Tüm alıştırma soruları

Your enterprise security policy strictly forbids downloading exportable service account keys. You are tasked with provisioning a Compute Engine virtual machine instance in `prod-app-project` that requires read access to a BigQuery dataset located in `prod-analytics-project`. Arrange the administrative actions in the correct chronological sequence to configure and attach a custom service account under least-privilege best practices.

An organization mandates that external deployment pipelines running outside Google Cloud must access Cloud Storage buckets without using downloadable credential keys. A cloud engineer configures Workload Identity Federation to establish trust between the external identity provider and Google Cloud. Which IAM role assignment on the target Google Cloud service account is required to allow the external workload principal to obtain short-lived credentials?

An enterprise organization is deploying a fleet of Compute Engine instances running custom Linux images. The SRE team requires collection of system memory metrics, disk space utilization, and custom application log files stored at `/var/log/app/*.log`. Following Google Cloud recommended practices and the principle of least privilege, which TWO operational actions must be performed to enable telemetry ingestion and authorization?

An operations team monitors a high-throughput IoT analytics platform that streams write traffic to a Cloud Bigtable instance. During peak usage windows, monitoring alerts show that CPU utilization on the Bigtable cluster exceeds 80%, causing significant write latency spikes. The team needs an immediate operational resolution to lower CPU usage and restore low latency without application code modifications or data schema changes. Which action should the Cloud Engineer take?

A Cloud Operations team manages a custom Virtual Private Cloud (VPC) network named `finance-vpc`. A system administrator is tasked with updating an existing ingress firewall rule named `allow-db-ingress` so that it allows incoming TCP traffic on port 5432, targets Compute Engine instances with the network tag `db-node`, and evaluates at a priority level of 200. Additionally, the administrator must verify the updated configuration details using the Google Cloud CLI. Which TWO steps should the administrator take to complete these operations?

An organization operates a custom-mode Virtual Private Cloud (VPC) named `production-vpc`. To adhere to security compliance, an ingress firewall rule named `deny-ssh-global` was created with a priority of `1000` to deny TCP port 22 traffic from source `0.0.0.0/0` across all instances in the VPC. The operations team now requires temporary SSH access to a specific subset of Compute Engine instances tagged with `ops-troubleshoot` from an internal management IP range of `10.50.0.0/20`. How should you configure the new firewall rule to allow this access while leaving the global restriction intact for all other instances?

A cloud engineer needs to provision a single Compute Engine instance named `analytics-worker` in zone `us-east1-b`. The virtual machine must use the `e2-standard-4` machine type, must not have a public IP address assigned, and must execute a local provisioning script stored on the engineer's workstation at `/scripts/bootstrap.sh` when the instance boots up. Which `gcloud` command should the engineer run to deploy this instance?

A system administrator needs to recover a Compute Engine VM instance whose primary boot disk has suffered operating system corruption. The administrator has access to a recent, uncorrupted disk snapshot. What is the correct sequence of steps to restore the instance to operational status using the gcloud CLI while preserving the VM instance identity and IP configurations?

Match each Google Cloud database or persistent disk option on the left with its target technical workload requirement on the right.

You need to provision a Compute Engine virtual machine that requires access to Cloud Storage, following Google Cloud identity best practices. Arrange the administrative steps in the correct logical sequence to create, grant permissions to, and assign a custom service account to the instance.

An application deployed on a Compute Engine virtual machine in a Google Cloud project named `payments-service-prod` requires access to database credentials stored in Secret Manager. The application's service account must be able to read secret payload values at runtime to establish database connections. To meet strict enterprise security guidelines, the service account must not be granted permissions to modify secrets, create new secrets, or access resources in any other projects. Which IAM role binding strategy adheres to the principle of least privilege while fulfilling these requirements?

A Cloud Engineer must configure a Google Cloud Storage bucket storing audit logs to adhere to regulatory compliance standards. The policy mandates that objects must be protected against deletion or modification for three years, and storage costs for logs older than 90 days must be optimized automatically while retaining accessibility. Which TWO actions should the engineer execute to achieve these operational requirements?

An enterprise application hosted on Compute Engine instances in project `telemetry-prod` needs to publish metrics to a Cloud Pub/Sub topic residing in project `shared-monitoring-prod`. To adhere to security directives requiring keyless identity delegation across projects, the source service account `[email protected]` must obtain short-lived credentials for the target service account `[email protected]`. Which IAM configuration correctly enables this cross-project impersonation while following the principle of least privilege?

An application developer needs to access and retrieve configuration secrets stored in Google Cloud Secret Manager for a single project named `prod-config-service`. The developer should be able to read secret values and list secret versions, but must not be allowed to modify secret payloads, delete secret versions, or alter IAM access policies. Additionally, enterprise security policy requires following the principle of least privilege and avoiding unnecessary access across the resource hierarchy. Which IAM role assignment strategy should be implemented?

A Cloud Engineer needs to export Data Access audit logs from a Google Cloud project to a Cloud Storage bucket for long-term compliance storage. Which of the following configuration steps must be performed to successfully setup this log export? (Select TWO.)

An infrastructure administrator needs to enable an external automation tool running on a developer workstation to mint short-lived OAuth 2.0 access tokens for a specific target service account named `[email protected]`. The organization strictly prohibits creating long-lived private key files and mandates enforcing least-privilege access. Which `gcloud` command accurately grants the minimum required permission to the developer user `[email protected]` on the target service account?

A Kubernetes application running on a Google Kubernetes Engine (GKE) cluster requires secure access to objects in a Google Cloud Storage bucket. To follow security best practices and avoid using downloadable service account key files, an engineer must configure Workload Identity. In what sequence should the engineer execute the configuration steps to enable identity delegation for the application?

What is the correct sequential order of administrative steps to configure GKE Workload Identity so that a Pod running in a Kubernetes namespace can access Google Cloud APIs using a dedicated Google Service Account?

A Cloud Operations team is preparing to deploy an update to a mission-critical web application hosted on Google Cloud Run using the gcloud CLI. Company policy requires that newly deployed container revisions must receive zero percent of live customer traffic immediately upon deployment, allowing quality assurance engineers to smoke-test the revision at its dedicated revision URL before shifting production traffic. Which command flag should the team include when executing gcloud run deploy?

A DevOps team is writing a script to automate the deployment of stateless worker virtual machines using the Google Cloud CLI. The Compute Engine instances must meet two specific operational requirements:
1. Execute a local bash script located at `./scripts/setup-worker.sh` during the initial instance startup.
2. Run under a custom service account named `[email protected]` while explicitly granting the instance full access to all Google Cloud APIs.

Which flag configurations should be included in the `gcloud compute instances create` command to satisfy these requirements? (Select TWO options.)