Tüm alıştırma soruları

A cloud engineer manages a Google Kubernetes Engine (GKE) Standard cluster named `analytics-cluster` in zone `us-central1-a`. Several newly deployed workload Pods are stuck in a `Pending` state because the existing node pool named `analytics-pool` lacks sufficient CPU capacity to schedule them. The engineer needs to ensure that worker node capacity automatically scales out whenever Pods cannot be scheduled due to resource constraints. Which `gcloud` command should the engineer execute?

An enterprise data engineering team processes nightly batch data pipelines that are fault-tolerant and save progress checkpoints to a Cloud Storage bucket every 10 minutes. The engineering manager needs to optimize compute costs for this workload while delegating operational tasks—such as starting, stopping, and reconfiguring these Compute Engine VM instances—to a specialized operations team following Google Cloud security best practices. Which TWO actions should the cloud engineer take to meet these requirements? (Select 2 answers.)

A security engineer needs to configure access for an application service account running in a dedicated project named `finance-prod-app`. The service account requires access to retrieve and read secret values stored within Secret Manager in this project. To comply with corporate security standards, the service account must not have access to secrets in any other project within the organization, nor should it have permissions to create, update, or delete secret metadata. Which IAM role binding strategy adheres to the principle of least privilege while meeting these requirements?

An integration engineer is configuring access for an external application service account that must send telemetry messages to a specific Google Cloud Pub/Sub topic in a production project. The application should only be capable of publishing messages to this single topic and must not be allowed to read messages, manage subscriptions, or modify any other project resources. To adhere to Google Cloud's recommendation of least privilege, which IAM configuration should be implemented?

A DevOps team is deploying an event-driven Python microservice as a Cloud Functions (2nd gen) service to process file uploads arriving in a Cloud Storage bucket. The microservice must execute using a dedicated custom service account under the principle of least privilege while interacting with Cloud Storage and Firestore. Which TWO actions must the team perform to successfully deploy and configure this serverless workload?

Your organization operates a multi-tier enterprise workload in Google Cloud using a custom Virtual Private Cloud (VPC) named `prod-vpc`. An existing ingress firewall rule named `allow-app-traffic` currently allows inbound TCP traffic on port 8080 from `10.2.0.0/16` to instances tagged `app-server`, evaluated at a priority of 1000. Due to a compliance update, you must modify this rule to meet three operational requirements:
1. Restrict the source IP range to `10.2.15.0/24`.
2. Ensure the firewall rule takes precedence over a newly added conflicting rule evaluated at priority 500.
3. Keep the target tag `app-server` intact while replacing the source range.

Which `gcloud` command should you execute to accomplish this operational requirement cleanly in a single step?

A Cloud Engineer needs to migrate an existing local Terraform state file to a Google Cloud Storage (GCS) remote backend to allow team collaboration and state locking. What is the correct sequence of steps to safely execute this backend migration?

An online retail organization is migrating its platform backend to Google Cloud. The architecture requires two storage components: first, a transactional relational database for order management that mandates ACID compliance and automatic cross-zone failover within a single region; second, ultra-low sub-millisecond latency scratch storage for ephemeral data processing jobs running on Compute Engine instances. Which TWO storage and database configurations should the team select to satisfy these requirements?

A Systems Administrator needs to create a standardized golden image from an existing, configured Compute Engine instance named `web-template-vm` located in GCP project `corp-base-images`. The administrator must then use this custom image to provision a new production Compute Engine instance in a separate project named `corp-prod-apps`. In what correct chronological order should the administrator perform the steps to complete this cross-project image creation and VM deployment workflow?

A DevOps engineer needs to grant a CI/CD service account permission to push container images to a single specific Artifact Registry repository within the project `prod-apps-123`. Following the principle of least privilege, the service account must be allowed to write artifacts to this repository without permissions to delete artifacts, alter repository administrative settings, or gain access to other repositories in the organization hierarchy. Which IAM configuration should the engineer apply?

An enterprise network team is provisioning infrastructure within a custom-mode Virtual Private Cloud (VPC) named `corp-vpc` that connects to an on-premises network operating on $10.100.0.0/16$. The requirement is to deploy a new subnet `us-east-subnet` in region `us-east1` and configure firewall rules allowing inbound SSH traffic from the on-premises range exclusively to instances tagged with `secure-bastion`. This inbound SSH rule must override a broad network-wide SSH block rule currently set with a priority of 1000.

Which TWO configuration choices or CLI operations are correct to implement this requirement? (Select TWO)

An enterprise financial organization is architecting a Google Kubernetes Engine (GKE) cluster to support a mission-critical transaction processing system. The architecture must ensure high availability for both the cluster control plane and worker nodes during a single availability zone outage, while avoiding control plane downtime during master upgrades. Additionally, the workload cannot tolerate unexpected node preemptions. Which cluster configuration should the cloud engineer choose to satisfy these constraints?

An e-commerce company is architecting a containerized application platform on Google Kubernetes Engine (GKE). The solution consists of two distinct workloads: a stateless, fault-tolerant log analytics pipeline and a legacy core service that requires custom Linux kernel sysctl parameters and specialized node-level privilege access to the host OS. Which TWO architectural decisions should the engineering team implement to satisfy these operational and technical requirements? (Select TWO options.)

A cloud engineer needs to deploy a Cloud SQL for PostgreSQL instance named analytics-db in the us-central1 region using the gcloud CLI. The deployment must strictly enforce private IP connectivity on the custom VPC network prod-vpc without allocating a public IP address, and must ensure high availability across multiple zones. Which TWO flags must be included in the gcloud sql instances create command to meet these requirements? (Select TWO.)

An enterprise organization manages a Google Cloud resource hierarchy containing a Folder named 'Data-Analytics' with two child projects: 'analytics-prod' and 'analytics-dev'. A compliance audit team requires permissions to run SQL queries and inspect table data strictly in the 'analytics-prod' project. Additionally, the auditors require read-only visibility into Cloud Storage bucket metadata across both projects. Security policy strictly forbids binding IAM roles at the Folder level to prevent unintended inherited access. Which IAM role assignment configuration adheres to the principle of least privilege while complying with the resource hierarchy constraint?

A network administrator configures two ingress firewall rules for a Google Cloud Virtual Private Cloud (VPC) network targeting the same Compute Engine instance. The first rule, named allow-web, allows TCP traffic on port 80 with a priority of 1000. The second rule, named deny-web, denies TCP traffic on port 80 with a priority of 500. When TCP traffic on port 80 arrives at the instance, which firewall rule determines how the traffic is handled?

A cloud operations engineer manages a Google Cloud Storage bucket storing high-volume security telemetry logs. The operational requirements dictate that logs must be accessed frequently during the first 30 days for real-time security analysis, accessed rarely over the subsequent 60 days for periodic auditing, and archived long-term for 3 years before deletion. The engineer must automate this workflow to minimize storage and access costs without incurring early retrieval fees during the analysis window. Which Object Lifecycle Management policy configuration should the engineer apply to the bucket?

A Cloud Engineer needs to create a project-level custom IAM role from a definition file (`custom-role.yaml`) and assign it to a service account (`[email protected]`) in the project `my-project`. Place the required command line operations and configuration steps in the correct chronological order from first to last to enforce least privilege access securely.

An operations team needs to grant a application service account permissions to publish messages to Cloud Pub/Sub topics and manage Pub/Sub subscriptions within a dedicated staging project. The service account must not be granted full administrative control over Pub/Sub resources, nor broad access across the entire organization. Which TWO IAM roles should you grant to the service account to adhere to the principle of least privilege?

An organization is deploying an internal backend authentication microservice on Compute Engine instances distributed across multiple zones within a single Google Cloud VPC region. The microservice processes raw, non-HTTP TCP traffic on custom port 9090 from client application VMs located inside the same VPC network. The solution must provide internal load balancing with continuous health checks and allow client VMs to access the microservice using a custom internal domain name (auth.internal.example.com). Which TWO architectural actions should you take to meet these requirements?