Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 1281Soru →

An infrastructure team needs to modify the service account assigned to a standalone production Compute Engine virtual machine to adhere to the principle of least privilege. The instance is currently running and associated with the default Compute Engine service account. Which sequence of actions should the Cloud Engineer take to attach a newly created custom service account to this existing virtual machine?

Cevabı ve açıklamayı göster

Cevap: Stop the virtual machine instance, execute the gcloud compute instances set-service-account command specifying the custom service account, and start the instance.

Cevap

Stop the virtual machine instance, execute the gcloud compute instances set-service-account command specifying the custom service account, and start the instance.
To update the identity of an existing Compute Engine VM instance, the instance must first be stopped. Once in the TERMINATED state, the gcloud compute instances set-service-account command updates the associated service account. Starting the VM applies the change.

Adım Adım Çözüm

1
Stop the Compute Engine instance using gcloud compute instances stop.
The VM enters the TERMINATED state, freeing up system locks on instance metadata configuration.
Google Cloud requires VMs to be stopped before modifying attached service accounts or access scopes.
2
Run gcloud compute instances set-service-account INSTANCE_NAME --service-account=SA_EMAIL.
The custom service account is successfully attached to the instance metadata configuration.
This updates the identity and identity tokens provided to workloads running inside the VM instance.
3
Start the VM instance using gcloud compute instances start.
The instance boots up using the updated custom service account identity.
Restarting restores operational status with least-privilege IAM permissions enforced.

Anahtar Kavram

Modifying Compute Engine Service Accounts and Least Privilege Administration
Tahmini Süre:1m 30s
Soru 1282Soru →

A lead security engineer is configuring access controls for an internal compliance service that needs to retrieve sensitive API tokens stored in Secret Manager within a specific project named `corp-sec-vault`. The service executes under a dedicated service account named `[email protected]`. The compliance service does not require administrative capabilities, such as creating, updating, or deleting secret metadata. To adhere strictly to Google Cloud security best practices and the principle of least privilege, which IAM configuration should the security engineer apply?

Cevabı ve açıklamayı göster

Cevap: Grant the Secret Manager Secret Accessor role (roles/secretmanager.secretAccessor) to the service account at the `corp-sec-vault` project level.

Cevap

Grant the predefined role Secret Manager Secret Accessor (roles/secretmanager.secretAccessor) to the service account scoped specifically to the target project.
Granting the predefined Secret Manager Secret Accessor role at the project level restricts the service account to only reading secret payloads inside the target project. This satisfies the requirement without exposing administrative controls or granting access to other projects in the resource hierarchy.

Adım Adım Çözüm

1
Identify the specific task requirements and required permission scope
The application only needs to read secret payloads within project `corp-sec-vault` without needing administrative privileges or access to other projects.
Security best practices dictate selecting predefined roles with only necessary permissions over broad primitive roles.
2
Evaluate role types against the principle of least privilege
The predefined Secret Manager Secret Accessor role provides access to secret contents while excluding management operations and non-related GCP service access.
Primitive roles like Editor or Owner grant expansive privileges across the entire project.
3
Select the appropriate resource hierarchy scope for the binding
Binding the role at the project level ensures the service account gains access only within `corp-sec-vault` and not across parent folders or other organizational resources.
IAM permissions assigned at higher levels of the hierarchy inherit downward to all child resources.

Anahtar Kavram

Principle of Least Privilege and Resource Hierarchy Scope in GCP IAM
Tahmini Süre:1m 30s
Soru 1283Soru →

An organization enforces a strict security policy prohibiting the creation and downloading of service account JSON keys. A cloud engineer must run local deployment commands using `gcloud` under the identity of `[email protected]`. The engineer has already been granted the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the service account resource. Which method should the engineer use to execute these commands securely?

Cevabı ve açıklamayı göster

Cevap: Pass the `--impersonate-service-account=deployer@proj-prod-app.iam.gserviceaccount.com` flag or set the `auth/impersonate_service_account` property in `gcloud config`.

Cevap

Configure `gcloud` to use service account impersonation via the `--impersonate-service-account` flag or by setting `auth/impersonate_service_account` in `gcloud config`.
Service account impersonation allows authenticated principals holding the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) to generate short-lived credentials dynamically. Supplying `--impersonate-service-account` in `gcloud` or setting `auth/impersonate_service_account` configures the SDK to transparently request access tokens for the target service account without storing key files.

Adım Adım Çözüm

1
Identify the authentication requirement
The engineer must act as a service account without using long-lived JSON keys.
Security policies strictly forbid service account key downloads.
2
Verify required IAM permissions
The user holds `roles/iam.serviceAccountTokenCreator` on the target service account.
This permission allows minting short-lived OAuth 2.0 access tokens for impersonation.
3
Apply the appropriate gcloud impersonation mechanism
Pass `--impersonate-service-account` with the `gcloud` CLI command or set `gcloud config set auth/impersonate_service_account`.
This instructs `gcloud` to dynamically request short-lived credentials for the target service account.

Anahtar Kavram

Service Account Impersonation via gcloud
Soru 1284Soru →

A cloud administrator needs to deploy a containerized data ingestion service named telemetry-ingest to Google Cloud Run. The container listens on the default port 8080 and must execute under a dedicated, non-default service account named [email protected] to interact securely with backend resources. Which gcloud command should the administrator run to deploy the container image gcr.io/prod-data-project/telemetry-ingest:v1 with the correct identity configuration?

Cevabı ve açıklamayı göster

Cevap: gcloud run deploy telemetry-ingest --image=gcr.io/prod-data-project/telemetry-ingest:v1 --service-account=ingest-worker@prod-data-project.iam.gserviceaccount.com

Cevap

The command 'gcloud run deploy telemetry-ingest --image=gcr.io/prod-data-project/telemetry-ingest:v1 --service-account=ingest-worker@prod-data-project.iam.gserviceaccount.com' correctly deploys the container image while attaching the custom execution service account.
The correct command uses 'gcloud run deploy' with the container image URI and attaches the custom service account email using the '--service-account' flag, matching Cloud Run deployment specifications.

Adım Adım Çözüm

1
Identify the target serverless service type
Since the workload is a pre-built container image, Google Cloud Run is the appropriate serverless compute platform.
Cloud Run natively executes container images, whereas Cloud Functions targets source code functions.
2
Determine the required gcloud command flags for identity configuration
Use the --service-account flag followed by the full service account email address.
Attaching a custom service account adheres to the principle of least privilege for backend GCP resource authorization.
3
Verify default port configuration requirements
Do not pass a custom --port flag if the container already binds to the standard default port 8080.
Cloud Run injects the PORT environment variable (default 8080) into the container container environment.

Anahtar Kavram

Deploying containerized workloads to Cloud Run with custom service account execution identity
Soru 1285Soru →

A cloud engineer needs to deploy a Compute Engine virtual machine instance using a custom image stored in a central image repository project. The VM requires a reserved static internal IP address in a specific target subnet and must be assigned a custom service account. What is the correct sequence of steps to perform this deployment workflow?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of execution is: First, grant the target project service agent `roles/compute.imageUser` access on the central image. Second, reserve the static internal IP address in the target subnet. Third, execute `gcloud compute instances create` with the image URI, reserved internal IP, and custom service account. Fourth, verify the VM state and configuration using `gcloud compute instances describe`.
Cross-project image deployments require establishing IAM permissions prior to instance creation. Granting `roles/compute.imageUser` to the target project's Compute Engine Service Agent authorizes access to the custom image in the central project. Next, reserving the static internal IP in the target subnet ensures the network resource exists. Once these prerequisites are met, running `gcloud compute instances create` provisions the instance with the specified image, network IP, and service account. Finally, verifying with `gcloud compute instances describe` ensures proper deployment.

Adım Adım Çözüm

1
Authorize cross-project image access
Target project service account receives read access to the custom disk image
Compute Engine cannot read disk images across project boundaries without explicit IAM role delegation.
2
Reserve static internal IP address
An internal IP address is allocated within the specified subnet
An existing reserved IP resource is required to attach a static IP during instance creation.
3
Provision the Compute Engine VM
The instance is created and boots from the cross-project image
All authorization and network prerequisites are in place to execute instance provisioning.
4
Inspect instance deployment status
Instance configuration and RUNNING status are confirmed
Executing a describe command validates successful initialization and correct network/IAM metadata attachment.

Anahtar Kavram

Cross-Project Image Provisioning and Static Network Allocation
Soru 1286Soru →

A company manages a Google Cloud resource hierarchy containing an Organization root, a top-level Folder named 'Finance', and a child Project named 'audit-logs-prod'. To enforce data sovereignty compliance, an Organization Policy enforcing the Resource Locations constraint (`constraints/gcp.resourceLocations`) is applied at the 'Finance' Folder level, restricting resource creation strictly to `in:eu-locations`.

A cloud engineer needs to allow the 'audit-logs-prod' project to deploy Cloud Storage buckets in `us-east1` for cross-region disaster recovery testing. The engineer grants the project lead the primitive Owner role (`roles/owner`) on 'audit-logs-prod' and configures the project-level Organization Policy to add `us-east1` to the allowed values list while setting `inheritFromParent: true`. However, bucket creation in `us-east1` continues to fail with an Organization Policy violation error.

What is the root cause of this failure, and how should it be resolved?

Cevabı ve açıklamayı göster

Cevap: The project inherits the parent folder's policy restriction because `inheritFromParent` is set to true; to allow `us-east1`, the project-level Organization Policy must set `inheritFromParent: false` to override the parent list policy and explicitly define the allowed values.

Cevap

The project inherits the parent folder's policy restriction because `inheritFromParent` is set to true; to allow `us-east1`, the project-level Organization Policy must set `inheritFromParent: false` to override the parent list policy and explicitly define the allowed values.
In Google Cloud resource hierarchy policy evaluation, list constraints applied at higher levels (such as a Folder) inherit downward to child projects. When a child project sets `inheritFromParent: true`, it remains bound by the parent's restrictions. To establish a location exception for a specific project under a restricted folder, the child project's Organization Policy must set `inheritFromParent: false` (or explicitly override parent rules) to decouple from the parent folder's list constraint and define its own allowed values list.

Adım Adım Çözüm

1
Analyze how list constraint inheritance works in Google Cloud Organization Policies.
When a parent resource node (Folder) enforces a list constraint restricting allowed values (such as restricting locations to `in:eu-locations`), any child node setting `inheritFromParent: true` evaluates the effective policy as the intersection/combination of rules, keeping the parent's restrictions active.
Setting `inheritFromParent: true` on a child policy does not negate or remove restrictions imposed by parent nodes.
2
Evaluate the relationship between IAM roles and Organization Policy constraints.
Granting IAM roles (such as `roles/owner` or `roles/storage.admin`) grants identity permissions but cannot override or bypass an active Organization Policy constraint.
Organization Policies act as guardrails on resources, taking precedence over IAM user permissions.
3
Determine the necessary configuration change to allow the exception.
To allow `us-east1` in the child project `audit-logs-prod`, the project's Organization Policy rule must set `inheritFromParent: false` (restoring/overriding inheritance) and specify the permitted location list directly.
Disabling parent policy inheritance at the project level breaks the restriction inherited from the 'Finance' folder, allowing the project to define its own allowed location rules.

Anahtar Kavram

Organization Policy List Constraint Inheritance and Override Mechanisms
Soru 1287Soru →

An organization operates a production Cloud SQL for MySQL instance supporting an online web application. During high-traffic events, database storage usage grows rapidly and risks consuming all remaining disk space. The operations team needs to ensure that database storage expands dynamically as data grows without incurring application downtime or requiring manual operational intervention. Which action should the operations team perform to satisfy this requirement?

Cevabı ve açıklamayı göster

Cevap: Enable the Automatic Storage Increase setting directly on the Cloud SQL instance configuration.

Cevap

Enable the Automatic Storage Increase setting directly on the Cloud SQL instance configuration.
Enabling the Automatic Storage Increase feature in Cloud SQL ensures that Google Cloud automatically adds storage space whenever available capacity drops below a critical threshold (such as 10%). This disk expansion is non-disruptive and takes effect while the database instance remains running and accessible.

Adım Adım Çözüm

1
Identify the operational goal and database management requirement.
The goal is to automatically scale storage capacity on a Cloud SQL instance under heavy load without causing downtime.
Cloud SQL manages disk space transparently when appropriate built-in configuration settings are enabled.
2
Evaluate GCP managed database operational features.
Cloud SQL provides a built-in Automatic Storage Increase feature that checks available space and adds storage automatically when free space drops below a threshold (typically 10% of total capacity).
This operation expands disk capacity online without requiring instance restarts or downtime.
3
Select the correct management action.
Enabling Automatic Storage Increase on the Cloud SQL instance configuration meets all operational constraints.
Alternative compute or object storage tools do not manage Cloud SQL relational disk volumes.

Anahtar Kavram

Cloud SQL Storage Management & Automatic Storage Increase
Tahmini Süre:1m 30s
Soru 1288Soru →

An enterprise organization manages a Google Cloud resource hierarchy containing an Organization root node, a Production folder, and a Development folder. At the Organization root level, a Boolean Organization Policy constraint named `constraints/compute.disableGlobalExternalIpAccess` is configured with enforcement enabled (`enforce: true`). The cloud operations team must permit Compute Engine instances within the Development folder to use global external IP addresses, while ensuring the Production folder strictly maintains the prohibition. Furthermore, changes to the organization policy must follow the principle of least privilege. Which TWO actions or policy principles must be applied to achieve this configuration? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an explicit Organization Policy on the Development folder for `constraints/compute.disableGlobalExternalIpAccess` and set `enforce: false` to override the inherited restriction.; Assign the Organization Policy Administrator role (`roles/orgpolicy.policyAdmin`) to the administrator responsible for setting constraints on the resource hierarchy nodes.

Cevap

To allow external IP creation under the Development folder while enforcing restrictions on the Production folder, an explicit Organization Policy with enforcement set to false must be applied to the Development folder to override the inherited parent constraint. Additionally, modifying Organization Policies requires granting the Organization Policy Administrator role (`roles/orgpolicy.policyAdmin`) according to least-privilege administrative standards.
Child resource hierarchy nodes inherit Organization Policy enforcement settings from parent nodes, but an administrator with the `roles/orgpolicy.policyAdmin` role can override inherited Boolean constraints by explicitly setting `enforce: false` on the lower-level node (such as the Development folder).

Adım Adım Çözüm

1
Analyze resource hierarchy inheritance for Organization Policy constraints.
By default, child folders inherit the `enforce: true` setting for `constraints/compute.disableGlobalExternalIpAccess` from the Organization root.
Organization policies propagate down the resource hierarchy unless explicitly overridden at a lower node.
2
Determine how to override a Boolean Organization Policy constraint for a specific child folder.
Setting an explicit Organization Policy on the Development folder with `enforce: false` restores the ability to allocate external IP addresses for projects within that folder without altering the constraint on the Production folder.
Node-level explicit policies override inherited parent policies.
3
Identify the required IAM privilege for managing Organization Policies.
Assign `roles/orgpolicy.policyAdmin` to the administrator modifying the policy.
This predefined role grants exact permissions to manage constraints while upholding the principle of least privilege.

Anahtar Kavram

Organization Policy inheritance evaluation and discrete administrative role delegation
Soru 1289Soru →

A cloud security engineer needs to review Data Access audit logs in Google Cloud Logging to inspect user activity on Cloud Storage objects. Which predefined IAM role must be granted to the security engineer to view these specific logs?

Cevabı ve açıklamayı göster

Cevap: Private Logs Viewer (roles/logging.privateLogViewer)

Cevap

Grant the Private Logs Viewer (roles/logging.privateLogViewer) role.
Data Access audit logs record API calls that create, modify, or read user-provided resource data. Because these logs can expose sensitive resource contents, Google Cloud restricts access to users with the Private Logs Viewer (roles/logging.privateLogViewer) role or specific logging admin permissions.

Adım Adım Çözüm

1
Identify the log type mentioned in the requirement.
The requirement specifies Data Access audit logs.
Data Access audit logs contain detailed resource access data and require elevated log viewing permissions.
2
Select the minimum necessary predefined IAM role for reading Data Access audit logs.
The Private Logs Viewer (roles/logging.privateLogViewer) role allows viewing Data Access audit logs.
The standard Logs Viewer role omits access to Data Access audit logs to protect sensitive resource data.

Anahtar Kavram

Cloud Audit Logs Access Controls and IAM Roles
Tahmini Süre:45s
Soru 1290Soru →

A software engineering team requires access to deploy and manage Cloud Run revisions, as well as create and view builds using Cloud Build within a specific project named `app-dev-proj`. Company security policy requires adhering strictly to the Principle of Least Privilege by granting fine-grained permissions at the project scope rather than assigning primitive roles or granting permissions higher in the resource hierarchy. Which TWO role bindings should the cloud engineer apply to the engineering team? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Assign the Cloud Run Developer role (`roles/run.developer`) at the `app-dev-proj` project level.; Assign the Cloud Build Editor role (`roles/cloudbuild.builds.editor`) at the `app-dev-proj` project level.

Cevap

To follow the Principle of Least Privilege for the specified requirements, the engineer should grant the Cloud Run Developer role (`roles/run.developer`) and the Cloud Build Editor role (`roles/cloudbuild.builds.editor`) scoped directly to the `app-dev-proj` project.
The Cloud Run Developer role (`roles/run.developer`) grants necessary permissions to create and manage Cloud Run revisions and services, while the Cloud Build Editor role (`roles/cloudbuild.builds.editor`) grants permissions to create, view, and manage build requests. Granting both roles at the target project level ensures compliance with the Principle of Least Privilege.

Adım Adım Çözüm

1
Identify the required permissions for managing Cloud Run services and executing Cloud Build tasks.
Cloud Run service management requires `roles/run.developer`, and Cloud Build operations require `roles/cloudbuild.builds.editor`.
Predefined roles target specific operational capabilities without over-granting permissions.
2
Determine the appropriate resource scope for the permissions.
Role bindings must be applied at the `app-dev-proj` project scope.
Granting permissions at the folder level causes permissions to be inherited by all child projects within that folder.
3
Select the correct combination of predefined roles at project scope.
The Cloud Run Developer and Cloud Build Editor roles bound at the project level satisfy all conditions.
This combination adheres strictly to the Principle of Least Privilege.

Anahtar Kavram

Managing IAM Roles and Permissions
Tahmini Süre:1m 30s
Soru 1291Soru →

A security team requires that incoming HTTP (port 80) traffic be allowed strictly to Compute Engine virtual machines that have the `web-server` network tag assigned, within a custom VPC network named `prod-vpc`. The rule must take precedence over default VPC firewall rules (which have a priority of 65534), while leaving priority values below 1000 reserved for future emergency overrides. Which command should a cloud engineer execute to fulfill this requirement?

Cevabı ve açıklamayı göster

Cevap: gcloud compute firewall-rules create allow-web-http --network=prod-vpc --direction=INGRESS --priority=1000 --allow=tcp:80 --target-tags=web-server

Cevap

Execute the command: gcloud compute firewall-rules create allow-web-http --network=prod-vpc --direction=INGRESS --priority=1000 --allow=tcp:80 --target-tags=web-server
In Google Cloud VPC networking, firewall rules determine packet filtering. Priority numbers range from 0 to 65535, where lower numbers have higher precedence. A priority of 1000 ensures the rule evaluates before the default allow/deny rules (priority 65534) and leaves lower priority numbers available for emergency rules. Specifying `--direction=INGRESS`, `--allow=tcp:80`, and `--target-tags=web-server` correctly restricts incoming HTTP traffic to tagged instances.

Adım Adım Çözüm

1
Identify the required network filtering mechanism
GCP Virtual Private Cloud (VPC) Firewall Rules must be used to filter network traffic based on protocols, ports, and network tags.
IAM roles and resource hierarchy policies control control-plane access, not data-plane network packet filtering.
2
Evaluate priority ordering in Google Cloud VPC Firewall Rules
Lower priority numbers represent higher precedence (0 is highest, 65535 is lowest).
Setting the priority to 1000 ensures it evaluates before default rules (priority 65534) while keeping priority range 0–999 open for emergency overrides.
3
Select the proper CLI parameters for ingress traffic filtering
Use '--direction=INGRESS', '--allow=tcp:80', '--target-tags=web-server', and '--network=prod-vpc'.
This precisely restricts inbound web traffic to VM instances matching the specified target tag within the target VPC.

Anahtar Kavram

VPC Firewall Rule Priority and Tag Targeting
Soru 1292Soru →

A Cloud Operations engineer is managing networking resources in a Google Cloud project. An existing Cloud NAT gateway named `prod-nat` is deployed on Cloud Router `prod-router` in region `us-central1` to provide internet access for selected subnets within the `prod-vpc` network. The Cloud NAT gateway is currently configured with manual subnet mapping (`--nat-custom-subnet-option=LIST_OF_SUBNETWORKS`). A new subnet named `analytics-subnet` has been created in `us-central1`. The engineer needs to update `prod-nat` to enable Outbound NAT for the primary IP range of `analytics-subnet` while preserving the NAT configuration for all existing subnets. Which `gcloud` command should the engineer execute to achieve this?

Cevabı ve açıklamayı göster

Cevap: Execute `gcloud compute routers nats update prod-nat --router=prod-router --region=us-central1 --add-subnetworks=analytics-subnet`

Cevap

The correct action is to execute `gcloud compute routers nats update prod-nat --router=prod-router --region=us-central1 --add-subnetworks=analytics-subnet`.
Updating an existing Cloud NAT configuration to include an additional subnet while keeping existing mappings intact requires using `gcloud compute routers nats update` with the `--add-subnetworks` flag. This correctly appends the primary IP range of the specified subnet to the Cloud NAT configuration.

Adım Adım Çözüm

1
Identify the correct gcloud CLI resource path for Cloud NAT operations
Cloud NAT configurations are sub-resources of Cloud Routers, so commands use `gcloud compute routers nats`.
Cloud NAT operates on top of Cloud Router instances in Google Cloud.
2
Select the appropriate flag for appending a subnet to an existing LIST_OF_SUBNETWORKS configuration
The `--add-subnetworks` flag appends specified subnets to the existing Cloud NAT gateway configuration.
Using `--subnetworks` would overwrite the entire existing subnet list, whereas `--add-subnetworks` appends the new subnet safely.
3
Construct and verify the complete gcloud command
The resulting command includes the NAT name (`prod-nat`), Cloud Router name (`--router=prod-router`), region (`--region=us-central1`), and the target subnet (`--add-subnetworks=analytics-subnet`).
All required scoping flags and modification parameters are correctly supplied.

Anahtar Kavram

Cloud NAT Subnet Mapping Management
Tahmini Süre:2m 0s
Soru 1293Soru →

A security engineer is configuring access controls and key management policies for cryptographic keys in Google Cloud KMS. Which TWO of the following statements correctly describe operational practices or resource constraints in Cloud KMS? (Select TWO answers.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Cloud KMS key rings and cryptographic key resources cannot be deleted once created; retiring key material requires disabling or scheduling destruction of key versions.; Granting the Cloud KMS CryptoKey Encrypter/Decrypter role to service accounts enables data encryption and decryption while enforcing separation of duties without granting key management rights.

Cevap

The correct statements are that key rings and cryptographic keys cannot be deleted (retiring key material requires disabling or destroying key versions) and that assigning the Cloud KMS CryptoKey Encrypter/Decrypter role to service accounts enforces separation of duties without granting key management rights.
In Google Cloud KMS, key rings and cryptographic key resources cannot be deleted once created; key retirement is managed strictly by disabling or destroying individual key versions. Furthermore, using predefined roles such as Cloud KMS CryptoKey Encrypter/Decrypter upholds separation of duties by allowing workloads to perform cryptographic operations without granting administrative key management permissions.

Adım Adım Çözüm

1
Evaluate key resource lifecycle rules in Google Cloud KMS.
Recognize that key rings and key resources are permanent and cannot be deleted. Disabling or destroying key versions is the required method for key retirement.
Cloud KMS guarantees resource name immutability to preserve cryptographic audit trails.
2
Assess IAM roles for Cloud KMS operational tasks.
Confirm that predefined roles like Cloud KMS CryptoKey Encrypter/Decrypter grant specific cryptographic capabilities to service accounts without exposing key administrative permissions.
Applying principle of least privilege requires separation of duties between key users and key administrators.
3
Identify misconceptions in wrong choices.
Reject key ring deletion claims, primitive Owner role requirements, and lower-level IAM permission restriction assumptions.
Key rings cannot be deleted, primitive roles violate least privilege, and IAM permissions are strictly additive down the hierarchy.

Anahtar Kavram

Cloud KMS Key Lifecycle and IAM Separation of Duties
Soru 1294Soru →

Your organization plans to enforce uniform security policies across all Google Cloud Storage buckets. You need to transition a bucket currently using fine-grained access control to Uniform Bucket-Level Access without interrupting existing user access. In what sequence should you execute these migration steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins by auditing existing object ACLs, granting equivalent IAM roles at the bucket level, enabling Uniform Bucket-Level Access on the bucket, and finally validating access through log audits and workflow testing.
The correct process mandates auditing existing ACLs first to determine access needs, granting equivalent IAM roles at the bucket level to prevent downtime, enabling Uniform Bucket-Level Access to enforce bucket-wide IAM controls, and verifying post-migration access using audit logs.

Adım Adım Çözüm

1
Audit object ACL permissions on the existing bucket.
Identified all principals relying on fine-grained access control.
Prevents unauthorized access loss by establishing a baseline of required permissions before changing access control models.
2
Assign corresponding bucket-level IAM roles to identified principals.
IAM roles are configured at the bucket level prior to disabling ACLs.
Ensures continuous user access during the transition from ACLs to Uniform Bucket-Level Access.
3
Enable Uniform Bucket-Level Access on the target Cloud Storage bucket.
Fine-grained ACLs are disabled, and authorization relies strictly on IAM policies.
Enforces uniform security across all objects in the bucket as mandated by organizational governance.
4
Perform post-migration verification using logs and application tests.
Confirmed that all application workflows operate cleanly under IAM permissions.
Ensures no residual permission errors exist following the access model migration.

Anahtar Kavram

Migrating fine-grained ACLs to Uniform Bucket-Level Access in Google Cloud Storage
Soru 1295Soru →

A central data operations team is configuring access permissions for a contract analyst. The analyst requires permissions to run SQL query jobs and view dataset contents within a single Google Cloud project named `analytics-prod-883`, without permissions to edit data, delete tables, or manage infrastructure. In accordance with the principle of least privilege, which TWO predefined IAM roles should be granted to the analyst on the `analytics-prod-883` project?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: BigQuery Job User (roles/bigquery.jobUser); BigQuery Data Viewer (roles/bigquery.dataViewer)

Cevap

The contract analyst should be assigned the predefined roles BigQuery Job User (roles/bigquery.jobUser) and BigQuery Data Viewer (roles/bigquery.dataViewer) scoped directly to the target project.
Running queries and viewing dataset contents in BigQuery requires two distinct permissions in GCP IAM: permission to execute jobs within the project and permission to read dataset contents. Assigning BigQuery Job User (roles/bigquery.jobUser) provides job execution access, and BigQuery Data Viewer (roles/bigquery.dataViewer) grants read-only dataset access at the project scope.

Adım Adım Çözüm

1
Identify the required permissions for running queries and reading table data.
The user needs job execution permissions and read-only dataset access.
BigQuery separates job running permissions from data access permissions.
2
Map required permissions to predefined roles that uphold least privilege.
roles/bigquery.jobUser allows creating and running query jobs; roles/bigquery.dataViewer allows reading datasets and tables.
Predefined roles grant only the specific permissions needed for job execution and data viewing.
3
Evaluate resource scope boundaries.
Roles must be granted at the project level analytics-prod-883 rather than at folder/organization scope or using broad primitive roles.
Inheritance from parent folders or using primitive roles grants excessive scope and administrative capabilities.

Anahtar Kavram

Applying least privilege for BigQuery operations using project-scoped predefined roles
Tahmini Süre:2m 0s
Soru 1296Soru →

A cloud administrator manages an existing production Cloud Run service named `reporting-service` in the `us-central1` region. To mitigate cold start latency during morning traffic spikes while ensuring monthly compute costs do not exceed budget, the administrator needs to keep at least 5 warm instances idle and cap maximum scaling at 50 instances. Which `gcloud` command should the administrator execute to update these operational parameters?

Cevabı ve açıklamayı göster

Cevap: gcloud run services update reporting-service --min-instances 5 --max-instances 50 --region us-central1

Cevap

Execute the `gcloud run services update` command specifying the service name, `--min-instances 5`, `--max-instances 50`, and the deployment region.
The correct command uses `gcloud run services update` with `--min-instances 5` and `--max-instances 50`. This properly configures the scaling bounds of an existing Cloud Run service to keep 5 warm instances available while capping total instances at 50.

Adım Adım Çözüm

1
Identify the target Cloud Run management CLI tool
Determine that operational parameter updates to existing Cloud Run services use `gcloud run services update`.
Cloud Run services require specific service-level commands to modify runtime flags such as instance limits.
2
Apply the requested minimum and maximum instance parameters
Append `--min-instances 5` to maintain warm instances and `--max-instances 50` to cap scale-out expansion.
Setting min-instances reduces cold starts while max-instances prevents unintended cost spikes.
3
Specify the regional scope
Include `--region us-central1` to target the specific regional service endpoint.
Cloud Run resources are regional resources and require regional context if not set in defaults.

Anahtar Kavram

Managing Cloud Run scaling parameters and instance limits via gcloud CLI
Soru 1297Soru →

A cloud engineer needs to deploy a fault-tolerant batch processing workload on Compute Engine using the Google Cloud CLI (`gcloud`). The application runs short-lived jobs and must be provisioned on highly discounted, temporary compute capacity that can be reclaimed by Google Cloud at any time. Which `gcloud compute instances create` command correctly provisions the virtual machine instance with this capability?

Cevabı ve açıklamayı göster

Cevap: gcloud compute instances create batch-worker-1 --zone=us-central1-a --provisioning-model=SPOT

Cevap

The command using `gcloud compute instances create batch-worker-1 --zone=us-central1-a --provisioning-model=SPOT` is correct because `--provisioning-model=SPOT` is the standard gcloud CLI flag to request Spot VM capacity on Compute Engine.
The correct command specifies `--provisioning-model=SPOT`. Spot VMs are highly discounted compute instances that can be reclaimed by Compute Engine when resources are needed elsewhere, making them ideal for fault-tolerant batch workloads.

Adım Adım Çözüm

1
Identify the workload requirements
The workload is fault-tolerant and requires temporary, discounted capacity that can be preempted.
Spot VMs provide lower-cost compute capacity suitable for batch and fault-tolerant jobs.
2
Determine the proper Google Cloud CLI flag for Spot VM provisioning
The `--provisioning-model=SPOT` flag explicitly instructs Compute Engine to create a Spot VM.
Compute Engine uses the `--provisioning-model` flag (or legacy `--preemptible`) to specify instance scheduling behavior.

Anahtar Kavram

Provisioning Spot Compute Engine Virtual Machines via gcloud
Soru 1298Soru →

A cloud security engineer needs to transition a legacy Cloud Storage bucket containing audit logs from fine-grained Access Control Lists (ACLs) to Uniform Bucket-Level Access (UBLA) without disrupting active applications or causing permission denials. In what correct chronological sequence should the engineer execute the following operational steps to safely enforce bucket-level access control?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational order is: 1) Audit existing object-level and bucket-level ACLs to identify all access requirements, 2) Map discovered ACL permissions to equivalent Cloud Storage predefined IAM roles, 3) Apply the mapped IAM role bindings to the target bucket, and 4) Enable Uniform Bucket-Level Access (UBLA) on the Cloud Storage bucket.
The migration process requires discovering existing access rules, translating them into IAM role assignments, granting those IAM roles at the bucket level, and finally toggling Uniform Bucket-Level Access. This guarantees zero service interruption while enforcing uniform security governance.

Adım Adım Çözüm

1
Inventory current bucket access requirements.
Identified all users, groups, and service accounts currently relying on ACL entries.
Without auditing first, enabling UBLA would immediately break access for principals who rely solely on object-level ACLs.
2
Translate object ACLs into bucket-level predefined IAM roles.
Created a deterministic mapping from legacy ACL permissions to GCP predefined storage roles.
UBLA ignores ACLs entirely, so permissions must be expressed via IAM role bindings.
3
Bind the IAM roles to the bucket's IAM policy.
Principals hold overlapping permissions via both ACLs and IAM roles.
Pre-granting IAM roles guarantees zero downtime or permission denied errors during the UBLA transition.
4
Execute command or update bucket metadata to set uniformBucketLevelAccess.enabled to true.
Bucket ACLs are ignored, and all access requests are evaluated strictly against IAM permissions.
Enabling UBLA finalizes the security posture mandate.

Anahtar Kavram

Migrating from Fine-Grained ACLs to Uniform Bucket-Level Access (UBLA)
Soru 1299Soru →

An organization enforces a strict security policy prohibiting the creation and storage of long-lived service account JSON keys on Compute Engine instances. A cloud engineer needs to configure an application on a Compute Engine virtual machine in Project A so that it can impersonate a target service account in Project B to read data from a Cloud Storage bucket. Which of the following configuration steps are required to establish this access securely according to Google Cloud best practices? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the Compute Engine VM's attached service account the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account in Project B.; Grant the target service account in Project B the Storage Object Viewer role (roles/storage.objectViewer) on the target Cloud Storage bucket.

Cevap

The correct configuration steps are to grant the source VM's service account the Service Account Token Creator role on the target service account, and to grant the target service account the Storage Object Viewer role on the target Cloud Storage bucket.
To set up service account impersonation securely, the requesting identity (the VM's attached service account) must be granted the Service Account Token Creator role directly on the target service account. Additionally, the target service account must hold the specific predefined role (Storage Object Viewer) on the Cloud Storage bucket to perform the required operations.

Adım Adım Çözüm

1
Configure impersonation permissions on the target service account.
The source Compute Engine VM's attached service account receives `roles/iam.serviceAccountTokenCreator` on the target service account in Project B.
This permission allows the source identity to generate short-lived access tokens for the target service account.
2
Configure resource permissions for the target service account.
The target service account is assigned `roles/storage.objectViewer` on the target bucket.
When the application impersonates the target service account, it assumes all permissions assigned to that target identity.

Anahtar Kavram

Service Account Impersonation and Short-Lived Credentials
Soru 1300Soru →

An organization runs an internal financial analytics service on Google Compute Engine. During peak reporting hours, incoming queue requests cause processing backlogs that are not effectively captured by CPU utilization metrics alone. Additionally, during sudden lulls in incoming traffic, the Managed Instance Group (MIG) rapidly reduces instance count, causing active analytics tasks to fail before completing. The cloud engineer must configure the MIG to scale dynamically based on task backlog while ensuring running jobs finish cleanly during scale-down events. Which TWO actions should the engineer take to achieve this objective?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an autoscaling policy in the Managed Instance Group based on a custom Cloud Monitoring metric that measures queue depth.; Enable scale-in controls in the MIG autoscaling policy and set a stabilization period to slow down instance termination.

Cevap

The cloud engineer should configure an autoscaling policy based on a custom Cloud Monitoring metric measuring queue depth and enable scale-in controls with a stabilization period to delay instance reduction.
Configuring a custom Cloud Monitoring metric enables the Managed Instance Group to scale out according to application queue depth rather than generic infrastructure metrics. Implementing scale-in controls with a stabilization period holds instance removal for a specified time window, preventing sudden instance termination while long-running analytics tasks complete.

Adım Adım Çözüm

1
Define and collect custom queue depth telemetry in Cloud Monitoring.
Queue depth metrics become available to the Compute Engine autoscaler.
Standard CPU or network metrics do not reflect application-layer queue backlogs accurately.
2
Configure the Managed Instance Group autoscaling policy to target the custom metric.
The MIG scales out when task queue depth exceeds target thresholds.
Scaling based on application queue length ensures capacity aligns directly with workload volume.
3
Configure scale-in controls with a stabilization period within the MIG autoscaling policy.
The autoscaler calculates recommended capacity over the stabilization window before terminating instances.
Stabilization periods prevent aggressive scale-in during short traffic dips, giving running analytics jobs sufficient time to complete.

Anahtar Kavram

Compute Engine MIG Autoscaling Policies and Scale-In Controls
ÖncekiSayfa 65 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin