Tüm alıştırma soruları

A developer needs to execute local gcloud commands to manage Cloud Storage objects on behalf of a target service account, [email protected]. Following Google Cloud security best practices, the developer must temporarily impersonate this service account without downloading static key files. Which IAM configuration correctly enables this service account impersonation?

What is the correct sequence of steps to configure a Kubernetes Service Account (KSA) to impersonate a Google Cloud Service Account (GSA) using GKE Workload Identity?

An enterprise operations team is configuring Google Cloud storage and database resources for a web application. The application requires a database engine capable of handling complex relational schemas with ACID transactions and multi-table SQL joins. Additionally, product assets stored in Google Cloud Storage must have access permissions managed strictly at the bucket level via IAM policies, disabling individual object ACLs. Which TWO operational choices align with these technical requirements?

An organization is configuring access for an automated data pipeline in a Google Cloud project named `analytics-prod`. A dedicated service account used by a Cloud Run service requires read access to objects stored in a specific Cloud Storage bucket named `raw-data-vault`. Simultaneously, a data analyst requires access to create query jobs and view table data within BigQuery in the `analytics-prod` project. Security policies mandate strict adherence to the principle of least privilege while preventing unnecessary permission inheritance across the resource hierarchy. Which TWO IAM role assignments should the cloud engineer configure?

A software engineering team built a Node.js microservice packaged as a custom container image stored in Artifact Registry. The internal web server application inside the container is explicitly configured to listen on port 5000. The team must deploy this service to Cloud Run in region us-central1 using a custom identity service account named [email protected] and ensure that unauthenticated requests are blocked. Which gcloud command should be executed to accomplish this deployment?

A cloud engineer is deploying a Cloud SQL for PostgreSQL instance named 'orders-db' in a custom VPC network named 'production-vpc'. To meet security and operational compliance, the database instance must accept traffic exclusively via Private IP, enforce SSL/TLS encryption for all incoming client connections, and automatically increase storage capacity when available disk space is low. Which gcloud command correctly provisions this managed database instance?

A company is deploying a self-managed relational database on a Compute Engine virtual machine to handle internal order processing. The database requires persistent block storage that retains data across instance restarts and supports point-in-time snapshots for disaster recovery. The workload requires baseline SSD performance for daily operations but does not need peak performance or extreme IOPS scaling. The engineering team wants to minimize storage costs while satisfying these operational requirements. Which storage configuration should you select?

An infrastructure team is preparing to deploy a set of virtual machine instances into a target Google Cloud project named `infra-prod-882` using Google Cloud Deployment Manager. When executing the `gcloud deployment-manager deployments create` command, the deployment fails with an error stating that `compute.googleapis.com` is disabled. Which action must be taken to successfully execute the deployment?

A platform engineer is configuring autoscaling for a state-agnostic API service running on a Google Kubernetes Engine (GKE) Standard cluster. During peak traffic hours, existing pods experience high CPU utilization, and incoming pods remain in a Pending state because the current worker nodes lack remaining CPU capacity to schedule them. Which TWO scaling mechanisms must be configured together to automatically handle both pod load and node capacity constraints? (Select TWO)

A DevOps engineer manages a production Cloud Run service named `billing-service` deployed in the `us-central1` region. To test a performance optimization patch in production with minimal risk, the engineer deployed a new revision named `billing-service-00002-patch` using the `--no-traffic` flag. Currently, $100\%$ of production traffic continues to be routed to the baseline revision `billing-service-00001-base`. The engineer must now configure the service to route $15\%$ of incoming traffic to `billing-service-00002-patch` while leaving the remaining $85\%$ on `billing-service-00001-base`.

Which `gcloud` command should the engineer execute to implement this precise traffic split?

A DevOps team needs to route application logs generated by workloads running in Google Cloud Project-A to a central BigQuery dataset hosted in Project-B for long-term security compliance and querying. Which TWO actions must be configured to successfully set up this log export?

A platform engineering team is setting up Terraform to manage Google Cloud networking infrastructure across multiple developer environments. To adhere to security best practices, the team wants to centrally store state files with automatic state locking while eliminating the risk of exposed long-lived service account credentials on local engineer workstations. Which TWO configuration steps should the team perform to fulfill these requirements? (Select TWO)

An organization is configuring security policies for container image management within a Google Cloud project named `prod-app-repo`. An application deployment team requires access to push and pull container images in Artifact Registry repositories in this project. Simultaneously, a compliance auditor needs read-only access to view repository metadata without the ability to modify or delete artifacts. Adhering strictly to the principle of least privilege, which two IAM configuration actions should you perform? (Select TWO.)

You need to create a new service account named "app-scanner" in your Google Cloud project using the command-line interface. Which gcloud command should you run to accomplish this?

A DevOps engineer is deploying a specialized compute workload on Google Cloud attached to GPU hardware accelerators. Compute Engine GPU instances do not support live migration. The application configuration requires that if host maintenance occurs, the instance must terminate instead of migrating, and it should not restart automatically if the host experiences an unexpected outage. Which flags must be passed to the `gcloud compute instances create` command to configure this availability behavior correctly?

An organization runs an enterprise application on Google Kubernetes Engine (GKE) in `project-app-prod`. The application needs to read objects from a Cloud Storage bucket located in a separate project, `project-data-shared`. Security policies strictly mandate adherence to the principle of least privilege and prohibit creating or downloading long-lived service account private keys (`.json` key files). Which of the following configuration steps must you perform to grant the application keyless cross-project access securely? (Select TWO.)

An operations team manages a Google Cloud Storage bucket used for storing raw media uploads. To adhere to corporate governance and optimize operational costs, the team must ensure that object access is managed exclusively via Google Cloud IAM without per-object Access Control Lists (ACLs). Furthermore, active objects must automatically transition to Coldline Storage after 30 days of inactivity, and noncurrent object versions must be purged after 90 days. Which TWO actions should the cloud engineer take to fulfill these operational requirements?

An enterprise financial service runs a critical stateless application deployed inside a regional Managed Instance Group (MIG) in `us-central1`. The team needs to deploy a newly created instance template (`finapp-v2`) to the MIG with zero application downtime. Additionally, operational monitoring alerts reveal that during peak traffic events, the MIG attempts to autoscale beyond its current capacity but fails because the project has reached its regional N2 CPU quota limit. Which TWO actions should you perform to execute the update seamlessly and resolve the operational bottleneck?

An engineering team is deploying an application to Google Kubernetes Engine (GKE) that requires access to a Google Cloud Storage bucket. To adhere to security best practices, the team decides to use Workload Identity instead of exporting static service account keys. What is the correct sequence of steps to configure Workload Identity binding between the Kubernetes Service Account (KSA) and the GCP Service Account (GSA)?

A Cloud Engineer discovers that a daily log export process into a Cloud Storage bucket is incurring high operational costs. Inspection reveals an Object Lifecycle Management rule configured to transition objects to the Coldline storage class zero days after creation. However, an automated analytics pipeline reads these newly created log files multiple times daily during their first two weeks before access drops completely. Which action should the engineer take to resolve the issue and optimize costs?