Examkin

Tüm alıştırma soruları

262 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 61Soru →

An Associate Cloud Engineer is tasked with setting up a new isolated environment for a financial analytics team under an existing Google Cloud Organization. The team requires a dedicated workspace where organization policies are pre-enforced before any project is provisioned, and team leads are granted permissions to create projects only within their assigned scope. Place the following administrative steps in the correct sequence to establish this resource hierarchy according to Google Cloud best practices.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with creating the parent folder under the Organization, enforcing Organization Policy constraints on the folder, delegating the Project Creator IAM role to the team leads scoped to that folder, and finally creating the workload project inside the folder.
The correct administrative sequence follows top-down governance: first establish the parent container (Folder), apply security guardrails (Organization Policies) to the container, delegate creation authority (IAM roles) at the folder scope, and finally instantiate child resources (Projects). This ensures all projects are created inside a pre-secured container.

Adım Adım Çözüm

1
Provision the parent Folder container
Establishes a structural node in the GCP resource hierarchy under the Organization.
Folders must exist before policy constraints or folder-scoped IAM permissions can be applied.
2
Set Organization Policy constraints on the newly created Folder
Establishes security guardrails at the folder scope.
Configuring constraints prior to project creation guarantees that newly provisioned projects inherit compliance policies immediately upon instantiation.
3
Delegate IAM Project Creator role to team leads at the Folder level
Gives team leads project creation capabilities restricted strictly to the Finance-Analytics folder.
Least privilege dictates granting project creation access on specific folder nodes rather than across the entire organization.
4
Provision the target Project within the Folder container
The project is created inside the folder with inherited folder-level governance.
Project creation occurs last after the container hierarchy, security constraints, and identity permissions are operational.

Anahtar Kavram

Resource Hierarchy Provisioning Sequence and IAM/Policy Inheritance
Soru 62Soru →

Place the following steps in the correct chronological sequence to deploy and verify a Compute Engine virtual machine configured with an automated web server startup script.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: Write the local startup script -> Execute gcloud compute instances create with --metadata-from-file -> Run gcloud compute instances list to get the external IP -> Access the external IP in a browser to verify deployment.
The standard deployment workflow starts with authoring the startup script locally. Next, the VM is created using `gcloud compute instances create` while passing `--metadata-from-file startup-script=...`. After creation, `gcloud compute instances list` is used to discover the instance's public IP address. Finally, navigating to the IP address validates that the script executed successfully and the web server is running.

Adım Adım Çözüm

1
Prepare the startup script locally
A bash script file containing package installation commands is stored on disk.
The file must be present locally so gcloud can read its contents during provisioning.
2
Provision the Compute Engine virtual machine
Google Cloud creates the VM instance and executes the script during initial startup.
Using `gcloud compute instances create` with `--metadata-from-file startup-script=...` attaches the script to the instance metadata.
3
Retrieve network details
The public external IP address of the instance is identified.
The `gcloud compute instances list` command displays running instances and their allocated external IP addresses.
4
Verify application health
The web server response confirms successful provisioning and execution.
Testing the endpoint verifies end-to-end connectivity and verifies that the startup script completed.

Anahtar Kavram

Deploying Compute Engine virtual machines with startup scripts using the gcloud CLI
Soru 63Soru →

A cloud engineer needs to deploy a containerized application to a newly provisioned Google Kubernetes Engine (GKE) cluster from a local workstation. What is the correct sequence of steps to configure cluster access, deploy the workload, and verify pod execution?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: 1) Fetch cluster credentials using `gcloud container clusters get-credentials`, 2) Deploy the workload using `kubectl apply -f deployment.yaml`, and 3) Verify pod execution using `kubectl get pods`.
The workflow begins with configuring local cluster credentials via `gcloud container clusters get-credentials`, followed by creating cluster objects using `kubectl apply -f deployment.yaml`, and concludes by checking container state with `kubectl get pods`.

Adım Adım Çözüm

1
Retrieve cluster access configuration for the workstation.
Local `kubeconfig` is updated with credentials and API server endpoint info.
The `kubectl` CLI requires cluster context details provided by `gcloud container clusters get-credentials` before it can communicate with GKE.
2
Deploy the application resource manifest.
Kubernetes API server receives the manifest and creates Deployment and Pod resources.
Once `kubectl` is authenticated against the cluster, resources defined in `deployment.yaml` can be created using `kubectl apply`.
3
Confirm workload deployment status.
Pod lifecycle status and container health are displayed.
Executing `kubectl get pods` provides verification that container instances have been scheduled and are actively running.

Anahtar Kavram

Deploying workloads to Google Kubernetes Engine requires establishing CLI cluster context with gcloud container clusters get-credentials prior to applying resource manifests and inspecting pod status with kubectl.
Tahmini Süre:1m 0s
Soru 64Soru →

A cloud engineer is deploying a new Google Cloud Storage bucket named `gs://finance-reports-archival` to store sensitive audit documents. The requirements mandate creating the bucket in the `us-central1` region, enforcing uniform bucket-level access to prevent object-level ACL overrides, applying a lifecycle management configuration from a local file named `policy.json` to transition items to Coldline storage, and finally populating the bucket with local files from `./reports/`. What is the correct sequential order of `gcloud storage` administrative steps to complete this deployment?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins with provisioning the bucket resource, configuring security controls (uniform bucket-level access), applying lifecycle rules from the configuration file, and finally copying local object files into the bucket.
The correct deployment sequence follows standard infrastructure lifecycle practices: provision the storage container (`gcloud storage buckets create`), apply security controls (`--uniform-bucket-level-access`), configure management rules (`--lifecycle-file`), and then perform data ingestion (`gcloud storage cp`).

Adım Adım Çözüm

1
Provision the bucket
Bucket `gs://finance-reports-archival` is created in `us-central1`.
You cannot update configuration settings or upload data to a bucket that does not yet exist.
2
Configure security controls
Uniform bucket-level access is enabled, disabling legacy object ACLs.
Configuring security boundaries prior to data ingestion ensures objects uploaded later strictly inherit IAM access policies.
3
Apply object lifecycle management
The bucket updates its lifecycle metadata using `policy.json`.
Applying the lifecycle rule prior to data upload guarantees that incoming objects are managed by the storage class transition rules immediately upon upload.
4
Ingest objects into the bucket
Local report files are copied to `gs://finance-reports-archival/`.
Data transfer occurs as the final step after target storage resources and policies are fully initialized.

Anahtar Kavram

Cloud Storage Deployment Lifecycle & Ordering
Soru 65Soru →

A cloud engineer needs to deploy a containerized web application to a Google Kubernetes Engine (GKE) cluster from a local management workstation. In what order should the engineer execute the following commands to authenticate, configure cluster access, deploy the workload, and verify the deployment status?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps is: 1) Authenticate using `gcloud auth login`, 2) Update kubeconfig context using `gcloud container clusters get-credentials`, 3) Create resources using `kubectl apply -f deployment.yaml`, and 4) Confirm pod readiness using `kubectl rollout status deployment/web-app`.
The correct operational lifecycle requires authenticating identity first (`gcloud auth login`), retrieving the target GKE cluster endpoint and credentials to populate kubeconfig (`gcloud container clusters get-credentials`), applying the Kubernetes manifest (`kubectl apply`), and finally validating that the pods have successfully rolled out (`kubectl rollout status`).

Adım Adım Çözüm

1
Authenticate user credentials with Google Cloud.
User session is authenticated for gcloud CLI operations.
Accessing Google Cloud APIs and retrieving cluster metadata requires prior authentication.
2
Generate cluster entry in kubeconfig using `gcloud container clusters get-credentials`.
Local kubectl client is configured with the GKE cluster control plane endpoint and auth token.
kubectl requires local kubeconfig context to communicate with the GKE control plane.
3
Submit workload manifest using `kubectl apply -f deployment.yaml`.
Deployment object and underlying Pod specifications are registered with the Kubernetes API server.
Workload specifications must be applied to the targeted cluster.
4
Verify deployment status using `kubectl rollout status deployment/web-app`.
Confirmation that all requested pod replicas are running and ready.
Verification ensures the newly applied deployment specification has successfully completed its rollout.

Anahtar Kavram

GKE Cluster Credential Retrieval and Workload Deployment Lifecycle
Tahmini Süre:1m 30s
Soru 66Soru →

A cloud network team is planning to expand the primary IP range of an existing production subnet in a custom-mode Google Cloud Virtual Private Cloud (VPC) network from 10.200.1.0/2410.200.1.0/24 to 10.200.0.0/2310.200.0.0/23 to accommodate a higher volume of compute instances. To ensure zero service downtime and avoid IP address space collisions, what is the correct chronological sequence of operational steps the team should follow?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins with auditing existing routing tables and peered network ranges for IP collisions, followed by confirming that the new prefix (10.200.0.0/2310.200.0.0/23) mathematically encompasses the existing primary range (10.200.1.0/2410.200.1.0/24). Next, the network engineer executes the non-disruptive `gcloud compute networks subnets expand-ip-range` command with `--prefix-length=23`. Finally, post-expansion verification validates active workload connectivity and new instance IP allocation.
Expanding a primary IP range in a Google Cloud custom-mode VPC subnet requires a systematic approach. First, pre-expansion checks must verify that the target expanded block (10.200.0.0/2310.200.0.0/23) does not overlap with any static routes, Cloud Routers, or peered networks. Second, the target CIDR must be verified to mathematically encompass the current range (10.200.1.0/2410.200.1.0/24) by decreasing the prefix length (from /24/24 to /23/23). Third, the expansion command `gcloud compute networks subnets expand-ip-range` is run specifying `--prefix-length=23`. Finally, post-deployment testing validates continuous operational status and allocation to new VM instances.

Adım Adım Çözüm

1
Audit routing tables and peered network ranges.
Identified that 10.200.0.0/2310.200.0.0/23 is completely unassigned across all connected environments.
Prevents routing table conflicts and peering non-overlap violations before modifying the live subnet configuration.
2
Verify mathematical prefix containment.
Confirmed that 10.200.0.0/2310.200.0.0/23 spans 10.200.0.010.200.0.0 to 10.200.1.25510.200.1.255, strictly containing the current range of 10.200.1.0/2410.200.1.0/24 (10.200.1.010.200.1.0 - 10.200.1.25510.200.1.255).
Google Cloud VPC subnet expansion rules mandate that primary ranges can only be expanded to a larger contiguous CIDR block (smaller prefix mask length) encompassing the original range.
3
Run the gcloud CLI subnet expansion command.
The VPC primary subnet range updates online without requiring instance reboots or dropping active connections.
Applying changes via `gcloud compute networks subnets expand-ip-range --prefix-length=23` executes the live configuration update.
4
Perform post-expansion connectivity and allocation validation.
Existing instances maintain active network sessions and newly deployed VMs correctly pull addresses from the 10.200.0.0/2410.200.0.0/24 pool.
Ensures the expanded address range is active and functioning as expected.

Anahtar Kavram

VPC Subnet Primary CIDR Range Expansion Rules and Procedure
Soru 67Soru →

A cloud engineer must securely deploy an internal application on a new Compute Engine virtual machine without a public IP address. The deployment requires a custom service account with minimal access to a Cloud Storage bucket, an automated boot installation via a startup script that retrieves dependencies from the internet, and post-deployment validation. How should the engineer sequence these administrative tasks to ensure successful provisioning?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence requires creating the custom service account with IAM permissions first, establishing Cloud NAT for private outbound egress second, executing the `gcloud compute instances create` command with private IP flags third, and validating the startup script execution using Identity-Aware Proxy SSH tunneling fourth.
Proper deployment dependency ordering dictates that prerequisites must be established before provisioning. First, the IAM service account with Cloud Storage permissions must be created so it can be assigned to the instance. Second, Cloud NAT must be established on the VPC router so that a VM without a public IP can access external repositories during startup. Third, the instance is provisioned using `gcloud compute instances create` with `--service-account`, `--no-address`, and `--metadata-from-file startup-script=...`. Finally, post-deployment inspection requires connecting via Identity-Aware Proxy (IAP) SSH because the VM lacks an external IP address.

Adım Adım Çözüm

1
Identity & Access Preparation
The custom service account is created and bound to the required Cloud Storage role.
The service account must exist in GCP IAM prior to referencing it in the Compute Engine deployment command.
2
Egress Network Architecture
Cloud NAT is provisioned on the VPC subnet router.
Instances provisioned without public IP addresses (`--no-address`) require Cloud NAT to fetch external software packages during startup script execution.
3
Instance Provisioning
The Compute Engine VM is created and begins booting.
The `gcloud compute instances create` command binds the network, IAM service account, metadata startup script, and private IP configuration together.
4
Post-Deployment Verification
The engineer connects via IAP SSH and confirms startup execution logs.
Without a public IP address, traditional SSH fails; IAP TCP forwarding provides secure administrative access to inspect boot logs.

Anahtar Kavram

Secure Private VM Deployment, Service Account Scoping, Cloud NAT Egress, and IAP Tunneling
Soru 68Soru →

A cloud administrator needs to create a custom disk image from an existing Compute Engine VM instance and deploy a new VM instance using that image. What is the correct sequence of steps to complete this workflow?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: Stop the source Compute Engine VM instance to ensure disk consistency, create a custom disk image from the source instance's root persistent disk using `gcloud compute images create`, provision a new Compute Engine VM instance specifying the custom image as the boot disk using `gcloud compute instances create --image`, and verify that the new Compute Engine VM instance reaches the RUNNING status.
The workflow follows standard Google Cloud Compute Engine deployment practices: first, stopping the source VM ensures data integrity; second, creating the custom image packages the operating system and installed software; third, creating a new instance from that image provisions the VM; fourth, checking the status ensures the instance has started properly.

Adım Adım Çözüm

1
Stop the source VM instance
Disk writes cease, leaving the persistent disk in a consistent state.
Capturing an image from an active VM can result in corrupted or incomplete snapshot data.
2
Create the custom image
A custom image artifact is stored in the project's image registry.
Compute Engine instances cannot boot directly from another VM's live disk without creating an image or disk clone first.
3
Deploy the new VM instance
A new Compute Engine VM is instantiated with a boot disk initialized from the custom image.
Specifying the `--image` flag during instance creation provisions the new VM with the pre-configured operating system and applications.
4
Verify operational status
The instance status transitions to RUNNING.
Validating the instance status confirms that initialization succeeded.

Anahtar Kavram

Custom Image Creation and VM Provisioning Workflow
Soru 69Soru →

A cloud engineer is tasked with deploying an application to a new Google Kubernetes Engine (GKE) cluster. The application must securely access Cloud Storage using Workload Identity instead of exported service account keys. The target Google Service Account (GSA) and its IAM permissions have already been created. In which chronological order should the engineer execute the steps below to set up the cluster, configure Workload Identity, and deploy the workload?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with provisioning the GKE cluster with Workload Identity enabled, fetching cluster credentials for kubectl, creating the Kubernetes Service Account (KSA), granting the IAM Workload Identity User role on the Google Service Account (GSA), and finally annotating the KSA and deploying the application manifest.
The proper deployment workflow requires creating infrastructure and establishing authentication boundaries before deploying application resources. First, provision the GKE cluster with Workload Identity enabled. Next, configure local cluster credentials with `gcloud container clusters get-credentials`. Third, create the Kubernetes Service Account (KSA) within the cluster. Fourth, bind the Google Service Account (GSA) to the KSA using `gcloud iam service-accounts add-iam-policy-binding` with `roles/iam.workloadIdentityUser`. Finally, annotate the KSA with the GSA email and deploy the workload manifest.

Adım Adım Çözüm

1
Provision the GKE cluster with Workload Identity enabled
GKE cluster created with Workload Identity pool initialized
You cannot configure Workload Identity or deploy workloads until the cluster control plane and nodes exist with workload identity capabilities enabled.
2
Run gcloud container clusters get-credentials
Local kubeconfig updated with cluster endpoint and authentication tokens
kubectl commands require an active cluster context and valid authentication credentials to interact with the API server.
3
Create the Kubernetes Service Account (KSA)
KSA resource registered in the Kubernetes namespace
A KSA must exist in the cluster before IAM policy bindings or Kubernetes annotations can reference it.
4
Add IAM policy binding for Workload Identity
GSA configured to trust the specific KSA via roles/iam.workloadIdentityUser
Google Cloud IAM must explicitly permit the KSA member identity string (`serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]`) to impersonate the GSA.
5
Annotate KSA and deploy workload manifest
Pods deployed and automatically mapped to the target GSA identity
The annotation `iam.gke.io/gcp-service-account` instructs GKE's metadata server to inject GSA tokens into pod workload containers upon deployment.

Anahtar Kavram

Workload Identity Configuration Sequence for GKE
Soru 70Soru →

A Cloud Engineer needs to deploy a Cloud SQL for PostgreSQL instance with Private IP connectivity in an existing Virtual Private Cloud (VPC) network. Place the required steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of deployment steps is: 1) Allocate an IP address range in the VPC network for private services access, 2) Establish a private connection between the VPC network and Google Service Networking, 3) Create the Cloud SQL instance specifying the VPC network and disabling public IP.
Configuring Cloud SQL for private access requires preparing network infrastructure prior to instance creation. First, an IP allocation is reserved for Google services. Next, a private service connection (VPC Peering) is created between the user VPC and Google Service Networking. Finally, the Cloud SQL instance is provisioned specifying the target VPC network.

Adım Adım Çözüm

1
Allocate IP address range
A named IP range is reserved within the target VPC network.
Google Cloud SQL Private IP requires a allocated IP CIDR block dedicated to Service Networking.
2
Create Private Connection (VPC Peering)
The VPC network is peered with Google Service Networking.
Cloud SQL instances run in a tenant VPC managed by Google, which must be connected to the user VPC via Private Services Access.
3
Provision Cloud SQL instance
Cloud SQL instance is deployed with a private IP address.
With the private connection configured, the database instance can be launched using the gcloud sql instances create command with the --network flag.

Anahtar Kavram

Deploying Cloud SQL with Private IP using Private Services Access and VPC Peering
Soru 71Soru →

A cloud security administrator at a global freight logistics company needs to authorize a DevOps engineer to link a newly provisioned project, `logistics-telematics-prod`, to the enterprise central Cloud Billing Account (`01A2B3-4C5D6E-7F8990`). The task must adhere strictly to Google Cloud least-privilege guidelines. Place the administrative authorization and CLI execution steps in the correct sequential order required to successfully perform this billing link.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins by granting the Billing Account User role on the central Cloud Billing Account resource, followed by granting the Project Billing Manager role on the target project resource, authenticating to the gcloud CLI with the engineer's credentials, and finally executing the gcloud billing projects link command.
Linking a Google Cloud project to a Cloud Billing Account requires permissions on both the billing account resource and the project resource. Under least-privilege principles, the user needs Billing Account User (roles/billing.user) on the billing account and Project Billing Manager (roles/resourcemanager.projectBillingManager) on the project. Once both roles are assigned, authenticating and executing the gcloud billing projects link command completes the process.

Adım Adım Çözüm

1
Assign Billing Account IAM role
The engineer gains resourcemanager.projects.createBillingAssignment permission on the billing account resource.
To attach any project to a billing account, the user must be a Billing Account User on that billing account.
2
Assign Project IAM role
The engineer gains billing modification privileges on the target project resource.
The Project Billing Manager predefined role provides least-privilege access to link or unlink billing on the target project.
3
Authenticate CLI environment
The gcloud CLI session is authenticated with the authorized engineer account.
CLI commands run under the active authenticated identity's privileges.
4
Execute billing link command
The project logistics-telematics-prod is linked to billing account 01A2B3-4C5D6E-7F8990.
The command completes the association between the target project and the billing account.

Anahtar Kavram

Least-privilege IAM configuration for linking projects to Cloud Billing Accounts
Soru 72Soru →

A cloud network administrator is planning to expand the primary IPv4 address range of an existing subnet within a custom-mode Virtual Private Cloud (VPC) network in Google Cloud to support newly required virtual machine instances. Arrange the following steps in the correct chronological order required to safely plan and execute this subnet expansion.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence to expand a VPC primary subnet range is: 1) Audit existing network routes and IP ranges for unallocated space, 2) Calculate valid expanded CIDR boundaries using a smaller netmask, 3) Execute the gcloud compute networks subnets expand-ip-range command, and 4) Confirm the updated configuration and update IPAM records.
Safely expanding a primary VPC subnet CIDR range requires evaluating unallocated IP space across all connected networks first, calculating valid CIDR netmask boundaries, running the gcloud compute networks subnets expand-ip-range command, and updating IP address documentation upon completion.

Adım Adım Çözüm

1
Audit current IP allocations
Verified contiguous unallocated IP block availability without conflicts.
Prevents IP overlap issues across local subnets, peered VPCs, and hybrid on-premises routes.
2
Determine expanded CIDR prefix length
Calculated a valid expanded netmask retaining the original network address start.
GCP rules mandate that primary range expansion must expand existing range boundaries without shifting the starting range address illegally.
3
Issue the subnet expansion command
The subnet CIDR block is enlarged in-place without instance downtime.
The expand-ip-range command modifies subnet primary ranges dynamically without re-creating resources.
4
Verify and document changes
Updated subnet metadata validated in GCP and IPAM documentation updated.
Ensures accurate tracking of organizational IP space for future network expansion plans.

Anahtar Kavram

Subnet IP Range Expansion Planning and Execution
Soru 73Soru →

You are tasked with deploying a Python-based microservice to Google Cloud Functions (2nd gen) using the gcloud command-line interface. Arrange the deployment workflow steps into the correct chronological order from start to finish.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence is: first, enable the required APIs; second, prepare local application files; third, execute the gcloud functions deploy command; fourth, test the deployed HTTPS endpoint.
Deploying serverless workloads on Google Cloud follows a standard linear lifecycle: project API enablement precedes local source code creation, followed by deploying via the gcloud CLI, and concluding with endpoint functional testing.

Adım Adım Çözüm

1
Enable project service APIs
Cloud Functions API and Cloud Build API are active and ready to accept requests.
Google Cloud requires required service APIs to be active before accepting deployment commands.
2
Develop code and dependency files
Source files main.py and requirements.txt are saved in the project folder.
Cloud Functions requires local source files to package during deployment.
3
Execute deployment command
The code is uploaded, built, and deployed as a 2nd gen Cloud Function.
Executing gcloud functions deploy triggers Cloud Build to compile and host the revision.
4
Verify service functionality
HTTP response confirms function execution.
Post-deployment validation ensures the endpoint works as expected.

Anahtar Kavram

Cloud Functions Deployment Workflow
Soru 74Soru →

Your organization is establishing a deployment pipeline for a stateless containerized web application using Google Cloud Run in the us-central1 region. The application source code is stored locally and needs to be built into a container image, stored in a managed repository, and deployed to Cloud Run with public unauthenticated access enabled. What is the correct sequence of execution steps to deploy this serverless application using the Google Cloud CLI from start to finish?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps begins with enabling the Cloud Run and Artifact Registry APIs, followed by creating the Artifact Registry Docker repository, then submitting the source code to Cloud Build to build and push the container image, and finally deploying the container image from Artifact Registry to Cloud Run using gcloud run deploy with the --allow-unauthenticated flag.
The deployment of a serverless Cloud Run application follows a strict dependency order: API enablement allows resource management, creating the Artifact Registry repository provides the storage destination, compiling source code via Cloud Build pushes the container image to that repository, and finally running gcloud run deploy references the stored image to deploy the running service.

Adım Adım Çözüm

1
Enable required Cloud APIs
Cloud Run and Artifact Registry APIs are active and ready to accept API requests.
Google Cloud service APIs must be enabled prior to creating resources or invoking deployment tools that rely on those APIs.
2
Create Artifact Registry Repository
A regional Docker repository is available in us-central1 to store built container images.
Artifact Registry requires an existing target repository of type Docker before images can be stored.
3
Build and Store Container Image
Cloud Build compiles the source code into a container image and tags/pushes it to Artifact Registry.
Cloud Run requires an accessible container image stored in Artifact Registry (or Container Registry) to instantiate service instances.
4
Deploy Service to Cloud Run
The Cloud Run service is deployed, receives a HTTPS endpoint URL, and permits unauthenticated access.
The gcloud run deploy command provisions the service using the fully qualified Artifact Registry image path.

Anahtar Kavram

Serverless Container Deployment Workflow with Cloud Run and Artifact Registry
Soru 75Soru →

You are managing Compute Engine resources and need to create a custom image from an existing virtual machine's boot disk and use it to deploy a new virtual machine instance. What is the correct sequence of steps to safely perform this operation?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of operations is: Stop the running source instance -> Create the custom image from the boot disk -> Deploy the new instance using the custom image -> Restart the source instance.
To create a consistent custom image from a Compute Engine boot disk, the source virtual machine should first be stopped. After the VM stops, the image is created from its boot disk. The new VM instance is then provisioned from the created custom image, and finally the original source VM is restarted.

Adım Adım Çözüm

1
Stop the source VM instance.
The source instance enters the TERMINATED state, locking disk modifications.
Creating an image from an active disk can cause data corruption or inconsistent snapshot states.
2
Execute `gcloud compute images create`.
A new reusable custom image is created from the source boot disk.
The custom image encapsulates the OS configuration and applications for future deployments.
3
Execute `gcloud compute instances create` with `--image` pointing to the custom image.
A new Compute Engine VM instance is created with identical configuration and disk content.
New VM instances require an image source for provisioning their boot disks.
4
Start the source VM instance using `gcloud compute instances start`.
The original VM resumes normal operation.
Once image creation completes, the original instance can safely resume serving traffic.

Anahtar Kavram

Custom Image Creation and VM Provisioning Workflow
Soru 76Soru →

An Associate Cloud Engineer is tasked with setting up a new environment for the Finance engineering division under an existing Google Cloud Organization. What is the correct sequence of administrative steps to establish the resource container structure, enable billing, and grant access using least privilege?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is to first create the parent Folder under the Organization, create the child Project inside the Folder, link the Billing Account to the Project, and finally grant the necessary IAM predefined role at the Folder level for inherited permissions.
The correct order follows standard GCP resource hierarchy provisioning: first build the parent container (Folder) under the Organization node, then create the child resource container (Project) inside the Folder, link the Project to a Cloud Billing Account to permit resource deployment, and finally bind predefined IAM roles at the Folder level to automatically grant permissions to child resources via IAM policy inheritance.

Adım Adım Çözüm

1
Create the parent Folder under the Organization node.
Establishes the container boundary in the Google Cloud resource hierarchy.
Projects require a parent container (Organization or Folder) to exist first.
2
Provision the Project within the created Folder.
Creates the project resource container under the folder.
Project creation requires defining its parent folder ID during execution.
3
Link the Project to an active Cloud Billing Account.
Enables resource allocation and billing capabilities for the project.
Google Cloud projects cannot run billable services without a linked billing account.
4
Apply predefined IAM roles at the parent Folder level.
Grants access permissions that inherit down to the child project.
Configuring IAM roles at the parent folder ensures consistent permissions through policy inheritance according to the principle of least privilege.

Anahtar Kavram

Google Cloud Resource Hierarchy Provisioning and IAM Policy Inheritance
Soru 77Soru →

A cloud engineer is preparing an automated deployment script to create and configure a Google Cloud Storage bucket for ingesting real-time telemetry data. According to Google Cloud security and operational best practices, infrastructure must be created first, bucket-level configurations and policies applied next, access control granted third, and data ingestion validated last. In what sequence should the engineer execute these operational steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence is: 1) Provision the Cloud Storage bucket with uniform bucket-level access, 2) Apply the lifecycle management rule configuration file to the bucket, 3) Bind the Storage Object Creator IAM role to the ingestion service account, and 4) Perform a test object upload using `gcloud storage cp` to verify configuration.
The deployment sequence follows standard infrastructure-as-code and cloud operational principles: first provision the core storage resource, next apply bucket configurations and governance rules (lifecycle policies), then establish access security by binding least-privilege IAM roles (`roles/storage.objectCreator`), and finally execute an end-to-end write test with object upload.

Adım Adım Çözüm

1
Provision the bucket resource using `gcloud storage buckets create`
The Cloud Storage bucket `gs://telemetry-ingest-logs` exists in `us-east1` with uniform bucket-level access enabled.
You cannot set lifecycle rules, bind IAM roles, or upload objects until the underlying Cloud Storage bucket resource is created.
2
Apply lifecycle rules using `gcloud storage buckets update`
The bucket is configured with automated storage class transition rules prior to data ingestion.
Applying bucket governance and lifecycle management rules immediately after bucket creation guarantees compliance before any data is ingested.
3
Grant application access using `gcloud storage buckets add-iam-policy-binding`
The target service account is assigned `roles/storage.objectCreator` on the bucket.
IAM permissions must be explicitly configured on the ready bucket before applications or service accounts attempt data writes.
4
Verify upload capability using `gcloud storage cp`
Object upload succeeds, confirming end-to-end operational readiness.
Data upload is the final verification step to confirm that bucket setup and IAM authorization are functioning correctly.

Anahtar Kavram

Cloud Storage Deployment & Operational Sequencing
Soru 78Soru →

A cloud engineer is deploying a new Google Cloud Storage bucket named `gs://media-ingest-pipeline-2026` in the `us-central1` region for an automated processing workflow. The project requirements specify configuring security standards (Uniform Bucket-Level Access), applying a lifecycle transition policy to lower long-term storage costs, and uploading initial assets. In what order should the engineer execute the following operational steps to establish the bucket and its initial configuration following Google Cloud best practices?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The operational sequence should begin with bucket creation (`gcloud storage buckets create`), followed by enabling Uniform Bucket-Level Access (`--uniform-bucket-level-access`), then applying the lifecycle rules (`--lifecycle-file`), and lastly uploading the data objects (`gcloud storage cp`).
Google Cloud deployment best practices dictate establishing the infrastructure resource first, applying security access boundaries next (Uniform Bucket-Level Access), binding lifecycle automation rules, and finally ingesting initial objects.

Adım Adım Çözüm

1
Provision the bucket
Bucket `gs://media-ingest-pipeline-2026` is created in `us-central1`.
The bucket resource must exist in Google Cloud before any configuration flags or files can be applied.
2
Enforce security controls
Uniform Bucket-Level Access is activated on the bucket.
Security governance requires establishing uniform access controls prior to storing data.
3
Configure lifecycle management
Lifecycle rules from `lifecycle.json` are bound to the bucket.
Setting operational policies before data upload ensures proper automated handling of objects as soon as they land.
4
Ingest objects into the bucket
The file `media_batch_01.tar.gz` is stored in the fully configured bucket.
Object ingestion is the final step after infrastructure and governance rules are in place.

Anahtar Kavram

Deploying and Configuring Cloud Storage Buckets and Objects
Soru 79Soru →

A cloud engineer needs to deploy a web application to an existing Google Kubernetes Engine (GKE) cluster and verify its operational readiness. Arrange the following steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of operations is: 1) Authenticate and update local kubeconfig credentials using `gcloud container clusters get-credentials`, 2) Submit the deployment manifest using `kubectl apply -f deployment.yaml`, 3) Monitor the deployment rollout status using `kubectl rollout status deployment/web-app`, and 4) Inspect pod details using `kubectl get pods -o wide`.
Deploying a workload to a GKE cluster follows a logical workflow: first, establish cluster authentication and API endpoints locally via `gcloud container clusters get-credentials`; second, create the workload objects by applying the YAML manifest with `kubectl apply`; third, wait for the deployment controller to complete replica creation with `kubectl rollout status`; and fourth, verify active pod IPs and host node assignments with `kubectl get pods -o wide`.

Adım Adım Çözüm

1
Fetch cluster credentials using gcloud
The local ~/.kube/config file is populated with the GKE API server endpoint and authentication token.
kubectl requires active credentials and context configuration to issue commands against the GKE control plane.
2
Apply the Kubernetes workload manifest
The Kubernetes API server accepts the specification and triggers pod scheduling across cluster node pools.
Manifest submission tells Kubernetes which container images, replica counts, and configurations to run.
3
Track deployment rollout status
The command monitors pod startup until all requested replicas pass readiness probes.
Verifying rollout status ensures that pod initialization issues, image pull errors, or crash loops are caught.
4
Inspect running pod runtime metadata
A broad overview of running pods, internal IP addresses, and underlying host nodes is rendered.
Final health check and IP address allocation verification occur once pods are confirmed operational.

Anahtar Kavram

GKE Workload Deployment Procedure and Verification Sequence
Tahmini Süre:1m 30s
Soru 80Soru →

A cloud administrator is tasked with setting up a highly compliant log storage architecture on Google Cloud using modern `gcloud storage` CLI utilities. The solution requires creating a bucket with uniform bucket-level access enabled, setting a 365-day retention policy, defining and attaching a lifecycle policy to automatically transition objects to ARCHIVE storage after 90 days, and finally populating the bucket with historical log files. In what exact sequential order should the administrator perform these operations?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence is: first, create the bucket with Uniform Bucket-Level Access; second, set the 365-day retention policy on the bucket; third, construct the local lifecycle JSON file; fourth, attach the lifecycle JSON file to the bucket using gcloud storage buckets update; and fifth, copy the historical log files into the bucket.
The deployment sequence follows proper dependency order: creating the Cloud Storage bucket resource with Uniform Bucket-Level Access, configuring bucket-level compliance retention settings, drafting the local lifecycle configuration JSON file, updating the bucket to apply the lifecycle configuration file, and finally copying log files into the configured bucket.

Adım Adım Çözüm

1
Execute `gcloud storage buckets create` with `--uniform-bucket-level-access`.
The destination bucket is provisioned with uniform IAM access control enforcement.
Resource creation must precede configuration modifications or data population.
2
Execute `gcloud storage buckets update` with `--retention-period=365d`.
The bucket retention governance policy is established.
Configuring compliance retention settings prior to populating objects ensures all stored data is bound by the policy from the moment of ingestion.
3
Draft the local `lifecycle.json` file defining an age-based condition (90 days) and `SetStorageClass` action (`ARCHIVE`).
A valid local lifecycle definition document is created.
The lifecycle rule document must exist locally before it can be referenced in a `gcloud` update command.
4
Execute `gcloud storage buckets update` with `--lifecycle-file=lifecycle.json`.
The lifecycle policy is bound to the Cloud Storage bucket.
Attaching the policy activates automated object transition rules on the bucket.
5
Execute `gcloud storage cp` to transfer the local log files into the bucket path.
Objects are securely written into the fully configured and governed bucket.
Object upload is the final deployment step.

Anahtar Kavram

Deploying and configuring Google Cloud Storage buckets requires establishing underlying bucket resources and security policies prior to deploying lifecycle rules and ingesting data via modern `gcloud storage` CLI commands.
ÖncekiSayfa 4 / 14Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin