Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 1361Soru →

A DevOps engineer needs to safely roll out a new version of a Cloud Run service named `billing-api` in the `us-central1` region by creating a tagged revision, sending a small percentage of test traffic to it, and finally shifting all production traffic to the new revision once verified. Place the following `gcloud` CLI steps in the correct chronological order to complete this canary release workflow.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence to perform a tagged canary rollout on Cloud Run is: 1) Deploy the new revision with `--no-traffic` and `--tag=canary`, 2) Test the revision via its dedicated tag URL, 3) Update traffic to route 10% of production traffic to the `canary` tag, and 4) Route 100% of traffic to the new revision using `--to-latest`.
A standard zero-downtime canary deployment sequence in Cloud Run requires deploying the new code revision with no initial traffic allocation using `--no-traffic` while assigning a revision tag (`--tag`). Next, the engineer tests the container using the generated tag-specific URL. After successful direct verification, a small percentage of live production traffic is assigned to the tag using `gcloud run services update-traffic --to-tags`. Finally, after monitoring stability, 100% of live traffic is shifted to the latest revision.

Adım Adım Çözüm

1
Deploy the updated container container with `--no-traffic` and `--tag=canary`.
The revision is created and receives a uniqueURL prefix (`canary---...`), but receives 0% of the main service URL's incoming traffic.
This allows safe deployment to production infrastructure without exposing live users to unverified code.
2
Perform smoke tests directly against the tagged URL.
Validation of service responses and health checks in the live environment.
Verifies that the revision initializes correctly without risking production traffic.
3
Execute `gcloud run services update-traffic billing-api --region=us-central1 --to-tags=canary=10`.
10% of live traffic hitting the main service URL is diverted to the canary revision.
Gradually introduces production load to monitor error rates and latency metrics.
4
Execute `gcloud run services update-traffic billing-api --region=us-central1 --to-latest`.
100% of main service URL traffic is directed to the newest revision.
Completes the canary release once stability is confirmed.

Anahtar Kavram

Cloud Run Traffic Splitting & Revision Tagging Workflow
Soru 1362Soru →

A DevOps engineer needs to manage an existing Cloud Run service named `inventory-api` deployed in the `us-east1` region. The engineer must route exactly 20% of incoming production traffic to a newly deployed revision tagged `v2` while keeping the remaining 80% on the prior revision. Additionally, the service must be configured so that unauthenticated public requests are blocked. Which TWO actions should the engineer perform using `gcloud` commands or IAM configurations to achieve these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Execute `gcloud run services update-traffic inventory-api --region=us-east1 --to-tags v2=20` to allocate traffic to the tagged revision.; Execute `gcloud run services update inventory-api --region=us-east1 --no-allow-unauthenticated` to enforce authentication requirements.

Cevap

The engineer must run `gcloud run services update-traffic inventory-api --region=us-east1 --to-tags v2=20` to shift traffic and run `gcloud run services update inventory-api --region=us-east1 --no-allow-unauthenticated` to block unauthenticated requests.
To manage Cloud Run traffic splits safely, `gcloud run services update-traffic` with `--to-tags` allows fine-grained percentage routing to tagged revisions. To restrict public access, `gcloud run services update` with the `--no-allow-unauthenticated` flag removes the `allUsers` invoker binding and enforces IAM authentication.

Adım Adım Çözüm

1
Configure traffic split using the gcloud CLI
Assign 20% of incoming production requests to revision tag v2
The `gcloud run services update-traffic` command with `--to-tags v2=20` explicitly updates the service's traffic routing configuration while retaining the remaining percentage on existing revisions.
2
Update Cloud Run ingress authentication settings
Remove public access and require IAM authentication
Applying the `--no-allow-unauthenticated` flag via `gcloud run services update` updates the IAM policy on the Cloud Run service to block unauthenticated invocations.

Anahtar Kavram

Cloud Run Traffic Management & IAM Access Control
Soru 1363Soru →

An infrastructure engineer is configuring ingress firewall rules for a custom Virtual Private Cloud (VPC) network. Two firewall rules are applied to Compute Engine instances with the network tag `api-server`:

- Rule 1 (`allow-internal-api`): Action: Allow, Protocol/Port: TCP:8080, Source CIDR: `10.1.0.0/16`, Priority: `1000`.
- Rule 2 (`deny-partner-api`): Action: Deny, Protocol/Port: TCP:8080, Source CIDR: `10.1.5.0/24`, Priority: `500`.

A client host at IP address `10.1.5.25` attempts a TCP connection on port 8080 to an `api-server` instance. How will Google Cloud VPC firewall rule evaluation process this traffic request?

Cevabı ve açıklamayı göster

Cevap: The traffic will be denied because Rule 2 has a lower priority number (500), giving it higher precedence over Rule 1 (1000).

Cevap

The traffic will be denied because Rule 2 has a lower priority number (500), giving it higher precedence over Rule 1 (1000).
In Google Cloud Virtual Private Cloud (VPC), firewall rules are evaluated in ascending numerical order of their priority values (from 0 to 65535). A lower integer value represents a higher priority. Because priority 500 is lower than priority 1000, Rule 2 (`deny-partner-api`) is evaluated first. Since the incoming IP address `10.1.5.25` falls within `10.1.5.0/24`, Rule 2 matches and immediately denies the connection.

Adım Adım Çözüm

1
Identify matching firewall rules for incoming traffic.
Both Rule 1 (Source `10.1.0.0/16`) and Rule 2 (Source `10.1.5.0/24`) match traffic from `10.1.5.25` on TCP port 8080 targeting instances with tag `api-server`.
Traffic matching requires evaluating target tags, protocols, ports, and source IP CIDRs.
2
Compare the priority numbers of the matching rules.
Rule 2 has priority 500, while Rule 1 has priority 1000.
GCP evaluates firewall rules in ascending order of priority integer value (0 to 65535, where 0 is evaluated first).
3
Determine the outcome based on the highest precedence rule.
Rule 2 takes precedence due to its lower priority number (500 < 1000), executing its action (Deny).
Once a matching rule with the lowest numerical priority is found, its action is applied and evaluation stops.

Anahtar Kavram

GCP VPC Firewall Rule Priority Precedence
Soru 1364Soru →

A cloud engineer needs to deploy stateless, fault-tolerant Compute Engine virtual machine instances for a batch processing workload using the gcloud CLI. The instances must minimize compute costs and automatically execute a setup script stored in a Google Cloud Storage bucket (gs://my-app-scripts/setup.sh) during boot. Which TWO gcloud compute instances create flag configurations should the engineer use? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: --provisioning-model=SPOT; --metadata=startup-script-url=gs://my-app-scripts/setup.sh

Cevap

To achieve minimum compute costs for fault-tolerant workloads while executing a startup script from a Cloud Storage bucket, the engineer must specify '--provisioning-model=SPOT' to request Spot VM pricing and '--metadata=startup-script-url=gs://my-app-scripts/setup.sh' to point to the remote script path.
The combination of using '--provisioning-model=SPOT' and '--metadata=startup-script-url=gs://my-app-scripts/setup.sh' correctly provisions a low-cost Spot VM and instructs Compute Engine to fetch and execute the startup script directly from the designated Cloud Storage bucket.

Adım Adım Çözüm

1
Determine the cost-optimization deployment model suitable for stateless, fault-tolerant batch workloads.
Identify that Spot VMs (configured via --provisioning-model=SPOT) provide maximum cost savings for preemptible batch jobs.
Spot instances offer up to 60-91% discounts compared to standard VMs and fit stateless, fault-tolerant batch workloads.
2
Identify the proper gcloud CLI flag for passing a startup script hosted in a Cloud Storage bucket.
Use --metadata=startup-script-url=gs://... rather than local file metadata flags.
When referencing scripts stored remotely in Cloud Storage, the startup-script-url key inside the --metadata flag is required.

Anahtar Kavram

Compute Engine Instance Deployment and Metadata Configuration
Soru 1365Soru →

Your team needs to deploy a dedicated Compute Engine virtual machine instance named prod-api-worker in zone us-east1-b to execute critical database schema migration tasks. To follow security best practices, the VM must run using a non-default, user-managed service account named [email protected] and grant full Google Cloud platform access scopes so IAM roles govern permissions. Which gcloud command should you run to deploy the VM instance according to these requirements?

Cevabı ve açıklamayı göster

Cevap: gcloud compute instances create prod-api-worker --zone=us-east1-b [email protected] --scopes=https://www.googleapis.com/auth/cloud-platform

Cevap

Execute gcloud compute instances create specifying [email protected] and --scopes=https://www.googleapis.com/auth/cloud-platform.
The correct option uses gcloud compute instances create with [email protected] to attach the user-managed service account identity and --scopes=https://www.googleapis.com/auth/cloud-platform to allow IAM policies to manage resource access.

Adım Adım Çözüm

1
Identify the required gcloud compute instances create flags for service account identity.
The correct flag to specify identity is --service-account with the full service account email.
Attaching custom service accounts ensures the instance operates under least-privilege IAM permissions instead of the default Compute Engine service account.
2
Determine the appropriate access scope flag.
Use --scopes=https://www.googleapis.com/auth/cloud-platform to delegate effective permission checks to IAM.
Google Cloud best practice recommends enabling the cloud-platform scope when using custom service accounts so IAM policies dictate API permissions.
3
Evaluate workload suitability for availability policies.
Omit flags like --preemptible or --provisioning-model=SPOT for stateful migration tasks.
Database migration jobs are critical operations that should not be unexpectedly terminated.

Anahtar Kavram

Attaching User-Managed Service Accounts to Compute Engine Instances via gcloud CLI
Tahmini Süre:1m 30s
Soru 1366Soru →

An Associate Cloud Engineer needs to increase the available disk space for a stateful application running on a Linux Compute Engine VM without restarting or replacing the existing Persistent Disk. Sequence the steps required to safely expand the disk capacity and make the additional storage space usable by the operating system.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with expanding the Persistent Disk capacity in GCP (`gcloud compute disks resize`), followed by connecting to the VM via SSH (`gcloud compute ssh`), extending the disk partition table (`growpart`), and finally expanding the guest filesystem (`resize2fs` or `xfs_growfs`).
Expanding persistent storage on a live Compute Engine VM requires a top-down layer approach: provision additional raw block storage at the GCP control plane (`gcloud compute disks resize`), gain access to the OS (`gcloud compute ssh`), update the partition table to encompass the new space (`growpart`), and finally resize the filesystem layer (`resize2fs` or `xfs_growfs`).

Adım Adım Çözüm

1
Resize the Persistent Disk resource via GCP infrastructure.
GCP provisions additional raw block storage for the disk attached to the VM.
The hypervisor must present larger physical disk space before the VM guest OS can recognize added capacity.
2
SSH into the VM instance CLI.
An active interactive terminal session inside the guest OS is opened.
Resizing the GCP disk resource does not automatically reconfigure guest OS partitions or filesystems.
3
Run partition expansion tools (`growpart`).
The target partition boundary is grown to encompass the unallocated blocks on the raw disk device.
Filesystems reside within partition boundaries; expanding the partition table must precede filesystem expansion.
4
Run filesystem growth utilities (`resize2fs` or `xfs_growfs`).
The filesystem expands to consume the newly enlarged partition space.
The filesystem layer manages block allocation tables and must be explicitly resized to make storage usable by applications.

Anahtar Kavram

Compute Engine Persistent Disk Resizing Procedure
Tahmini Süre:1m 30s
Soru 1367Soru →

An organization manages a critical microservice deployed on Cloud Run named `payment-processor` in the `us-central1` region. Following the deployment of a new revision named `payment-processor-00005-xyz`, Cloud Monitoring metrics reveal a sharp increase in HTTP 500 error rates. The operations team needs to immediately redirect 100% of live incoming production traffic back to the previous stable revision named `payment-processor-00004-abc` without deleting the failed revision so developers can inspect its logs. Which `gcloud` CLI command should the operations team run to execute this rollback?

Cevabı ve açıklamayı göster

Cevap: gcloud run services update-traffic payment-processor --to-revisions=payment-processor-00004-abc=100 --region=us-central1

Cevap

Execute `gcloud run services update-traffic payment-processor --to-revisions=payment-processor-00004-abc=100 --region=us-central1` to immediately route all production traffic back to the stable revision.
The command `gcloud run services update-traffic payment-processor --to-revisions=payment-processor-00004-abc=100 --region=us-central1` correctly routes 100% of live traffic to the specified healthy revision while leaving the faulty revision intact for troubleshooting.

Adım Adım Çözüm

1
Identify the target revision to receive traffic and the required percentage.
The target revision is `payment-processor-00004-abc` and needs 100% of production traffic.
Emergency rollbacks require directing full live traffic away from the erroneous revision instantly.
2
Select the proper gcloud CLI tool for Cloud Run traffic routing.
Use `gcloud run services update-traffic`.
`update-traffic` explicitly adjusts routing weights between revisions.
3
Specify the revision mapping flag `--to-revisions` along with region metadata.
Construct `gcloud run services update-traffic payment-processor --to-revisions=payment-processor-00004-abc=100 --region=us-central1`.
This guarantees that revision `payment-processor-00005-xyz` receives 0% of traffic while preserving its instance data and logs.

Anahtar Kavram

Cloud Run Traffic Management and Revision Rollbacks
Soru 1368Soru →

A cloud engineer needs to deploy an isolated enterprise application environment in Google Cloud using the Google Cloud CLI (`gcloud`). Arrange the administrative steps in the correct operational order to provision the networking infrastructure and deploy the application instance safely.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The operational sequence requires first creating the custom VPC network, next adding the custom subnet, followed by establishing the ingress firewall rule with target tags, and finally creating the Compute Engine instance bound to the subnet and network tag.
In Google Cloud Platform networking, resources must be created following structural dependencies. First, a custom-mode VPC network must exist to act as the parent object. Second, a subnet within that VPC must be created to define regional CIDR IP blocks. Third, firewall rules are attached to the VPC network with target tags so traffic rules are active. Finally, the Compute Engine VM instance is created referencing the custom subnet and network tags.

Adım Adım Çözüm

1
Create the custom-mode VPC network
The VPC container is initialized with no automatically generated subnets.
Subnets and firewall rules require a host VPC network to exist before they can be configured.
2
Create the custom subnet within the designated region
An IP CIDR allocation is bound to the target region under the custom VPC.
Compute instances in a custom VPC require an explicit subnet reference upon creation.
3
Configure firewall rules for incoming traffic
Traffic filters and target network tags are registered within the VPC network.
Security policies should be established before instance deployment to ensure instances are immediately protected.
4
Provision the Compute Engine virtual machine instance
The VM starts with an internal IP assigned from the subnet and traffic controlled by the firewall rule.
Creating the instance depends on both the active subnet for IP allocation and network tags for firewall policy matching.

Anahtar Kavram

Deployment dependency order for GCP Virtual Private Cloud (VPC) networks, custom subnets, firewall rules, and compute workloads.
Soru 1369Soru →

A Cloud Engineer needs to update an existing global HTTP(S) load balancer configuration on Google Cloud Platform. Specifically, the connection draining duration for a global backend service named `app-backend-service` must be reduced from 300 seconds to 60 seconds to decrease deployment waiting times during instance updates. Which gcloud command should the engineer execute to apply this change?

Cevabı ve açıklamayı göster

Cevap: gcloud compute backend-services update app-backend-service --global --connection-draining-timeout=60

Cevap

Execute the command `gcloud compute backend-services update app-backend-service --global --connection-draining-timeout=60`.
The correct command uses `gcloud compute backend-services update` targeting `app-backend-service` with the `--global` flag and sets the `--connection-draining-timeout` parameter to 60 seconds.

Adım Adım Çözüm

1
Identify the resource type and scope
The resource is a global backend service named `app-backend-service` associated with an HTTP(S) load balancer.
Backend services manage backend instance groups and settings such as health checks, capacity, and connection draining for HTTP(S) load balancers.
2
Determine the correct gcloud command group and flag for connection draining
Use `gcloud compute backend-services update` with the `--global` location scope flag and `--connection-draining-timeout=60`.
Connection draining is a parameter of the backend service resource measured in seconds.

Anahtar Kavram

Configuring connection draining timeout on Google Cloud Load Balancer backend services
Tahmini Süre:1m 30s
Soru 1370Soru →

A company operates a critical processing application deployed on a Managed Instance Group (MIG) in a specific Compute Engine region. During peak traffic hours, autoscaling events fail, and system logs report that the project has reached its maximum regional vCPU threshold. The workload must continue scaling horizontally within the same region to accommodate demand. Which action should an Associate Cloud Engineer take to resolve this capacity constraint?

Cevabı ve açıklamayı göster

Cevap: Submit a formal quota increase request for regional vCPUs in the Google Cloud console Quotas page.

Cevap

Submit a formal quota increase request for regional vCPUs in the Google Cloud console Quotas page.
Submitting a quota increase request via the Quotas page in the Google Cloud console is the correct operational method to request additional vCPU capacity for Compute Engine in a designated region.

Adım Adım Çözüm

1
Identify the cause of the autoscaling failure
System logs confirm that the regional vCPU quota limit has been exhausted.
Compute Engine resources are constrained by regional and project-level quota caps to prevent unexpected spending and resource exhaustion.
2
Determine the appropriate administrative procedure
Select the option to request an official GCP quota evaluation and increase.
Quota limits cannot be bypassed by network reconfiguration, role modifications, or switching instance types without separate quota provisions.
3
Execute the request via Google Cloud Console
Navigate to IAM & Admin > Quotas, select the regional vCPU metric, and submit an increase request.
Google Cloud approval workflows process quota expansions officially through this channel.

Anahtar Kavram

Managing GCP Resource Quotas for Compute Engine Resources
Soru 1371Soru →

A cloud operations team is configuring a compute infrastructure on Google Cloud to process stateless, fault-tolerant data transformation tasks. The architecture must minimize compute costs while ensuring high availability and automatic replacement of failed instances. Which TWO management strategies should the team implement? (Select 2 answers)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the Managed Instance Group (MIG) to use Spot VMs for instance provisioning to reduce compute expenses.; Define an HTTP health check and assign an autohealing policy to the Managed Instance Group to automatically recreate unhealthy instances.

Cevap

The correct strategies are to configure the Managed Instance Group to use Spot VMs for stateless processing and to configure an autohealing policy with an HTTP health check to recreate degraded instances.
For stateless, fault-tolerant batch workloads, using Spot VMs within a Managed Instance Group delivers maximum cost savings. Pairing the MIG with an HTTP health check and an autohealing policy ensures high availability because any instance that becomes unresponsive or fails its health check is automatically terminated and recreated.

Adım Adım Çözüm

1
Identify cost optimization mechanisms appropriate for stateless workloads
Spot VMs provide significant cost reductions for fault-tolerant and stateless workloads that handle preemptions gracefully.
Stateless batch transformations do not store local persistent state, so unexpected preemptions by Compute Engine will not degrade data integrity.
2
Identify health monitoring and auto-recovery configurations for Compute Engine MIGs
Attaching an explicit HTTP health check to the MIG autohealing policy ensures automatic instance recreation upon application freeze or crash.
Autohealing continuously monitors application endpoints and replaces failed VM instances automatically.

Anahtar Kavram

Compute Engine Resource Management: Managed Instance Groups (MIGs), Spot VM placement, and Autohealing Policies
Soru 1372Soru →

A cloud engineer must deploy a Compute Engine virtual machine instance that automatically executes a startup script to read files from a secure Cloud Storage bucket. To ensure least-privilege security, the VM must authenticate using a dedicated custom service account rather than the default Compute Engine service account. Place the operational steps in the correct chronological order required to set up and deploy this VM instance.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational order is: 1) Create the custom IAM service account, 2) Grant the Storage Object Viewer IAM role to the service account, 3) Execute the gcloud compute instances create command with the service account and startup script metadata flags, and 4) Verify VM startup and inspect logs.
Proper GCP infrastructure deployment dictates creating identity resources (service accounts) first, granting them specific role permissions second, instantiating compute resources with those identities and metadata scripts third, and verifying log execution fourth.

Adım Adım Çözüm

1
Identity Creation
A custom service account is created in the project.
An identity must exist before access permissions can be granted or assigned to resources.
2
Role Binding
The service account receives the Storage Object Viewer role on the bucket.
Granting least-privilege access prior to VM creation ensures the VM's workload can immediately access required resources upon initialization.
3
Instance Provisioning
The VM is created via gcloud CLI with the identity and script attached.
Specifying `--service-account` and `--metadata-from-file` during provisioning binds the identity and startup script to the instance.
4
Validation
Logs confirm the startup script successfully read from the bucket.
Post-deployment validation ensures the identity credentials and startup script operated as expected.

Anahtar Kavram

Compute Engine Service Account Provisioning & Startup Configuration
Soru 1373Soru →

An infrastructure engineer needs to update a production web application hosted on a Compute Engine Managed Instance Group (MIG). A new instance template with the updated application image has already been created. The deployment must update the running VM instances gradually without interrupting ongoing user traffic. Which Google-recommended approach should the engineer use to perform this update?

Cevabı ve açıklamayı göster

Cevap: Update the Managed Instance Group target instance template and initiate a rolling update using the gcloud compute instance-groups managed rolling-action start-update command.

Cevap

Update the Managed Instance Group target instance template and execute a rolling update via gcloud compute instance-groups managed rolling-action start-update.
The standard and Google-recommended method to update instances in a Managed Instance Group without downtime is to point the MIG to the new Instance Template and execute a rolling update command (`gcloud compute instance-groups managed rolling-action start-update`). This automatically handles replacing instances while maintaining minimum available capacity.

Adım Adım Çözüm

1
Identify the requirement for zero-downtime rolling updates in Compute Engine Managed Instance Groups.
Determined that instance updates must be performed incrementally using instance templates.
Managed Instance Groups maintain instance consistency through instance templates rather than manual per-VM edits.
2
Apply the newly created instance template to the Managed Instance Group.
The MIG configuration points to the updated instance template.
The MIG requires an updated template definition before starting the automated update process.
3
Trigger the rolling update action via the gcloud CLI command `gcloud compute instance-groups managed rolling-action start-update`.
Compute Engine replaces old VM instances with new instances in a controlled, rolling manner.
Rolling updates replace instances gradually to preserve service capacity and prevent downtime.

Anahtar Kavram

Managed Instance Group (MIG) Rolling Updates
Soru 1374Soru →

A site reliability engineer needs to optimize a latency-sensitive microservice running on Cloud Run named `telemetry-service` in the `europe-west1` region. To prevent cold starts during peak traffic hours, the service must maintain at least 5 warm container instances at all times, while restricting the upper autoscaling limit to 50 instances to maintain budget boundaries. Which `gcloud` command should be executed to apply these scaling configurations?

Cevabı ve açıklamayı göster

Cevap: Execute `gcloud run services update telemetry-service --region=europe-west1 --min-instances=5 --max-instances=50`.

Cevap

The command `gcloud run services update telemetry-service --region=europe-west1 --min-instances=5 --max-instances=50` properly configures autoscaling limits for Cloud Run.
Executing `gcloud run services update telemetry-service --region=europe-west1 --min-instances=5 --max-instances=50` correctly updates the active configuration of the existing Cloud Run service. Specifying `--min-instances=5` keeps 5 instances ready to process incoming requests without cold start latency, while `--max-instances=50` ensures that Cloud Run will not scale beyond 50 concurrent instances.

Adım Adım Çözüm

1
Identify the target serverless platform and required operation
The target workload is deployed on Cloud Run, requiring resource autoscaling updates.
Cloud Run service operational configurations are managed via `gcloud run services update`.
2
Select the correct gcloud flags for minimum and maximum instance count limits
The `--min-instances` flag ensures minimum active instances to prevent cold starts, and `--max-instances` sets the scaling ceiling.
These flags directly modify the service template spec for instance limits.

Anahtar Kavram

Cloud Run Autoscaling and Instance Management
Soru 1375Soru →

An operations team needs to update the network configuration for a custom subnet named `prod-analytics-subnet` located in region `us-east1` within the Virtual Private Cloud (VPC) network `corp-vpc`. The requirements are:

1. Enable VPC Flow Logs on `prod-analytics-subnet` with an aggregation interval set to 5 seconds (`INTERVAL_5_SEC`).
2. Update the existing Cloud NAT service named `nat-config-east` on Cloud Router `nat-router-east` so that `prod-analytics-subnet` is included to provide outbound internet access for private virtual machines using automatically allocated external IP addresses.

Which TWO `gcloud` CLI commands must the team run to satisfy these operational requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: `gcloud compute networks subnets update prod-analytics-subnet --region=us-east1 --enable-flow-logs --logging-aggregation-interval=INTERVAL_5_SEC`; `gcloud compute routers nats update nat-config-east --router=nat-router-east --region=us-east1 --auto-allocate-nat-external-ips --add-subnetworks=prod-analytics-subnet`

Cevap

The two correct commands are `gcloud compute networks subnets update prod-analytics-subnet --region=us-east1 --enable-flow-logs --logging-aggregation-interval=INTERVAL_5_SEC` and `gcloud compute routers nats update nat-config-east --router=nat-router-east --region=us-east1 --auto-allocate-nat-external-ips --add-subnetworks=prod-analytics-subnet`.
To manage Google Cloud networking resources effectively, enabling or modifying VPC Flow Logs on an existing subnet requires running `gcloud compute networks subnets update` with the `--enable-flow-logs` flag and setting `--logging-aggregation-interval=INTERVAL_5_SEC`. To attach a subnet to an existing Cloud NAT configuration without replacing current settings, `gcloud compute routers nats update` must be used with the `--add-subnetworks` flag along with required parameters such as `--router` and `--region`.

Adım Adım Çözüm

1
Identify the proper gcloud command to modify subnet settings for logging.
Use `gcloud compute networks subnets update` with `--enable-flow-logs` and `--logging-aggregation-interval=INTERVAL_5_SEC`.
VPC Flow Logs properties on existing subnets are altered using the subnet update command group.
2
Identify the proper gcloud command to add a subnet to an existing Cloud NAT gateway.
Use `gcloud compute routers nats update` targeting the NAT gateway, specifying `--router`, `--region`, `--auto-allocate-nat-external-ips`, and `--add-subnetworks=prod-analytics-subnet`.
Cloud NAT operates on top of Cloud Routers, so adding subnet mapping requires modifying the NAT configuration on the associated Cloud Router.

Anahtar Kavram

Managing VPC Subnet Settings and Cloud NAT Resources
Tahmini Süre:1m 30s
Soru 1376Soru →

A Cloud Engineer needs to execute a safe canary rollout of a updated container image for an existing Cloud Run service named `order-processor`. Arrange the operational steps in the correct order from first to last to complete the canary deployment and traffic transition without risking immediate full-production downtime.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for a Cloud Run canary rollout is: 1) Deploy the new image using `--no-traffic` and assign a revision tag. 2) Direct verification requests to the tag-specific URL. 3) Route a small percentage of live traffic to the tagged revision. 4) Shift 100% of live production traffic to the latest revision.
A safe canary deployment in Cloud Run follows a distinct lifecycle: first creating the new revision isolated with `--no-traffic` and a dedicated tag, testing the tag-specific URL directly, initiating a partial live traffic split using `gcloud run services update-traffic --to-tags`, and finally updating the service traffic to 100% (`--to-latest`) once stability is verified.

Adım Adım Çözüm

1
Deploy revision with traffic suppression and a revision tag
A new revision is instantiated without receiving traffic from the primary service URL.
The `--no-traffic` flag prevents automatic 100% traffic assignment to new deployments.
2
Validate revision via tag-specific endpoint URL
Functionality is verified on `https://canary---order-processor-REGION.a.run.app`.
Revision tags provide isolated subdomains for pre-release validation.
3
Apply canary traffic split using CLI
10% of incoming live traffic is routed to the `canary` tag, while 90% remains on the previous stable revision.
`gcloud run services update-traffic --to-tags` manages granular percentage traffic allocation.
4
Promote latest revision to receive full traffic load
100% of production traffic is routed to the new revision.
Using `--to-latest` completes the canary deployment once stability is confirmed under live load.

Anahtar Kavram

Cloud Run Revision Tagging and Traffic Splitting Sequence
Soru 1377Soru →

An operations team is updating telemetry collection for a fleet of Linux Compute Engine virtual machines hosting enterprise applications. The security policy requires collecting system memory (RAM) utilization metrics and ingesting custom application logs into Google Cloud Observability, while strictly adhering to Google-recommended practices and the principle of least privilege. Which TWO actions should the team take to complete this configuration?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Install and configure the Google Cloud Ops Agent on each Compute Engine virtual machine instance.; Grant the VM service account the predefined roles Monitoring Metric Writer (`roles/monitoring.metricWriter`) and Logs Writer (`roles/logging.logWriter`).

Cevap

The team must install the unified Google Cloud Ops Agent on each VM instance and assign the predefined Monitoring Metric Writer and Logs Writer IAM roles to the VM service account.
Collecting OS-level metrics such as RAM utilization alongside application log files on Compute Engine requires deploying the unified Google Cloud Ops Agent. To allow the agent to write telemetry to Google Cloud Observability in accordance with security best practices, the VM service account must be granted specific predefined roles: Monitoring Metric Writer and Logs Writer.

Adım Adım Çözüm

1
Select the modern unified telemetry agent for Compute Engine
Deploy the Google Cloud Ops Agent across all VM instances.
The Ops Agent is Google's official agent for capturing OS-level metrics like RAM usage alongside application log files.
2
Configure standard least-privilege IAM permissions for metric and log ingestion
Attach `roles/monitoring.metricWriter` and `roles/logging.logWriter` to the attached Compute Engine service account.
These predefined roles allow telemetry ingestion into Cloud Monitoring and Cloud Logging without providing broader resource management access.

Anahtar Kavram

Compute Engine Observability & Least-Privilege Telemetry Roles
Tahmini Süre:2m 0s
Soru 1378Soru →

A cloud engineer needs to deploy a new Compute Engine virtual machine instance named analytics-db-tool in zone us-central1-a to host a dedicated database management utility. The business requirements specify that the instance must be placed in a custom subnet named analytics-subnet, assigned the network tag db-client, and explicitly configured to terminate rather than live-migrate during Google Cloud host maintenance events. Which gcloud command should the engineer execute to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: gcloud compute instances create analytics-db-tool --zone=us-central1-a --subnet=analytics-subnet --tags=db-client --on-host-maintenance=TERMINATE

Cevap

The command 'gcloud compute instances create analytics-db-tool --zone=us-central1-a --subnet=analytics-subnet --tags=db-client --on-host-maintenance=TERMINATE' correctly deploys the VM with all requested network and maintenance specifications.
The correct command uses '--subnet=analytics-subnet' to target the custom subnet, '--tags=db-client' to attach the required network tag, and '--on-host-maintenance=TERMINATE' to specify that the VM should be stopped rather than live-migrated when maintenance occurs on the underlying host hardware.

Adım Adım Çözüm

1
Identify the proper gcloud command flag for placing a VM into a specific subnet.
Use '--subnet=analytics-subnet' instead of '--network' when targeting a custom subnet.
The '--network' flag expects the VPC network name, whereas specific subnets require the '--subnet' flag.
2
Identify the flag controlling instance behavior during infrastructure maintenance.
Use '--on-host-maintenance=TERMINATE' (valid choices are MIGRATE or TERMINATE).
The flag '--maintenance-policy' is not a valid gcloud flag for instance creation.
3
Verify network tag and provisioning settings.
Apply '--tags=db-client' on a standard provisioned instance.
Spot VMs are designed for fault-tolerant batch workloads, not dedicated utility instances that require standard maintenance policy configuration.

Anahtar Kavram

Deploying Compute Engine instances with custom subnets and host maintenance policies using gcloud CLI
Tahmini Süre:1m 30s
Soru 1379Soru →

An Associate Cloud Engineer needs to add an additional non-boot persistent disk to an existing Compute Engine Linux VM instance and prepare it for application data storage. What is the correct sequence of steps to provision, attach, and configure this storage resource?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence is: 1) Create the Persistent Disk via gcloud compute disks create, 2) Attach the disk to the VM instance via gcloud compute instances attach-disk, 3) SSH into the VM and format the raw device using sudo mkfs.ext4, and 4) Create a target directory and mount the formatted disk using sudo mount.
The correct workflow follows a standard infrastructure provisioning and operating system administration pattern. First, the cloud resource must be provisioned in GCP using the `gcloud compute disks create` command. Second, the newly created disk resource is attached to the VM instance via `gcloud compute instances attach-disk`. Third, within the VM's SSH session, the Linux operating system formats the newly recognized raw block device with an `ext4` filesystem using `sudo mkfs.ext4`. Finally, the formatted filesystem is mounted to a designated local directory using `sudo mount`.

Adım Adım Çözüm

1
Provision the zonal Persistent Disk in Google Cloud.
A new block storage disk is allocated within the target zone.
Storage resources must exist in the cloud control plane prior to attachment.
2
Attach the disk resource to the Compute Engine VM instance.
The block device becomes accessible to the guest operating system hardware controller.
Attaching exposes the raw block device (e.g., /dev/sdb or google-disk-name) to the Linux kernel.
3
Format the raw block device inside the VM guest OS.
An ext4 file system structure is written to the block device.
Operating systems cannot write or read files on unformatted raw block devices.
4
Mount the filesystem to a target directory in Linux.
The persistent storage becomes active and usable at the specified directory path.
Linux requires mounting formatted storage devices into the OS directory tree for application access.

Anahtar Kavram

Compute Engine Persistent Disk provisioning, attachment, formatting, and mounting lifecycle.
Tahmini Süre:1m 30s
Soru 1380Soru →

An engineer needs to configure a `gcloud` command to deploy a Compute Engine virtual machine named `batch-processor` in zone `us-central1-a`. The VM must run using a dedicated custom service account named `[email protected]` and must automatically execute a script stored on the local administrative machine named `setup.sh` upon first boot. Which of the following flags must be included in the `gcloud compute instances create` command? (Select TWO correct answers.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: [email protected]; --metadata-from-file=startup-script=setup.sh

Cevap

The command requires `[email protected]` to attach the identity of the custom service account, and `--metadata-from-file=startup-script=setup.sh` to read and upload the local bash script as the startup script.
To assign a custom service account identity and execute a local script file on startup, `gcloud compute instances create` requires `--service-account` to define the identity and `--metadata-from-file=startup-script=...` to load local file contents into the startup script metadata entry.

Adım Adım Çözüm

1
Identify the flag required to attach a specific custom service account identity to a Compute Engine instance during creation.
The correct flag is `--service-account=EMAIL`.
Attaching a custom service account defines the IAM identity for applications running inside the VM.
2
Identify the flag required to pass a local script file as an instance startup script.
The correct flag is `--metadata-from-file=startup-script=LOCAL_FILE_PATH`.
The `--metadata-from-file` flag reads content from the local disk, whereas `--metadata=startup-script-url=...` expects a remote URL.

Anahtar Kavram

Deploying Compute Engine VMs with custom service accounts and local startup scripts via gcloud CLI
Tahmini Süre:1m 30s
ÖncekiSayfa 69 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin