-year lifecycle, making it an ideal candidate for 3-Year Committed Use Discounts (CUDs).
CUDs provide substantial cost reductions in exchange for a committed level of resource usage over a 1-year or 3-year period.
2
Analyze the operational profile of the batch processing worker workload.
The batch processing workers execute non-critical, fault-tolerant jobs intermittently, making them optimal candidates for Spot VMs.
Spot VMs leverage spare GCP compute capacity at significantly lower prices, which is ideal for workloads that can handle preemptions.
3
Combine the chosen pricing options in the Google Cloud Pricing Calculator.
Select 3-Year CUDs for the steady-state frontend tier and Spot VMs for the batch worker tier.
This combination minimizes total estimated monthly infrastructure cost while matching GCP billing mechanisms.

Anahtar Kavram

Selecting optimal Google Cloud pricing models (Committed Use Discounts vs. Spot VMs) based on workload stability and fault tolerance.
Soru 52Soru →

A cloud administrator is configuring a newly created Google Cloud Storage bucket named `analytics-export-data` to align with organizational security and operational compliance standards. The organization mandates that access must be managed strictly using IAM roles at the bucket level rather than per-object Access Control Lists (ACLs). Additionally, log files uploaded to this bucket must automatically transition to Nearline storage after 90 days to minimize ongoing storage fees. Which of the following commands should the administrator execute using the `gcloud` CLI to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Execute `gcloud storage buckets update gs://analytics-export-data --enable-uniform-bucket-level-access` to disable per-object ACLs and enforce bucket-level IAM policies.; Execute `gcloud storage buckets update gs://analytics-export-data --lifecycle-file=lifecycle.json` where `lifecycle.json` defines a rule to change the storage class to Nearline for objects older than 90 days.

Cevap

The administrator must enable uniform bucket-level access using `gcloud storage buckets update gs://analytics-export-data --enable-uniform-bucket-level-access` and set the object lifecycle policy using `gcloud storage buckets update gs://analytics-export-data --lifecycle-file=lifecycle.json`.
To satisfy security and lifecycle requirements using modern GCP CLI standards, the administrator must enable Uniform Bucket-Level Access on the bucket resource to enforce IAM policy evaluation and apply a JSON lifecycle policy file using `gcloud storage buckets update --lifecycle-file` to automate the transition of 90-day-old objects to Nearline storage.

Adım Adım Çözüm

1
Enforce bucket-level access control
Disables per-object ACLs on the bucket and relies exclusively on Google Cloud IAM permissions.
Uniform Bucket-Level Access unifies access management under IAM and satisfies the organizational requirement to prevent per-object ACL usage.
2
Configure object lifecycle rules for cost optimization
Applies a lifecycle policy file to the bucket containing a SetStorageClass action targeting Nearline storage for objects with age greater than 90 days.
Bucket-level lifecycle rules continuously inspect object ages and automatically transition storage classes without manual intervention or invalid object-update flags.

Anahtar Kavram

Cloud Storage bucket configuration using modern gcloud CLI flags for Uniform Bucket-Level Access and Object Lifecycle Management.
Tahmini Süre:1m 30s
Soru 53Soru →

An enterprise organization is migrating an online transaction processing (OLTP) core application to Google Cloud. The system requires a relational database engine with strict multi-row ACID compliance, sub-10 millisecond write latencies, and persistent data retention across virtual machine restart events. The database requires 30,000 sustained random read/write IOPS for a 1 TB dataset. The architecture team mandates achieving these requirements with minimal operational management overhead. Which database and block storage architecture should you recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy a Cloud SQL instance with High Availability enabled, utilizing a Persistent Disk SSD (pd-ssd) storage volume.

Cevap

Deploying a Cloud SQL instance with High Availability and Persistent Disk SSD (pd-ssd) storage provides a fully managed relational engine, persistent storage across host restarts, low latencies, and necessary IOPS performance.
The solution recommending Cloud SQL with High Availability and Persistent Disk SSD (pd-ssd) meets all criteria. Cloud SQL offers a fully managed relational database engine (MySQL, PostgreSQL, or SQL Server) with ACID compliance and automatic maintenance/failover, reducing management overhead. Persistent Disk SSD provides durable non-volatile storage that retains data through VM restarts and delivers high performance (30 IOPS per GB30\text{ IOPS per GB} for reads and writes, achieving the 30,000 IOPS30,000\text{ IOPS} requirement at 1 TB1\text{ TB}).

Adım Adım Çözüm

1
Evaluate workload database requirements
Relational schema and multi-row ACID compliance eliminate NoSQL options like Cloud Bigtable.
Cloud Bigtable lacks multi-row ACID transaction guarantees required for relational OLTP engines.
2
Evaluate storage persistence and operational overhead constraints
Local SSDs are ephemeral and lose data upon instance shutdown. Managed Cloud SQL reduces operational overhead compared to self-managed Compute Engine databases.
Primary storage for persistent transactional databases must survive VM restarts and host maintenance.
3
Calculate Persistent Disk IOPS performance
A 1 TB Persistent Disk SSD (pd-ssd) yields 30,000 random IOPS (1,000 GB×30 IOPS/GB=30,000 IOPS1,000\text{ GB} \times 30\text{ IOPS/GB} = 30,000\text{ IOPS}), meeting latency and throughput targets.
pd-standard disks provide significantly lower IOPS per GB and are intended for sequential I/O.

Anahtar Kavram

Selecting GCP Managed Databases and Persistent Block Storage Types based on ACID requirements, persistence, IOPS, and operational overhead.
Soru 54Soru →

A system administrator needs to provision a production-grade PostgreSQL database on Cloud SQL using the Google Cloud CLI. The compliance policy mandates that the instance must be attached strictly to a custom Virtual Private Cloud (VPC) network without a public IP address, must be configured for High Availability (regional failover), and must support Point-in-Time Recovery (PITR) alongside daily automated backups. Which `gcloud sql instances create` command configuration satisfies all specified enterprise requirements?

Cevabı ve açıklamayı göster

Cevap: gcloud sql instances create prod-db --database-version=POSTGRES_15 --cpu=4 --memory=16GiB --region=us-central1 --network=custom-vpc --no-assign-ip --availability-type=REGIONAL --backup-start-time=02:00 --enable-point-in-time-recovery

Cevap

The command that uses `--network=custom-vpc` along with `--no-assign-ip`, `--availability-type=REGIONAL`, `--backup-start-time`, and `--enable-point-in-time-recovery` fully satisfies all requirement criteria.
The correct command explicitly suppresses public IP allocation using `--no-assign-ip` while attaching to the specified VPC network via `--network`. It also configures multi-zone regional failover using `--availability-type=REGIONAL` and enables continuous WAL archiving required for PostgreSQL point-in-time recovery via `--enable-point-in-time-recovery` and `--backup-start-time`.

Adım Adım Çözüm

1
Evaluate network connectivity requirements
Identify that allocating a private IP without a public IP requires specifying `--network=[VPC_NAME]` and explicitly passing `--no-assign-ip` to disable the default public IP allocation.
If `--no-assign-ip` is omitted, Cloud SQL assigns both a public IP and a private IP by default.
2
Evaluate high availability configurations
Determine that regional failover across primary and standby zones is enabled via `--availability-type=REGIONAL`.
Setting `--availability-type=ZONAL` creates a single-zone instance without automatic failover capabilities.
3
Evaluate backup and point-in-time recovery flags for PostgreSQL
Verify that `--backup-start-time` combined with `--enable-point-in-time-recovery` provides continuous write-ahead log (WAL) archiving for PostgreSQL.
Flags such as `--enable-bin-log` apply only to MySQL engines, whereas `--enable-point-in-time-recovery` is the valid flag for PostgreSQL in `gcloud sql`.

Anahtar Kavram

Cloud SQL CLI Provisioning and Security Configuration
Soru 55Soru →

A cloud engineer is using Terraform to automate the deployment of a Google Kubernetes Engine (GKE) cluster into a target service project named `proj-workloads-prod`. During the pipeline execution, `terraform apply` fails with an API error stating `Google API Error 403: Kubernetes Engine API has not been used in project proj-workloads-prod or it is disabled`. The engineer had previously enabled `container.googleapis.com` in the central CI/CD administrative project `proj-pipeline-host` where the deployment pipeline service account resides, assuming that API enablement in the calling project would suffice. Which action must the engineer take to resolve this failure?

Cevabı ve açıklamayı göster

Cevap: Enable `container.googleapis.com` specifically in the target project `proj-workloads-prod` where the infrastructure resources are being provisioned.

Cevap

Enable the Kubernetes Engine API (`container.googleapis.com`) specifically inside the target project where infrastructure resources are being deployed.
In Google Cloud, infrastructure service APIs (such as `container.googleapis.com`) must be explicitly enabled within the specific target project where the resources are created. Enabling the API in a caller's host project or pipeline administrative project only enables API usage for resources located in that host project.

Adım Adım Çözüm

1
Identify the project context of the failed resource deployment
The Terraform configuration attempts to provision resources within `proj-workloads-prod`.
GCP service APIs control endpoint access and billing enablement on a per-project basis for resource creation.
2
Determine where the service API needs to be enabled
The required API `container.googleapis.com` must be active in `proj-workloads-prod`.
Enabling an API in an administrative host project only allows operations on resources residing within that host project.
3
Apply remediation to enable the API in the target project
Run `gcloud services enable container.googleapis.com --project=proj-workloads-prod` or include a `google_project_service` resource targeting `proj-workloads-prod` in Terraform.
This grants permission for resource creation and endpoint allocation in the target project.

Anahtar Kavram

API Enablement Location in Multi-Project Infrastructure Provisioning
Soru 56Soru →

A cloud engineer is deploying a Compute Engine Virtual Machine instance named `analytics-worker` in the `us-east1-b` zone using the Google Cloud CLI (`gcloud`). The deployment must fulfill all of the following operational constraints:
- Attach an existing secondary persistent disk named `analytics-data` in read-only mode.
- Execute an initialization script stored in a Google Cloud Storage bucket (`gs://corp-analytics-binaries/init.sh`) upon startup.
- Identity and service access must be bound to the custom service account `[email protected]`.
- Prevent the allocation of an external (public) IP address to the VM.

Which `gcloud` command correctly provisions the instance according to these requirements?

Cevabı ve açıklamayı göster

Cevap: gcloud compute instances create analytics-worker --zone=us-east1-b --service-account=worker-sa@analytics-prod.iam.gserviceaccount.com --no-address --metadata=startup-script-url=gs://corp-analytics-binaries/init.sh --disk=name=analytics-data,mode=ro

Cevap

The command starting with `gcloud compute instances create analytics-worker` that specifies `--service-account=worker-sa@analytics-prod.iam.gserviceaccount.com`, `--no-address`, `--metadata=startup-script-url=gs://corp-analytics-binaries/init.sh`, and `--disk=name=analytics-data,mode=ro` correctly fulfills all requirements.
The correct option correctly uses `--service-account` to specify the identity, `--no-address` to omit external IP allocation, `--metadata=startup-script-url=...` to reference the Cloud Storage initialization script, and `--disk=name=analytics-data,mode=ro` to attach the existing persistent disk in read-only mode.

Adım Adım Çözüm

1
Identify the proper service account flag for Compute Engine VM identity.
The `--service-account` flag must be set to the email address of the service account (`[email protected]`). The `--scopes` flag defines API access scopes, not service account assignment.
Compute Engine requires explicit service account binding for workload identity.
2
Determine the parameter required to suppress external IP assignment.
Use `--no-address` to launch an instance with only a private network interface.
By default, `gcloud compute instances create` assigns an ephemeral external IP address unless `--no-address` is supplied.
3
Select the correct metadata key for remote GCS startup scripts.
Set `--metadata=startup-script-url=gs://corp-analytics-binaries/init.sh`.
The key `startup-script-url` is used for scripts hosted in Cloud Storage, whereas `startup-script` or `--metadata-from-file` is intended for local script files.
4
Specify disk attachment flags for existing secondary disks.
Pass `--disk=name=analytics-data,mode=ro` to attach the existing persistent disk in read-only mode.
The `mode=ro` option enforces read-only mounting of existing block devices.

Anahtar Kavram

Provisioning Compute Engine instances via gcloud CLI with custom service accounts, private networking, GCS startup scripts, and attached persistent disks.
Soru 57Soru →

An organization is configuring Virtual Private Cloud (VPC) firewall rules for a microservice environment hosted on Compute Engine instances. A security engineer needs to block incoming traffic on TCP port 2222 from external IP addresses while ensuring that an internal administrative subnet (10.2.0.0/2410.2.0.0/24) can maintain SSH access to instances tagged with `admin-bastion`.

Currently, the VPC network has two custom firewall rules:
- `rule-block-ssh`: Action `DENY`, Direction `INGRESS`, Priority `1000`, Source `0.0.0.0/0`, Protocol/Port `tcp:22`, Target `All instances in the network`.
- `rule-allow-admin-ssh`: Action `ALLOW`, Direction `INGRESS`, Priority `5000`, Source `10.2.0.0/24`, Protocol/Port `tcp:22`, Target network tag `admin-bastion`.

Administrators report that internal SSH connections from 10.2.0.0/2410.2.0.0/24 to `admin-bastion` instances are currently being blocked. Which modification should the cloud engineer make to resolve this issue while maintaining all security requirements?

Cevabı ve açıklamayı göster

Cevap: Update `rule-allow-admin-ssh` to have a priority number lower than 1000, such as 500.

Cevap

Update `rule-allow-admin-ssh` to have a priority number lower than 1000, such as 500.
In Google Cloud VPC networks, firewall rules are evaluated strictly by priority integer values ranging from 0 to 65535, where lower numbers have higher precedence. Because `rule-block-ssh` has a priority of 1000 and source `0.0.0.0/0`, all incoming SSH traffic is denied before reaching `rule-allow-admin-ssh` which has priority 5000. Decreasing the priority number of `rule-allow-admin-ssh` to a value lower than 1000 (such as 500) forces GCP to evaluate and grant the specific admin allow rule first.

Adım Adım Çözüm

1
Analyze firewall rule priority evaluation order in Google Cloud VPC.
Google Cloud evaluates ingress firewall rules in order of priority from integer value 0 to 65535, stopping at the first rule match. Lower integers indicate higher evaluation precedence.
Understanding priority ordering is necessary to determine which rule takes effect first when traffic matches multiple rules.
2
Evaluate the current rule precedence for traffic originating from source IP 10.2.0.0/2410.2.0.0/24 targeted at port 2222.
The incoming packet matches `rule-block-ssh` at priority 1000 (since 0.0.0.0/00.0.0.0/0 includes 10.2.0.0/2410.2.0.0/24). Because priority 1000 is evaluated before priority 5000, the packet is denied immediately.
The existing allow rule is never reached because the deny rule has a smaller priority number.
3
Determine the required priority modification to allow administrative SSH traffic.
Assigning `rule-allow-admin-ssh` a priority value less than 1000 (such as 500) ensures that traffic from 10.2.0.0/2410.2.0.0/24 matching port 2222 and tag `admin-bastion` is explicitly allowed before hitting the broader deny rule at priority 1000.
Placing the specific allow rule at a higher precedence (lower priority number) than the general deny rule resolves the connectivity block.

Anahtar Kavram

VPC Firewall Rule Priority Evaluation Order
Soru 58Soru →

An enterprise application running on Google Cloud uses a Cloud SQL instance for transactional workloads requiring complex relational SQL queries and joins. Additionally, the application stores daily audit log files in a Cloud Storage Standard bucket. These audit logs are frequently accessed and analyzed during the first 30 days after creation, but access drops significantly after 30 days while retention is required for compliance. The operations team reports high CPU utilization on the Cloud SQL primary instance due to reporting queries, as well as rising storage costs for the audit log bucket.

Which TWO architectural and operational management actions should the Cloud Engineer implement to resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision a Cloud SQL read replica and redirect reporting and analytical read queries away from the primary database instance.; Configure an Object Lifecycle Management rule on the Cloud Storage bucket to transition objects from Standard to Nearline storage after 30 days.

Cevap

The team should provision a Cloud SQL read replica to offload reporting queries and set a Cloud Storage lifecycle rule to move log files to Nearline storage after 30 days.
Provisioning a Cloud SQL read replica successfully isolates analytical and reporting queries from the primary instance, relieving primary CPU saturation while preserving full relational SQL functionality. Transitioning Cloud Storage objects to Nearline storage after 30 days matches the operational access pattern—where access drops after one month—minimizing storage fees without incurring excessive retrieval costs.

Adım Adım Çözüm

1
Analyze database performance bottleneck
Identify that read-heavy reporting queries are consuming primary Cloud SQL CPU resources.
Creating a read replica handles read traffic horizontally without impacting write performance on the primary instance.
2
Analyze storage access patterns and cost requirements
Identify that audit logs are accessed frequently for 30 days and rarely thereafter.
Nearline storage is designed for data accessed less than once a month, making a 30-day lifecycle transition ideal for cost optimization.
3
Evaluate unsuitable database engine and storage class alternatives
Reject Cloud Bigtable migration and premature Archive tiering.
Cloud Bigtable lacks SQL join capabilities, and Archive storage imposes heavy retrieval penalties when accessed frequently within 30 days.

Anahtar Kavram

Cloud SQL Read Replicas & Cloud Storage Lifecycle Management
Soru 59Soru →

A cloud administrator is managing firewall configurations for a Google Cloud custom VPC network. The network currently has two ingress firewall rules applied to virtual machines with the target network tag `db-server`:

- Rule `rule-allow-internal`: Direction INGRESS, Action ALLOW, IP protocol/port `tcp:5432`, Source IP ranges `10.150.0.0/16`, Priority 800.
- Rule `rule-deny-external`: Direction INGRESS, Action DENY, IP protocol/port `tcp:5432`, Source IP ranges `0.0.0.0/0`, Priority 300.

Database clients operating within the `10.150.0.0/16` subnet report that their connections to port 5432 on the `db-server` instances are failing. How should the administrator modify the firewall rules to allow access from `10.150.0.0/16` while continuing to block all other traffic on port 5432?

Cevabı ve açıklamayı göster

Cevap: Modify `rule-allow-internal` to have a priority of 200 so that its evaluation takes precedence over `rule-deny-external`.

Cevap

Modify `rule-allow-internal` to have a priority of 200 so that its evaluation takes precedence over `rule-deny-external`.
In Google Cloud Virtual Private Cloud (VPC), firewall rules are evaluated in ascending numerical order of their priority field (from 0 to 65535). The first rule whose attributes (direction, target tags, protocol, port, source/destination) match the packet determines the action taken. Lower priority values take precedence over higher priority values. Because `rule-deny-external` currently has priority 300 and applies to source `0.0.0.0/0`, it matches all incoming packets—including those from `10.150.0.0/16`—before `rule-allow-internal` (priority 800) is evaluated. Changing `rule-allow-internal` to priority 200 gives it higher precedence than priority 300, allowing traffic from `10.150.0.0/16` to pass while still blocking all other external ingress traffic.

Adım Adım Çözüm

1
Analyze firewall rule evaluation order in Google Cloud VPC.
GCP evaluates firewall rules sequentially starting from the lowest priority integer (0) up to the highest (65535). Evaluation stops at the first matching rule.
Lower priority numbers represent higher rule precedence.
2
Evaluate the current rule precedence and behavior for traffic originating from `10.150.0.0/16`.
`rule-deny-external` (Priority 300) matches all source IPs (`0.0.0.0/0`), including `10.150.0.0/16`, before `rule-allow-internal` (Priority 800) can be evaluated.
Since 300 is lower than 800, incoming traffic hits the DENY rule first and gets blocked.
3
Determine the required modification to enforce the intended access policy.
Assigning a priority number lower than 300 (such as 200) to `rule-allow-internal` ensures that internal traffic matching `10.150.0.0/16` is allowed before reaching `rule-deny-external`.
Traffic from `10.150.0.0/16` matches the ALLOW rule at Priority 200 and terminates evaluation, while non-matching external traffic falls through to Priority 300 and gets denied.

Anahtar Kavram

GCP VPC Firewall Rule Priority Precedence
Tahmini Süre:2m 0s
Soru 60Soru →

An enterprise SaaS company is planning the architecture for a new containerized web application on Google Kubernetes Engine (GKE). The application consists of stateless microservices that scale dynamically based on HTTP traffic. The infrastructure team wants to eliminate manual node provisioning, OS patching, and capacity planning while ensuring Google manages the cluster infrastructure health and node lifecycle entirely. Additionally, organizational policy forbids running pods with privileged host access. Which GKE mode should the cloud engineer choose to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Provision a GKE Autopilot cluster, allowing Google Cloud to fully manage the underlying node infrastructure and enforce built-in security baselines.

Cevap

Provision a GKE Autopilot cluster, allowing Google Cloud to fully manage the underlying node infrastructure and enforce built-in security baselines.
GKE Autopilot is designed to provide a fully managed environment where Google handles the cluster infrastructure, including node provisioning, auto-scaling, auto-repair, and OS patching. It also enforces security best practices by blocking privileged pod execution by default, making it the ideal choice for stateless microservices with zero node administration overhead.

Adım Adım Çözüm

1
Analyze the operational and management requirements specified in the scenario.
The requirements demand zero node management overhead (automated provisioning, health, and OS patching) for stateless microservices alongside strict pod security constraints.
Understanding the operational boundary helps evaluate the appropriate GKE cluster deployment mode.
2
Compare GKE Autopilot and GKE Standard operational models.
GKE Autopilot completely manages node provisioning, scaling, security hardening, and OS updates, while GKE Standard requires administration of node pools, underlying Compute Engine instances, and node OS upgrades.
Matching workload needs to GKE mode features ensures compliance with architectural goals.
3
Select the GKE mode that fulfills all constraints.
GKE Autopilot provides a hands-off cluster architecture ideal for stateless microservices while enforcing baseline security controls.
Autopilot satisfies the zero node-management overhead mandate while maintaining security compliance.

Anahtar Kavram

GKE Autopilot vs. Standard Cluster Architecture Planning
ÖncekiSayfa 3 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin