Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 1021Soru →

A cloud engineer is deploying a enterprise database tier on Compute Engine instances tagged with `db-node` inside a custom Virtual Private Cloud (VPC) network. To enforce strict security compliance, a firewall rule named `deny-db-all` has been configured with priority 1000 to DENY all ingress TCP traffic on port 5432 targeting the `db-node` tag from `0.0.0.0/0`. The engineer now needs to allow ingress traffic on port 5432 to these database instances specifically from application servers located in the subnet CIDR range `10.2.0.0/24`. Which firewall rule configuration must the engineer implement to ensure application traffic is allowed while maintaining the default restriction for all other sources?

Cevabı ve açıklamayı göster

Cevap: Create an ingress firewall rule named `allow-db-internal` with action ALLOW, target tag `db-node`, source IP range `10.2.0.0/24`, protocol/port `tcp:5432`, and priority 900.

Cevap

Create an ingress firewall rule named `allow-db-internal` with action ALLOW, target tag `db-node`, source IP range `10.2.0.0/24`, protocol/port `tcp:5432`, and priority 900.
In Google Cloud VPC networking, firewall rules are processed sequentially by priority value, where lower numbers have higher precedence. Because the general rule blocking port 5432 traffic from all sources has a priority of 1000, creating an allow rule for the specific `10.2.0.0/24` CIDR with priority 900 ensures that packets from application instances in that subnet match the allow rule first and bypass the broader deny rule.

Adım Adım Çözüm

1
Analyze GCP firewall rule priority evaluation order.
GCP evaluates firewall rules based on integer priority values ranging from 0 to 65535, where lower numerical values indicate higher precedence.
Rules with smaller priority numbers are processed first. Evaluation stops as soon as a matching rule is found for the network packet.
2
Determine the necessary priority for the specific allow rule relative to the existing deny rule.
Since the existing `deny-db-all` rule has priority 1000, any exception allowing specific IP ranges must have a priority strictly less than 1000 (e.g., 900).
Setting priority 900 guarantees that packets from source `10.2.0.0/24` match the ALLOW rule first and are permitted before reaching the DENY rule at priority 1000.

Anahtar Kavram

VPC Firewall Rule Priority Evaluation Order
Tahmini Süre:2m 0s
Soru 1022Soru →

A Cloud Engineer needs to reserve a static regional external IP address named `frontend-static-ip` in the `us-east1` region for a Google Cloud workload using the command-line interface. Which `gcloud` command should the engineer run?

Cevabı ve açıklamayı göster

Cevap: gcloud compute addresses create frontend-static-ip --region=us-east1

Cevap

The command `gcloud compute addresses create frontend-static-ip --region=us-east1` reserves a static regional external IP address.
To reserve a static regional external IP address in Google Cloud, the `gcloud compute addresses create [ADDRESS_NAME] --region=[REGION]` command is used. This allocates a static IP address in the specified region that can be attached to Compute Engine instances or load balancers.

Adım Adım Çözüm

1
Identify the target resource category in gcloud.
IP address reservations belong to the `gcloud compute addresses` command group.
Networking addresses in Compute Engine are managed through `compute addresses`.
2
Specify the action subcommand and target name.
Use `create frontend-static-ip` to create a new address reservation with that name.
Creating a static IP reservation requires the `create` action.
3
Append mandatory location flags for regional IP allocation.
Add `--region=us-east1` to assign the static IP to the specified region.
Regional external IP addresses require the explicit `--region` flag.

Anahtar Kavram

Reserving Static IP Addresses in GCP
Soru 1023Soru →

An operations engineer is managing a Cloud Bigtable cluster that processes high-throughput time-series data from IoT sensors. During daily peak ingestion windows, application latency increases significantly, and Cloud Monitoring indicates that CPU utilization on the Bigtable cluster repeatedly exceeds 80%. The engineer must restore acceptable read/write performance while maintaining cost efficiency and operational monitoring. Which TWO actions should the engineer take to address this issue?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Increase the number of nodes in the Cloud Bigtable cluster or configure a programmatic autoscaling policy based on target CPU utilization.; Create a Cloud Monitoring alerting policy tracking the node CPU utilization metric to proactively trigger capacity adjustments before performance degrades.

Cevap

The engineer should scale out the cluster by increasing node count or enabling autoscaling, and set up Cloud Monitoring alerts on node CPU utilization.
Scaling out node capacity directly mitigates CPU bottlenecks in Cloud Bigtable because processing capacity scales linearly with node count. Combining this with Cloud Monitoring alerting allows administrators to proactively manage workload spikes and maintain low latency.

Adım Adım Çözüm

1
Analyze performance metrics for Cloud Bigtable
Identify high CPU utilization (>80%) on cluster nodes as the bottleneck causing elevated latency.
Cloud Bigtable performance depends directly on node count for compute and I/O capacity.
2
Scale Bigtable cluster compute capacity
Add nodes manually or configure an autoscaling policy to distribute load.
Scaling out nodes increases processing power and lowers CPU utilization per node without requiring downtime.
3
Establish proactive monitoring and alerting
Configure Cloud Monitoring alerts for node CPU utilization.
Ensures the operational team is alerted before cluster CPU saturation leads to application latency degradation.

Anahtar Kavram

Cloud Bigtable Operational Performance Management and Monitoring
Soru 1024Soru →

An operations specialist needs to manage Compute Engine virtual machine instances within a project and link that project to an enterprise Billing Account. Following Google Cloud best practices and the principle of least privilege, which of the following IAM role assignments are required? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Assign the Compute Admin role (`roles/compute.admin`) to the specialist on the project.; Assign the Billing Account User role (`roles/billing.user`) to the specialist on the Billing Account.

Cevap

To perform these tasks using least privilege, assign the Compute Admin role on the project and the Billing Account User role on the Billing Account.
To manage Compute Engine instances while adhering to least privilege, the Compute Admin role provides the necessary compute permissions without exposing unrelated GCP services. To link a project to a Billing Account, the user requires the Billing Account User role granted directly on the Billing Account resource.

Adım Adım Çözüm

1
Determine the predefined IAM role required for managing Compute Engine resources.
Compute Admin (`roles/compute.admin`) grants full control over Compute Engine resources without granting project-wide Editor access.
Google Cloud best practices dictate using specific predefined roles over primitive roles.
2
Determine the permission needed to link a project to an existing Billing Account.
The user must have the Billing Account User role (`roles/billing.user`) on the target Billing Account resource.
Linking a project requires explicit permissions on the Billing Account itself in addition to project management rights.

Anahtar Kavram

Least privilege IAM role selection for resource management and billing account linking
Soru 1025Soru →

An organization operates a fleet of Compute Engine virtual machines running an in-memory database application. To establish proactive capacity planning, the operations team needs to collect detailed internal system memory utilization and disk space metrics within Google Cloud Observability. After deploying the legacy Stackdriver Monitoring agent to Debian 12 instances, the team observes that internal memory metrics are missing from Cloud Monitoring. Following Google-recommended best practices for Compute Engine operational management, which action should the team take to collect these metrics?

Cevabı ve açıklamayı göster

Cevap: Uninstall the legacy agent and install the unified Google Cloud Ops Agent on the virtual machine instances.

Cevap

Uninstall the legacy agent and install the unified Google Cloud Ops Agent on the virtual machine instances.
The Google Cloud Ops Agent is Google's recommended solution for collecting guest OS telemetry, such as internal memory utilization and detailed disk metrics, from Compute Engine virtual machines. Replacing legacy Monitoring and Logging agents with the Ops Agent restores metric reporting into Google Cloud Observability.

Adım Adım Çözüm

1
Identify the telemetry requirement
System memory utilization and disk space are internal guest OS metrics not captured by default hypervisor monitoring.
Compute Engine external metrics only measure host-level data such as CPU utilization and network throughput.
2
Evaluate the telemetry agent compatibility
The legacy Monitoring (Stackdriver) agent is deprecated on newer Linux distributions in favor of the Google Cloud Ops Agent.
The Google Cloud Ops Agent combines logging and metrics collection into a single agent optimized for Compute Engine VMs.
3
Determine the Google-recommended resolution path
Installing the Google Cloud Ops Agent enables native metric collection for memory and disk metrics into Google Cloud Observability.
This adheres to GCP operational management best practices.

Anahtar Kavram

Telemetry collection for Compute Engine instances using the unified Google Cloud Ops Agent
Soru 1026Soru →

A developer has packaged a web microservice into a custom container image. The internal web server inside the container is configured to listen strictly on port 8000. When deploying this container image to Google Cloud Run using the gcloud CLI, which command flag must be included to ensure Cloud Run correctly routes incoming HTTP requests to the application?

Cevabı ve açıklamayı göster

Cevap: Pass the --port=8000 flag during the gcloud run deploy execution.

Cevap

Pass the --port=8000 flag during the gcloud run deploy execution.
By default, Cloud Run sends ingress requests to port 8080 inside the container. Supplying the --port=8000 flag during deployment configures Cloud Run to direct ingress traffic to port 8000, aligning with the application's internal listener port.

Adım Adım Çözüm

1
Analyze container listening port configuration.
Identify that the web application inside the container listens strictly on port 8000.
Cloud Run defaults to sending traffic to port 8080 inside the container unless configured otherwise.
2
Identify the proper gcloud CLI parameter to override default port routing.
Use --port=8000 with gcloud run deploy.
The --port flag informs Cloud Run of the container's listening port so ingress traffic is routed properly.

Anahtar Kavram

Cloud Run Custom Container Port Configuration
Soru 1027Soru →

A financial analytics enterprise is architecting a new microservice on Google Cloud to ingest and analyze real-time credit card transaction telemetry for fraud detection. The workload requires ingesting millions of event writes per second with single-digit millisecond latency, supporting time-series data access patterns, and scaling horizontally without schema migration overhead. High-level relational features such as multi-table ACID transactions and complex SQL joins are not required. Which database service should be selected to fulfill these requirements with minimal operational management?

Cevabı ve açıklamayı göster

Cevap: Cloud Bigtable

Cevap

Cloud Bigtable should be selected because it is designed for high-throughput time-series and key-value workloads with low latency and seamless horizontal scaling.
Cloud Bigtable is a fully managed NoSQL wide-column database service ideal for high-volume telemetry, time-series data, and key-value stores. It delivers consistent single-digit millisecond latency and scales linearly to millions of write operations per second with low operational overhead.

Adım Adım Çözüm

1
Analyze the workload requirements
Identified key constraints: millions of writes per second, single-digit millisecond latency, time-series data patterns, NoSQL key-value access, and minimal operational overhead.
Matching workload access patterns to Google Cloud database services ensures optimal performance and cost efficiency.
2
Evaluate database candidates against latency and write throughput needs
Cloud Bigtable provides scalable NoSQL wide-column storage optimized specifically for high-throughput ingestion and time-series data.
Relational options like Cloud SQL cannot handle millions of writes per second, and Cloud Spanner is intended for relational transactional workloads rather than simple time-series key-value data.
3
Assess operational viability of self-managed options on Spot instances
Self-managed clusters on Spot instances violate Google Cloud operational best practices for stateful applications due to instance preemptibility.
Managed services minimize administrative overhead while providing necessary SLA guarantees.

Anahtar Kavram

Selecting Cloud Bigtable for high-throughput NoSQL time-series and key-value workloads
Soru 1028Soru →

A DevOps team manages a Google Kubernetes Engine (GKE) Standard cluster named `prod-cluster` in zone `us-central1-a`. The team wants to ensure that unhealthy nodes in the existing node pool named `worker-pool` are automatically detected and recreated, and that the nodes automatically update to match the control plane version when upgrades occur. Which TWO commands should the cloud engineer execute to configure these operational settings?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: gcloud container node-pools update worker-pool --cluster=prod-cluster --zone=us-central1-a --enable-autorepair; gcloud container node-pools update worker-pool --cluster=prod-cluster --zone=us-central1-a --enable-autoupgrade

Cevap

Execute `gcloud container node-pools update worker-pool --cluster=prod-cluster --zone=us-central1-a --enable-autorepair` to enable automatic health monitoring and recreation, and `gcloud container node-pools update worker-pool --cluster=prod-cluster --zone=us-central1-a --enable-autoupgrade` to keep node software synchronized with control plane updates.
Enabling auto-repair (`--enable-autorepair`) instructs GKE to perform health checks on nodes in the pool and repair/recreate any that fail. Enabling auto-upgrade (`--enable-autoupgrade`) ensures nodes stay up-to-date with the cluster control plane version.

Adım Adım Çözüm

1
Identify the required node pool operational features.
Automatic node recreation requires auto-repair (`--enable-autorepair`), and automatic node version upgrades require auto-upgrade (`--enable-autoupgrade`).
These are node-pool-level management policies managed via the Google Cloud container API.
2
Select the correct management interface and syntax.
Use `gcloud container node-pools update [POOL_NAME] --cluster=[CLUSTER_NAME]` with the respective flags.
`kubectl` manages Kubernetes workload objects inside the cluster, whereas node pool infrastructure properties must be modified using `gcloud`.

Anahtar Kavram

GKE Node Pool Management (Auto-Repair and Auto-Upgrade)
Soru 1029Soru →

An organization is migrating an enterprise resource planning (ERP) relational database to a Compute Engine virtual machine on Google Cloud. The workload requires reliable, cost-effective SSD-backed performance with consistent IOPS for standard transactional operations. Additionally, the disk volume must automatically replicate data across two zones in the same region to ensure high availability during a zonal outage. Which block storage disk type should you select to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Regional Balanced Persistent Disk (pd-balanced)

Cevap

Regional Balanced Persistent Disk (pd-balanced)
Regional Balanced Persistent Disk (pd-balanced) delivers cost-effective SSD-based performance suitable for enterprise relational database workloads while providing synchronous cross-zone replication within a region for high availability.

Adım Adım Çözüm

1
Analyze storage performance requirements
Relational ERP database workloads require solid-state drive (SSD) performance rather than standard hard disk drives (HDD).
Standard HDDs (pd-standard) lack sufficient sequential and random IOPS required for database read/write queries.
2
Evaluate availability and replication needs
The scenario requires automatic synchronous data replication across two zones within the same region.
Regional Persistent Disks synchronously replicate block data across two zones in a region, whereas Zonal persistent disks reside in a single zone.
3
Balance cost versus high-performance specifications
Balanced Persistent Disk (pd-balanced) offers an optimal tradeoff of SSD-backed IOPS and cost efficiency.
Extreme Persistent Disk (pd-extreme) is over-provisioned for standard ERP baseline operations and lacks regional replication options.

Anahtar Kavram

Selecting persistent disk options based on performance, cost, and high availability replication requirements
Tahmini Süre:1m 30s
Soru 1030Soru →

An infrastructure team is deploying a Compute Engine instance named `fin-db-01` in zone `us-central1-a` to host a compliance-sensitive relational database engine. Company policy mandates strict hardware security and capacity specifications:
1. The instance must be provisioned with Shielded VM security features enabled, specifically Secure Boot and Virtual Trusted Platform Module (vTPM).
2. To optimize resource utilization, the VM must use a custom machine configuration with exactly 6 vCPUs and 24 GB (24,576 MB) of RAM.

Which `gcloud` command correctly provisions the Compute Engine instance according to these requirements?

Cevabı ve açıklamayı göster

Cevap: gcloud compute instances create fin-db-01 --zone=us-central1-a --machine-type=e2-custom-6-24576 --shielded-secure-boot --shielded-vtpm

Cevap

The command specifying `gcloud compute instances create fin-db-01 --zone=us-central1-a --machine-type=e2-custom-6-24576 --shielded-secure-boot --shielded-vtpm` correctly provisions the custom machine type and Shielded VM options.
The correct command provisions the virtual machine with the specified custom machine type configuration (`e2-custom-6-24576` representing 6 vCPUs and 24,576 MB RAM) and correctly sets the Shielded VM security capabilities using valid gcloud CLI flags (`--shielded-secure-boot` and `--shielded-vtpm`).

Adım Adım Çözüm

1
Identify the required machine type configuration syntax.
Custom machine types in Compute Engine follow the format `FAMILY-custom-vCPUS-MEMORY_IN_MB` (e.g., `e2-custom-6-24576` for 6 vCPUs and 24 GB of memory).
gcloud requires custom machine specs to be passed either via standard machine type strings or specific `--custom-cpu` and `--custom-memory` flags with memory specified in MB/GB units.
2
Identify the proper Shielded VM flags.
The correct flags for Shielded VM attributes are `--shielded-secure-boot` and `--shielded-vtpm`.
Compute Engine uses `--shielded-*` prefixes for configuring guest OS security features.
3
Evaluate workload suitability constraints.
Stateful database applications require persistent availability and cannot use Spot/Preemptible provisioning models.
Spot VMs can be preempted with 30 seconds notice, causing data corruption or downtime for non-fault-tolerant databases.

Anahtar Kavram

Compute Engine Instance Provisioning Flags and Machine Specifications
Soru 1031Soru →

A cloud engineer is deploying a new Cloud SQL for MySQL database instance named app-db to support a production application. The deployment requirements specify that the instance must provide regional high availability with automatic failover and must be accessible only via Private IP within the existing Virtual Private Cloud (VPC) network named corp-vpc, without any public IP address assigned. Which gcloud command should the engineer use to provision this instance correctly?

Cevabı ve açıklamayı göster

Cevap: gcloud sql instances create app-db --database-version=MYSQL_8_0 --tier=db-n1-standard-2 --region=us-central1 --availability-type=REGIONAL --no-assign-ip --network=corp-vpc

Cevap

The command 'gcloud sql instances create app-db --database-version=MYSQL_8_0 --tier=db-n1-standard-2 --region=us-central1 --availability-type=REGIONAL --no-assign-ip --network=corp-vpc' correctly provisions a high-availability Cloud SQL instance on Private IP.
The correct command uses '--availability-type=REGIONAL' to configure high availability with cross-zone failover, along with '--no-assign-ip' and '--network=corp-vpc' to enforce private IP connectivity within the targeted VPC network.

Adım Adım Çözüm

1
Identify the high availability requirement for Cloud SQL.
Determine that --availability-type=REGIONAL must be specified in the gcloud CLI command.
Regional availability provisions a primary instance and a standby replica in a secondary zone within the same region for high availability.
2
Identify the networking and access requirements.
Combine --no-assign-ip and --network=corp-vpc.
The --no-assign-ip flag disables public IP assignment, while --network specifies the target VPC network for Private Service Access.
3
Construct and verify the complete gcloud command.
Combine instance creation flags into gcloud sql instances create app-db ...
Ensures all production constraints (regional HA, private IP connectivity, and accurate flag syntax) are satisfied.

Anahtar Kavram

Cloud SQL High Availability and Private IP Provisioning
Tahmini Süre:1m 30s
Soru 1032Soru →

A Lead Site Reliability Engineer is designing a cross-project telemetry pipeline in Google Cloud. The architecture requires routing all IAM audit logs from a workload project (`proj-app-prod`) to a centralized security project (`proj-sec-analytics`) into a BigQuery dataset. Additionally, any unauthorized IAM policy modification attempt logged in `proj-app-prod` must trigger an immediate email notification via Cloud Monitoring. Which TWO of the following operational steps are required to implement this centralized logging and alerting architecture following Google Cloud best practices?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Cloud Logging export sink in `proj-app-prod` with an inclusion filter for audit logs targeting the BigQuery dataset in `proj-sec-analytics`, and grant the sink's unique writer identity service account the BigQuery Data Editor role on the destination dataset.; Define a custom log-based counter metric in `proj-app-prod` that matches log entries for IAM policy changes, and create a Cloud Monitoring alerting policy condition based on this metric attached to a notification channel.

Cevap

Centralized audit log export requires creating a Cloud Logging sink in the source project targeting the destination BigQuery dataset in the central security project, followed by granting the sink's writer identity service account the BigQuery Data Editor role on the target dataset. For real-time alerting on specific log events, a custom log-based metric must be defined for matching log entries, and a Cloud Monitoring alerting policy must be configured using that metric.
To export logs across projects, Cloud Logging relies on Log Router sinks. When a sink is created with a destination in another project, GCP generates a unique writer identity service account for that sink. That specific service account must be granted the appropriate predefined role (such as BigQuery Data Editor) on the target resource. Furthermore, to alert on specific log event patterns like IAM modifications, a log-based metric must be created to convert matching log entries into time-series metric data, which can then be monitored by Cloud Monitoring alerting policies.

Adım Adım Çözüm

1
Configure cross-project log routing sink and service account permissions.
Create a sink in `proj-app-prod` targeting `bigquery.googleapis.com/projects/proj-sec-analytics/datasets/audit_logs` with a filter for audit logs. Retrieve the created sink's `writerIdentity` service account.
Log sinks require explicit destination permissions using their autogenerated writer identity service account.
2
Grant BigQuery write permissions to the sink's service account in the destination project.
Assign the `roles/bigquery.dataEditor` role to the sink's writer identity service account on the destination dataset in `proj-sec-analytics`.
Cross-project log exports fail unless the sink's service account has write permissions on the target resource.
3
Create a log-based counter metric for security events.
Define a counter metric in `proj-app-prod` filtering for log entries where `protoPayload.methodName` matches IAM policy update methods.
Log-based metrics bridge Cloud Logging event occurrences into quantitative time series metrics for monitoring.
4
Attach a Cloud Monitoring alerting policy to the log-based metric.
Create an alerting policy in Cloud Monitoring triggered when the log-based metric count exceeds zero within the alignment period, configured with an email notification channel.
Alerting policies evaluate metric time-series data to send notifications when threshold conditions are met.

Anahtar Kavram

Cross-Project Log Routing & Log-Based Metrics Alerting
Soru 1033Soru →

An organization is configuring access for an automated CI/CD service account that must deploy workloads to Google Kubernetes Engine (GKE) clusters and read database passwords stored in Secret Manager within a single project named `prod-application`. In accordance with the principle of least privilege, which TWO IAM roles should be granted to the service account? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Kubernetes Engine Developer (`roles/container.developer`) bound at the project level; Secret Manager Secret Accessor (`roles/secretmanager.secretAccessor`) bound at the project level

Cevap

To follow the principle of least privilege for deploying GKE workloads and accessing Secret Manager payloads within a specific project, grant the Kubernetes Engine Developer (`roles/container.developer`) role and the Secret Manager Secret Accessor (`roles/secretmanager.secretAccessor`) role at the project level.
Adhering to the principle of least privilege requires selecting targeted predefined roles scoped directly to the affected project. The Kubernetes Engine Developer role permits deploying container workloads without cluster admin capabilities, while the Secret Manager Secret Accessor role allows reading secret data without allowing secret administration.

Adım Adım Çözüm

1
Identify the minimum required permissions for managing GKE Kubernetes workloads.
Select `roles/container.developer` instead of primitive roles or cluster admin roles.
This predefined role grants permissions to create and edit application deployments, pods, and services inside GKE clusters.
2
Identify the minimum required permissions for reading secret values from Secret Manager.
Select `roles/secretmanager.secretAccessor` at the target project level.
This role permits fetching secret payloads without allowing administration or modification of secret configurations.
3
Verify resource hierarchy scoping.
Ensure bindings are restricted to the specific target project scope.
Binding roles higher up in the hierarchy (such as at the Folder or Organization level) grants unnecessary permissions across unintended projects.

Anahtar Kavram

Applying Least Privilege with Predefined Roles and Resource Scope
Soru 1034Soru →

A company is planning to deploy a gaming telemetry ingest service on Google Cloud Compute Engine. The service receives raw, non-HTTP TCP traffic on port 7000 directly from external game client applications around the world. The architecture team requires a load balancing solution that preserves the original client IP addresses in backend server logs without terminating the TCP connections at an intermediary proxy. Which Google Cloud load balancer should the team select?

Cevabı ve açıklamayı göster

Cevap: External Passthrough Network Load Balancer

Cevap

External Passthrough Network Load Balancer is the correct architectural choice because it handles external raw TCP traffic at Layer 4 and preserves the original client source IP address directly.
An External Passthrough Network Load Balancer is a regional Layer 4 load balancer that routes raw TCP/UDP traffic directly to Compute Engine backend instances. Because it does not terminate connections at a proxy, the original client packet headers (including the source IP address) remain intact when delivered to the backend VMs.

Adım Adım Çözüm

1
Identify traffic scope and protocol requirements
Traffic comes from external internet clients using raw non-HTTP TCP on custom port 7000.
Protocol requirements rule out Layer 7 (HTTP/HTTPS) load balancers.
2
Identify network routing and IP preservation requirements
The solution must preserve client source IP addresses and avoid proxy termination.
Passthrough load balancers route packets directly to backend instances without terminating TCP sessions.
3
Select the appropriate GCP load balancer type
External Passthrough Network Load Balancer satisfies external exposure, raw TCP support, and client IP preservation.
It operates at Layer 4 as a regional passthrough service built on Google Cloud Maglev architecture.

Anahtar Kavram

Selecting GCP Load Balancers based on traffic scope (internal/external), OSI layer (L4 vs L7), and packet passthrough vs proxy behavior.
Soru 1035Soru →

An administrator needs to list all existing Virtual Private Cloud (VPC) subnets across all regions in a Google Cloud project using the command-line interface. Which of the following commands or actions will accomplish this requirement? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Run gcloud compute networks subnets list; In the Google Cloud Console, navigate to VPC network > Subnets

Cevap

Executing 'gcloud compute networks subnets list' via the CLI and viewing the Subnets page under VPC network in the Google Cloud Console are both valid methods to list all VPC subnets in a project.
Listing VPC subnets can be performed via the gcloud CLI using 'gcloud compute networks subnets list' or graphically in the GCP Console by navigating to VPC network > Subnets.

Adım Adım Çözüm

1
Identify the standard CLI syntax for managing subnets in GCP Compute Engine.
The correct command structure under gcloud CLI is 'gcloud compute networks subnets list'.
gcloud CLI commands for VPC subnets are grouped under the 'compute networks subnets' command group.
2
Identify the standard Cloud Console navigation path for VPC subnets.
Navigating to VPC network > Subnets displays the full inventory of subnets in the current project.
The Cloud Console provides administrative views for all subnets under the VPC network service menu.

Anahtar Kavram

Managing VPC networks and listing subnets using gcloud CLI and Google Cloud Console
Soru 1036Soru →

A media streaming platform is designing a Google Kubernetes Engine (GKE) cluster deployment to support two distinct workloads: an internal management portal that requires custom Linux kernel sysctl modifications on cluster worker nodes, and a batch telemetry processing job that runs nightly and can tolerate unexpected pod terminations. Which TWO cluster configuration choices should the cloud engineer implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision a GKE Standard cluster to support custom kernel parameter configuration on node instances.; Configure a dedicated node pool utilizing Spot VMs for the nightly batch processing pipeline.

Cevap

The correct architectural decisions are to provision a GKE Standard cluster (to allow custom node kernel sysctl parameters) and to configure a dedicated Spot VM node pool for the fault-tolerant nightly batch workload.
GKE Standard mode allows administrators to customize node configurations, such as sysctl settings, which are restricted in GKE Autopilot. Additionally, using Spot VMs in a dedicated node pool for batch workloads maximizes cost reduction while honoring the fault-tolerant nature of the nightly processing jobs.

Adım Adım Çözüm

1
Analyze the operational requirements for the management portal.
Custom node sysctl settings require access to node-level operating system parameters, which is only supported in GKE Standard mode.
GKE Autopilot abstracts node management away from users and blocks custom kernel tuning.
2
Analyze the workload characteristics of the nightly batch telemetry job.
The batch pipeline is stateless and can tolerate unexpected pod preemptions.
Spot VMs offer substantial cost savings for fault-tolerant and time-flexible batch processing tasks.

Anahtar Kavram

Selecting between GKE Standard vs Autopilot based on node OS customization constraints, and choosing appropriate node pool lifecycle types (Spot vs On-Demand) based on workload fault tolerance.
Tahmini Süre:1m 30s
Soru 1037Soru →

An enterprise architecture team is setting up access control for a newly deployed microservice in Google Cloud Project `prod-analytics-v2`. A third-party security auditing team needs to review IAM policy bindings and configuration settings for Cloud Pub/Sub topics and Cloud Storage buckets without viewing payload data or modifying resources. Additionally, an external deployment service account needs to deploy new revisions to Cloud Run services within the project without receiving permissions to modify project IAM policies or create new Cloud Storage buckets. Which of the following IAM role assignments adhere to the principle of least privilege to satisfy these security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the Security Reviewer role (`roles/iam.securityReviewer`) at the project level to the security auditing team.; Grant the Cloud Run Developer role (`roles/run.developer`) at the project level to the external deployment service account.

Cevap

Granting the Security Reviewer role at the project level to the auditing team and granting the Cloud Run Developer role at the project level to the deployment service account.
To satisfy least-privilege security requirements, predefined roles should be used instead of primitive roles, and permissions should be scoped precisely to the targeted project rather than parent folders or organization nodes. The Security Reviewer role allows reading security policies and configuration metadata without exposing application payload data. The Cloud Run Developer role allows creating and updating Cloud Run revisions without granting broad project administration permissions.

Adım Adım Çözüm

1
Analyze the security auditing team's permission scope
Auditors need to view IAM policies and configuration metadata across project resources without viewing data payloads or modifying settings.
The predefined role `roles/iam.securityReviewer` scoped to the project satisfies this exact requirement without granting access to object/message data.
2
Analyze the deployment service account's permission scope
The service account needs to deploy Cloud Run services without gaining administrative rights over project IAM or other services like Cloud Storage.
The predefined role `roles/run.developer` provides service creation/deployment access specifically for Cloud Run.
3
Evaluate scope and role granularity against least privilege constraints
Primitive roles (`roles/editor`) and higher hierarchy scopes (Folder level) over-grant permissions.
Permissions inherited from higher resource hierarchy levels apply across all child projects, and primitive roles grant broad permissions beyond the required scope.

Anahtar Kavram

Applying Least Privilege via Predefined Roles and Project Resource Scope
Soru 1038Soru →

A cloud engineer is configuring operational access and network controls for an existing Cloud Run service named `inventory-service`. The service must fulfill two operational requirements: first, inbound network traffic must be restricted so that it accepts requests only from internal VPC networks and Google Cloud HTTP(S) Load Balancing; second, members of the developer group `[email protected]` must be granted administrative permission to deploy new container revisions and modify traffic splits without receiving broad administrative access across the entire project.

Which TWO actions should the cloud engineer execute? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Run `gcloud run services update inventory-service --ingress=internal-and-cloud-load-balancing` to configure the ingress settings.; Grant the `roles/run.developer` IAM role to `[email protected]` on the Cloud Run service resource.

Cevap

The correct operational steps are to update the Cloud Run service ingress setting using `gcloud run services update inventory-service --ingress=internal-and-cloud-load-balancing` and to grant the `roles/run.developer` role to `[email protected]` on the resource.
Configuring Cloud Run ingress with `gcloud run services update inventory-service --ingress=internal-and-cloud-load-balancing` restricts traffic to internal VPC callers and external load balancers. Concurrently, assigning the predefined `roles/run.developer` role to the developer group provides the specific permissions required to deploy revisions and manage traffic split percentages without violating the principle of least privilege.

Adım Adım Çözüm

1
Identify the proper gcloud CLI command and flag for restricting Cloud Run ingress traffic.
The command `gcloud run services update inventory-service --ingress=internal-and-cloud-load-balancing` correctly applies ingress controls allowing only internal VPC and Cloud Load Balancer traffic.
Cloud Run uses the `--ingress` flag with values like `all`, `internal`, or `internal-and-cloud-load-balancing` to restrict incoming network requests.
2
Select the appropriate IAM role for managing Cloud Run revisions and traffic splits under least-privilege principles.
The predefined role `roles/run.developer` grants permission to deploy new revisions, update traffic allocations, and view configuration without giving project-wide write access.
Using predefined resource-scoped roles adheres to Google Cloud IAM security best practices, unlike broad primitive roles.

Anahtar Kavram

Cloud Run Resource Operational Management (Ingress Controls and Least Privilege IAM)
Soru 1039Soru →

A software engineer needs to upload container images to Google Artifact Registry repositories within a development project. Following the principle of least privilege, which IAM role should you grant to the engineer?

Cevabı ve açıklamayı göster

Cevap: Artifact Registry Writer (`roles/artifactregistry.writer`) on the project

Cevap

Grant the Artifact Registry Writer role (`roles/artifactregistry.writer`) scoped to the specific project.
The Artifact Registry Writer role (`roles/artifactregistry.writer`) provides permissions to read and write repositories, which enables pushing container images. Granting this predefined role at the project level meets the functional requirement while adhering strictly to the principle of least privilege.

Adım Adım Çözüm

1
Identify the required operational permission
The engineer specifically needs permission to upload (push) container images to Artifact Registry repositories.
Understanding the precise capability needed allows selecting the narrowest matching IAM role.
2
Apply the Principle of Least Privilege
Select the predefined role `roles/artifactregistry.writer` over broad primitive roles or administrative predefined roles.
Predefined roles provide targeted permissions for specific service actions without exposing administrative capabilities or other GCP services.
3
Scope the role binding appropriately
Bind the role at the target project level rather than higher up in the resource hierarchy.
IAM roles inherit down the resource hierarchy; granting access at the project level restricts access to resources within that project.

Anahtar Kavram

Selecting specific Predefined Roles over broad Primitive Roles to satisfy the Principle of Least Privilege.
Tahmini Süre:45s
Soru 1040Soru →

An enterprise operations team manages a production Cloud SQL for MySQL instance that experiences unpredictable data volume growth. To prevent database downtime caused by running out of disk space, the cloud engineer needs to configure the instance so that its storage capacity expands automatically when free space drops below a critical threshold, without requiring manual instance restarts. Which action should the engineer take?

Cevabı ve açıklamayı göster

Cevap: Execute `gcloud sql instances patch INSTANCE_NAME --storage-auto-increase` to enable automatic disk capacity expansion.

Cevap

Execute `gcloud sql instances patch INSTANCE_NAME --storage-auto-increase` to enable automatic disk capacity expansion.
Executing the command to patch the Cloud SQL instance with the automatic storage increase flag configures Google Cloud to automatically expand persistent disk capacity whenever free space drops below threshold limits, preventing service failure without requiring instance downtime.

Adım Adım Çözüm

1
Analyze the operational objective.
The requirement is to ensure the database instance automatically increases storage capacity before running out of disk space without downtime.
Cloud SQL database instances need automatic storage expansion configured to handle unexpected data volume spikes.
2
Identify the correct Google Cloud CLI tool and parameter.
Use `gcloud sql instances patch` specifying `--storage-auto-increase`.
This instance configuration patch enables automatic persistent disk resizing when free space drops below the system safety threshold.

Anahtar Kavram

Cloud SQL Storage Auto-Increase Management
ÖncekiSayfa 52 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin