Tüm alıştırma soruları

An operations engineering team is configuring an application running on a Compute Engine instance to read sensitive configuration data from Secret Manager. Security policies strictly prohibit creating or downloading service account JSON keys. The application runs under the VM instance's service account (`[email protected]`) and must temporarily impersonate a dedicated target service account (`[email protected]`) to retrieve the secrets. Which TWO actions must be completed to grant the minimum necessary permissions for this impersonation setup? (Select TWO.)

A cloud administrator is configuring access for a Google Cloud Storage bucket named `corp-financial-records`. The security policy requires enforcing central governance by activating Uniform Bucket-Level Access (UBLA). A data analyst requires read-only access to the data in this bucket. How should the administrator grant the analyst the required access while adhering to Google Cloud security best practices?

An enterprise application exports daily database dump files into a Google Cloud Storage Standard bucket. Corporate governance mandates that these dump files remain immediately available for audit queries during their first 30 days, after which they are rarely accessed. All dump files must be automatically purged after 365 days. You want to implement an Object Lifecycle Management policy to meet these requirements with minimal operational overhead and optimized storage costs. Which TWO lifecycle rule configurations should you apply? (Select TWO)

An administrator needs to establish resource constraints on a folder named 'Staging'. The requirements state that developers must not be allowed to create external service account keys, and Compute Engine virtual machines in this folder must be restricted from obtaining public IP addresses. Which two Organization Policy constraint configurations directly fulfill these security requirements? (Select TWO.)

An operations team needs to deploy a non-critical, fault-tolerant batch data processing workload on Google Compute Engine. The solution must minimize compute costs and require custom memory usage metrics to be sent to Cloud Monitoring for operational visibility. Which TWO actions should the team take to satisfy these requirements?

A cloud engineer is deploying a Linux Compute Engine instance to host an internal application. The engineer needs to collect operating system-level metrics—specifically detailed RAM/memory usage—and application log files, streaming both to Google Cloud Observability. Which solution aligns with Google Cloud recommended practices for VM telemetry collection and access control?

A Cloud Operations engineer is configuring a new Regional Internal Application Load Balancer in a custom Virtual Private Cloud (VPC) network named `corp-vpc` in the `us-central1` region. The load balancer will distribute internal HTTP traffic across a Compute Engine managed instance group deployed in a workload subnet (`10.1.0.0/24`). Before deploying the backend service and forwarding rule, the engineer needs to establish the underlying networking infrastructure required by Google Cloud for proxy-based internal load balancing. Which TWO networking configuration steps must be performed to meet these requirements?

A cloud engineer needs to deploy a secure web server workload using the Google Cloud CLI (`gcloud`). The architecture requires a dedicated custom-mode Virtual Private Cloud (VPC) network, a custom subnet in the `us-central1` region, an ingress firewall rule allowing HTTP traffic to instances with the network tag `web-server`, and a Compute Engine virtual machine instance provisioned inside the custom subnet. What is the correct sequence of operational steps to deploy this infrastructure from scratch?

An organization requires a third-party security auditor service account to review configuration settings and read log archives stored inside a single designated Cloud Storage bucket (`sec-audit-logs-2026`) located within the `analytics-prod` project. The auditor must not be able to view objects in any other buckets, nor should they have permissions to alter or delete any resources. Following Google Cloud best practices and the Principle of Least Privilege, how should you grant the necessary permissions?

A cloud engineer needs to standardize access management for a new Cloud Storage bucket by enforcing Cloud IAM permissions exclusively across all stored objects and completely disabling individual object-level Access Control Lists (ACLs). Which bucket configuration must the engineer enable to achieve this requirement?

A data engineering team configures an automated script running on a Compute Engine instance to upload daily transaction logs to a Cloud Storage bucket named `fintech-settlements-prod`. To satisfy regulatory compliance, the security team has already enabled Uniform Bucket-Level Access on `fintech-settlements-prod`. During initial testing, the script fails with a HTTP 400 Bad Request error stating that ACLs cannot be set because Uniform Bucket-Level Access is enabled. Inspection of the script reveals it invokes `gcloud storage cp` with the flag `--predefined-acl=bucket-owner-full-control`. How should the team modify the workflow to resolve the upload failure while preserving compliance standards?

What is the correct sequential order of steps required to configure GKE Workload Identity so that an application running in a Kubernetes namespace can access Google Cloud resources using a dedicated Google Service Account (GSA) without relying on static service account keys?

An enterprise manages its Google Cloud infrastructure using a multi-layer resource hierarchy. At the organization root level, an Organization Policy enforces the Domain Restricted Sharing constraint (`constraints/iam.allowedPolicyMemberDomains`) with an allowed list containing Primary Domain Customer ID `C01111111`.

To allow integration with a partner company, a cloud administrator updates the policy for `constraints/iam.allowedPolicyMemberDomains` on the `Partner-Projects` folder by setting `inheritFromParent: true` and adding Customer ID `C02222222` to the allowed list.

A project administrator for `Project-X` (located inside the `Partner-Projects` folder) attempts to perform two separate IAM policy updates on `Project-X`:
1. Granting `roles/storage.admin` to an identity belonging to Customer ID `C01111111`.
2. Granting `roles/storage.admin` to an identity belonging to Customer ID `C03333333`.

Which outcome will occur when the project administrator attempts these IAM role assignments?

An engineer is deploying a custom web microservice named `order-processor` to Google Cloud Run using a container image stored in Artifact Registry (`us-docker.pkg.dev/prod-project/apps/order-processor:v1`). The containerized application is hardcoded to listen for HTTP requests on port `3000`. The service must run using a dedicated service account (`[email protected]`) to follow the principle of least privilege, and it must accept public incoming traffic from third-party webhooks without requiring Google IAM authentication. Which `gcloud` command should you run to deploy the service with these specifications?

A cloud administration team manages a stateless web application deployed across a Managed Instance Group (MIG) in Google Cloud. The team has created a new instance template containing an updated container image for the application. They need to update all virtual machine instances in the group to the new version with zero downtime for end users. Which action should the team take to perform this update?

A cloud engineer needs to deploy a Compute Engine virtual machine named `app-frontend` using the Google Cloud CLI. The VM must be configured to run with a dedicated custom service account to access Google Cloud resources securely. Additionally, the instance requires initial configuration parameters provided via key-value key pairs at boot time. Which flags should the engineer include in the `gcloud compute instances create` command to satisfy these requirements? (Select TWO.)

A cloud solution architect is deploying a custom-mode Virtual Private Cloud (VPC) subnet to host internal Compute Engine virtual machines that do not have public IP addresses assigned. These virtual machines must be able to upload log files directly to a Google Cloud Storage bucket without sending traffic over the public internet or utilizing NAT gateways.

Which configuration must be enabled on the subnet to support this connectivity requirement?

An organization is updating its Cloud Storage operational guidelines to align with corporate data governance standards. The security policy mandates consolidating object access controls under identity and access management policies. Which TWO statements correctly describe the operational behaviors and configuration rules when Uniform Bucket-Level Access (UBLA) is enabled on a storage bucket?

A Cloud Operations engineer is managing networking resources in a Google Cloud Virtual Private Cloud (VPC) network. To audit network traffic for an upcoming security compliance review, the engineer needs to enable VPC Flow Logs on an existing subnet named `sb-analytics` located in the `us-east1` region. The operational policy specifies that the aggregation interval must be set to 5 minutes ($5\text{ min}$) and the sampling rate must capture $50\%$ of traffic ($0.5$). Which `gcloud` command must the engineer execute to correctly update the subnet configuration?

A Cloud Engineer is responsible for verifying the disaster recovery preparedness of a production Cloud SQL for PostgreSQL instance configured with High Availability (HA). The engineer needs to perform a scheduled manual failover test to switch traffic to the standby instance with minimal operational disruption. Which gcloud command should the engineer execute to initiate this test?