Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 101Soru →

A DevOps team is configuring an automated script that needs to enable Google Cloud service APIs on demand across new workload projects. The script executes the command `gcloud services enable vision.googleapis.com`. Following the principle of least privilege, which predefined IAM role should be granted to the identity executing this script?

Cevabı ve açıklamayı göster

Cevap: Service Usage Admin (roles/serviceusage.serviceUsageAdmin)

Cevap

Service Usage Admin (roles/serviceusage.serviceUsageAdmin)
The Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) provides the exact permissions required (`serviceusage.services.enable`) to enable and manage APIs within a target Google Cloud project while adhering to the principle of least privilege.

Adım Adım Çözüm

1
Identify the required operation
The automated script needs to enable Cloud Service APIs using `gcloud services enable`.
Enabling APIs requires the specific IAM permission `serviceusage.services.enable`.
2
Evaluate roles based on the principle of least privilege
The predefined role `roles/serviceusage.serviceUsageAdmin` provides permissions to enable and disable services without granting excessive privileges over unrelated GCP resources.
Primitive roles like Owner or broad organization-level roles grant unnecessary admin access.

Anahtar Kavram

Least privilege IAM role selection for enabling Google Cloud service APIs
Soru 102Soru →

A software team needs to run a lightweight event-driven code snippet in Python whenever a new file is uploaded to a Cloud Storage bucket. The execution takes only a few seconds, and the team wants to deploy raw source code directly without managing container images or underlying infrastructure. Which Google Cloud compute service should they choose?

Cevabı ve açıklamayı göster

Cevap: Cloud Functions

Cevap

Cloud Functions is the best serverless choice for executing lightweight, event-driven code in response to Cloud Storage events without container management.
Cloud Functions provides a serverless execution environment designed specifically to run event-driven code in response to Cloud Storage triggers, allowing deployment of source code directly with zero container maintenance.

Adım Adım Çözüm

1
Identify the key operational requirements
The scenario requires executing short-lived Python code triggered by Cloud Storage file uploads without creating container images.
Understanding operational constraints helps determine the exact serverless compute paradigm needed.
2
Compare serverless execution models
Cloud Functions accepts raw code directly and natively integrates with Cloud Storage event triggers, whereas Cloud Run requires containerized deployments.
Matching GCP service features to developer workflow preferences minimizes operational overhead.

Anahtar Kavram

Selecting Cloud Functions for lightweight event-driven snippets vs Cloud Run for containerized applications.
Soru 103Soru →

A data engineering team is preparing to deploy an internal stateful batch processing application to Google Kubernetes Engine (GKE). The application requires specific Linux kernel parameter modifications via sysctl settings on the underlying node OS to achieve optimal network socket throughput. Furthermore, the batch processing job cannot tolerate sudden node terminations or interruptions during its multi-hour execution window. Which deployment configuration should the cloud engineer implement to satisfy these technical requirements?

Cevabı ve açıklamayı göster

Cevap: Provision a GKE Standard cluster with a node pool composed of standard (on-demand) Compute Engine virtual machines, and configure the required sysctl kernel parameters on the node pool.

Cevap

Provision a GKE Standard cluster using a standard on-demand node pool where sysctl kernel tuneables can be configured.
GKE Standard provides full operational control over node pools, enabling custom Linux sysctl kernel tuning needed for specific network performance profile requirements. Additionally, standard on-demand virtual machines ensure that long-running stateful batch workloads run without unexpected termination.

Adım Adım Çözüm

1
Evaluate cluster mode operational boundaries
GKE Autopilot locks down underlying node OS configurations and restricts custom sysctl kernel parameters, whereas GKE Standard supports custom node configuration.
The workload specifically requires custom sysctl kernel modifications on the host node OS.
2
Evaluate node provisioning type for workload fault tolerance
Spot VMs are subject to sudden preemption, which breaks uninterrupted multi-hour execution required for this stateful workload.
Standard on-demand VMs guarantee continuous execution without preemption risk.
3
Select optimal combination
GKE Standard with standard on-demand Compute Engine node pool meets both the sysctl customization and zero-preemption requirements.
This configuration satisfies all technical constraints while keeping infrastructure reliable.

Anahtar Kavram

GKE Standard vs Autopilot cluster capabilities and node pool VM instance suitability
Tahmini Süre:2m 0s
Soru 104Soru →

Your organization plans to migrate a legacy high-throughput network monitoring containerized application to Google Cloud. The application requires custom Linux sysctl kernel tuning on the host nodes to optimize network buffer sizes and low-level packet processing. Additionally, the workload requires predictable performance without unexpected host terminations, while utilizing Kubernetes container orchestration for deployment and auto-healing. Which Google Cloud compute strategy should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy the application on Google Kubernetes Engine (GKE) Standard using node pools configured with custom node system configurations.

Cevap

Deploy the application on Google Kubernetes Engine (GKE) Standard using node pools configured with custom node system configurations.
Google Kubernetes Engine (GKE) Standard allows system administrators to supply custom node system configurations (including sysctl parameters) to node pools while supporting standard, non-preemptible Compute Engine instances for predictable uptime.

Adım Adım Çözüm

1
Analyze workload constraints and technical requirements.
Identified requirements: Container orchestration, custom host OS kernel tuning (sysctl), and predictable availability without unexpected interruptions.
Evaluating infrastructure flexibility versus management overhead narrows down valid compute options.
2
Evaluate serverless and fully managed container options (Cloud Run and GKE Autopilot).
Cloud Run and GKE Autopilot abstract node management and enforce strict security boundaries that prohibit custom host kernel modifications.
Fully managed environments lock down the host kernel for security and multi-tenancy stability.
3
Evaluate node provisioning options for GKE Standard (Spot VMs vs standard Compute Engine instances).
GKE Standard supports custom node system configurations for sysctl tuning. Standard instances guarantee non-preemptible execution, whereas Spot VMs risk unexpected terminations.
Spot VMs are designed for fault-tolerant batch workloads and violate predictable availability requirements.

Anahtar Kavram

Planning Compute Engine and GKE infrastructure based on kernel customization and fault-tolerance trade-offs.
Soru 105Soru →

An organization manages its Google Cloud resources using the hierarchy: Organization -> Finance Folder -> Analytics Project. A compliance auditor requires read-only access strictly to resources inside the Analytics Project. However, a junior administrator previously granted the user the Viewer role (roles/viewer) at the Finance Folder level. When you try to restrict access by removing the Viewer role binding specifically on the Analytics Project, the user can still view all resources in the project. Which fundamental rule of the Google Cloud resource hierarchy explains this behavior, and what is the proper action to enforce the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: IAM policy evaluation is additive down the resource hierarchy and permissions granted at a parent node cannot be revoked at a child node; you must remove the role at the folder level and grant a predefined role on the project.

Cevap

IAM policy evaluation is additive down the resource hierarchy, meaning permissions granted at a parent node (Folder) are inherited by child nodes (Project) and cannot be revoked at the child level. To restrict access to a single project, the role must be revoked at the folder level and granted directly on the target project.
In Google Cloud IAM, policy inheritance is effective and additive down the resource hierarchy. Any role granted at a parent node (such as a Folder) is inherited by all child resources (such as Projects). Child nodes cannot revoke or subtract permissions granted higher up. Therefore, to ensure the compliance auditor only has access to the single project, the broad role must be removed at the folder level and assigned directly at the project level.

Adım Adım Çözüm

1
Analyze how IAM permissions flow in the GCP resource hierarchy.
Identify that policies are inherited additively from Organization -> Folder -> Project -> Resource.
Permissions granted at higher levels automatically apply to all child resources contained within that parent scope.
2
Determine why removing the role at the project level failed to restrict access.
Realize that child policy bindings can only add permissions, never subtract or negate inherited permissions from parent nodes.
Inheritance cannot be blocked or revoked at lower levels in standard IAM policy binding.
3
Formulate the correct administrative remediation to achieve least privilege.
Revoke the broad Viewer role at the Finance Folder level, then grant the necessary predefined role specifically on the Analytics Project.
Scoping IAM roles to the precise target resource prevents unintended access across sibling projects in the folder.

Anahtar Kavram

Resource Hierarchy IAM Policy Inheritance and Least Privilege
Tahmini Süre:2m 0s
Soru 106Soru →

An enterprise company is planning to migrate two distinct workloads to Google Compute Engine. Workload 1 is a mission-critical relational database that runs continuously 24/7, requires 128 vCPUs and 512 GB RAM, and cannot tolerate unexpected terminations. Workload 2 is a batch data processing job that runs overnight, is designed to resume from checkpoints if interrupted, and needs to be executed as cost-effectively as possible. Which resource allocation and provisioning strategy aligns with Google Cloud recommended practices?

Cevabı ve açıklamayı göster

Cevap: Provision standard compute instances with Committed Use Discounts (CUDs) for Workload 1, and use Spot VMs for Workload 2.

Cevap

Provision standard compute instances with Committed Use Discounts for the continuous stateful workload, and use Spot VMs for the fault-tolerant batch processing workload.
The option recommending Committed Use Discounts for the 24/7 mission-critical database and Spot VMs for the checkpoint-enabled batch processing job correctly pairs workload fault tolerance with Google Cloud pricing models. Committed Use Discounts reduce costs for predictable 24/7 compute usage without preemption risk, while Spot VMs minimize batch costs for workloads that handle interruptions gracefully.

Adım Adım Çözüm

1
Analyze the requirements and fault tolerance of Workload 1.
Workload 1 runs 24/7, requires dedicated memory/CPU scale, and cannot tolerate interruptions.
Stateful database workloads require predictable availability, making Spot or Preemptible instances unsuitable.
2
Evaluate discounting models for steady-state workloads.
Committed Use Discounts (CUDs) provide up to 57% (or 70% for memory-optimized) savings for predictable continuous usage over a 1-year or 3-year term.
Because Workload 1 runs continuously, committing to vCPU and memory resource usage maximizes cost savings without compromising instance stability.
3
Analyze the requirements and fault tolerance of Workload 2.
Workload 2 is a batch process that can resume from checkpoints if interrupted.
Stateless or checkpoint-enabled batch jobs can tolerate preemption, making them ideal candidates for Spot VMs, which offer 60-91% discounts compared to standard pricing.

Anahtar Kavram

Selecting Compute Engine machine provisioning models and discounting strategies based on workload availability demands and fault tolerance.
Soru 107Soru →

An enterprise developer needs to migrate a legacy web service to a Google Cloud serverless platform. The application is packaged as a custom Docker container image containing compiled C++ binaries and system-level C libraries. The service handles HTTP requests that can each take up to 45 minutes to process. To optimize cost efficiency during peak traffic, each deployed compute instance must handle up to 80 concurrent HTTP requests simultaneously, while scaling down completely to zero instances during idle periods with zero underlying server maintenance. Which Google Cloud compute solution best satisfies these architectural requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy the containerized application to Cloud Run, configuring instance concurrency to 80 and setting the HTTP request timeout to 45 minutes.

Cevap

Deploy the containerized application to Cloud Run, configuring instance concurrency to 80 and setting the HTTP request timeout to 45 minutes.
Deploying the containerized application to Cloud Run satisfies all constraints. Cloud Run allows running arbitrary container images with custom C++ binaries, supports setting HTTP request execution timeouts up to 60 minutes (exceeding the required 45 minutes), allows configuring instance concurrency to handle multiple requests (80) per container instance, scales down to zero when no traffic arrives, and eliminates infrastructure management overhead.

Adım Adım Çözüm

1
Evaluate runtime container requirements
The application requires custom C++ binaries and system dependencies, which necessitates an arbitrary container image execution environment.
Cloud Run is designed to run any standard container image (OCI-compliant), providing full control over binaries, OS libraries, and runtime environment.
2
Evaluate execution time constraints
The workload requires a request timeout of up to 45 minutes.
Cloud Run supports HTTP request timeouts up to 60 minutes (3600 seconds), whereas Cloud Functions 1st gen maxes out at 9 minutes.
3
Evaluate concurrency and scaling requirements
Each instance must process up to 80 requests simultaneously and scale to zero when idle.
Cloud Run supports multi-concurrency (up to 1000 concurrent requests per container instance) and automatically scales instances down to zero when traffic stops.

Anahtar Kavram

Selecting Cloud Run versus Cloud Functions based on containerization, concurrency, and request execution timeout requirements.
Soru 108Soru →

A financial analytics company is designing the infrastructure on Google Cloud to support two distinct internal services. Service 1 is a non-standard stateless data transformation microservice requiring 3 vCPUs and 20 GB of memory. Service 2 is a large-scale batch simulation job that is fully fault-tolerant, stateless, and capable of resuming interrupted tasks from intermediate checkpoints. Which TWO compute resource planning strategies should you recommend to minimize compute costs while meeting operational requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Provision Custom Machine Types for Service 1 to match the precise vCPU and memory ratio without paying for unused predefined resources.; Provision Spot Virtual Machines (VMs) for Service 2 to run the fault-tolerant batch simulation workload at significant cost savings.

Cevap

The correct recommendations are to provision Custom Machine Types for the non-standard microservice and to use Spot Virtual Machines for the fault-tolerant batch simulation job.
Custom Machine Types allow precise vCPU and memory sizing for non-standard workload ratios to avoid over-provisioning unused resources. Spot Virtual Machines deliver maximum cost savings for stateless, fault-tolerant batch workloads that can tolerate unexpected interruptions.

Adım Adım Çözüm

1
Analyze the requirements for Service 1 (3 vCPUs and 20 GB RAM).
Standard machine types follow fixed vCPU-to-RAM ratios (e.g., n2-standard-4 has 4 vCPUs and 16 GB RAM). To get 20 GB RAM using predefined types, one would have to over-provision vCPUs.
Custom Machine Types permit granular allocation of vCPUs and memory tailored to specific application requirements, optimizing costs.
2
Analyze the requirements for Service 2 (fault-tolerant batch simulation job).
Since the batch job can handle interruptions and resume from checkpoints, high availability is not required.
Spot VMs offer steep discounts for compute instances that can be reclaimed by Compute Engine at any time, making them ideal for batch processing.
3
Evaluate and eliminate incorrect distractor strategies.
Stateful databases cannot risk sudden Spot terminations, and Spot VMs are not eligible for Sustained Use Discounts.
Prevents anti-patterns in Compute Engine workload planning.

Anahtar Kavram

Compute Engine Machine Types & Provisioning Models
Soru 109Soru →

Your enterprise organization is preparing a new Google Cloud project `prod-ml-app-402` to host an automated image processing pipeline. You need to enable the Cloud Vision API (`vision.googleapis.com`) using the `gcloud` CLI while following Google Cloud security and operational best practices. In what logical sequence should you perform the configuration, authorization, enablement, and verification steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The proper sequence starts with setting the target project context in gcloud CLI, verifying that the deploying identity possesses the Service Usage Admin role, executing the API enablement command for vision.googleapis.com, and finally running a list command to verify that the service status is enabled.
The correct operational sequence mandates establishing the target project context in gcloud CLI first to avoid misconfiguration across environments. Next, administrative IAM authorization must be confirmed using the specific predefined role required for API management (Service Usage Admin). Once authorized within the correct context, the gcloud services enable command initiates API activation. Finally, operational state verification using gcloud services list ensures that the API endpoint is fully active before application deployment.

Adım Adım Çözüm

1
Set project context
Local CLI environment is bound to prod-ml-app-402
Prevents targeting the wrong project or inheriting unintended environment defaults.
2
Check/Grant IAM permissions
Operating principal holds roles/serviceusage.serviceUsageAdmin
Required least-privilege predefined role to modify API enablement states on the project.
3
Run service enablement
vision.googleapis.com state is updated to enabled
Activates the specific service endpoint in Service Usage API for the designated project.
4
Validate enabled service state
CLI output confirms vision.googleapis.com is active
Ensures complete propagation of enablement before application workloads attempt API requests.

Anahtar Kavram

API Enablement Workflow and Privilege Scoping using gcloud CLI
Soru 110Soru →

Your team is deploying a serverless data processing application in a Google Cloud project named proj-data-pipeline. The application requires access to the BigQuery API (bigquery.googleapis.com), but execution fails because the API has not been enabled for the project. Following Google Cloud best practices and the principle of least privilege, which IAM role should you assign to the cloud administrator, and which command must they execute using the Google Cloud CLI to enable the API?

Cevabı ve açıklamayı göster

Cevap: Grant the administrator the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) on proj-data-pipeline, and execute gcloud services enable bigquery.googleapis.com --project=proj-data-pipeline.

Cevap

Grant the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) to the administrator for proj-data-pipeline, and run gcloud services enable bigquery.googleapis.com --project=proj-data-pipeline.
Enabling a Google Cloud API requires the serviceusage.services.enable permission, which is provided by the predefined Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Executing gcloud services enable bigquery.googleapis.com --project=proj-data-pipeline explicitly enables the service on the designated project while maintaining least privilege.

Adım Adım Çözüm

1
Identify the required predefined IAM role for API enablement following least privilege principles.
The predefined role roles/serviceusage.serviceUsageAdmin grants permissions to enable, disable, and inspect APIs without granting full primitive administrative access.
Using predefined roles avoids over-granting permissions such as roles/owner or roles/editor.
2
Determine the correct command structure using the Google Cloud CLI.
The standard command to enable a service API is gcloud services enable <SERVICE_NAME>.
Service enablement is managed under the gcloud services command group.
3
Ensure the target project context is explicitly specified.
Adding --project=proj-data-pipeline ensures the operation applies strictly to the target project.
APIs are enabled per-project, so the correct project context must be specified if not set in default gcloud configuration.

Anahtar Kavram

Enabling Cloud Service APIs using gcloud CLI and least privilege IAM roles
Tahmini Süre:2m 0s
Soru 111Soru →

An enterprise is planning to migrate a critical, stateful relational database workload to Google Cloud Compute Engine. The database requires persistent storage, continuous uptime, and predictable performance without abrupt shutdowns. Which Compute Engine resource planning strategy should you select?

Cevabı ve açıklamayı göster

Cevap: Deploy the database on standard Compute Engine N2 instances using persistent disks and apply Committed Use Discounts for cost optimization.

Cevap

Deploy the database on standard Compute Engine N2 instances using persistent disks and apply Committed Use Discounts for cost optimization.
Standard Compute Engine instances provide guaranteed resource availability and continuous execution necessary for stateful database workloads. Combining standard instances with persistent disks and Committed Use Discounts (CUDs) fulfills SLA requirements while optimizing costs for predictable, long-running compute workloads.

Adım Adım Çözüm

1
Analyze workload requirements
The workload is a stateful database requiring uninterrupted operations and persistent storage.
Databases cannot tolerate unexpected terminations without risking data corruption or downtime.
2
Evaluate VM machine options and lifecycle settings
Standard instances (non-preemptible/non-Spot) guarantee uptime availability and support persistent disks.
Spot VMs are subject to abrupt preemption and should only be used for fault-tolerant batch workloads.
3
Select cost optimization strategy suitable for steady-state workloads
Committed Use Discounts offer significant savings for predictable continuous usage.
Committed Use Discounts provide price reductions for steady-state workloads without risking instance availability.

Anahtar Kavram

Planning Compute Engine Instance Types and Lifecycle for Stateful Workloads
Soru 112Soru →

Your organization needs to deploy a stateless REST API packaged as a custom Docker container image containing a legacy C++ binary dependency. The API must scale down to zero instances during idle periods to minimize costs and be capable of processing up to 80 concurrent HTTP requests per container instance. Which Google Cloud serverless compute option should you recommend?

Cevabı ve açıklamayı göster

Cevap: Cloud Run

Cevap

Cloud Run is the correct choice because it natively executes custom stateless container images with non-standard binary dependencies, supports multi-request concurrency per instance, and scales down to zero when idle.
Cloud Run is a fully managed serverless platform built to run stateless container images that listen for web requests. It natively accommodates custom C++ binaries built into the container, handles request concurrency (such as 80 concurrent requests per container instance), and automatically scales down to zero instances when no traffic is present.

Adım Adım Çözüm

1
Identify workload constraints and architectural requirements
The requirements specify a custom Docker container image, legacy compiled C++ library dependencies, 80 concurrent requests per instance, automatic scale-to-zero capability, and a serverless operational model.
Determining the correct compute option requires matching application constraints to GCP platform capabilities.
2
Compare serverless compute options against containerization and concurrency parameters
Cloud Run natively deploys container images containing arbitrary dependencies and allows configuring concurrency up to 1000 requests per instance while scaling to zero during idle times. Cloud Functions is meant for source-code event handlers.
Cloud Run is explicitly designed to bring custom containerized web workloads into a fully managed serverless environment.

Anahtar Kavram

Selecting Cloud Run for containerized serverless workloads with custom binary dependencies and request concurrency.
Soru 113Soru →

An enterprise organization is planning to migrate a stateless HTTP web application to Google Cloud. The application is packaged as a custom Docker container image containing specialized binary dependencies, but it does not require low-level Linux kernel modifications or persistent disk storage. Traffic to the application is highly sporadic with unpredictable volume spikes, and the team requires the solution to scale down to zero instances during idle periods to eliminate unnecessary compute costs. The operations team has strictly mandated that infrastructure and server management overhead must be kept to an absolute minimum. Which GCP compute option should you recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy the application container directly to Cloud Run.

Cevap

Deploy the application container directly to Cloud Run.
Deploying directly to Cloud Run is correct because Cloud Run is a fully managed serverless execution environment designed specifically for stateless HTTP container workloads. It natively accepts custom Docker images, automatically scales to zero when idle to eliminate cost, and requires zero node or cluster management overhead.

Adım Adım Çözüm

1
Analyze workload characteristics and constraints
The workload is a stateless HTTP service packaged in a custom Docker container, requiring zero instance idle scaling and minimal operational management.
Evaluating containerization, traffic patterns, and operational boundaries determines the appropriate GCP compute paradigm.
2
Compare compute platform capabilities against constraints
Cloud Run natively supports custom Docker containers, automatically scales from zero to handle sporadic traffic spikes, and eliminates all server or cluster administration.
Compute Engine MIGs incur OS patching and management overhead, GKE Autopilot introduces Kubernetes manifest management complexity, and Cloud Functions 1st gen lacks flexible custom container support.
3
Identify the optimal compute platform
Cloud Run fulfills all operational and functional constraints with minimal administrative effort and maximum cost efficiency.
Cloud Run is Google Cloud's recommended serverless platform for stateless containerized web applications.

Anahtar Kavram

Selecting and planning GCP compute options based on operational overhead, containerization, and scaling requirements.
Tahmini Süre:2m 0s
Soru 114Soru →

An enterprise organization maintains a Google Cloud resource hierarchy consisting of an Organization node, a top-level Folder named Finance-Dept, a child Folder named Payroll-Apps, and a Project named payroll-prod-db. An Organization Policy enforcing `constraints/compute.vmExternalIpAccess` (restricting external IP creation) is applied at the Finance-Dept folder level. A DevOps Team Lead must be allowed to create and manage new projects inside the Payroll-Apps folder, but must not be granted permissions to modify or delete the Payroll-Apps folder itself. Concurrently, a developer attempts to assign the primitive `roles/owner` role to a service account at the payroll-prod-db project level to allow Compute Engine instances to receive external IPs. Which statement correctly describes the administrative permission scoping and policy inheritance behavior across this hierarchy?

Cevabı ve açıklamayı göster

Cevap: Granting roles/resourcemanager.projectCreator at the Payroll-Apps folder level allows project creation within that folder without allowing folder modification, while the Organization Policy inherited from Finance-Dept prevents external IP creation regardless of project-level roles/owner assignments.

Cevap

Granting roles/resourcemanager.projectCreator at the Payroll-Apps folder level allows project creation within that folder without allowing folder modification, while the Organization Policy inherited from Finance-Dept prevents external IP creation regardless of project-level roles/owner assignments.
The correct option identifies that granting the predefined role Project Creator (`roles/resourcemanager.projectCreator`) at the target folder level permits users to create projects inside that container without giving them rights to edit or delete the folder itself. Furthermore, Organization Policies enforced at parent nodes inherit downward and acts as strict guardrails; IAM role bindings at child resource levels (such as project-level primitive Owner) cannot override parent Organization Policy constraints.

Adım Adım Çözüm

1
Analyze the delegation requirement for project creation under Payroll-Apps folder.
Assigning `roles/resourcemanager.projectCreator` at the `Payroll-Apps` folder scope allows creating child projects inside `Payroll-Apps` without granting `roles/resourcemanager.folderAdmin` or folder edit/delete capabilities on `Payroll-Apps`.
Predefined roles follow the principle of least privilege.
2
Evaluate resource hierarchy inheritance for Organization Policies versus IAM roles.
The Organization Policy restriction `constraints/compute.vmExternalIpAccess` set at `Finance-Dept` inherits down through `Payroll-Apps` to `payroll-prod-db`.
Organization policies establish mandatory restrictions across the hierarchy that inherit down all child nodes.
3
Determine if project-level primitive roles can override parent Organization Policies.
Granting `roles/owner` at the project level grants IAM capabilities within the project, but cannot override or disable an Organization Policy inherited from a parent folder.
IAM permissions grant authority to invoke APIs, but Organization Policies enforce non-negotiable architectural guardrails.

Anahtar Kavram

Google Cloud Resource Hierarchy Inheritance & Organization Policy Enforcement
Tahmini Süre:2m 0s
Soru 115Soru →

A Cloud Engineer needs to enable the Cloud Run API (`run.googleapis.com`) on a newly created Google Cloud project named `app-prod-101` using the `gcloud` command-line interface and verify that it is properly activated. In what order should the engineer execute the following procedural steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps is: 1) Authenticate to Google Cloud CLI using gcloud auth login, 2) Set the active project context using gcloud config set project app-prod-101, 3) Enable the Cloud Run service using gcloud services enable run.googleapis.com, and 4) Confirm activation by running gcloud services list --enabled.
The correct procedural order requires authentication first, followed by establishing the project context, enabling the service API, and finally verifying that the API status is enabled.

Adım Adım Çözüm

1
Authenticate user or service account session
Establishes credentials needed to invoke API management calls.
Without authenticating with sufficient IAM permissions (e.g., Service Usage Admin), subsequent gcloud commands will fail due to lack of authorization.
2
Configure gcloud CLI project property
Sets `app-prod-101` as the default target project for command execution.
The gcloud CLI needs to know which Google Cloud project resource to target for enabling services.
3
Execute API enablement command
Enables the Cloud Run API (`run.googleapis.com`) for the specified project.
`gcloud services enable` sends an API call to Service Usage to activate the API infrastructure.
4
Verify enabled APIs in the project
Filters enabled services and verifies `run.googleapis.com` is present and active.
Auditing enabled services ensures the operational state matches requirements prior to deploying application workloads.

Anahtar Kavram

Managing Google Cloud Service APIs via gcloud CLI
Soru 116Soru →

A company is planning to host a production web application frontend on Google Compute Engine that runs 24/7. Profiling shows the application specifically requires 3 vCPUs and 6 GB of RAM, which does not match any predefined machine type. Which TWO compute planning decisions should the cloud engineer select to meet these requirements cost-effectively while ensuring high availability? (Select TWO answers.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a custom machine type with 3 vCPUs and 6 GB of memory to match the workload requirements.; Purchase Committed Use Discounts (CUDs) for the predictable baseline compute capacity of the 24/7 web application.

Cevap

The correct decisions are to configure a custom machine type tailored to 3 vCPUs and 6 GB of memory, and to purchase Committed Use Discounts for the predictable continuous workload.
Custom machine types allow precise sizing of vCPUs and memory when non-standard ratios are required, avoiding unnecessary costs of larger predefined types. Additionally, Committed Use Discounts are ideal for predictable, steady-state workloads running 24/7.

Adım Adım Çözüm

1
Evaluate machine resource specifications
Identify that 3 vCPUs and 6 GB RAM fit a custom machine type configuration without paying for an over-provisioned predefined machine instance.
Compute Engine custom machine types allow exact sizing when standard predefined instance sizes do not match workload demands.
2
Evaluate pricing model for steady-state 24/7 workload
Apply Committed Use Discounts (CUDs) to lock in lower rates for predictable continuous compute usage.
CUDs provide discounted rates in exchange for a 1-year or 3-year commitment on baseline resource utilization.

Anahtar Kavram

Planning Compute Engine machine sizing with Custom Machine Types and cost optimization using Committed Use Discounts.
Soru 117Soru →

A cloud solution architect is planning Google Cloud compute infrastructure for two separate organizational workloads:

1. A stateless, fault-tolerant batch processing job that can tolerate unexpected node preemptions and requires maximum cost reduction.
2. A lightweight containerized webhook service that experiences intermittent HTTP requests, needs to scale down to zero, and requires zero node management overhead.

Which TWO of the following Google Cloud compute configurations should be recommended for these workloads?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Compute Engine Spot VMs for the stateless batch processing workload; Cloud Run for the containerized HTTP webhook service

Cevap

The correct compute choices are Compute Engine Spot VMs for the stateless batch job and Cloud Run for the containerized webhook service.
Selecting Compute Engine Spot VMs for the batch job leverages maximum cost efficiency for interruption-tolerant processing. Selecting Cloud Run for the containerized HTTP webhook satisfies the need for zero infrastructure node management and automatic scaling to zero when idle.

Adım Adım Çözüm

1
Assess the requirements of the batch processing workload.
The workload is stateless, fault-tolerant, and requires low cost.
Spot VMs offer significantly lower pricing in exchange for compute instances that can be interrupted at any time.
2
Assess the requirements of the HTTP webhook workload.
The service is containerized, intermittent, needs to scale to zero, and requires zero node infrastructure management.
Cloud Run provides a serverless execution environment for containerized applications with automatic scaling to zero and no worker node management.

Anahtar Kavram

Matching Google Cloud compute options (Spot VMs vs Cloud Run vs GKE Standard vs Cloud Functions) to specific workload fault-tolerance, operational overhead, and scaling requirements.
Soru 118Soru →

A system architect is evaluating Google Cloud serverless options for hosting microservices. Which TWO statements accurately describe key characteristics and planning considerations for Cloud Run compared to Cloud Functions?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Cloud Run automatically scales compute instances down to zero when no incoming traffic is detected to minimize costs.; Cloud Run can execute custom binaries and unsupported language runtimes by packaging them inside a container image.

Cevap

The correct statements are that Cloud Run can scale down to zero instances when idle, and Cloud Run can execute custom binaries or unsupported language runtimes by packaging them into container images.
Cloud Run runs stateless containers, enabling developers to package any runtime, library, or binary inside an OCI container image. Additionally, it features automatic scaling, including scaling down to zero instances when inactive to eliminate idle resource charges.

Adım Adım Çözüm

1
Evaluate the scaling features of Cloud Run
Cloud Run supports scaling to zero instances when there are no active requests.
Scaling to zero is a core serverless feature of Cloud Run designed to reduce compute costs for idle applications.
2
Evaluate runtime flexibility between Cloud Run and Cloud Functions
Cloud Run accepts standard container images containing any custom binary or runtime environment.
Cloud Functions requires selecting a supported programming language runtime, while Cloud Run abstracts the runtime inside a container image.

Anahtar Kavram

Planning Serverless Compute Options (Cloud Run vs. Cloud Functions)
Soru 119Soru →

An organization is setting up a new Google Cloud environment from scratch. Arrange the following steps in the correct sequential order to establish the resource hierarchy and prepare a project for application workloads according to Google Cloud best practices.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with provisioning the top-level Organization resource, followed by creating environment Folders beneath it, creating the Cloud Project inside the appropriate Folder, linking an active Billing Account to the Project, and finally enabling Cloud Service APIs and configuring IAM roles.
Google Cloud resources strictly follow a top-down dependency hierarchy: Organization -> Folder -> Project. Operational setup requires establishing the project container, attaching an active billing account, and then enabling project APIs and granting access permissions.

Adım Adım Çözüm

1
Establish the root node of the resource hierarchy.
Provision the Google Cloud Organization resource via Cloud Identity.
The Organization resource is the top-level root node required for folder creation and centralized governance.
2
Create administrative groupings under the root node.
Create environment Folders under the Organization node.
Folders allow administrative isolation and inheritance of policy constraints for child projects.
3
Instantiate the resource container.
Create a Google Cloud Project within the designated Folder.
Projects are child elements of Folders and serve as the physical containers for GCP resources.
4
Attach billing capabilities to the project container.
Link an active Billing Account to the Cloud Project.
Google Cloud requires an active billing attachment before enabling APIs or creating paid billable resources.
5
Configure services and access controls.
Enable required APIs and grant least-privilege IAM permissions on the Project.
Service APIs must be explicitly enabled within a billing-enabled project container before deploying workload resources.

Anahtar Kavram

Google Cloud Resource Hierarchy Provisioning Order
Soru 120Soru →

Your team needs to enable the Cloud Vision API (`vision.googleapis.com`) in a Google Cloud project named `proj-ai-prod` using the `gcloud` CLI while adhering to Google Cloud security and administrative best practices. Which of the following sequences represents the correct order of steps to configure permissions, set project context, activate the service, and verify its status?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps is: 1) Assign the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) to the engineer's identity on project `proj-ai-prod`; 2) Set the active project context in the gcloud CLI by executing `gcloud config set project proj-ai-prod`; 3) Enable the Cloud Vision API by executing `gcloud services enable vision.googleapis.com`; 4) Confirm the API is enabled by executing `gcloud services list --enabled --filter="NAME:vision.googleapis.com"`.
The correct workflow follows standard GCP administration sequence: first authorization, then workspace context initialization, service execution, and status verification. Assigning `roles/serviceusage.serviceUsageAdmin` grants permissions to modify API states. Executing `gcloud config set project proj-ai-prod` explicitly targets the target project. Running `gcloud services enable vision.googleapis.com` enables the service API. Finally, running `gcloud services list --enabled --filter="NAME:vision.googleapis.com"` validates the operational status of the service.

Adım Adım Çözüm

1
Grant requisite IAM access role on the project
The identity receives the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on `proj-ai-prod`
Administrative permissions (`serviceusage.services.enable`) are required before invoking API enablement operations.
2
Set active CLI project context
The gcloud environment targets `proj-ai-prod` as the active project
Prevents accidental modification of incorrect project environments during CLI administration.
3
Execute the API enablement command
The `vision.googleapis.com` service API is enabled for `proj-ai-prod`
Activates the specific service API endpoints required for application workloads.
4
Inspect enabled services list
Output displays `vision.googleapis.com` as active
Provides empirical verification that the API enablement succeeded.

Anahtar Kavram

Enabling Cloud Service APIs via the gcloud CLI requires establishing appropriate IAM roles, targeting the correct project context, executing enablement, and verifying status.
ÖncekiSayfa 6 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin