Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 661Soru →

A network engineering team is managing a custom-mode Virtual Private Cloud (VPC) network in Google Cloud. An existing primary subnet located in the `us-central1` region is currently assigned the primary IPv4 CIDR range 172.16.16.0/22172.16.16.0/22. Due to rapid workload scaling, the team needs to double the IP address capacity of this primary subnet without recreating the subnet or disrupting existing Virtual Machines (VMs). A secondary peered network occupies the range 172.16.24.0/22172.16.24.0/22. Which expanded IPv4 CIDR range should the team configure for the subnet?

Cevabı ve açıklamayı göster

Cevap: 172.16.16.0/21172.16.16.0/21

Cevap

The primary CIDR range should be expanded to 172.16.16.0/21172.16.16.0/21.
Expanding the primary IPv4 CIDR range to 172.16.16.0/21172.16.16.0/21 correctly doubles the subnet size (from 1,024 to 2,048 addresses) without changing the starting network address. It satisfies netmask boundary alignment rules (16(mod8)=016 \pmod 8 = 0) and finishes at 172.16.23.255172.16.23.255, ensuring zero overlap with the adjacent peered range starting at 172.16.24.0/22172.16.24.0/22.

Adım Adım Çözüm

1
Determine the required IP address capacity.
The existing range 172.16.16.0/22172.16.16.0/22 provides 1,024 addresses (172.16.16.0172.16.16.0 to 172.16.19.255172.16.19.255). Doubling capacity requires a /21 prefix length (2,048 addresses).
Decreasing the CIDR prefix length by 1 bit doubles the number of available host addresses.
2
Validate the CIDR netmask boundary alignment for the expanded range.
A /21 prefix requires the third octet to be a multiple of 8. Since 16 is divisible by 8 (16=2×816 = 2 \times 8), 172.16.16.0/21172.16.16.0/21 is a valid network boundary covering 172.16.16.0172.16.16.0 to 172.16.23.255172.16.23.255.
GCP subnet expansions must maintain the existing start IP address or expand backwards to a valid CIDR boundary that encompasses the current range.
3
Check for IP address space conflicts with existing peered networks.
The expanded range (172.16.16.0172.16.16.0 – 172.16.23.255172.16.23.255) ends immediately before 172.16.24.0/22172.16.24.0/22, avoiding any overlap.
Subnet ranges in Google Cloud VPC networks cannot overlap with connected peered VPC networks or hybrid interconnect routes.

Anahtar Kavram

VPC Subnet Primary IPv4 Range Expansion Rules
Soru 662Soru →

An enterprise is planning the networking architecture for an enterprise resource planning (ERP) platform deployed on Compute Engine. The public-facing frontend tier relies on a Global External Application Load Balancer integrated with Cloud CDN. The architecture team must now select a load balancer for an internal backend service hosted on Compute Engine instances across multiple zones in the europe-west1 region. This internal microservice receives high-volume, non-HTTP raw TCP traffic on a custom port from other VPC workloads. The load balancing solution must provide maximum performance without terminating TCP connections, while preserving the original internal client IP addresses. Which load balancing solution should you select?

Cevabı ve açıklamayı göster

Cevap: An Internal Passthrough Network Load Balancer in the europe-west1 region

Cevap

Select an Internal Passthrough Network Load Balancer in the europe-west1 region.
The correct architecture requires an Internal Passthrough Network Load Balancer because it operates at Layer 4 for internal VPC traffic, supports arbitrary non-HTTP raw TCP protocols, does not terminate TCP connections, and preserves client IP addresses directly.

Adım Adım Çözüm

1
Analyze traffic scope and visibility requirements
Traffic originates solely from internal VPC workloads, requiring an internal load balancing service rather than an external one.
Internal VPC traffic should be routed securely within the network without exposed public IP endpoints.
2
Identify the protocol and OSI layer constraints
The application uses a custom non-HTTP raw TCP protocol, ruling out Layer 7 Application Load Balancers.
Layer 7 (Application) load balancers only support HTTP, HTTPS, and gRPC traffic types.
3
Evaluate TCP termination and IP preservation requirements
Passthrough Layer 4 load balancing is required because proxy-based load balancers terminate TCP connections and do not natively preserve original client IP addresses without PROXY protocol support.
Internal Passthrough Network Load Balancers pass packets directly through to backend instances without connection termination, preserving source client IPs and minimizing processing latency.

Anahtar Kavram

Selecting GCP Network Load Balancers based on Traffic Scope, Protocol Layer, and Passthrough vs. Proxy Behavior
Tahmini Süre:2m 0s
Soru 663Soru →

An autonomous vehicle testing company uploads high-resolution LiDAR and sensor log files to a Google Cloud Storage bucket. The uploaded data is analyzed and queried daily by machine learning training pipelines during the first 30 days. After 30 days, the files are rarely accessed (less than once per year) for compliance verification, but regulatory policies require them to be retained for a total of 3 years before deletion. You need to design an Object Lifecycle Management policy to minimize total storage and operational costs while avoiding early deletion fee penalties. Which TWO lifecycle rules should you include in the bucket configuration? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Transition objects to Archive storage class when their age reaches 30 days.; Delete objects when their age reaches 1,095 days.

Cevap

The optimal lifecycle strategy involves transitioning objects to the Archive storage class after 30 days of active use and configuring an object deletion rule after 1,095 days (3 years).
Data active during the first 30 days benefits from Standard storage. Transitioning to Archive storage at 30 days optimizes storage costs for data accessed less than once a year during the remainder of its 3-year life. Deleting the objects at 1,095 days ensures regulatory compliance without paying for unnecessary long-term storage.

Adım Adım Çözüm

1
Analyze access frequency during the initial ingest phase.
Objects are accessed daily for the first 30 days, requiring the Standard storage class to avoid data retrieval penalties.
Standard storage carries no retrieval fees for active processing workloads.
2
Determine the optimal long-term storage class for rare access after 30 days.
Archive storage provides the lowest cost for data accessed less than once per year.
Transitioning at day 30 satisfies the 3-year total retention timeline, avoiding Archive storage's 365-day minimum billing commitment penalty.
3
Configure the lifecycle expiration rule.
An action rule with condition age set to 1,095 days will automatically delete the object.
This guarantees compliance retention without incurring ongoing storage fees beyond the 3-year mark.

Anahtar Kavram

Planning Cloud Storage bucket storage class transitions and object lifecycle policies based on data access patterns, minimum retention rules, and retrieval costs.
Tahmini Süre:1m 30s
Soru 664Soru →

An internal compliance auditor requires read-only access to inspect IAM policy bindings and view the list of enabled Cloud APIs within a Google Cloud project. The auditor must not be permitted to modify permissions, enable or disable APIs, or view underlying data stored in project resources. Which TWO predefined IAM roles should you grant to the auditor to adhere to the principle of least privilege?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Security Reviewer (roles/iam.securityReviewer); Service Usage Viewer (roles/serviceusage.serviceUsageViewer)

Cevap

To meet the compliance auditing requirements with minimal privilege, grant Security Reviewer (roles/iam.securityReviewer) to allow inspecting IAM policies and Service Usage Viewer (roles/serviceusage.serviceUsageViewer) to allow listing enabled Cloud APIs.
Security Reviewer grants read-only access to inspect security settings and IAM policies, while Service Usage Viewer provides read-only access to inspect enabled services and APIs. Combining these two predefined roles satisfies the auditor's read-only requirements without granting unnecessary administrative or write permissions.

Adım Adım Çözüm

1
Identify the required access permissions for the auditor role.
The user needs to inspect project IAM policies and list enabled APIs in read-only mode.
Understanding the precise minimal scope prevents over-granting administrative rights.
2
Evaluate predefined roles against the principle of least privilege.
Security Reviewer (roles/iam.securityReviewer) allows viewing security settings and IAM policies. Service Usage Viewer (roles/serviceusage.serviceUsageViewer) allows listing project APIs and service states.
Predefined roles should always be selected over primitive roles or administrative roles when specific read-only capabilities are requested.
3
Eliminate overly permissive options.
Project Editor and Project IAM Admin both allow state modification and privilege administration.
Administrative and primitive roles violate GCP security best practices.

Anahtar Kavram

Granting Least-Privilege Predefined Roles for Security Auditing and API Inspection
Soru 665Soru →

A cloud engineering team needs to manually change the number of worker nodes in a Google Kubernetes Engine (GKE) node pool named pool-analytics inside an existing zonal cluster named analytics-cluster in zone us-central1-a. They want to set the target size to 5 nodes per zone using the Google Cloud CLI. Which command should they execute?

Cevabı ve açıklamayı göster

Cevap: gcloud container node-pools resize pool-analytics --cluster=analytics-cluster --zone=us-central1-a --num-nodes=5

Cevap

The command `gcloud container node-pools resize pool-analytics --cluster=analytics-cluster --zone=us-central1-a --num-nodes=5` correctly resizes the specified GKE node pool.
Resizing a GKE node pool requires using the Google Cloud CLI command `gcloud container node-pools resize`. Specifying the node pool name alongside the `--cluster`, `--zone`, and `--num-nodes` flags correctly updates the underlying Compute Engine instance group size for that pool.

Adım Adım Çözüm

1
Identify the target resource and CLI utility.
GKE node pools are infrastructure components managed via `gcloud container node-pools` commands rather than `kubectl` workload commands.
Node pool sizing operates at the GCP infrastructure layer rather than inside the Kubernetes control plane.
2
Select the correct subcommand and flags.
Use `resize` with `--cluster`, `--zone` (or `--region`), and `--num-nodes` specifying the target count.
The `--num-nodes` flag sets the number of nodes per zone in the selected node pool.

Anahtar Kavram

Manually resizing GKE node pools using gcloud container node-pools resize.
Soru 666Soru →

Your organization requires a new Virtual Private Cloud (VPC) network where network administrators manually define subnets and IP ranges per region rather than having subnets created automatically. Which gcloud CLI command flag must you specify when executing `gcloud compute networks create` to achieve this outcome?

Cevabı ve açıklamayı göster

Cevap: --subnet-mode=custom

Cevap

The correct command flag is `--subnet-mode=custom`.
When deploying a Google Cloud Virtual Private Cloud network via the gcloud CLI, setting `--subnet-mode=custom` creates a custom mode VPC network. Custom mode VPCs do not automatically create subnets, giving administrators complete manual control over subnet names, regions, and IP address ranges.

Adım Adım Çözüm

1
Identify the deployment requirement for VPC network creation.
The requirement calls for a network without automatically generated subnets, requiring manual creation of subnets.
Google Cloud VPC networks operate in either auto mode or custom mode.
2
Evaluate the flags available in the `gcloud compute networks create` CLI command.
Setting `--subnet-mode=custom` ensures that zero subnets are auto-created upon network instantiation.
Auto mode creates one subnet per region by default, whereas custom mode starts with zero subnets.

Anahtar Kavram

VPC Network Subnet Modes (Auto Mode vs. Custom Mode)
Soru 667Soru →

A company is planning to run a continuous 24/7 video rendering service on Compute Engine virtual machines with predictable, steady resource utilization over the next three years. A cloud engineer needs to model the projected monthly infrastructure expenses in the Google Cloud Pricing Calculator. Which configuration option in the Google Cloud Pricing Calculator should the engineer select to produce the most accurate and cost-effective estimate for this continuous baseline workload?

Cevabı ve açıklamayı göster

Cevap: Apply a 3-Year Committed Use Discount (CUD) model to the Compute Engine instance specifications in the calculator.

Cevap

Apply a 3-Year Committed Use Discount (CUD) model to the Compute Engine instance specifications in the calculator.
For continuous, predictable workloads spanning multiple years, Google Cloud provides Committed Use Discounts (CUDs) for 1-year or 3-year terms. Applying a 3-Year Committed Use Discount in the Google Cloud Pricing Calculator yields the most accurate estimate and maximum cost efficiency for long-term baseline Compute Engine capacity.

Adım Adım Çözüm

1
Analyze the workload characteristics provided in the scenario.
The workload runs continuous 24/7 processing with predictable baseline resource utilization over a 3-year horizon.
Identifying workload predictability and duration dictates which pricing model applies.
2
Evaluate pricing models supported by the Google Cloud Pricing Calculator for steady Compute Engine workloads.
Committed Use Discounts (CUDs) require a commitment of 1 or 3 years in exchange for deeply discounted hourly rates on vCPUs and RAM.
A 3-year commitment offers the highest cost savings for predictable, continuous compute capacity.
3
Select the option in the pricing calculator that models 3-Year CUDs.
Configuring a 3-Year Committed Use Discount line item yields the most accurate baseline cost projection.
This accurately reflects the planned architectural strategy and financial commitment.

Anahtar Kavram

Estimating predictable Compute Engine workload costs using Committed Use Discounts in the Pricing Calculator
Soru 668Soru →

A Cloud Engineer needs to establish a daily Cloud Billing detailed usage cost export to BigQuery for organization-wide financial analytics. What is the correct sequence of steps to configure this export?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with verifying required IAM roles (Billing Account Costs Manager on the billing account and BigQuery Data Editor on the target project), followed by enabling the BigQuery API in the destination project, creating the target BigQuery dataset, navigating to the Billing export section in the Cloud Billing console, and finally configuring the Detailed usage cost export with the project ID and dataset name.
Configuring a BigQuery billing export requires completing prerequisite security and infrastructure tasks first. First, verify IAM roles on both the billing account (Billing Account Costs Manager) and project (BigQuery Data Editor). Second, enable the BigQuery API in the destination project. Third, create the target BigQuery dataset. Fourth, navigate to the Billing export section of the Cloud Billing console. Fifth, configure the Detailed usage cost export by entering the target project ID and dataset, then save.

Adım Adım Çözüm

1
Grant and verify IAM roles
The engineer holds Billing Account Costs Manager and BigQuery Data Editor roles.
Without billing administrative access and project data editor access, dataset creation and billing sink creation will be denied.
2
Enable BigQuery API
BigQuery API is enabled in the destination project.
Services in GCP cannot be provisioned or configured until their corresponding API is activated in the project.
3
Create destination dataset
Target BigQuery dataset is created.
The export workflow requires selecting an existing dataset as the destination sink.
4
Access Cloud Billing export menu
Billing export settings interface is loaded.
Cloud Billing export sinks are managed within the Cloud Billing account settings.
5
Configure and save export sink
Detailed usage cost data starts exporting daily to BigQuery.
Specifying the project and dataset binds the billing stream to BigQuery.

Anahtar Kavram

Configuring BigQuery Billing Exports
Soru 669Soru →

A Cloud Engineer is establishing command-line administration for a newly deployed Google Kubernetes Engine (GKE) cluster named `analytics-cluster` in zone `us-central1-a`. The engineer also needs to configure node pools to host a stateful, non-fault-tolerant database workload. Which two actions should the engineer perform to fulfill these operational requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Run `gcloud container clusters get-credentials analytics-cluster --zone us-central1-a` to populate the local kubeconfig file with cluster endpoint and authentication details.; Provision a dedicated node pool using standard On-Demand Compute Engine VM instances for the database workload.

Cevap

The engineer must run `gcloud container clusters get-credentials analytics-cluster --zone us-central1-a` to configure local `kubectl` authentication, and provision standard On-Demand Compute Engine node pools for the stateful, non-fault-tolerant database workload.
To grant `kubectl` command-line access to a GKE cluster, administrators must fetch credentials via `gcloud container clusters get-credentials`, which updates the local `kubeconfig` file. Additionally, stateful and non-fault-tolerant workloads such as databases require persistent compute availability, making standard On-Demand node pools the correct architectural choice.

Adım Adım Çözüm

1
Identify the proper command to configure cluster credentials for kubectl access.
Using `gcloud container clusters get-credentials analytics-cluster --zone us-central1-a` fetches the necessary cluster endpoint data and access tokens, inserting them into `~/.kube/config`.
kubectl requires active credentials and endpoint configuration stored in the kubeconfig file to execute control plane operations.
2
Evaluate infrastructure requirements for a non-fault-tolerant, stateful database workload.
Select standard On-Demand Compute Engine instances for the database node pool.
Preemptible or Spot VMs can be reclaimed by Google Cloud at any time, leading to unexpected termination and potential data corruption for stateful applications.

Anahtar Kavram

GKE kubectl credential configuration and workload-to-node pool matching strategy
Soru 670Soru →

A solution architect is deploying a containerized REST API image stored in Artifact Registry to Google Cloud Run in the us-central1 region using the gcloud CLI. The application binary inside the container is configured to listen strictly on container port 5000 and does not dynamically adopt environment variables. The service must be deployed securely, allowing only authenticated requests. Which gcloud CLI command correctly deploys the service with the required network port configuration and ingress access control?

Cevabı ve açıklamayı göster

Cevap: gcloud run deploy inventory-api --image=us-central1-docker.pkg.dev/my-project/api-repo/inventory:v1 --port=5000 --no-allow-unauthenticated --region=us-central1

Cevap

The command that specifies the custom container listening port using --port=5000, enforces private access via --no-allow-unauthenticated, and targets the us-central1 region with gcloud run deploy is the correct deployment approach.
The command using gcloud run deploy with --port=5000 and --no-allow-unauthenticated correctly informs Cloud Run to forward incoming requests to container port 5000 while ensuring that unauthenticated public traffic is blocked.

Adım Adım Çözüm

1
Identify the appropriate serverless compute service for custom container image deployment.
Cloud Run is the required platform because it accepts arbitrary container images from Artifact Registry, whereas Cloud Functions targets source code/event-driven function signatures.
Cloud Run allows developers to package microservices into standard OCI containers.
2
Determine the required CLI flags for custom port binding.
By default, Cloud Run sends requests to port 8080 inside the container. Because the binary listens on port 5000, the --port=5000 flag must be explicitly declared during deployment.
If the container port does not match where the binary is listening, container health checks fail and ingress traffic cannot reach the application.
3
Configure the access control parameters according to security requirements.
The --no-allow-unauthenticated flag ensures IAM authentication is enforced for incoming HTTP requests.
The requirement specifies that only authenticated requests should be permitted.

Anahtar Kavram

Cloud Run Container Port Configuration and Ingress IAM Security via gcloud CLI
Tahmini Süre:2m 0s
Soru 671Soru →

Your organization is integrating an on-premises data center with a Google Cloud Virtual Private Cloud (VPC) network over Cloud Interconnect. You need to enable on-premises clients to resolve internal Cloud DNS zone records ending in `internal.example.com`. Place the deployment steps in the correct chronological order from first to last to complete this configuration.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts by enabling inbound DNS forwarding via a Cloud DNS server policy on the VPC network, retrieving the allocated inbound forwarder IP addresses, configuring on-premises DNS conditional forwarding to those IP addresses, and finally testing resolution from an on-premises host.
Configuring hybrid DNS resolution requires provisioning the cloud infrastructure first (Cloud DNS server policy with inbound forwarding), identifying the generated inbound forwarder IP addresses, configuring the on-premises DNS server to use those IPs as conditional forwarders, and finally verifying connectivity from an on-premises client.

Adım Adım Çözüm

1
Enable inbound DNS forwarding on the VPC network.
A Cloud DNS server policy is created on the VPC network, provisioning inbound DNS forwarder entry points.
Cloud DNS cannot accept external/on-premises DNS queries until inbound forwarding is explicitly enabled via a server policy.
2
Look up the allocated Cloud DNS inbound forwarder IP addresses.
The administrator obtains the specific internal IP addresses created in the VPC subnets for inbound DNS traffic.
These IP addresses serve as the target destinations for DNS queries originating from the on-premises network.
3
Update on-premises DNS conditional forwarding rules.
The on-premises DNS servers forward all requests for `internal.example.com` across the hybrid connection to Google Cloud.
On-premises clients send queries to their local DNS server, which requires conditional forwarding rules pointing to the Cloud DNS forwarders.
4
Test end-to-end resolution from an on-premises client.
Successful DNS response containing the private IP address of the queried Google Cloud resource.
Testing from the end client verifies that routing, firewall rules, and DNS forwarding configurations are operating correctly.

Anahtar Kavram

Cloud DNS Inbound Forwarding Configuration for Hybrid Cloud Environments
Soru 672Soru →

A cloud engineer needs to expand the primary IPv4 CIDR range of an existing custom-mode Virtual Private Cloud (VPC) subnet in Google Cloud to accommodate new virtual machines without causing service disruption. What is the correct sequence of steps to plan and execute this subnet expansion?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for expanding a custom-mode VPC primary subnet range is: 1) Verify that adjacent contiguous IP space is free of conflicts, 2) Select a broader prefix length encompassing the original base IP address, 3) Execute `gcloud compute networks subnets expand-ip-range` with the desired prefix length, and 4) Verify the expanded primary range in the subnet resource configuration.
Proper planning and execution of a GCP custom-mode VPC subnet primary range expansion requires checking for non-overlapping contiguous IP space, calculating a valid expanded prefix length, executing `gcloud compute networks subnets expand-ip-range`, and verifying the updated subnet status.

Adım Adım Çözüm

1
Audit current subnet IP allocation and connected networks
Ensures the planned expanded CIDR block does not collide with existing subnets, VPN tunnels, or interconnect routes.
Subnet expansion will fail or cause routing conflicts if the new IP space overlaps with existing network definitions.
2
Determine the new prefix length for expansion
Identifies a smaller prefix number (e.g., /23 instead of /24) that expands capacity while retaining the existing subnet start address.
GCP subnet expansion only permits broadening the netmask without changing the existing starting IP address boundary.
3
Execute the live expansion command
Applies the primary IP range expansion in place without causing VM downtime.
The `gcloud compute networks subnets expand-ip-range` command dynamically grows the subnet CIDR block online.
4
Confirm the updated subnet resource details
Validates that the subnet reflects the expanded primary IP range.
Post-execution verification confirms the subnet has successfully scaled its capacity.

Anahtar Kavram

VPC Subnet Primary Range Expansion Procedure
Soru 673Soru →

An organization is establishing hybrid connectivity between their Google Cloud environment and their on-premises data center using Cloud VPN. Compute Engine instances located in a Virtual Private Cloud (VPC) named `prod-vpc` need to resolve domain names under the custom corporate domain `internal.example.com`, which are managed by an on-premises authoritative DNS server at IP address `192.168.1.50`. Which action should you take in Cloud DNS to enable internal name resolution for these on-premises hosts from `prod-vpc`?

Cevabı ve açıklamayı göster

Cevap: Create a Cloud DNS forwarding zone for the domain `internal.example.com`, specify the DNS server IP `192.168.1.50` as the target DNS server, and set `prod-vpc` as the authorized network.

Cevap

Create a Cloud DNS forwarding zone for the domain internal.example.com, specify the DNS server IP 192.168.1.50 as the target DNS server, and set prod-vpc as the authorized network.
To allow Compute Engine instances in a GCP VPC to resolve domain names hosted on an on-premises DNS server, you create a Cloud DNS private zone configured for DNS forwarding (an outbound forwarding zone). By setting the target domain to `internal.example.com`, specifying the destination on-premises DNS server IP `192.168.1.50`, and authorizing `prod-vpc`, Cloud DNS proxies all incoming queries for that domain from the VPC across the Cloud VPN tunnel.

Adım Adım Çözüm

1
Identify the hybrid DNS resolution direction
GCP workloads in `prod-vpc` need to resolve names hosted on an on-premises DNS server (`outbound` DNS query path).
Traffic originates inside GCP and targets external DNS infrastructure.
2
Select the appropriate Cloud DNS resource type
A Cloud DNS Private Forwarding Zone is required.
Forwarding zones allow Cloud DNS to act as a DNS proxy and delegate specific domain queries to specified target IP addresses over VPN or Interconnect.
3
Configure zone parameters and network authorization
Set target server IP to `192.168.1.50` and authorize `prod-vpc`.
Authorizing `prod-vpc` ensures instances within the VPC use Cloud DNS to forward matching `.internal.example.com` queries to the on-premises DNS server.

Anahtar Kavram

Cloud DNS Outbound Forwarding Zones
Tahmini Süre:2m 0s
Soru 674Soru →

You need to manually migrate running microservice workloads from an existing Google Kubernetes Engine (GKE) node pool to a newly created node pool with minimal disruption. Arrange the following operational steps in the correct execution sequence.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: provision the new node pool (gcloud container node-pools create), cordon the original nodes (kubectl cordon), drain the original nodes (kubectl drain), and delete the empty node pool (gcloud container node-pools delete).
Safe workload migration between GKE node pools requires creating the new node pool first so target capacity exists. Next, cordoning the old nodes ensures no new pods land on them. Draining the old nodes then evicts running workloads, allowing Kubernetes to reschedule them onto the new node pool. Finally, deleting the old node pool cleans up unused GCP resources.

Adım Adım Çözüm

1
Create target node pool
A new node pool is created and attached to the cluster.
Target capacity must be active before evicting workloads from the original nodes to avoid unschedulable pod states.
2
Cordon old nodes
The old nodes are marked with SchedulingDisabled status.
Prevents newly incoming pods or restarted pods from being assigned to the nodes undergoing decommission.
3
Drain old nodes
Pods are safely evicted from old nodes and rescheduled onto the new node pool.
kubectl drain triggers a graceful eviction process that respects PodDisruptionBudgets.
4
Delete original node pool
The old node pool and underlying Compute Engine instances are deleted.
Once all workloads are confirmed to be running on the new node pool, the old infrastructure can be safely removed.

Anahtar Kavram

Manual GKE Node Pool Migration and Node Lifecycle Management
Tahmini Süre:1m 30s
Soru 675Soru →

A smart grid utility provider is planning a Google Kubernetes Engine (GKE) cluster architecture to handle real-time telemetry from millions of smart meters. The deployment requires two distinct workloads:

1. A high-throughput API gateway service that requires custom Linux kernel (`sysctl`) parameter modifications on the node host to optimize TCP socket buffers.
2. A stateless, fault-tolerant batch data processing pipeline that parses incoming telemetry logs and can handle sudden node preemptions.

The architecture team wants to minimize compute costs and management overhead while meeting all workload technical requirements. Which TWO cluster planning choices should be included in the solution architecture?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision a GKE Standard cluster with a node pool configured with custom Linux kernel settings to host the API gateway service.; Create a dedicated node pool using Spot VMs for the batch data processing pipeline workload.

Cevap

The architecture plan should include provisioning a GKE Standard cluster with a node pool configured for custom kernel parameters for the API gateway service, and creating a dedicated Spot VM node pool for the stateless batch processing pipeline.
GKE Standard must be selected because the API gateway requires custom Linux kernel (`sysctl`) tuning, which is restricted in GKE Autopilot. Furthermore, utilizing Spot VMs for the batch data processing pipeline effectively minimizes compute costs, as the workload is stateless and resilient to node terminations.

Adım Adım Çözüm

1
Determine the appropriate GKE cluster mode based on host kernel requirements.
Select GKE Standard for the API gateway because GKE Autopilot restricts host-level kernel parameter (sysctl) customizations.
Autopilot operates under a strict security and configuration model that blocks custom node kernel tuning.
2
Determine the optimal compute purchasing model for the batch processing pipeline.
Assign Spot VMs to the batch processing node pool to minimize infrastructure spend.
Stateless, fault-tolerant workloads can easily recover from preemption, making them ideal candidates for discounted Spot instances.

Anahtar Kavram

Evaluating GKE operational mode boundaries (Standard vs. Autopilot) and node pool provisioning models (Standard vs. Spot VMs) based on workload requirements.
Soru 676Soru →

A Cloud Engineer needs to perform maintenance on a Google Kubernetes Engine (GKE) Standard cluster by replacing an existing node pool with a new machine-type node pool, while ensuring zero workload downtime. Arrange the operational CLI steps in the correct sequential order from first to last to complete this node pool migration safely.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: 1) Create the new target node pool using gcloud container node-pools create, 2) Mark nodes in the old pool as unschedulable using kubectl cordon, 3) Gracefully evict running pods from old nodes using kubectl drain --ignore-daemonsets, 4) Verify workload status and node placement using kubectl get pods -o wide, and 5) Decommission the old node pool using gcloud container node-pools delete.
Safe migration requires creating destination capacity first (gcloud container node-pools create), blocking new pod placement on old nodes (kubectl cordon), gracefully evicting existing workloads (kubectl drain), validating that all pods are healthy on the new pool (kubectl get pods -o wide), and finally deleting the deprecated node pool (gcloud container node-pools delete).

Adım Adım Çözüm

1
Provision target compute capacity in GKE.
A new node pool is initialized and joins the cluster.
Destination capacity must be available before evicting pods to prevent capacity shortages or Unschedulable pod states.
2
Cordon the old nodes in the cluster.
Nodes in the legacy node pool are marked as Unschedulable.
Ensures that any new pods or evicted workloads are routed exclusively to the new node pool.
3
Drain the old nodes.
Existing pods are evicted and rescheduled onto the new node pool.
Gracefully shuts down workloads on old hardware and recreates them on the newly provisioned infrastructure.
4
Inspect pod deployment status across nodes.
Pods are confirmed running and healthy on the new nodes.
Verification confirms that application traffic is served correctly before removing old compute resources.
5
Delete the old node pool.
The old node pool is removed from the cluster.
Safely reclaims resources and avoids unnecessary compute billing.

Anahtar Kavram

GKE Zero-Downtime Manual Node Pool Migration Workflow
Soru 677Soru →

A financial risk modeling platform generates large batch output reports during the first 10 days of every month. Financial analysts access and modify these reports multiple times per day during this 10-day period. After the 10th day, the reports are never accessed again unless requested during an annual compliance audit. The organization must retain all report files for 7 years to meet statutory obligations while minimizing total storage and retrieval costs. Which Cloud Storage strategy should you recommend?

Cevabı ve açıklamayı göster

Cevap: Create the Cloud Storage bucket with the Standard storage class and configure Object Lifecycle Management to transition objects to Archive storage after 30 days.

Cevap

Create the Cloud Storage bucket with the Standard storage class and configure Object Lifecycle Management to transition objects to Archive storage after 30 days.
The platform requires frequent daily reads and edits during the first 10 days of every month. Using Standard storage for newly created objects ensures zero retrieval fees during this active window. After 30 days, when data is rarely accessed, transitioning objects to Archive storage via Object Lifecycle Management minimizes monthly storage costs for the remaining 7-year compliance period.

Adım Adım Çözüm

1
Analyze access frequency during the initial phase
Heavy daily access in the first 10 days requires Standard storage to avoid retrieval costs.
Standard storage has no data retrieval fees, making it optimal for frequently accessed active data.
2
Analyze access frequency and retention requirement for the long-term phase
Files are held for 7 years and accessed less than once a year (only during annual audits).
Archive storage offers the lowest monthly gigabyte storage rate for long-term retention of rarely accessed data.
3
Determine optimal Object Lifecycle Management policy timing
Transition from Standard to Archive after 30 days.
Ensures active reading occurs in Standard storage without retrieval fees while fulfilling lifetime cost-minimization goals.

Anahtar Kavram

Selecting Cloud Storage classes and configuring lifecycle transition rules based on data access patterns and retrieval cost tradeoffs.
Soru 678Soru →

You are deploying a Regional Internal HTTP(S) Load Balancer in a Google Cloud Virtual Private Cloud (VPC) network using the gcloud CLI to service internal microservices. Arrange the required deployment steps in the correct dependency sequence from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct deployment sequence is: 1) Create a proxy-only subnet in the region, 2) Create the health check and regional backend service (load balancing scheme INTERNAL_MANAGED) with backend instance groups, 3) Create the regional URL map pointing to the backend service, 4) Create the regional target HTTP proxy referencing the URL map, and 5) Create the regional forwarding rule linking the internal IP to the target proxy.
Deploying a Regional Internal Application Load Balancer follows a strict bottom-up object dependency model: lower-layer resources must exist before higher-layer resources can reference them. First, a proxy-only subnet must be established in the region to host Envoy proxies. Next, backend services and health checks are configured. Once backend services are defined, the URL map can be created. The target HTTP proxy is then built targeting the URL map. Finally, the forwarding rule is created as the frontend entry point that links an internal IP address to the target proxy.

Adım Adım Çözüm

1
Reserve network resources for Envoy proxies.
Proxy-only subnet is provisioned in the VPC for the specified region.
Regional Internal Application Load Balancers require a dedicated proxy-only subnet in the region to instantiate Envoy proxies.
2
Configure backend infrastructure.
Regional backend service configured with INTERNAL_MANAGED scheme and associated with health checks and instance groups.
Backend services define how traffic is distributed and health-checked before frontend routing components can reference them.
3
Configure routing configuration.
URL map object created pointing to the backend service.
The URL map relies on the existence of the destination backend service.
4
Configure target proxy.
Target HTTP proxy created referencing the URL map.
Target HTTP proxies require an existing URL map to route traffic received from forwarding rules.
5
Configure frontend entry point.
Forwarding rule established pointing to the target proxy.
The forwarding rule is the final step in the frontend pipeline, connecting incoming network traffic to the target proxy.

Anahtar Kavram

Internal HTTP(S) Load Balancer Deployment Dependencies
Soru 679Soru →

An enterprise organization is setting up a new Google Cloud environment. A finance specialist needs permission to link newly created cloud projects to the company's central Cloud Billing Account. The specialist must not be allowed to modify payment methods, manage billing account admins, or view cost reports for other projects linked to the account. Which predefined IAM role should be assigned to the finance specialist on the Cloud Billing Account resource to satisfy the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Billing Account User (roles/billing.user)

Cevap

Billing Account User (roles/billing.user)
The Billing Account User (roles/billing.user) role allows users to associate projects with a Cloud Billing Account. When granted on the billing account level, it fulfills the requirement of allowing project linking while strictly withholding administrative permissions over payment settings or billing account configuration.

Adım Adım Çözüm

1
Identify the minimum permission required for linking a project to a billing account.
The user requires the billing.resourceAssociations.create permission on the Cloud Billing Account resource.
Linking a project to a billing account requires access rights on the billing account itself.
2
Evaluate predefined IAM roles scoped to the Cloud Billing Account resource against least privilege rules.
Billing Account User (roles/billing.user) grants project association rights without administrative or viewing access to unrelated billing data.
Overly permissive roles like Billing Account Administrator grant sensitive management privileges, while Billing Account Viewer lacks write/association capabilities.

Anahtar Kavram

Least privilege IAM role selection for Google Cloud Billing Accounts
Tahmini Süre:1m 30s
Soru 680Soru →

A media streaming company is setting up a new web asset repository on Google Cloud to host image and stylesheet files in the us-central1 region. The cloud architecture team mandates using Google Cloud's modern CLI tools (gcloud storage) and enforcing Uniform Bucket-Level Access to ensure consistent IAM governance across all stored objects. Which set of commands correctly provisions the bucket and uploads the static files according to Google Cloud best practices?

Cevabı ve açıklamayı göster

Cevap: Execute gcloud storage buckets create gs://media-app-assets-2026 --location=us-central1 --uniform-bucket-level-access to provision the bucket, then execute gcloud storage cp -r ./assets/* gs://media-app-assets-2026/ to upload the static files.

Cevap

Execute gcloud storage buckets create gs://media-app-assets-2026 --location=us-central1 --uniform-bucket-level-access to provision the bucket, then execute gcloud storage cp -r ./assets/* gs://media-app-assets-2026/ to upload the static files.
The correct response specifies using `gcloud storage buckets create` with `--location=us-central1` and `--uniform-bucket-level-access`, followed by `gcloud storage cp` to upload files. This follows Google Cloud's current best practices for bucket deployment and CLI usage.

Adım Adım Çözüm

1
Select the correct command and flag to create the Cloud Storage bucket.
Use `gcloud storage buckets create` specifying `--location=us-central1` and `--uniform-bucket-level-access`.
Modern Google Cloud tooling prefers `gcloud storage` commands over `gsutil`, and `--uniform-bucket-level-access` ensures IAM-only access control.
2
Select the correct command to recursively upload static asset files.
Use `gcloud storage cp -r ./assets/* gs://media-app-assets-2026/`.
The `gcloud storage cp` command efficiently performs recursive file transfers to Cloud Storage buckets.

Anahtar Kavram

Deploying Cloud Storage Buckets with Uniform Bucket-Level Access using gcloud storage CLI
ÖncekiSayfa 34 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin