Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 1141Soru →

A cloud engineer needs to collect detailed system memory utilization metrics and application log files from a newly deployed fleet of Compute Engine virtual machine instances. Which TWO configuration steps should the engineer perform to fulfill these telemetry requirements following Google Cloud recommended practices?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Install the unified Google Cloud Ops Agent on each VM instance.; Grant the service account attached to the VM instances the Monitoring Metric Writer and Logs Writer roles.

Cevap

To collect system memory metrics and log files from Compute Engine instances using Google Cloud recommended practices, you must install the unified Google Cloud Ops Agent on the VM instances and ensure the VM service account is assigned least-privilege predefined roles (Monitoring Metric Writer and Logs Writer).
The correct steps involve installing the unified Google Cloud Ops Agent on the VM instances and granting the VM service account the specific predefined IAM roles for Monitoring Metric Writer and Logs Writer. The Ops Agent gathers system-level metrics such as memory utilization and application logs, while the predefined IAM roles authorize telemetry data export securely under the principle of least privilege.

Adım Adım Çözüm

1
Identify the recommended telemetry agent for Google Cloud Compute Engine instances.
The unified Google Cloud Ops Agent replaces legacy agents and combines metric and log collection.
Google Cloud recommends the Ops Agent for all new VM observability setups.
2
Determine the necessary IAM roles for exporting metrics and logs to Google Cloud Observability.
Assign the predefined roles Monitoring Metric Writer (roles/monitoring.metricWriter) and Logs Writer (roles/logging.logWriter) to the service account.
Following the principle of least privilege ensures proper write access without granting excessive administrative permissions.

Anahtar Kavram

Google Cloud Ops Agent installation and IAM permission requirements for VM telemetry.
Soru 1142Soru →

An automated analytics pipeline deployed on Cloud Run operates using the runtime service account [email protected]. To complete batch jobs, it must mint short-lived OAuth 2.0 access tokens to impersonate [email protected] without using static credentials. Following the principle of least privilege, which configuration enables this impersonation capability?

Cevabı ve açıklamayı göster

Cevap: Assign the predefined IAM role roles/iam.serviceAccountTokenCreator on the target bq-exporter service account to principal [email protected].

Cevap

Assign the predefined IAM role roles/iam.serviceAccountTokenCreator on the target bq-exporter service account to principal [email protected].
To impersonate a target service account and generate short-lived tokens keylessly, the principal making the call must be granted the roles/iam.serviceAccountTokenCreator role directly on that target service account.

Adım Adım Çözüm

1
Identify the source principal and target resource
The source principal is [email protected] and the target resource being impersonated is [email protected].
Impersonation requires configuring IAM policy bindings directly on the target service account.
2
Determine the required permission capability
The requirement specifies generating short-lived access tokens without long-lived keys.
Minting short-lived tokens requires the iam.serviceAccounts.getAccessToken permission contained in the Service Account Token Creator role.
3
Select the minimum necessary IAM role binding
Assigning roles/iam.serviceAccountTokenCreator on the target service account grants the exact permission needed for impersonation without granting overprivileged project access.
This satisfies GCP security best practices and the principle of least privilege.

Anahtar Kavram

Service Account Impersonation via Service Account Token Creator Role
Tahmini Süre:1m 30s
Soru 1143Soru →

A cloud administrator manages a Compute Engine virtual machine running a stateful database application on a standard persistent disk (`pd-standard`). Due to increasing transaction volume, the database is experiencing disk I/O bottlenecks. The administrator needs to increase both disk IOPS and throughput with minimal operational impact and without recreating the VM or detaching the disk. Which action should the administrator take to achieve this requirement following Google Cloud best practices?

Cevabı ve açıklamayı göster

Cevap: Increase the size of the existing persistent disk while it remains attached to the VM, and then expand the file system within the guest operating system.

Cevap

Increase the size of the existing persistent disk while attached to the running VM, and then expand the file system from within the guest operating system.
In Compute Engine, persistent disk performance (IOPS and throughput) scales linearly with the size of the disk. Disks can be expanded online without detaching them or stopping the virtual machine. Once the disk capacity is increased via the Cloud Console or gcloud CLI, the administrator only needs to resize the file system within the guest OS to gain the additional capacity and higher I/O performance limits.

Adım Adım Çözüm

1
Identify the storage performance scaling mechanism in Compute Engine.
Recognize that persistent disk performance (IOPS and throughput) increases linearly with provisioned disk size up to specified per-disk limits.
Standard persistent disks scale performance based on disk capacity rather than API settings or IAM configurations.
2
Resize the persistent disk using Google Cloud tools (Cloud Console or `gcloud compute disks resize`).
The disk capacity and corresponding IOPS/throughput limits are expanded immediately while the disk remains attached to the running VM.
Compute Engine supports online persistent disk expansion without requiring instance shutdown or disk detachment.
3
Resize the partition and file system inside the guest OS.
The operating system detects and utilizes the additional disk space and improved I/O limits.
Increasing the GCP disk size makes raw storage available, but file system utilities (such as `resize2fs` or `xfs_growfs`) are necessary to make the extra space usable by applications.

Anahtar Kavram

Online Persistent Disk Resizing and Performance Scaling
Tahmini Süre:2m 0s
Soru 1144Soru →

A DevOps engineer needs to configure GKE Workload Identity so that an application running in a Kubernetes cluster can securely access Google Cloud resources without using exported service account key files. Which TWO of the following configuration actions must be performed to complete this setup?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the roles/iam.workloadIdentityUser role on the Google Service Account to the Kubernetes Service Account member.; Annotate the Kubernetes Service Account with the email address of the Google Service Account.

Cevap

The two required configuration actions are binding the IAM Workload Identity User role to the Kubernetes Service Account on the Google Service Account, and annotating the Kubernetes Service Account with the Google Service Account email address.
To set up GKE Workload Identity, you must authorize the Kubernetes Service Account (KSA) to impersonate the Google Service Account (GSA) by assigning the roles/iam.workloadIdentityUser role, and you must annotate the KSA with the GSA's email address so GKE pods receive short-lived credentials.

Adım Adım Çözüm

1
Bind the IAM Workload Identity User role
The Kubernetes Service Account is allowed to impersonate the Google Service Account.
The roles/iam.workloadIdentityUser permission establishes trust between the Kubernetes identity and Google Cloud IAM.
2
Annotate the Kubernetes Service Account
GKE metadata server automatically provides short-lived tokens for the specified Google Service Account to pods using this Kubernetes Service Account.
The annotation identifies which target Google Service Account identity the Kubernetes pod should adopt.

Anahtar Kavram

Configuring Workload Identity between Kubernetes Service Accounts and Google Service Accounts
Soru 1145Soru →

An enterprise cloud team is creating reusable Google Cloud Deployment Manager templates (`storage_bucket.jinja`) to standardize Cloud Storage bucket deployments across multiple projects. The team wants to enforce parameter validation—such as requiring the `storage_class` input parameter and verifying allowed string values—so that invalid configuration files fail prior to resource creation. Which approach correctly implements this pre-deployment parameter validation in Deployment Manager?

Cevabı ve açıklamayı göster

Cevap: Create a companion schema file named `storage_bucket.jinja.schema` that defines mandatory properties and allowed values using JSON Schema.

Cevap

Create a companion schema file named `storage_bucket.jinja.schema` that defines mandatory properties and allowed values using JSON Schema.
In Google Cloud Deployment Manager, schema files (`.schema`) written in JSON Schema format allow authors to define rules for template properties. By creating `storage_bucket.jinja.schema`, Deployment Manager validates that required fields (such as `storage_class`) are present and conform to specified constraints before applying the deployment.

Adım Adım Çözüm

1
Identify the Deployment Manager requirement for template parameter validation.
Deployment Manager allows developers to define input rules for Jinja2 or Python templates.
Validation ensures invalid inputs are caught before API calls are made.
2
Match the requirement to the standard Deployment Manager schema contract.
A `.schema` file written in JSON Schema format matching the template name enforces required fields, types, and allowed values.
Deployment Manager automatically loads and checks `.schema` files alongside template imports.

Anahtar Kavram

Deployment Manager Schema Validation
Soru 1146Soru →

An enterprise security policy requires granting an external analytics team read access to messages processed by a Google Cloud Pub/Sub subscription and read-only access to log archive files in a specific Cloud Storage bucket within the `iot-telemetry-prod` project. The team must not be permitted to publish messages, alter Pub/Sub configurations, or modify/delete storage buckets and objects. Which TWO of the following IAM role configurations follow the principle of least privilege while providing the required access? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant `roles/pubsub.subscriber` on the specific Pub/Sub subscription in the `iot-telemetry-prod` project.; Grant `roles/storage.objectViewer` directly on the target Cloud Storage bucket resource.

Cevap

Granting `roles/pubsub.subscriber` on the Pub/Sub subscription and granting `roles/storage.objectViewer` on the specific Cloud Storage bucket.
The Pub/Sub Subscriber role (`roles/pubsub.subscriber`) provides the minimal permissions necessary to read messages from Pub/Sub subscriptions without granting permissions to modify topics or publish data. Similarly, granting Storage Object Viewer (`roles/storage.objectViewer`) directly on the specific Cloud Storage bucket allows reading object data while preventing object deletion, bucket deletion, or broader project-level changes.

Adım Adım Çözüm

1
Analyze required Pub/Sub permissions against the principle of least privilege.
The team only needs to consume subscription messages. The predefined role `roles/pubsub.subscriber` grants subscription consumption rights without allowing topic publishing or management.
Choosing fine-grained predefined roles over primitive roles prevents over-privileging identities.
2
Analyze required Cloud Storage permissions and target scope.
The predefined role `roles/storage.objectViewer` scoped directly to the target bucket permits listing and reading objects without granting deletion or bucket modification rights.
Applying bindings at the resource level avoids granting unintended access across all buckets in the project or folder.
3
Evaluate and eliminate incorrect distractor options.
Assigning primitive Editor access grants broad write permissions project-wide, while folder-level Storage Admin access propagates full administrative rights to all child projects via resource hierarchy inheritance.
Both distractor options violate the principle of least privilege through over-scopings and role severity.

Anahtar Kavram

Applying Predefined IAM Roles at Resource-Specific Scopes for Least Privilege
Soru 1147Soru →

A system engineer needs to provision a production Cloud SQL for MySQL instance named 'prod-mysql-db' in the us-central1 region. Organizational security policies mandate that the database instance must connect exclusively via Private IP within the custom Virtual Private Cloud (VPC) network named 'prod-vpc' and must not have an external public IP address assigned. Which gcloud command correctly provisions the Cloud SQL instance to meet these security requirements?

Cevabı ve açıklamayı göster

Cevap: gcloud sql instances create prod-mysql-db --database-version=MYSQL_8_0 --cpu=4 --memory=16GiB --network=projects/my-project/global/networks/prod-vpc --no-assign-ip --region=us-central1

Cevap

The command specifying '--network=projects/my-project/global/networks/prod-vpc' alongside '--no-assign-ip' correctly provisions the Cloud SQL instance with Private IP connectivity while suppressing public IP address assignment.
Provisioning a Cloud SQL instance with exclusive Private IP access requires attaching it to the target VPC network using the `--network` parameter and disabling public IP address allocation using `--no-assign-ip`.

Adım Adım Çözüm

1
Identify network connectivity requirement
The database must use Private IP connectivity within the custom VPC 'prod-vpc'.
Connecting Cloud SQL to a internal VPC requires configuring Private Services Access and specifying the --network flag in gcloud.
2
Identify public access restriction
The instance must not receive a public IPv4 address.
By default Cloud SQL instances receive a public IP unless the --no-assign-ip flag is explicitly provided during creation.
3
Select the correct gcloud syntax
Combine --network and --no-assign-ip in the gcloud sql instances create command.
This combination provisions private IP routing over VPC peering while blocking public IP interface assignment.

Anahtar Kavram

Cloud SQL Private IP Instance Provisioning
Tahmini Süre:1m 30s
Soru 1148Soru →

A developer requests a service account JSON key file to authenticate an application running on a Compute Engine virtual machine instance to BigQuery. Following Google Cloud security best practices, which approach should you take to provide authentication for the application?

Cevabı ve açıklamayı göster

Cevap: Attach a custom service account with the necessary predefined BigQuery roles directly to the Compute Engine instance.

Cevap

Attach a custom service account with the necessary predefined BigQuery roles directly to the Compute Engine instance.
Attaching a custom service account directly to a Compute Engine instance allows applications to retrieve access tokens automatically via the internal metadata server. This eliminates the need to generate, store, or rotate service account JSON keys, adhering strictly to Google Cloud security best practices.

Adım Adım Çözüm

1
Identify the environment and workload context
The application runs internally on a Compute Engine virtual machine instance within Google Cloud.
Internal GCP workloads do not require exported security keys for authentication.
2
Apply Google Cloud IAM best practices for service account management
Use instance metadata authentication by assigning a custom service account with least-privilege predefined roles.
Attached service accounts leverage automatically managed short-lived tokens, eliminating the maintenance and leak risk of long-lived service account JSON keys.

Anahtar Kavram

Service Account Attachment vs. Key File Export
Soru 1149Soru →

A cluster administrator needs to perform a manual control plane and worker node version upgrade on a Google Kubernetes Engine (GKE) Standard cluster named `prod-analytics-cluster` located in region `us-central1`. Automatic node upgrades are disabled for this cluster due to customized maintenance windows. What is the correct sequence of operational steps to upgrade the control plane first, verify stability, and then safely upgrade the node pool?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins by checking available cluster versions with `gcloud container get-server-config`, upgrading the control plane master using `gcloud container clusters upgrade` with the `--master-only` flag, verifying control plane health, upgrading the node pool using `gcloud container node-pools upgrade`, and finally verifying node readiness using `kubectl get nodes`.
The correct order follows GCP best practices for manual GKE cluster maintenance: first query valid versions (`gcloud container get-server-config`), then upgrade the control plane (`gcloud container clusters upgrade --master-only`), confirm control plane health, upgrade worker node pools (`gcloud container node-pools upgrade`), and verify node health with `kubectl get nodes`.

Adım Adım Çözüm

1
Query available GKE server versions
Identified valid target Kubernetes versions supported in `us-central1`
Before triggering upgrades, valid target versions must be verified against regional GKE availability.
2
Initiate control plane upgrade
Control plane upgraded using `--master-only`
Kubernetes version compatibility rules mandate that GKE control planes must be upgraded before worker node pools.
3
Verify control plane status
Control plane state confirmed as `RUNNING`
Ensures API server availability and control plane health before starting rolling updates on worker nodes.
4
Upgrade worker node pool
Node pool upgraded to target version using `gcloud container node-pools upgrade`
Node pools are upgraded after the master control plane is stable.
5
Validate cluster node health
All nodes return `Ready` status on the updated version via `kubectl get nodes`
Final validation ensures all workloads transitioned cleanly and all nodes operate correctly on the new release.

Anahtar Kavram

GKE Cluster and Node Pool Manual Upgrade Order
Soru 1150Soru →

A cloud engineer manages a production Cloud Run service named `checkout-api` deployed in the `europe-west1` region. A new revision named `checkout-api-v2` was previously deployed with the `--no-traffic` flag for testing. After successful verification, the engineer must immediately adjust the live traffic allocation so that 25%25\% of incoming requests are routed to `checkout-api-v2` while the remaining 75%75\% continues to serve on the existing revision `checkout-api-v1`. Which `gcloud` command should the engineer run to accomplish this traffic split?

Cevabı ve açıklamayı göster

Cevap: gcloud run services update-traffic checkout-api --region=europe-west1 --to-revisions=checkout-api-v1=75,checkout-api-v2=25

Cevap

The command `gcloud run services update-traffic checkout-api --region=europe-west1 --to-revisions=checkout-api-v1=75,checkout-api-v2=25` correctly splits traffic between existing Cloud Run revisions.
To modify traffic distribution across existing Cloud Run revisions without creating a new revision, you must use the `gcloud run services update-traffic` command. Specifying `--to-revisions=checkout-api-v1=75,checkout-api-v2=25` explicitly routes 75%75\% of incoming requests to the baseline revision and 25%25\% to the test revision.

Adım Adım Çözüm

1
Identify the operational goal for managing existing Cloud Run revisions
Recognize that traffic needs to be split across existing revisions (`checkout-api-v1` and `checkout-api-v2`) without creating a new revision.
Deploying a new container container image is unnecessary since `checkout-api-v2` is already deployed.
2
Select the correct gcloud CLI subcommand for Cloud Run traffic management
Use `gcloud run services update-traffic` rather than `gcloud run deploy` or `gcloud functions deploy`.
The `update-traffic` command specifically manages traffic assignments across active revisions of a service.
3
Configure revision target flags and percentages
Pass `--to-revisions=checkout-api-v1=75,checkout-api-v2=25` along with the `--region=europe-west1` flag.
The `--to-revisions` flag maps explicit revision names to their respective integer traffic percentages.

Anahtar Kavram

Managing Cloud Run revision traffic allocation via gcloud run services update-traffic
Tahmini Süre:2m 0s
Soru 1151Soru →

A DevOps engineer needs to deploy a new revision of an existing containerized API service to Google Cloud Run. To satisfy testing requirements, the new revision must be deployed without receiving any production user traffic until internal verification is complete. Which command should the engineer execute to deploy the container image while preserving 100% of live traffic on the current revision?

Cevabı ve açıklamayı göster

Cevap: gcloud run deploy api-service --image=gcr.io/my-project/api:v2 --no-traffic

Cevap

The command containing `gcloud run deploy api-service --image=gcr.io/my-project/api:v2 --no-traffic` correctly deploys the container revision without directing traffic to it.
Executing `gcloud run deploy` with the `--no-traffic` flag creates the new service revision in Google Cloud Run while retaining 100% of live production traffic on the previously serving revision. This allows developers to safely verify and test the new revision via revision-specific URLs or tags before updating the service traffic split.

Adım Adım Çözüm

1
Identify the target serverless compute product
The requirement specifies an existing containerized service deployed to Cloud Run, requiring `gcloud run deploy`.
Cloud Run handles container deployment and service management, whereas Cloud Functions targets function code runtimes.
2
Determine default revision traffic routing behavior in Cloud Run
By default, `gcloud run deploy` routes 100% of traffic to the newly created revision immediately.
Overriding default traffic assignment requires an explicit flag during deployment.
3
Select the correct `gcloud run deploy` flag to suppress traffic allocation
Using `--no-traffic` ensures the revision is created, but receives 0% of traffic, leaving existing traffic splits unchanged.
The `--no-traffic` flag is the built-in mechanism for creating revisions without shifting live production traffic.

Anahtar Kavram

Cloud Run Traffic Management during Revision Deployment
Tahmini Süre:1m 30s
Soru 1152Soru →

A company is planning the storage architecture for a self-managed relational database running on a Compute Engine virtual machine. The database workload requires SSD-level performance and lower latency than standard magnetic persistent disks, but the cloud engineering team wants a cost-effective option compared to high-performance SSD persistent disks (`pd-ssd`). The storage must persist independently of the VM instance lifecycle and provide standard zonal redundancy. Which storage option should the team select?

Cevabı ve açıklamayı göster

Cevap: Balanced persistent disk (`pd-balanced`)

Cevap

Balanced persistent disk (`pd-balanced`) is the recommended storage type because it offers SSD-backed performance at a lower cost point than `pd-ssd`, while maintaining persistent zonal durability independent of VM instance lifecycle.
Balanced persistent disk (`pd-balanced`) is specifically designed to bridge the gap between standard magnetic persistent disks (`pd-standard`) and high-performance SSD disks (`pd-ssd`). It provides SSD performance suitable for standard relational databases at a lower price point while ensuring data persistence independent of the Compute Engine VM lifecycle.

Adım Adım Çözüm

1
Analyze workload storage requirements
Identified the need for persistent, durable block storage suitable for a relational database with SSD performance, lower cost than `pd-ssd`, and independence from VM lifecycle.
Relational database engines require reliable block storage with consistent IOPS and data persistence across VM restarts.
2
Evaluate Google Cloud block storage and database options
Balanced persistent disks (`pd-balanced`) deliver a baseline of SSD performance tailored for standard database workloads at a lower price per gigabyte compared to `pd-ssd`.
Local SSDs are non-persistent/ephemeral, Cloud Bigtable is a NoSQL engine unsuited for relational databases, and Coldline object storage incurs severe latency and retrieval charges when used as active file storage.

Anahtar Kavram

Selecting persistent disk types based on database performance, durability, and cost constraints.
Tahmini Süre:1m 30s
Soru 1153Soru →

A Cloud Engineer needs to allow a developer to execute gcloud CLI commands by short-lived impersonation of a dedicated deployment service account, without creating or downloading service account keys. Which IAM role should be assigned to the developer on the target service account?

Cevabı ve açıklamayı göster

Cevap: Service Account Token Creator (roles/iam.serviceAccountTokenCreator)

Cevap

The Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) should be assigned to the developer on the target service account.
The Service Account Token Creator role provides the exact permissions required to mint short-lived tokens and impersonate a Google Cloud service account without creating service account keys.

Adım Adım Çözüm

1
Identify the goal of keyless service account delegation.
The developer needs short-lived credential access via impersonation without generating persistent JSON private keys.
Impersonation eliminates key management overhead and security risks associated with long-lived key files.
2
Determine the predefined IAM role specific to token minting.
Select the Service Account Token Creator role.
This role includes the iam.serviceAccounts.getAccessToken permission needed to generate impersonation tokens for gcloud commands.

Anahtar Kavram

Service Account Impersonation Roles
Tahmini Süre:1m 0s
Soru 1154Soru →

A company requires an external compliance officer to audit security configurations in a Google Cloud project named `finance-analytics-prod`. The auditor needs to inspect IAM policy bindings across the project and view metadata configurations for Cloud Spanner instances and databases. The auditor must NOT be able to read sensitive records stored inside the Spanner database tables or alter any GCP resources. Which TWO IAM role assignments should you configure for the auditor at the project level to satisfy these requirements while adhering to the principle of least privilege?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the Security Reviewer role (`roles/iam.securityReviewer`) on the project.; Grant the Cloud Spanner Viewer role (`roles/spanner.viewer`) on the project.

Cevap

Assign the Security Reviewer role (`roles/iam.securityReviewer`) and the Cloud Spanner Viewer role (`roles/spanner.viewer`) at the project level.
To grant read-only security audit capabilities and Spanner metadata visibility under the principle of least privilege, predefined roles should be bound at the target project scope. The Security Reviewer role (`roles/iam.securityReviewer`) allows security configuration and IAM policy inspection, while the Cloud Spanner Viewer role (`roles/spanner.viewer`) grants metadata read access without permitting data row retrieval.

Adım Adım Çözüm

1
Analyze the IAM requirements for auditing security policies.
Identify that inspect-only access for IAM bindings across project resources requires `roles/iam.securityReviewer`.
Security Reviewer grants security-related read permissions without providing access to actual underlying data stored in resources.
2
Analyze the IAM requirements for viewing Cloud Spanner instance and database metadata.
Identify that viewing database structure/metadata without reading table rows requires `roles/spanner.viewer`.
Cloud Spanner Viewer allows inspecting instance, database, and schema metadata while denying data plane read permissions (`spanner.databases.read`).
3
Verify scope and principle of least privilege.
Apply both predefined roles specifically at the project resource level (`finance-analytics-prod`).
Assigning predefined roles at the specific project scope avoids over-granting access via primitive roles or higher resource hierarchy levels.

Anahtar Kavram

Applying Predefined Roles at the Project Level for Least-Privilege IAM Audit Access
Soru 1155Soru →

A Cloud Engineer needs to deploy a custom microservice from local source code to Google Cloud Run and secure it so that only a specific client service account can invoke it. Arrange the steps in the correct sequential order from initial image creation to post-deployment verification.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: 1. Build and push the container image to Artifact Registry using gcloud builds submit. 2. Deploy the container image to Cloud Run with unauthenticated access disabled. 3. Bind the Cloud Run Invoker role (roles/run.invoker) to the client service account. 4. Verify access by invoking the service endpoint with an identity token.
Deployment workflow follows a strict chronological order: First, the container image must be built from source code and pushed to Artifact Registry so that Cloud Run can access the container bits. Second, the Cloud Run service is created from this container image with unauthenticated invocations disabled. Third, once the service resource exists, an IAM policy binding is attached to grant the specific client service account the `roles/run.invoker` role. Fourth, the deployment is validated by sending an authenticated request using an identity token.

Adım Adım Çözüm

1
Package and register the deployment artifact
A container image stored in Artifact Registry
Cloud Run requires a pre-built container image in a reachable container registry before deployment can commence.
2
Instantiate the Cloud Run service resource
A running, private Cloud Run service with a designated HTTPS URL
Deploying the service creates the target resource needed to attach service-specific IAM access policies.
3
Apply IAM invoker permissions
The client service account is explicitly authorized to invoke the endpoint
Adding the `roles/run.invoker` role via `gcloud run services add-iam-policy-binding` restricts invocation to the authorized identity.
4
Perform end-to-end verification
HTTP 200 OK response from the Cloud Run service endpoint
Sending an HTTP request with an identity token generated for the authorized service account confirms that authentication and authorization function properly.

Anahtar Kavram

Deploying containerized microservices to Cloud Run and managing service-level IAM authentication and invoker roles.
Soru 1156Soru →

An organization uses an automated CI/CD build pipeline running inside a central management project (`ci-build-proj`). The build process executes under a dedicated service account `[email protected]`. During the deployment phase, this pipeline must provision resources in a production project (`prod-scope-proj`) using a production service account `[email protected]`. Corporate security policies mandate that no service account keys can be exported or stored. Which IAM configuration correctly enables `ci-runner` to generate short-lived credentials to act as `prod-deployer` while strictly following the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Grant `[email protected]` the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) directly on the `[email protected]` service account resource.

Cevap

Grant `[email protected]` the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) directly on the `[email protected]` service account resource.
To enable short-lived credentials and service account impersonation without key exports, the executing principal (the build runner service account) must be granted the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) directly on the target service account's IAM resource policy.

Adım Adım Çözüm

1
Identify the source identity attempting impersonation and the target identity being impersonated.
Source identity: `[email protected]`. Target identity: `[email protected]`.
IAM role bindings for impersonation must be placed on the target service account resource granting access to the source principal.
2
Determine the required predefined IAM role for generating short-lived OAuth tokens.
The `roles/iam.serviceAccountTokenCreator` (Service Account Token Creator) role provides the required permissions to mint short-lived credentials.
`roles/iam.serviceAccountUser` only allows attaching a service account to a GCP workload, whereas creating tokens to act as the service account requires `roles/iam.serviceAccountTokenCreator`.
3
Apply the principle of least privilege by scoping the binding to the target service account resource.
The IAM policy binding is applied directly to `[email protected]` rather than at the project level.
Scoping access to the specific service account resource prevents granting unnecessary permissions over other service accounts in the project.

Anahtar Kavram

Service Account Impersonation via Service Account Token Creator
Soru 1157Soru →

A cloud engineer needs to deploy a Cloud SQL PostgreSQL instance named 'prod-db' in a custom Virtual Private Cloud (VPC) named 'app-vpc'. Security policies require that the database is accessible strictly using a Private IP address without any public IP assigned. What is the correct sequence of steps required to set up Private Services Access and provision the instance?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of steps is: 1) Reserve an internal IP range in the VPC using the VPC_PEERING purpose flag, 2) Establish a private connection to Google services via service peering, 3) Provision the Cloud SQL instance specifying the VPC network and disabling public IP assignment, and 4) Connect from an internal VM within the VPC to initialize database schemas.
To deploy a Cloud SQL instance with Private IP, Google Cloud requires setting up Private Services Access first. This involves reserving an internal IP address block in the VPC network (using purpose=VPC_PEERING), creating a VPC peering connection to the service producer network using gcloud services peered-connections create, provisioning the database instance with the --network and --no-assign-ip flags, and finally accessing the database from internal compute instances within the same VPC.

Adım Adım Çözüm

1
Allocate an IP range for VPC peering.
A dedicated IP range is reserved for Private Services Access in 'app-vpc'.
Google Cloud requires an allocated IP range before a VPC peering connection can be configured for managed services.
2
Create the private services connection.
Peering is established between 'app-vpc' and Google's service producer VPC network.
Cloud SQL Private IP relies on VPC Network Peering established through the Service Networking API.
3
Create the Cloud SQL instance with private IP only.
The Cloud SQL instance is provisioned into the peered service network with an IP from the allocated range.
The --network flag binds the instance to the VPC, while --no-assign-ip prevents public IP exposure.
4
Access and configure the database from an internal compute resource.
Database schemas and users are configured securely over private IP connectivity.
Post-provisioning configuration can only occur once the database instance is fully deployed and accessible on the VPC.

Anahtar Kavram

Configuring Private IP Connectivity for Cloud SQL using Private Services Access
Soru 1158Soru →

A cloud engineer needs to gather operating system memory (RAM) utilization metrics from a Compute Engine virtual machine instance. Which agent recommended by Google Cloud should be installed on the virtual machine instance to collect these telemetry metrics?

Cevabı ve açıklamayı göster

Cevap: The Google Cloud Ops Agent

Cevap

The Google Cloud Ops Agent is the recommended agent to collect memory utilization and system telemetry from Compute Engine virtual machines.
The Google Cloud Ops Agent is Google Cloud's primary unified agent for capturing system metrics (such as RAM and disk usage) and application logs directly from Compute Engine virtual machines.

Adım Adım Çözüm

1
Identify the telemetry requirement
System memory metrics require guest OS level access on a Compute Engine VM.
Hypervisors cannot inspect guest OS memory details without an agent installed inside the VM.
2
Select the appropriate software agent
Choose the Google Cloud Ops Agent.
The Google Cloud Ops Agent combines logging and metric collection into a single, unified agent for Compute Engine.

Anahtar Kavram

Google Cloud Ops Agent Telemetry Collection
Soru 1159Soru →

A Cloud Engineer must configure system telemetry for a fleet of Compute Engine virtual machines (VMs) to ingest custom application logs and capture system-level metrics, such as RAM/memory utilization, which are not collected by default compute hypervisor metrics. The implementation must follow Google Cloud security best practices regarding agent selection and least-privilege access control for telemetry collection. Which TWO actions should the Cloud Engineer perform?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Install and configure the unified Google Cloud Ops Agent on each Compute Engine VM instance.; Grant the service account attached to the VM instances the predefined Monitoring Metric Writer (`roles/monitoring.metricWriter`) and Logs Writer (`roles/logging.logWriter`) IAM roles.

Cevap

The correct actions are installing the unified Google Cloud Ops Agent on each VM instance and granting the VM's service account the predefined Monitoring Metric Writer and Logs Writer IAM roles.
To collect extended VM metrics (like RAM/memory utilization) and application logs, the unified Google Cloud Ops Agent must be installed on the instances. To permit telemetry submission under least privilege, the attached service account requires the predefined `roles/monitoring.metricWriter` and `roles/logging.logWriter` roles.

Adım Adım Çözüm

1
Identify the recommended GCP telemetry collection agent for Compute Engine VMs.
Selected the unified Google Cloud Ops Agent, which handles both logging and extended system metrics like memory usage.
Legacy Stackdriver Monitoring and Logging agents are deprecated and should not be deployed for new operations.
2
Determine the necessary IAM roles for publishing telemetry to Cloud Operations suite.
Assigned `roles/monitoring.metricWriter` and `roles/logging.logWriter` to the service account.
Predefined roles strictly enforce least-privilege access control compared to broad primitive roles like Editor or Owner.

Anahtar Kavram

Unified Ops Agent deployment and least-privilege telemetry IAM role assignment
Soru 1160Soru →

A cloud administrator needs to monitor system memory (RAM) usage and disk space utilization on a fleet of Compute Engine virtual machines (VMs). By default, these OS-level metrics are not visible in Cloud Monitoring. Which agent should be installed on the virtual machines to collect these telemetry metrics?

Cevabı ve açıklamayı göster

Cevap: The unified Google Cloud Ops Agent

Cevap

The unified Google Cloud Ops Agent should be installed on the Compute Engine virtual machines.
The unified Google Cloud Ops Agent is the official agent designed to collect guest OS metrics (like RAM and disk space usage) as well as logs from Compute Engine virtual machines.

Adım Adım Çözüm

1
Identify the required telemetry data type.
The requirement calls for guest operating system metrics (memory and disk usage) from Compute Engine VMs.
Hypervisor-level monitoring only captures CPU and network metrics by default; memory metrics require in-guest telemetry gathering.
2
Select the current Google Cloud recommended solution for guest telemetry.
The Ops Agent combines system metric collection and log ingestion into a single daemon.
Google Cloud recommends the Ops Agent as the modern standard over older legacy agents.

Anahtar Kavram

Compute Engine OS Telemetry Collection via Google Cloud Ops Agent
ÖncekiSayfa 58 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin