Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 961Soru →

A company generates daily analytical export files in a Google Cloud Storage bucket. Internal teams frequently read and analyze these files during the first 30 days following creation. After 30 days, the files are rarely accessed, but regulatory requirements state they must be retained for three years. A cloud engineer needs to configure an Object Lifecycle Management rule to optimize storage costs without incurring unexpected retrieval fees during active use. Which configuration should the engineer implement?

Cevabı ve açıklamayı göster

Cevap: Set a lifecycle rule to transition objects to Archive storage 30 days after their creation date.

Cevap

Set a lifecycle rule to transition objects to Archive storage 30 days after their creation date.
Keeping objects in Standard storage for the first 30 days supports active query patterns without retrieval charges. Automatically transitioning them to Archive storage after 30 days optimizes storage costs for long-term regulatory compliance retention.

Adım Adım Çözüm

1
Analyze access patterns and storage cost trade-offs
Standard storage is appropriate for the first 30 days when data is frequently accessed, while Archive storage offers the lowest cost for long-term retention of rarely accessed compliance data.
Coldline and Archive storage classes incur retrieval fees when read, making them suitable only after the initial high-frequency access period ends.
2
Evaluate Cloud Storage Object Lifecycle Management capabilities
Cloud Storage lifecycle rules can automatically change object storage classes based on age condition metrics without requiring application code changes.
Setting the condition 'Age: 30 days' and the action 'SetStorageClass: ARCHIVE' automates the transition at the optimal financial threshold.

Anahtar Kavram

Cloud Storage Object Lifecycle Management & Tiering
Tahmini Süre:1m 30s
Soru 962Soru →

An enterprise logistics company is migrating its fleet monitoring application to Compute Engine on Google Cloud. The system architecture has two key storage requirements:

1. A fully managed NoSQL database capable of ingesting high-throughput, low-latency time-series GPS location telemetry from tens of thousands of delivery vehicles.
2. Extremely high IOPS local block storage attached to processing virtual machines to serve as high-speed, temporary scratch space for processing incoming data streams, where data loss upon instance termination is acceptable.

Which TWO Google Cloud database and block storage options should the engineering team select? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Cloud Bigtable for storing high-throughput, low-latency GPS telemetry data; Local SSD attached to Compute Engine instances for temporary, high-IOPS stream transformation scratch disk space

Cevap

The correct architecture requires selecting Cloud Bigtable for the time-series telemetry ingestion and Local SSD for high-performance temporary VM scratch space.
The solution requires Cloud Bigtable because it is engineered for high-volume, low-latency NoSQL time-series data such as vehicle GPS tracking. Local SSD is the ideal choice for ephemeral scratch space requiring maximum IOPS, as it is physically attached to the hypervisor host and yields superior performance for scratch workloads.

Adım Adım Çözüm

1
Analyze the database requirement for high-throughput time-series GPS location telemetry.
Cloud Bigtable provides scalable, low-latency NoSQL storage specifically optimized for time-series and IoT telemetry data.
Relational databases like Cloud SQL do not scale as efficiently for massive, sustained single-key time-series write workloads.
2
Analyze the block storage requirement for temporary stream transformation scratch disk space requiring ultra-high IOPS.
Local SSD provides sub-millisecond latency and maximum throughput/IOPS by physically attaching to the VM host server, accepting data loss upon VM termination.
Standard Persistent Disks rely on network-attached HDD storage with substantially lower IOPS limits.

Anahtar Kavram

Selecting GCP Managed Databases and Persistent Block Storage Types based on Workload Characteristics
Soru 963Soru →

A company is architecture-planning a global application on Google Cloud Compute Engine. The application serves HTTPS web traffic to internet users worldwide and requires edge caching to minimize latency for static assets. In addition, the application processes real-time, non-HTTP TCP traffic on port 7000 within a single region, where backend instances must receive packets with the original client source IP address intact. Which combination of Google Cloud networking services meets these requirements according to Google recommended practices?

Cevabı ve açıklamayı göster

Cevap: Deploy a Global External Application Load Balancer with Cloud CDN enabled for the HTTPS traffic, and an External Passthrough Network Load Balancer for the port 7000 TCP traffic.

Cevap

Deploy a Global External Application Load Balancer with Cloud CDN enabled for the HTTPS traffic, and an External Passthrough Network Load Balancer for the port 7000 TCP traffic.
The correct choice pairs a Global External Application Load Balancer with Cloud CDN for the HTTPS traffic and an External Passthrough Network Load Balancer for the raw TCP traffic on port 7000. Global External Application Load Balancers provide HTTP(S) reverse-proxy capabilities and integrate directly with Cloud CDN at edge locations. External Passthrough Network Load Balancers operate at Layer 4 (regional) and pass incoming traffic straight to backend VMs without terminating connections, preserving the client's original IP address.

Adım Adım Çözüm

1
Analyze the web traffic requirements (HTTPS protocol, global scope, static media edge caching).
Identify that a Global External Application Load Balancer (Layer 7) paired with Cloud CDN is required for global edge caching of HTTPS assets.
Cloud CDN integrates with HTTP(S) Layer 7 load balancers to cache static content at Google edge points of presence globally.
2
Analyze the non-HTTP TCP traffic requirements (port 7000, regional scope, public internet accessibility, client IP preservation).
Identify that an External Passthrough Network Load Balancer (Layer 4) is required.
Passthrough load balancers route packets directly to backend instances without terminating the connection, preserving the original client source IP address.
3
Combine the service choices into a unified network architecture plan.
Select the option that pairs the Global External Application Load Balancer (with Cloud CDN) for HTTPS with the External Passthrough Network Load Balancer for TCP port 7000.
This configuration satisfies all protocol, scope, performance, and IP preservation requirements.

Anahtar Kavram

Selecting GCP Load Balancer Types based on Protocol (Layer 4 vs Layer 7), Scope, Cloud CDN Integration, and Client IP Preservation Requirements
Soru 964Soru →

A financial technology platform deploys stateful transactional logging Compute Engine virtual machines attached to Persistent Disks. Due to an upcoming compliance audit, the operations team must safely expand the persistent disk capacity from 500 GB to 1 TB and update the underlying file system without recreating the instances or causing unnecessary service downtime. Additionally, they must ensure automated daily backups of these disks are configured according to organizational policy using native Google Cloud capabilities. Which two actions should the team perform to fulfill these operational requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Execute gcloud compute disks resize to increase the disk capacity, and then run file-system expansion utility commands inside the VM instance operating system to utilize the new space.; Create a snapshot schedule resource policy specifying the daily backup frequency and retention, and attach the resource policy to each persistent disk.

Cevap

To expand disk capacity and automate backups with minimal disruption, the team should execute gcloud compute disks resize followed by OS-level file system expansion, and create a snapshot schedule resource policy attached to the persistent disks.
Expanding persistent disks in Compute Engine is performed online using gcloud compute disks resize or the Cloud Console, followed by OS-level file system expansion commands. For automated disk backups, GCP provides native snapshot schedule resource policies that attach directly to persistent disks.

Adım Adım Çözüm

1
Resize the persistent disk capacity in Google Cloud
The block storage allocation grows to 1 TB while the instance continues running.
Google Cloud Persistent Disks support online disk resizing without detaching the disk or stopping the VM.
2
Expand the partition and file system inside the operating system
The operating system recognizes and utilizes the newly added disk space.
Resizing the disk at the GCP API level only enlarges the block device; OS utilities (such as resize2fs or xfs_growfs) must extend the file system.
3
Configure a native Snapshot Schedule Resource Policy
Automated daily backups occur according to schedule and retention requirements.
Resource policies natively attach to disks to manage scheduled snapshots without requiring manual scripts or broad IAM privilege escalation.

Anahtar Kavram

Compute Engine Disk Management and Automated Resource Policies
Soru 965Soru →

An automated deployment process requires access to upload build artifacts as new files into a specific Cloud Storage bucket named `prod-build-artifacts` located inside the project `app-deployments-prod`. According to organization security compliance, the process must adhere strictly to the Principle of Least Privilege by ensuring it cannot read existing objects, overwrite/delete files, or access any other buckets in the project or parent folder. Which IAM role assignment strategy should be configured?

Cevabı ve açıklamayı göster

Cevap: Grant the predefined role Storage Object Creator (roles/storage.objectCreator) on the specific prod-build-artifacts bucket resource.

Cevap

Grant the predefined role Storage Object Creator (roles/storage.objectCreator) specifically on the target Cloud Storage bucket resource.
Granting `roles/storage.objectCreator` directly on the target Cloud Storage bucket grants only the necessary `storage.objects.create` permission specifically on that bucket. It prevents reading existing objects, deleting data, and accessing any other buckets in the project or folder hierarchy.

Adım Adım Çözüm

1
Analyze required permissions
The requirement mandates object upload (create) capability only, prohibiting object read, list, delete, or access to other storage resources.
Security rules enforce the Principle of Least Privilege.
2
Select the appropriate IAM role type
Select predefined role `roles/storage.objectCreator` over primitive roles (`roles/editor`, `roles/viewer`).
Predefined roles provide granular, narrow permissions tailored specifically to exact operational needs.
3
Determine the resource hierarchy binding level
Bind the role directly to the bucket resource `prod-build-artifacts` rather than at the project or folder level.
Permissions inherit down the hierarchy, so binding at project or folder levels grants unauthorized access to other buckets.

Anahtar Kavram

Principle of Least Privilege and IAM Resource Hierarchy Binding
Tahmini Süre:2m 0s
Soru 966Soru →

A cloud engineer needs to manually scale out an application deployment named `frontend-service` running in a Google Kubernetes Engine (GKE) cluster from 5 pod replicas to 20 pod replicas to handle an upcoming promotional event. The cluster already has sufficient node capacity to accommodate the additional workload. Which command should the engineer run to scale the application workload?

Cevabı ve açıklamayı göster

Cevap: kubectl scale deployment frontend-service --replicas=20

Cevap

Execute `kubectl scale deployment frontend-service --replicas=20` to update the application deployment workload replica count.
The `kubectl scale deployment` command updates the `spec.replicas` field of a Kubernetes Deployment. Because the GKE cluster already possesses adequate node compute capacity, increasing the pod count via `kubectl` immediately schedules the required additional replicas.

Adım Adım Çözüm

1
Identify the target resource level to scale.
The target is an application Deployment (`frontend-service`), which is a Kubernetes workload object, rather than GKE VM node infrastructure.
Pod replica counts are managed at the workload layer using Kubernetes API tools.
2
Select the correct command-line interface and sub-command for scaling Kubernetes Deployments.
`kubectl scale deployment frontend-service --replicas=20` targets the deployment and updates its replica specification.
`kubectl` is used to manage Kubernetes resources, whereas `gcloud container` commands manage GCP GKE cluster and node pool infrastructure.

Anahtar Kavram

Scaling GKE Workloads vs. Scaling GKE Node Infrastructure
Tahmini Süre:1m 30s
Soru 967Soru →

An operations team is setting up a new Google Kubernetes Engine (GKE) environment for a fleet of stateless microservices. The architecture requirements specify that Google Cloud must fully manage the node infrastructure, including automatic node provisioning and autoscaling, to minimize administrative management overhead. Additionally, site reliability engineers need to execute deployment manifests against the new cluster using `kubectl` from their local command-line interface.

Which TWO configuration steps must be performed to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create the GKE cluster using Autopilot mode, which automates node provisioning, scaling, and cluster infrastructure maintenance.; Execute `gcloud container clusters get-credentials` to fetch cluster authentication details and update the local kubeconfig file.

Cevap

To satisfy the deployment requirements, the team must deploy the cluster in Autopilot mode to delegate node infrastructure management to Google Cloud, and run `gcloud container clusters get-credentials` to configure local `kubectl` authentication entries.
Deploying the cluster in Autopilot mode ensures Google Cloud provisions, scales, and manages nodes automatically according to pod resource requests. Running `gcloud container clusters get-credentials` generates valid authentication tokens and sets the `kubectl` context so engineers can immediately deploy workloads.

Adım Adım Çözüm

1
Identify the operational boundary requirement for node infrastructure.
Autopilot mode is selected because Google Cloud handles node provisioning, auto-scaling, auto-repair, and security hardening without requiring manual node pool creation.
Standard GKE clusters require manual node pool configuration and machine type management.
2
Identify the command required to connect `kubectl` to the newly deployed GKE cluster.
The `gcloud container clusters get-credentials` command is executed.
This command fetches the cluster APIServer endpoint and authentication token, writing them into `~/.kube/config` so `kubectl` commands can target the cluster.

Anahtar Kavram

GKE Autopilot cluster deployment and kubectl kubeconfig context initialization via gcloud
Soru 968Soru →

A database administrator needs to update an existing Cloud SQL for MySQL instance named `prod-mysql-db` to enable automated daily backups with a start time of 03:00 UTC and to enable point-in-time recovery (PITR). Which TWO `gcloud sql instances patch` command flags must be specified to meet these operational requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: --backup-start-time=03:00; --enable-bin-log

Cevap

To configure automated backups and point-in-time recovery on a Cloud SQL for MySQL database, specify `--backup-start-time=03:00` to establish the daily backup start time window and `--enable-bin-log` to turn on binary logging.
For Cloud SQL for MySQL instances, automated daily backups are configured using the `--backup-start-time` flag in `HH:MM` format. Point-in-time recovery for MySQL requires binary logging to be enabled using the `--enable-bin-log` flag.

Adım Adım Çözüm

1
Identify the database engine type
The target instance uses MySQL (`prod-mysql-db`).
Different database engines in Cloud SQL utilize distinct mechanisms and flags for point-in-time recovery.
2
Select the flag for automated backup scheduling
Use `--backup-start-time=03:00`.
This configures the start of the 4-hour window during which automated daily backups occur.
3
Select the flag required for point-in-time recovery on MySQL
Use `--enable-bin-log`.
Point-in-time recovery for Cloud SQL for MySQL relies on binary logs to replay transactions after restoring from a base backup.

Anahtar Kavram

Cloud SQL for MySQL backup and binary logging configuration via gcloud CLI
Soru 969Soru →

You are tasked with managing Virtual Private Cloud (VPC) networking resources for your organization's Google Cloud environment. You need to view existing security policies and adjust subnet capacity. Which TWO actions represent valid administrative procedures for managing these networking resources? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Run `gcloud compute firewall-rules list` to display and review all active firewall rules configured in the project.; Execute `gcloud compute networks subnets expand-ip-range` to enlarge the primary IP address range of an existing custom subnet.

Cevap

The valid operational procedures are using `gcloud compute firewall-rules list` to view project firewall rules and using `gcloud compute networks subnets expand-ip-range` to increase a subnet's primary IP allocation.
Executing `gcloud compute firewall-rules list` correctly queries and retrieves all firewall rules within the current project scope. Furthermore, `gcloud compute networks subnets expand-ip-range` is the correct method for increasing the IP capacity of a subnet in a VPC.

Adım Adım Çözüm

1
Identify the standard CLI command for inspecting firewall rules.
`gcloud compute firewall-rules list` lists all active firewall rules in the target project.
This provides operational visibility into network security configuration.
2
Identify the process for expanding subnet IP address capacity.
`gcloud compute networks subnets expand-ip-range` allows expanding the primary CIDR block of a subnet.
VPC subnets support non-disruptive expansion of IP ranges as long as the new netmask covers a larger IP space without overlapping restricted or peered ranges.

Anahtar Kavram

Managing Google Cloud VPC Subnets and Firewall Rules
Soru 970Soru →

A Cloud Engineer has a local Terraform configuration managing Google Cloud infrastructure. The engineer wants to migrate the existing local state file (`terraform.tfstate`) to a remote Google Cloud Storage (GCS) backend for team collaboration and state locking. What is the correct sequence of steps to complete this state migration?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence requires creating the Cloud Storage bucket with object versioning first, adding the `backend "gcs"` block to the Terraform configuration, running `terraform init` to initialize the backend, and confirming the prompt by typing `yes` to transfer the local state file to the remote bucket.
Migrating a local Terraform state file to a GCS remote backend follows a strict dependency order: the target Cloud Storage bucket must be created first in GCP because Terraform initialization does not provision the backend bucket automatically. Next, the `backend "gcs"` code block must be declared in the Terraform configuration. Executing `terraform init` causes Terraform to detect the new backend configuration and prompt the user to transfer the state file. Finally, typing `yes` confirms the copy action and migrates the local state file to Cloud Storage.

Adım Adım Çözüm

1
Provision a Google Cloud Storage bucket with object versioning enabled.
A secure destination bucket is created to hold the remote state.
Terraform cannot automatically create the state bucket during backend initialization; it must already exist in GCP.
2
Define the `backend "gcs"` configuration block inside the `terraform` block in the HCL file.
The Terraform code now references the remote GCS bucket destination.
Terraform needs explicit backend attributes (such as `bucket` and `prefix`) to determine where state data belongs.
3
Execute `terraform init` in the terminal.
Terraform parses the backend change and initiates the state migration routine.
The initialization command recognizes that the backend changed from local to GCS and triggers state copying.
4
Approve the state migration prompt by typing `yes`.
The local state data is uploaded to Cloud Storage, and local state file references are updated.
User confirmation ensures that existing infrastructure state is safely copied to the remote backend without data loss.

Anahtar Kavram

Terraform Remote Backend Migration to Cloud Storage (GCS)
Soru 971Soru →

An organization hosts a backend application on Google Cloud Run. Following a new deployment of revision `orders-v2`, operations personnel observe a sudden spike in HTTP 500 error responses. A cloud engineer must immediately direct 100% of incoming production traffic back to the previous stable revision, `orders-v1`, while preserving `orders-v2` intact for internal diagnostic testing. Which `gcloud` command should the engineer execute to achieve this objective?

Cevabı ve açıklamayı göster

Cevap: gcloud run services update-traffic orders-service --to-revisions=orders-v1=100

Cevap

The command `gcloud run services update-traffic orders-service --to-revisions=orders-v1=100` correctly shifts 100% of incoming service traffic to revision `orders-v1`.
Executing `gcloud run services update-traffic orders-service --to-revisions=orders-v1=100` updates the service traffic assignment so that 100% of live HTTP traffic goes to the previous stable revision `orders-v1`. Revision `orders-v2` remains deployed in the background, allowing developers to inspect its logs or send direct test queries to its revision-specific URL.

Adım Adım Çözüm

1
Identify the requirement to modify traffic weights across active revisions of a Cloud Run service.
Determine that revision `orders-v2` is producing errors and traffic must revert to `orders-v1`.
Traffic management on existing revisions is handled via the `gcloud run services update-traffic` command.
2
Apply the `--to-revisions` flag specifying the targeted target revision and percentage.
Execute `gcloud run services update-traffic orders-service --to-revisions=orders-v1=100`.
This immediately redirects all live production requests to `orders-v1` without deleting or modifying `orders-v2`.

Anahtar Kavram

Managing Cloud Run Revision Traffic Splitting
Soru 972Soru →

Your organization operates a mission-critical Cloud SQL for MySQL database instance supporting an enterprise order-processing application. During an operational readiness review, the team identifies two operational requirements: the database must support Point-in-Time Recovery (PITR) without risking disk space exhaustion from unmanaged logs, and system maintenance reboots must be restricted to weekend off-peak hours rather than occurring at default provider times. Which TWO configuration actions should you perform on the Cloud SQL instance to satisfy these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable binary logging on the Cloud SQL instance and configure an automated binary log retention period to manage storage consumption.; Configure a customized maintenance window in the instance settings specifying the preferred day of the week and time range for updates.

Cevap

The two correct actions are enabling binary logging with log retention management to support Point-in-Time Recovery safely, and defining a maintenance window to restrict automated updates to designated off-peak hours.
Enabling binary logging on Cloud SQL for MySQL is mandatory for Point-in-Time Recovery (PITR), and establishing a log retention policy prevents storage exhaustion. Setting a maintenance window guarantees that routine maintenance reboots take place during administrative off-peak windows.

Adım Adım Çözüm

1
Enable binary logging and retention for MySQL PITR
Binary logging enables transaction replay required for Point-in-Time Recovery, while automated retention prevents binary logs from overwhelming persistent disk capacity.
Cloud SQL for MySQL relies on binary logs for PITR; unmanaged logs will continuously consume disk space until managed.
2
Define maintenance window schedule
Configure the specific day and hour window for Cloud SQL operational maintenance updates.
Without a explicit maintenance window, Google Cloud applies maintenance during default maintenance slots, which may collide with peak application usage.

Anahtar Kavram

Cloud SQL Operations: Binary Logging, Log Retention, and Maintenance Scheduling
Soru 973Soru →

A cloud engineer is establishing a custom Virtual Private Cloud (VPC) network environment for an enterprise analytics workload. The architecture requires creating a custom-mode VPC network named `corp-analytics-vpc` and provisioning an ingress firewall rule named `allow-internal-db` that permits TCP traffic on port 5432 strictly from application instances tagged `analytics-app` to database instances tagged `analytics-db`. Which TWO commands must the engineer execute to correctly deploy this network and firewall configuration?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: gcloud compute networks create corp-analytics-vpc --subnet-mode=custom; gcloud compute firewall-rules create allow-internal-db --network=corp-analytics-vpc --allow=tcp:5432 --source-tags=analytics-app --target-tags=analytics-db

Cevap

The correct configuration requires executing 'gcloud compute networks create corp-analytics-vpc --subnet-mode=custom' to instantiate the custom-mode network, along with 'gcloud compute firewall-rules create allow-internal-db --network=corp-analytics-vpc --allow=tcp:5432 --source-tags=analytics-app --target-tags=analytics-db' to allow ingress traffic from application instances to database instances.
Creating a custom-mode network requires the '--subnet-mode=custom' flag during network instantiation. For the ingress firewall rule, defining source tags as 'analytics-app' and target tags as 'analytics-db' ensures that traffic on port 5432 is evaluated correctly from originating client application instances to target database instances.

Adım Adım Çözüm

1
Determine the network creation command for a custom VPC.
Use 'gcloud compute networks create' with the '--subnet-mode=custom' flag.
Custom-mode VPC networks start with zero subnets, enabling manual control over CIDR block allocations per region.
2
Determine the correct source and target flags for the ingress firewall rule.
Set '--source-tags=analytics-app' and '--target-tags=analytics-db'.
For ingress rules, source tags specify where the connection originates and target tags specify the instances receiving the connection.

Anahtar Kavram

Deploying custom-mode VPC networks and configuring tagged ingress firewall rules using gcloud CLI
Soru 974Soru →

A digital publishing firm plans to migrate its containerized backend microservices to Google Kubernetes Engine (GKE). The microservices are stateless, follow standard Kubernetes configurations, and do not require custom host OS kernel modifications or privileged containers. The engineering team wants to minimize cluster administration overhead by transferring node provisioning, maintenance, and security patching responsibilities to Google Cloud, while paying only for the CPU, memory, and storage requested by running pods. Which GKE cluster architecture should the team deploy to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy a GKE Autopilot cluster.

Cevap

Deploying a GKE Autopilot cluster satisfies the requirement for zero node management overhead and per-pod resource billing.
Deploying a GKE Autopilot cluster is the optimal architecture when an organization wants to minimize operational overhead. In Autopilot mode, Google Cloud provisions, secures, and manages the underlying worker nodes, node pools, and OS patches. Furthermore, billing in Autopilot mode is calculated per pod based on requested CPU, memory, and storage resource limits rather than total node compute capacity.

Adım Adım Çözüm

1
Analyze operational requirements
Workloads are standard stateless microservices with no requirement for custom OS kernel configurations or host-level access.
Determines whether GKE Autopilot's hardened configuration boundaries permit the workload.
2
Evaluate administrative overhead and billing model requirements
GKE Autopilot eliminates node pool design, node patching, and OS upgrades, while shifting billing from node instance sizing to pod resource requests.
Matches the requirement to minimize infrastructure administration and pay strictly for requested pod compute.

Anahtar Kavram

GKE Autopilot operational boundary and billing model
Soru 975Soru →

A DevOps engineer is configuring a specialized service account for an automated CI/CD deployment pipeline. The pipeline must deploy new Cloud Functions (2nd gen) instances and configure Cloud Scheduler triggers strictly within a single target Google Cloud project named `proj-services-prod`. The service account must not be granted permissions beyond what is necessary to perform these tasks, nor should it acquire access to any neighboring projects. Which IAM role configuration meets these requirements while adhering to Google Cloud recommended best practices?

Cevabı ve açıklamayı göster

Cevap: Grant the service account the Cloud Functions Admin (roles/cloudfunctions.admin) and Cloud Scheduler Admin (roles/cloudscheduler.admin) roles on the target project proj-services-prod.

Cevap

Grant the service account the predefined Cloud Functions Admin (roles/cloudfunctions.admin) and Cloud Scheduler Admin (roles/cloudscheduler.admin) roles directly on the target project proj-services-prod.
Granting specific predefined roles (Cloud Functions Admin and Cloud Scheduler Admin) at the target project level grants exactly the privileges needed for pipeline execution without over-privileging the service account or leaking permissions to sibling projects.

Adım Adım Çözüm

1
Analyze the operational requirements
The automated deployment pipeline needs to manage Cloud Functions and Cloud Scheduler within a single specific project.
Identifying the target services and boundary limits establishes the required scope.
2
Apply the Principle of Least Privilege by role selection
Select specific predefined roles (`roles/cloudfunctions.admin` and `roles/cloudscheduler.admin`) rather than primitive roles (`roles/editor` or `roles/owner`).
Predefined roles limit actions strictly to Cloud Functions and Cloud Scheduler resources.
3
Select the correct resource hierarchy level for policy binding
Bind the IAM policy directly at the target project level (`proj-services-prod`).
Granting roles at the Folder or Organization level would automatically inherit down to all sibling projects within that scope.

Anahtar Kavram

Applying Least Privilege using Predefined Roles and Precise Hierarchy Scoping
Soru 976Soru →

Your organization operates a production Cloud SQL for MySQL instance that supports a mission-critical transactional application. During peak hours, complex analytical reporting queries involving multi-table SQL joins cause severe CPU throttling on the primary instance, impacting transaction processing. You must resolve the performance bottleneck for reporting workloads while maintaining real-time transactional data access, ensuring no schema changes are required, and minimizing operational overhead. What should you do?

Cevabı ve açıklamayı göster

Cevap: Create a Cloud SQL read replica, configure the reporting application to query the read replica's IP address, and maintain write operations on the primary instance.

Cevap

Create a Cloud SQL read replica, configure the reporting application to query the read replica's IP address, and maintain write operations on the primary instance.
Creating a Cloud SQL read replica allows read-heavy reporting queries to be processed independently from the primary instance. This eliminates CPU contention on the primary database, maintains relational SQL join functionality, provides near real-time data access via asynchronous replication, and requires zero schema migration overhead.

Adım Adım Çözüm

1
Analyze the workload requirements
The reporting queries require real-time data access, relational capabilities (multi-table SQL joins), and relief of CPU pressure on the primary transactional database.
Identifying that the workload is read-heavy and relational narrows down valid architecture options.
2
Evaluate Cloud SQL scaling capabilities
Cloud SQL supports read replicas, which asynchronously replicate data from the primary instance to serve read-only queries.
Deploying a read replica offloads reporting queries without changing database schemas or affecting primary instance transaction performance.
3
Reject non-viable alternatives
High Availability standby instances do not process read traffic; Cloud Bigtable does not support relational SQL joins; Cloud Storage Archive incur high retrieval costs for daily access.
Eliminating options that break operational or architectural constraints confirms the optimal choice.

Anahtar Kavram

Managing Cloud SQL Read Replicas for Operational Performance Optimization
Soru 977Soru →

An infrastructure administrator needs to deploy a Compute Engine virtual machine instance named `db-proxy-01` in the `us-central1-a` zone to handle sensitive internal database proxying. The virtual machine must reside in an existing custom subnetwork named `prod-db-subnet`, must not be exposed to the public internet, must attach an existing secondary persistent disk named `data-disk-01` in read-only mode, and must run using a dedicated service account `[email protected]` instead of the default Compute Engine service account. Which `gcloud` command accurately provisions this virtual machine according to all technical requirements?

Cevabı ve açıklamayı göster

Cevap: gcloud compute instances create db-proxy-01 --zone=us-central1-a --subnet=prod-db-subnet --no-address --disk=name=data-disk-01,mode=ro [email protected]

Cevap

The command that uses '--subnet=prod-db-subnet', '--no-address', '--disk=name=data-disk-01,mode=ro', and '[email protected]' correctly provisions the instance.
The correct command combines the required flags accurately: '--subnet=prod-db-subnet' places the instance in the specified subnetwork, '--no-address' prevents external public IP allocation, '--disk=name=data-disk-01,mode=ro' attaches the existing disk in read-only mode, and '[email protected]' enforces the custom identity.

Adım Adım Çözüm

1
Identify network deployment flags for Compute Engine instances
Use '--subnet=prod-db-subnet' to assign the subnetwork and '--no-address' to disable public IPv4 allocation.
gcloud CLI requires explicit subnetwork flags and uses '--no-address' to prevent external IP provisioning.
2
Determine disk attachment parameters during VM creation
Use '--disk=name=data-disk-01,mode=ro' to attach an existing disk in read-only mode.
The '--disk' flag accepts key-value sub-fields where 'mode=ro' configures read-only attachment.
3
Specify custom service account identity
Use '[email protected]' to associate the dedicated service account.
Without '--service-account', Compute Engine assigns the default Compute Engine service account.

Anahtar Kavram

gcloud Compute Engine VM creation flag syntax and identity configuration
Soru 978Soru →

A background data processing pipeline requires access to send telemetry events to Cloud Pub/Sub topics located within a dedicated analytics project. The service account assigned to the pipeline should only have permissions to publish messages, without the ability to create topics, read messages from subscriptions, or alter topic configurations. To adhere to the principle of least privilege, which IAM role configuration should be applied to the service account?

Cevabı ve açıklamayı göster

Cevap: Grant the Pub/Sub Publisher (roles/pubsub.publisher) role at the project level.

Cevap

Grant the Pub/Sub Publisher (roles/pubsub.publisher) role at the project level.
Granting the predefined Pub/Sub Publisher role at the project level satisfies the principle of least privilege by providing only the permissions needed to publish messages within the designated project, preventing excessive access to non-required actions or other projects.

Adım Adım Çözüm

1
Identify the required permissions based on operational needs.
The pipeline requires only message publishing capability (pubsub.topics.publish).
Least privilege mandates granting only permissions essential for the workload.
2
Select the appropriate IAM role type.
Select the predefined role 'roles/pubsub.publisher' instead of primitive roles or overly broad admin predefined roles.
Predefined roles provide fine-grained permissions tailored to specific job functions.
3
Determine the minimum resource hierarchy scope.
Apply the role binding at the project level containing the Pub/Sub topics.
Binding at higher levels (Organization or Folder) inherits downstream and grants unnecessary access across other projects.

Anahtar Kavram

Principle of Least Privilege and Resource Hierarchy Scoping in GCP IAM
Soru 979Soru →

An organization is designing the Google Cloud networking architecture for a two-tier application deployed on Compute Engine instances. The architecture has two primary traffic requirements:
1. A public-facing web frontend accepting external HTTPS requests from internet clients with a requirement to cache static media assets at edge locations.
2. An internal backend microservice communicating via raw TCP with other internal workloads in the same Virtual Private Cloud (VPC), requiring strict preservation of client source IP addresses.

Which TWO load balancing solutions should the organization select to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy a Global External Application Load Balancer with Cloud CDN enabled for the frontend web tier.; Deploy an Internal Passthrough Network Load Balancer for the internal backend microservice tier.

Cevap

The architecture requires a Global External Application Load Balancer with Cloud CDN enabled for the public frontend, and an Internal Passthrough Network Load Balancer for the internal TCP backend service.
To satisfy public HTTPS traffic and static media edge caching, a Global External Application Load Balancer with Cloud CDN is required. To satisfy internal VPC TCP traffic while preserving original client source IP addresses, an Internal Passthrough Network Load Balancer is the correct architectural choice because passthrough load balancers do not terminate TCP connections.

Adım Adım Çözüm

1
Analyze frontend traffic requirements.
Frontend requires public HTTPS endpoint and edge caching for static media assets.
Cloud CDN requires an External HTTP(S) Load Balancer (Application Load Balancer) to cache content at Google Edge points of presence.
2
Analyze backend microservice traffic requirements.
Backend requires internal VPC scope, raw TCP protocol, and client source IP preservation.
Internal Passthrough Network Load Balancers route raw TCP/UDP packets directly to backends without proxying, preserving the original client source IP address.

Anahtar Kavram

Selecting GCP Load Balancers based on traffic scope (internal vs. external), OSI layer (L4 vs. L7), Cloud CDN compatibility, and client IP preservation requirements.
Soru 980Soru →

An enterprise organization hosts a mission-critical web application on Compute Engine instances located in the europe-west1 region. During a planned capacity expansion, a Cloud Engineer attempts to launch 20 additional n2-standard-16 virtual machines within europe-west1-b. The creation request fails immediately with a QUOTA_EXCEEDED error indicating that the N2_CPUS regional quota limit has been reached. Due to strict data residency and VPC peering requirements, the workload must remain within the europe-west1 region. Which action should the engineer take to successfully provision the required compute capacity while following Google-recommended best practices?

Cevabı ve açıklamayı göster

Cevap: Submit a quota increase request for the N2_CPUS regional metric in europe-west1 via the Cloud Console IAM & Admin Quotas page.

Cevap

Submitting a quota increase request for the N2_CPUS regional metric in europe-west1 via the Cloud Console IAM & Admin Quotas page is the correct action.
The correct option is submitting a quota increase request via the Cloud Console IAM & Admin Quotas page. Google Cloud quotas are default safety limits placed on project resources per region or zone. When a valid operational need requires higher capacity within a specific region, administrative users must formally request a quota increase through the console or gcloud CLI.

Adım Adım Çözüm

1
Identify the cause of the failure from the error message.
The failure is caused by reaching the regional N2_CPUS quota ceiling in europe-west1.
Google Cloud enforces hard default limits on regional vCPU usage to prevent accidental cost overruns and maintain capacity.
2
Evaluate alternative workaround suggestions against GCP architecture constraints.
Creating new VPCs, changing IAM roles, or using Spot VMs does not bypass standard regional CPU quota limits for mission-critical workloads.
Quotas are enforced at the project/region level by the GCP control plane regardless of networking configuration or IAM privilege level.
3
Execute the Google-recommended operational workflow for capacity adjustments.
Navigate to IAM & Admin > Quotas in the Google Cloud Console, select the N2_CPUS metric for europe-west1, and submit an edit request with justification.
Quota increase requests allow Google Cloud to evaluate capacity allocations and safely expand resource limits for the project.

Anahtar Kavram

Resource Quotas and Capacity Management
ÖncekiSayfa 49 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin