Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 1401Soru →

A DevOps engineer needs to update an existing firewall rule named allow-internal-web in a custom Virtual Private Cloud (VPC) network. The rule currently filters traffic using the network tag legacy-web-backend. The team is migrating to identity-based security controls and requires the firewall rule to target instances using the service account [email protected] instead, while removing the existing network tag filter. Which gcloud command should the engineer execute to complete this operational change?

Cevabı ve açıklamayı göster

Cevap: gcloud compute firewall-rules update allow-internal-web --target-service-accounts=web-runner@prod-app.iam.gserviceaccount.com --remove-target-tags=legacy-web-backend

Cevap

Execute the command gcloud compute firewall-rules update allow-internal-web --target-service-accounts=web-runner@prod-app.iam.gserviceaccount.com --remove-target-tags=legacy-web-backend.
The correct command uses the `gcloud compute firewall-rules update` subcommand along with `--target-service-accounts` to set the service account identity and `--remove-target-tags` to clear the previous network tag target.

Adım Adım Çözüm

1
Identify the CLI tool and subgroup for managing VPC firewall rules.
Use the gcloud compute firewall-rules update command.
The requirement specifies modifying an existing firewall rule rather than creating a new one.
2
Specify the flags to assign service account identity and remove network tags.
Use --target-service-accounts to add the service account email and --remove-target-tags to strip the legacy tag.
VPC firewall rules allow targets to be defined by network tags or service accounts, and flags exist specifically to mutate these lists during an update.

Anahtar Kavram

Managing VPC Firewall Rules with gcloud CLI
Soru 1402Soru →

You need to configure Cloud Pub/Sub to trigger a Cloud Run microservice named `event-processor` using a secure push subscription. The Cloud Run service must reject any direct unauthenticated HTTP traffic from the public internet. Arrange the operational steps in the correct order to set up this secure integration.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts by creating a dedicated service account for the Pub/Sub push identity, deploying the target Cloud Run service with unauthenticated access disabled, binding the `roles/run.invoker` role on the Cloud Run service to the service account, and finally creating the Pub/Sub push subscription configured with the service endpoint and identity.
To build a secure push integration between Pub/Sub and Cloud Run, the identity components and service perimeter must be established in logical order: first create the principal (service account), then provision the resource and endpoint (`--no-allow-unauthenticated`), assign authorization (`roles/run.invoker`), and lastly create the integration object (Pub/Sub push subscription).

Adım Adım Çözüm

1
Create the service account identity using `gcloud iam service-accounts create`.
A service account email address is provisioned to represent the Pub/Sub push mechanism.
You need a dedicated principal identity to receive invoker permissions and sign authentication tokens.
2
Deploy the Cloud Run service with `gcloud run deploy event-processor --no-allow-unauthenticated`.
The Cloud Run service is instantiated with access restricted to authenticated invokers, returning a HTTPS service URL.
Enforcing private access ensures public requests are blocked and provides the target endpoint URL.
3
Add the IAM policy binding to the Cloud Run service using `gcloud run services add-iam-policy-binding event-processor --member=serviceAccount:... --role=roles/run.invoker`.
The push service account is authorized to invoke the private Cloud Run service.
Pub/Sub authentication relies on the service account possessing the specific `roles/run.invoker` predefined role.
4
Create the push subscription using `gcloud pubsub subscriptions create --topic=... --push-endpoint=... --push-auth-service-account=...`.
Pub/Sub automatically attaches OAuth/OIDC tokens signed by the service account when pushing messages to Cloud Run.
This final step connects the message queue to the verified, secure endpoint.

Anahtar Kavram

Securing Cloud Run Services with Pub/Sub Push Authentication and IAM Roles
Soru 1403Soru →

A security team enforces a strict policy at the root Organization node using the boolean constraint `constraints/iam.disableServiceAccountKeyCreation` set to `enforce: true`. An engineering team managing resources inside a specific child folder named `Legacy-Migration` requires temporary permission to create service account JSON keys for legacy workloads. The security team wants to allow service account key creation exclusively for resources within the `Legacy-Migration` folder hierarchy, while preserving the restriction across all other folders and without modifying user IAM permissions. Which configuration procedure should the security team perform?

Cevabı ve açıklamayı göster

Cevap: Apply an Organization Policy on the `Legacy-Migration` folder node for `constraints/iam.disableServiceAccountKeyCreation`, set `inheritFromParent` to `false`, and set `enforce` to `false`.

Cevap

Configure an Organization Policy directly on the target folder for the specified boolean constraint, setting enforcement to false and turning off parent policy inheritance.
To override an Organization Policy boolean constraint inherited from a parent node, an administrator must set `enforce` to `false` and set `inheritFromParent` to `false` on the specific child resource node (in this case, the `Legacy-Migration` folder). This exempts resources under that folder without relaxing security rules for the rest of the organization.

Adım Adım Çözüm

1
Identify the resource hierarchy target and constraint type.
The target is the `Legacy-Migration` folder, and the constraint is the boolean constraint `constraints/iam.disableServiceAccountKeyCreation`.
Organization Policies evaluate from the top down, with lower nodes inheriting parent policy rules unless explicitly overridden.
2
Determine how to override parent boolean constraint enforcement at a lower hierarchy node.
Setting `enforce: false` and `inheritFromParent: false` at the folder level allows key creation within that folder while keeping the root policy active elsewhere.
Inheritance must be disconnected or explicitly disabled on the child node so the parent's `enforce: true` setting does not take precedence.
3
Validate against IAM relationships.
Organization Policy constraints operate independently of IAM role bindings.
IAM grants capabilities to identities, whereas Organization Policies establish mandatory boundaries on resources.

Anahtar Kavram

Organization Policy Hierarchy Inheritance and Boolean Constraint Overrides
Soru 1404Soru →

An internal microservice hosted on Cloud Run named `payment-gateway` in the `us-central1` region must be configured so that it only accepts traffic originating from resources within the same Virtual Private Cloud (VPC) network or through a Google Cloud Cloud Load Balancing instance, while blocking direct public internet requests. Which command should a Cloud Engineer execute to apply this networking restriction to the existing service?

Cevabı ve açıklamayı göster

Cevap: gcloud run services update payment-gateway --ingress=internal-and-cloud-load-balancing --region=us-central1

Cevap

Execute `gcloud run services update payment-gateway --ingress=internal-and-cloud-load-balancing --region=us-central1` to restrict network access.
The correct command uses `gcloud run services update` along with the `--ingress=internal-and-cloud-load-balancing` flag and the appropriate region flag. This updates the Cloud Run service configuration to allow traffic only from internal VPC networks and Google Cloud Load Balancers while blocking direct public requests.

Adım Adım Çözüm

1
Identify the required operational management tool and subcommand for Cloud Run configuration changes.
The target command for updating service configuration on an existing Cloud Run deployment is `gcloud run services update`.
Service settings such as ingress, environment variables, scaling limits, and memory allocation are updated via service configuration update flags.
2
Select the correct ingress flag value for VPC and Load Balancer traffic.
Set `--ingress=internal-and-cloud-load-balancing`.
This specific flag value restricts inbound traffic to internal VPC sources, VPC Service Controls boundaries, and Cloud Load Balancing endpoints, blocking public direct requests.

Anahtar Kavram

Cloud Run Ingress Control Management
Soru 1405Soru →

A cloud engineer needs to deploy a mission-critical database virtual machine named `prod-db-01` in zone `us-east4-a` using the `gcloud` CLI. To protect the workload against accidental deletion through the Google Cloud Console or CLI, deletion protection must be enabled on the instance. Furthermore, the boot disk must be retained if the VM is ever deleted in the future. Which `gcloud compute instances create` command should the engineer execute?

Cevabı ve açıklamayı göster

Cevap: gcloud compute instances create prod-db-01 --zone=us-east4-a --deletion-protection --no-auto-delete-boot-disk

Cevap

The command using `gcloud compute instances create prod-db-01 --zone=us-east4-a --deletion-protection --no-auto-delete-boot-disk` correctly enables deletion protection and ensures the boot disk is preserved.
The correct command specifies `--deletion-protection` to guard the instance against accidental removal API calls and `--no-auto-delete-boot-disk` to preserve the persistent boot disk if the instance is eventually deleted.

Adım Adım Çözüm

1
Identify the requirement for protecting the VM instance against accidental deletion
Determine that the official `gcloud` flag for instance deletion safety is `--deletion-protection`.
This flag prevents users from deleting the instance unless deletion protection is explicitly disabled first.
2
Identify the requirement for boot disk retention upon VM deletion
Determine that the official `gcloud` flag to override default boot disk auto-deletion is `--no-auto-delete-boot-disk`.
By default, persistent boot disks created during instance deployment are set to auto-delete when the VM is destroyed unless this flag is passed.
3
Evaluate and select the complete `gcloud compute instances create` command
Combine `--zone=us-east4-a`, `--deletion-protection`, and `--no-auto-delete-boot-disk` into the command invocation.
This combination fulfills all operational security and storage persistence constraints.

Anahtar Kavram

Compute Engine gcloud flags for deletion protection and boot disk retention policy
Soru 1406Soru →

An infrastructure administrator needs to collect detailed system memory metrics from running Compute Engine virtual machines and inspect early stage kernel boot messages for instances that fail to start. Which TWO configuration actions should the administrator take to accomplish these operational tasks?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Install the Google Cloud Ops Agent on the virtual machine instances.; Enable serial console output logging in the instance metadata to stream boot messages to Cloud Logging.

Cevap

The correct actions are installing the Google Cloud Ops Agent on the virtual machines and enabling serial console output logging in instance metadata.
Installing the Google Cloud Ops Agent allows collection of system-level metrics such as memory and disk utilization from within the guest OS. Enabling serial port console output logging in instance metadata captures early kernel and boot log streams and sends them to Cloud Logging, enabling remote troubleshooting for unbootable virtual machines.

Adım Adım Çözüm

1
Deploy the telemetry collection agent inside the OS
In-guest memory metrics are captured and sent to Cloud Monitoring
Hypervisors only view allocated RAM bounds; an in-guest agent like the Google Cloud Ops Agent is required to read detailed internal memory utilization.
2
Enable serial port logging in metadata
Kernel startup output is captured and visible in Cloud Logging
Setting the metadata key serial-port-logging-enable=true enables Google Cloud to stream console output to Cloud Logging, allowing troubleshooting of instances that fail before establishing network connectivity.

Anahtar Kavram

Compute Engine Operational Monitoring and Troubleshooting
Tahmini Süre:1m 30s
Soru 1407Soru →

A security engineer needs to configure short-lived credential access for a developer working from a local terminal. The developer must deploy Cloud Storage resources by impersonating a dedicated service account named `[email protected]` without exporting service account JSON keys. Arrange the steps in the correct order to configure and enable service account impersonation using the gcloud CLI.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order begins with granting resource permissions to the target service account, followed by assigning the Service Account Token Creator role on the target service account to the developer, authenticating the user identity with `gcloud auth login`, and finally setting `gcloud config set auth/impersonate_service_account`.
To establish secure, keyless service account impersonation for local gcloud CLI execution, the workflow follows a precise logical sequence. First, the target service account must be granted the necessary workload permissions on target GCP resources. Second, the user identity must be granted the `Service Account Token Creator` role (`roles/iam.serviceAccountTokenCreator`) on the target service account to authorize short-lived token generation. Third, the user logs into gcloud using `gcloud auth login` to authenticate their user principal. Finally, running `gcloud config set auth/impersonate_service_account` configures the local gcloud environment to transparently request short-lived tokens for the specified target service account during resource operations.

Adım Adım Çözüm

1
Assign resource management roles to the target service account.
The service account `[email protected]` is granted the necessary Cloud Storage permissions.
Service account impersonation delegates authority, meaning the target service account itself must hold the permissions to perform actions.
2
Grant the developer the Service Account Token Creator role on the target service account resource.
The user identity is authorized to call the IAM credentials API to generate short-lived tokens for `[email protected]`.
Without `roles/iam.serviceAccountTokenCreator`, GCP IAM blocks attempts by the user principal to impersonate the service account.
3
Authenticate the developer's user identity in the local environment.
User credentials are established locally via `gcloud auth login`.
User authentication provides the underlying principal identity required to request impersonated tokens from GCP IAM.
4
Set the CLI authentication configuration to impersonate the target service account.
The gcloud CLI property `auth/impersonate_service_account` is configured.
This setting instructs gcloud to automatically mint and refresh short-lived tokens for the target service account for all gcloud operations.

Anahtar Kavram

Configuring Service Account Impersonation via gcloud CLI
Soru 1408Soru →

A network operations team is deploying firewall rules in a custom-mode Virtual Private Cloud (VPC) network. A target compute tier tagged `db-node` must receive PostgreSQL traffic on TCP port 5432 exclusively from an application tier tagged `app-node`. An existing firewall rule named `block-db-ingress` explicitly denies all ingress traffic on port 5432 with a priority of 500. Which TWO configuration settings must be applied to the new firewall rule to successfully allow this ingress traffic?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set the rule priority to a numerical value lower than 500 (such as 100).; Configure the target tags as `db-node` and the source tags as `app-node`.

Cevap

The correct options require setting the firewall rule priority to a numerical value lower than 500 and configuring target tags as `db-node` with source tags as `app-node`.
To grant access when a broader deny rule exists, the new allow rule must have a lower numerical priority (e.g., 100) than the existing deny rule (priority 500) because GCP processes rules in ascending numerical order. Additionally, for ingress rules, target tags identify the receiving destination workloads while source tags specify allowed origin workloads.

Adım Adım Çözüm

1
Determine firewall priority requirements to override existing deny rule
Identified that GCP firewall evaluation order prioritizes lower integer values. Setting priority below 500 (e.g., 100) ensures the allow rule evaluates before the deny rule.
GCP evaluates firewall rules strictly in ascending numerical order of priority, stopping at the first matching rule.
2
Configure network tag parameters for ingress traffic flow
Set `--target-tags=db-node` for receiving instances and `--source-tags=app-node` for initiating instances.
Ingress rules apply filtering where target tags specify the destination VMs receiving traffic and source tags define permitted sender VMs within the VPC.

Anahtar Kavram

VPC Firewall Priority and Network Tag Evaluation
Tahmini Süre:1m 30s
Soru 1409Soru →

A cloud network administrator is establishing high-availability hybrid connectivity between an on-premises data center and a GCP Virtual Private Cloud (VPC) network. An HA VPN gateway named `ha-vpn-gateway` and a Cloud Router named `bgp-router` have already been provisioned in region `us-central1`. Which TWO steps must the administrator perform next to complete the operational deployment of the VPN tunnels and dynamic routing sessions?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create two High Availability VPN tunnel resources referencing `ha-vpn-gateway` and associate them with `bgp-router`.; Configure BGP peerings on `bgp-router` corresponding to each VPN tunnel interface to exchange dynamic routes with the on-premises router.

Cevap

The administrator must create two HA VPN tunnel resources associated with the Cloud Router and configure BGP peerings on the Cloud Router for each tunnel interface.
Completing an HA VPN deployment requires configuring two VPN tunnels attached to the HA VPN gateway and assigning both to the regional Cloud Router. Subsequently, BGP interfaces and peers must be established on the Cloud Router to dynamically advertise and learn routes between the cloud VPC and on-premises networks.

Adım Adım Çözüm

1
Provision HA VPN Tunnels
Two VPN tunnels are created on interface 0 and interface 1 of the HA VPN gateway, both pointing to the designated Cloud Router (`bgp-router`).
HA VPN requires twin tunnels to ensure SLA-backed 99.99% availability.
2
Configure BGP Peers on Cloud Router
BGP interfaces and peer configurations are added to `bgp-router` for each VPN tunnel.
Dynamic routing via BGP allows automatically exchanging route prefixes between GCP VPC subnets and on-premises networks.

Anahtar Kavram

Configuring HA VPN Tunnels and BGP Peerings on Cloud Router
Soru 1410Soru →

A database administrator needs to allow an automated data extraction script, executing on a Compute Engine virtual machine instance in project `analytics-prod`, to read raw dataset files stored in a Cloud Storage bucket located inside a separate project `data-lake-central`. The Compute Engine instance is already configured to run with a custom user-managed service account named `[email protected]`. Following Google Cloud security best practices for cross-project resource access and the principle of least privilege, which configuration should the administrator apply?

Cevabı ve açıklamayı göster

Cevap: Grant the Storage Object Viewer role (`roles/storage.objectViewer`) on the specific Cloud Storage bucket in `data-lake-central` directly to `[email protected]`.

Cevap

Grant the Storage Object Viewer role (roles/storage.objectViewer) on the specific Cloud Storage bucket in data-lake-central directly to [email protected].
Service accounts can be granted IAM roles on resources in different Google Cloud projects. Granting the predefined role `roles/storage.objectViewer` on the specific bucket directly to the custom service account email address fulfills the least privilege requirement safely without key export overhead.

Adım Adım Çözüm

1
Identify the existing identity running the workload.
The identity is the custom service account [email protected].
Compute Engine workloads should leverage attached service accounts and Google Application Default Credentials (ADC).
2
Determine the minimal required role on the target resource.
The Storage Object Viewer role (roles/storage.objectViewer) provides read access to objects inside the Cloud Storage bucket.
Adhering to the principle of least privilege prevents unnecessary access write or administrative permissions.
3
Apply IAM binding directly on the target resource in the destination project.
The cross-project IAM policy binding allows the service account in project analytics-prod to read data from the bucket in project data-lake-central without long-lived keys.
GCP IAM supports referencing service account principal IDs across project boundaries.

Anahtar Kavram

Cross-Project Service Account Resource Access and Least Privilege
Soru 1411Soru →

A cloud operations team needs to grant a newly assigned developer permissions to deploy, update, and manage Cloud Functions within a target project named `backend-api-884`. The developer must not be granted permissions to modify other infrastructure components in the project, nor should their permissions extend to any other projects within the resource hierarchy. Which IAM role assignment adheres strictly to the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Assign the Cloud Functions Admin role (`roles/cloudfunctions.admin`) on the `backend-api-884` project.

Cevap

Assign the Cloud Functions Admin role (`roles/cloudfunctions.admin`) on the `backend-api-884` project.
Assigning the predefined Cloud Functions Admin role at the project level restricts administrative capabilities strictly to Cloud Functions and scopes those permissions solely to the targeted project (`backend-api-884`), satisfying the principle of least privilege.

Adım Adım Çözüm

1
Identify the required functional capabilities.
The user needs to create, update, and manage Cloud Functions specifically.
Determining the required task bounds allows choosing a predefined role rather than a broad primitive role.
2
Select the appropriate IAM role using least privilege principles.
The Cloud Functions Admin role (`roles/cloudfunctions.admin`) provides full control over Cloud Functions without granting access to unrelated services like Compute Engine or VPC networks.
Predefined service-specific roles adhere to least privilege better than primitive roles (Owner, Editor, Viewer).
3
Determine the minimal required resource hierarchy scope.
Bind the role at the specific project resource node (`backend-api-884`).
Assigning permissions at the project level prevents accidental permission inheritance to other projects contained within parent folders or the organization.

Anahtar Kavram

Principle of Least Privilege with Predefined Roles and Resource Scope
Soru 1412Soru →

An enterprise security policy mandates that an automated CI/CD pipeline executing on an external server must deploy Cloud Functions without using long-lived downloadable service account keys. The deployment script runs under an identity service account named [email protected]. A dedicated deployment service account named [email protected] has already been provisioned with the necessary Cloud Developer permissions. Which IAM configuration should the cloud engineer implement on func-deployer to allow cicd-runner to mint short-lived credential tokens under the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to serviceAccount:[email protected] on the func-deployer service account resource.

Cevap

Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to serviceAccount:[email protected] on the func-deployer service account resource.
To allow one identity to generate short-lived tokens on behalf of another service account securely, Google Cloud IAM requires granting the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the specific target service account resource to the calling principal identity. This satisfies least-privilege access and avoids creating static JSON service account keys.

Adım Adım Çözüm

1
Identify the target service account and the requesting identity service account.
The requesting principal is [email protected] and the target workload service account is [email protected].
Impersonation permissions must be granted on the target resource to the calling principal.
2
Select the appropriate IAM role for short-lived token generation.
The predefined IAM role roles/iam.serviceAccountTokenCreator permits generating OAuth2 access tokens, signed URLs, and JWTs.
This role provides the precise permissions needed for token minting without requiring static key files.
3
Apply the IAM binding scoped to the specific service account resource.
Bind roles/iam.serviceAccountTokenCreator specifically on the func-deployer service account resource for serviceAccount:[email protected].
Applying the role directly on the service account resource enforces the principle of least privilege, preventing access to other service accounts.

Anahtar Kavram

Service Account Impersonation and Short-Lived Credentials
Soru 1413Soru →

An enterprise operations team is implementing system telemetry collection and log archiving across a fleet of Compute Engine virtual machines. They require detailed operating system metrics (including memory and swap utilization) and must forward critical audit logs to a centralized BigQuery dataset in a security management project. Which two actions should the Cloud Engineer perform to satisfy these operational requirements following Google Cloud recommended practices? (Select TWO answers.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Install and configure the Google Cloud Ops Agent on each Compute Engine VM instance to collect extended system metrics and logs.; Create a Log Router sink targeting the BigQuery dataset and grant the sink's unique writer identity service account the BigQuery Data Editor role on the destination project/dataset.

Cevap

The correct actions are installing the Google Cloud Ops Agent on the VM instances to gather extended OS metrics and configuring a Log Router sink to BigQuery while assigning the sink's writer identity service account the BigQuery Data Editor role on the target destination.
The unified Google Cloud Ops Agent is the recommended solution to collect OS-level telemetry (memory and disk metrics) and logs from Compute Engine instances. When exporting logs to external targets like BigQuery via Log Router sinks, Google Cloud uses a unique writer identity service account for the sink that requires appropriate target IAM permissions (such as BigQuery Data Editor) on the destination project/dataset.

Adım Adım Çözüm

1
Identify the proper agent for VM telemetry collection.
Determine that the unified Google Cloud Ops Agent is required for capturing OS-level metrics like memory usage and system logs.
Legacy Stackdriver Monitoring and Logging agents are deprecated in favor of the unified Ops Agent.
2
Configure log routing and identity permissions.
Create a Log Router sink pointing to the BigQuery dataset and assign the BigQuery Data Editor role to the sink's unique writer identity service account.
Log Router sinks use service-account-based writer identities that require explicit IAM role bindings on the target resource to stream log entries successfully.

Anahtar Kavram

Compute Engine telemetry collection using the unified Google Cloud Ops Agent and IAM role delegation for Log Router sinks.
Soru 1414Soru →

A cloud administrator is tasked with setting up system memory and disk utilization telemetry for a newly deployed fleet of Linux Compute Engine virtual machines. Upon viewing the Cloud Monitoring dashboard, the administrator notices that memory utilization metrics are absent. The administrator must collect these operating system level metrics and send them to Cloud Monitoring while strictly adhering to Google-recommended practices and the principle of least privilege. Which approach should the administrator take?

Cevabı ve açıklamayı göster

Cevap: Install the Google Cloud Ops Agent on each Compute Engine instance and ensure the attached service account is granted the Monitoring Metric Writer role (roles/monitoring.metricWriter).

Cevap

Install the Google Cloud Ops Agent on each Compute Engine instance and ensure the attached service account is granted the Monitoring Metric Writer role (roles/monitoring.metricWriter).
To collect operating system metrics such as memory utilization, virtual machines require the Google Cloud Ops Agent. The agent runs inside the OS and transmits time-series data using the VM's service account. Providing the service account with the predefined Monitoring Metric Writer role (roles/monitoring.metricWriter) adheres to least privilege by allowing only metric writes without granting broader administrative capabilities.

Adım Adım Çözüm

1
Identify the correct telemetry collection agent for Compute Engine virtual machines.
Recognize that OS-level metrics like RAM/memory utilization are not collected by default hypervisor checks and require the Google Cloud Ops Agent (the unified successor to legacy agents).
Google Cloud Ops Agent combines logging and metrics telemetry into a single agent optimized for Compute Engine VMs.
2
Determine the minimal required Identity and Access Management (IAM) role for telemetry ingestion.
Select the predefined role Monitoring Metric Writer (roles/monitoring.metricWriter) for the VM's service account.
This role grants only the monitoring.metricWriter permission needed to publish metric time-series data to Cloud Monitoring, satisfying least privilege.

Anahtar Kavram

Compute Engine OS Telemetry Collection and IAM Least Privilege
Tahmini Süre:2m 0s
Soru 1415Soru →

A Google Cloud administrator manages a multi-tier resource hierarchy. At the root Organization node, the list constraint `constraints/gcp.resourceLocations` is configured to allow resources only in `in:us-locations`. The operations team creates a dedicated Folder named `/Europe-Operations` to host European workloads. Developers working inside this folder report that they are unable to create Cloud Storage buckets in `europe-west1`. The administrator must allow resource deployment in `europe-west1` for all projects within `/Europe-Operations` while maintaining existing restrictions across the rest of the organization, without granting developers administrative rights over security policies. Which TWO actions should the administrator perform? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Apply a new Organization Policy directly on the `/Europe-Operations` folder node that sets allowed locations to include `europe-west1` and overrides the inherited parent policy rule.; Verify that the administrator performing the policy update holds the Organization Policy Admin (`roles/orgpolicy.policyAdmin`) role on the resource hierarchy node.

Cevap

The administrator should apply a new Organization Policy on the targeted folder node to override inherited rules for allowed location values, and ensure they have the Organization Policy Admin role to execute policy changes.
To resolve location restriction blocks for a specific folder, an administrator must set an Organization Policy override directly on that folder node to allow the needed region, while holding the Organization Policy Admin role (`roles/orgpolicy.policyAdmin`) required to write policy constraints.

Adım Adım Çözüm

1
Analyze resource hierarchy policy evaluation for list constraints.
List constraints set at higher levels (Organization) propagate down to child nodes (Folders and Projects) unless overridden at a lower level node.
To grant exceptions for a specific folder without affecting sibling projects, an override policy must be defined directly at that folder node.
2
Determine required IAM role privileges for policy configuration.
Creating or modifying Organization Policy constraints requires the `roles/orgpolicy.policyAdmin` role.
Standard project or folder administration roles do not automatically include permissions to alter organization policy rules.
3
Evaluate why alternative options violate governance boundaries.
Granting IAM roles cannot bypass Organization Policies, and removing the root constraint exposes all other projects to unapproved regions.
IAM permissions and Organization Policies operate as independent security layers; removing root constraints breaks organizational guardrails.

Anahtar Kavram

Organization Policy Hierarchy Inheritance and Administrative Privileges
Soru 1416Soru →

An application deployed on Cloud Run in Project-A needs to publish messages securely to a Cloud Pub/Sub topic located in Project-B. Enterprise security policy strictly forbids generating or downloading service account keys. A dedicated target service account with Pub/Sub Publisher privileges has already been created in Project-B. Which IAM configuration correctly enables the Cloud Run service account in Project-A to generate short-lived credentials for the target service account following Google Cloud best practices?

Cevabı ve açıklamayı göster

Cevap: Grant the Cloud Run service account the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account in Project-B.

Cevap

Grant the Cloud Run service account the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the target service account in Project-B.
To impersonate a service account and request short-lived credentials (such as OAuth 2.0 access tokens), the calling identity must be assigned the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the target service account. This allows keyless cross-project authentication adhering to the principle of least privilege.

Adım Adım Çözüm

1
Analyze cross-project authentication constraints
The application requires cross-project resource access using short-lived tokens without exporting service account keys.
Service account impersonation is the GCP standard for keyless identity delegation across workloads.
2
Identify the required permission for token generation
Creating OAuth2 tokens or ID tokens via the IAM credentials API requires iam.serviceAccounts.getAccessToken.
This specific permission is provided by the Service Account Token Creator predefined role.
3
Bind the role with least privilege
Grant roles/iam.serviceAccountTokenCreator directly on the target service account resource in Project-B to the Cloud Run default service account principal.
Resource-level role bindings prevent the Cloud Run service account from impersonating unrelated service accounts in Project-B.

Anahtar Kavram

Configuring Service Account Impersonation using the Service Account Token Creator role
Soru 1417Soru →

A cloud operations team manages a stateful database cluster hosted on Compute Engine virtual machines in the region `us-central1`. During a planned scale-out operation, attempting to create additional VM instances fails with an error indicating that the regional `N2_CPUS` quota limit has been exceeded. The database workload requires continuous availability and cannot tolerate unexpected instance terminations. Which action should the team take to resolve this deployment failure in accordance with Google-recommended best practices?

Cevabı ve açıklamayı göster

Cevap: Submit a formal quota increase request for the N2_CPUS metric in the us-central1 region using the Google Cloud Console or gcloud CLI.

Cevap

Submit a formal quota increase request for the N2_CPUS metric in the us-central1 region using the Google Cloud Console or gcloud CLI.
Submitting a formal quota increase request for the N2_CPUS metric in the specified region directly addresses the project capacity limitation while maintaining the workload's location and availability requirements.

Adım Adım Çözüm

1
Identify the cause of the deployment failure
The failure occurs because the requested vCPU allocation exceeds the project's regional quota limit for N2 CPUs in us-central1.
Google Cloud enforces quotas on resource usage to prevent unexpected consumption and ensure fair resource allocation.
2
Evaluate workload requirements against potential solutions
Because the workload is a stateful database requiring continuous availability in us-central1, changing regions or using Spot VMs is inappropriate.
Stateful databases require high availability, low latency network locality, and non-preemptible Compute Engine instances.
3
Request additional resource quota from Google Cloud
Submit a quota increase request for N2_CPUS in us-central1 via the Cloud Console Quotas page or `gcloud alpha quotas` / Cloud Quotas API.
Formal quota adjustment is the official Google-recommended procedure for expanding capacity limits within a project and region.

Anahtar Kavram

GCP Resource Quota Management
Soru 1418Soru →

A cloud solution architect is configuring ingress firewall rules for a Google Cloud Virtual Private Cloud (VPC) network. An existing firewall rule allows SSH traffic (TCP port 22) from any source IP range (0.0.0.0/0) with a rule priority of 1000. The security team issues a new requirement to restrict SSH access so that only connections from the administrative CIDR range 192.168.10.0/24 are permitted, while all other SSH traffic from 0.0.0.0/0 must be blocked. Which firewall rule configuration correctly meets this requirement?

Cevabı ve açıklamayı göster

Cevap: Create a DENY rule for TCP port 22 from source 0.0.0.0/0 with priority 1000, and create an ALLOW rule for TCP port 22 from source 192.168.10.0/24 with priority 500.

Cevap

Create a DENY rule for TCP port 22 from source 0.0.0.0/0 with priority 1000, and create an ALLOW rule for TCP port 22 from source 192.168.10.0/24 with priority 500.
In Google Cloud VPC networking, firewall rules are evaluated based on priority numbers ranging from 0 to 65535, where lower numbers have higher precedence. To allow traffic from a specific subnet (192.168.10.0/24) while blocking all other sources (0.0.0.0/0), the ALLOW rule must have a lower priority number (e.g., 500) than the DENY rule (e.g., 1000). Incoming SSH packets from 192.168.10.0/24 match the priority 500 ALLOW rule first and are accepted. All other incoming packets bypass the first rule and hit the priority 1000 DENY rule.

Adım Adım Çözüm

1
Understand GCP VPC firewall rule priority evaluation order.
GCP evaluates firewall rules sequentially starting from the lowest integer value (0) up to the highest integer value (65535).
Lower priority numbers represent higher evaluation precedence.
2
Determine the required precedence for specific allow vs general deny rules.
The specific rule allowing 192.168.10.0/24 must be evaluated before the broad rule blocking 0.0.0.0/0.
If the general DENY rule were evaluated first, all traffic (including administrative traffic) would be matched and dropped immediately.
3
Assign numerical priority values based on precedence order.
Assign priority 500 to the ALLOW rule for 192.168.10.0/24 and priority 1000 to the DENY rule for 0.0.0.0/0.
Priority 500 ensures administrative traffic is allowed first, while all remaining SSH traffic hits the priority 1000 DENY rule.

Anahtar Kavram

VPC Firewall Rule Priority Precedence
Soru 1419Soru →

An analytics team needs to execute BigQuery SQL queries within project `proj-analytics-881` and read raw data files stored in a specific Cloud Storage bucket named `gs://raw-telemetry-2026`. The security administrator must configure access adhering strictly to the principle of least privilege. Which TWO IAM role bindings should be granted?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the BigQuery Job User role (`roles/bigquery.jobUser`) to the analytics team on project `proj-analytics-881`.; Grant the Storage Object Viewer role (`roles/storage.objectViewer`) to the analytics team specifically on the `gs://raw-telemetry-2026` bucket.

Cevap

Grant the BigQuery Job User role (`roles/bigquery.jobUser`) on project `proj-analytics-881` and grant the Storage Object Viewer role (`roles/storage.objectViewer`) on the specific Cloud Storage bucket `gs://raw-telemetry-2026`.
To satisfy least privilege requirements, the team should receive the BigQuery Job User role (`roles/bigquery.jobUser`) at the project level to execute queries, and the Storage Object Viewer role (`roles/storage.objectViewer`) applied directly to the designated bucket `gs://raw-telemetry-2026` to read target files without accessing other project resources.

Adım Adım Çözüm

1
Identify the minimum predefined role required to run BigQuery jobs within the target project.
The BigQuery Job User role (`roles/bigquery.jobUser`) enables executing queries without granting project-wide data modification privileges.
Running queries requires job creation and execution permissions at the project level.
2
Identify the minimum predefined role required to read files from a single Cloud Storage bucket.
The Storage Object Viewer role (`roles/storage.objectViewer`) bound directly to `gs://raw-telemetry-2026` grants read access exclusively to that specific bucket.
Binding roles at the resource level prevents exposing other storage buckets in the project or organization.

Anahtar Kavram

Applying least privilege through predefined role selection and resource-level IAM policy bindings.
Soru 1420Soru →

An operations engineer needs to update a regional internal HTTP(S) load balancer in Google Cloud. The team has deployed a new managed instance group named `ig-prod-backend` in region `us-central1` and wants to attach it as an additional backend to an existing regional backend service named `be-prod-service` in the same region. Which `gcloud` command should the engineer execute to achieve this configuration?

Cevabı ve açıklamayı göster

Cevap: gcloud compute backend-services add-backend be-prod-service --instance-group=ig-prod-backend --instance-group-region=us-central1 --region=us-central1

Cevap

The correct command is `gcloud compute backend-services add-backend be-prod-service --instance-group=ig-prod-backend --instance-group-region=us-central1 --region=us-central1`.
To add an instance group to an existing regional backend service, you must use `gcloud compute backend-services add-backend` along with the `--instance-group`, `--instance-group-region`, and `--region` flags.

Adım Adım Çözüm

1
Identify the target resource type and operational action required.
The target resource is a regional backend service (`be-prod-service`) and the action is adding an instance group backend.
Adding a new capacity source to an existing backend service requires the `add-backend` subcommand under `gcloud compute backend-services`.
2
Specify the appropriate scoping and region parameters.
Include `--instance-group=ig-prod-backend`, `--instance-group-region=us-central1`, and `--region=us-central1`.
Regional backend services and regional instance groups require explicit region flags matching their deployment locations.

Anahtar Kavram

Managing GCP Backend Services for Load Balancers
Tahmini Süre:1m 30s
ÖncekiSayfa 71 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin