Tüm alıştırma soruları

A cloud operations team needs to grant a newly assigned infrastructure technician permissions to create, stop, and restart Compute Engine virtual machine instances within project `proj-finance-workloads-992`, as well as view system logs in Cloud Logging. Following Google Cloud security best practices and adhering strictly to the principle of least privilege, which TWO IAM predefined roles should be assigned to the technician at the project level? (Select TWO.)

An administrator manages a fleet of non-critical, fault-tolerant web scraping tasks running on Compute Engine instances. The team needs to reduce compute infrastructure costs while collecting detailed host system memory metrics in Google Cloud Observability. Which TWO actions should the administrator take?

A Cloud Engineer needs to restore a corrupted boot disk on a Compute Engine virtual machine instance named `app-server-1` using an existing disk snapshot named `app-boot-snapshot-v2`. In what sequence should the engineer execute the `gcloud` operations to replace the boot disk and restore the server?

A security team needs to configure cross-project permissions for a audit service account named `[email protected]` in project `finance-prod`. The security group `[email protected]` must be allowed to generate short-lived OAuth2 access tokens for this service account to run security scans without using long-lived key files. Additionally, the service account itself requires read-only access to Cloud Storage objects stored in a separate project named `finance-data`. Following Google Cloud security best practices, which TWO actions should the security team perform? (Select TWO.)

An operations team needs to enable network traffic telemetry on an existing VPC subnet named `prod-analytics-subnet` in the `us-east1` region. They must activate VPC Flow Logs, set the log aggregation interval to 10 seconds, and adjust the sampling rate to $50\%$ ($0.5$). Which two `gcloud` flags or command invocations must the administrator execute to complete this network management task? (Select TWO answers.)

An enterprise Google Cloud organization enforces a list constraint at the root organization node using `constraints/compute.trustedImageProjects`, which explicitly allows images only from `projects/corp-base-images`. A cloud team managing a folder named `DataOps` needs to deploy Virtual Machine instances using custom images from `projects/dataops-custom-images`. However, instances in `DataOps` must also remain capable of using images from `projects/corp-base-images`. Which policy configuration on the `DataOps` folder will fulfill these security requirements?

A security operations team is reviewing firewall rules configured for a custom-mode Virtual Private Cloud (VPC) network. Two ingress firewall rules target Compute Engine instances carrying the tag `analytics-worker`:

- Rule 1: Action: DENY | Priority: 900 | Source CIDR: `10.10.0.0/16` | Protocol/Port: `tcp:80`
- Rule 2: Action: ALLOW | Priority: 1100 | Source CIDR: `10.10.1.0/24` | Protocol/Port: `tcp:80`

An internal client with IP address `10.10.1.50` sends an HTTP request on port 80 to a VM tagged `analytics-worker`. Which behavior will Google Cloud exhibit for this network request?

A security specialist needs to mandate that no user or service account can generate long-lived service account keys across any existing or future projects located inside the `Staging-Services` folder. This security requirement must be automatically inherited across all child resources without restricting developers from performing standard resource management tasks within their projects. Which solution enforces this operational restriction?

A DevOps engineer manages a critical application running on a Linux-based Compute Engine virtual machine. The attached persistent disk containing application data is approaching full capacity. The engineer needs to expand the storage capacity of this persistent disk with minimal disruption and without recreating the instance. Which procedure should the engineer follow?

A cloud security administrator needs to transition an enterprise Cloud Storage bucket containing financial audit data from legacy Access Control Lists (ACLs) to Uniform Bucket-Level Access. To ensure zero service disruption for automated workloads accessing the objects, what is the correct sequence of steps the administrator should execute?

An operations team manages a Virtual Private Cloud (VPC) network in Google Cloud. An existing ingress firewall rule named `deny-all-app-ingress` with priority `1000` denies all incoming TCP traffic on port `8080` across all instances in the VPC. The team needs to grant temporary access on TCP port `8080` specifically for management traffic originating from the IP range `10.10.0.0/24`. The administrator creates a new ingress firewall rule named `allow-mgmt-ingress` targeted at the same instances. Which priority configuration must be assigned to `allow-mgmt-ingress` to ensure management traffic is allowed without deleting or modifying `deny-all-app-ingress`?

An e-commerce platform runs its order-processing microservices across a fleet of Compute Engine virtual machines. The operations lead notices that standard Compute Engine CPU metrics do not provide visibility into OS-level memory utilization or custom file-based application logs. The team must configure telemetry collection and ensure the instances have appropriate access permissions. Which configuration steps should the operations team perform?

An organization administrator needs to enforce security controls on Google Cloud Compute Engine resources across a multi-tier resource hierarchy consisting of an Organization node, a 'Production' folder, and several project nodes. The organization policy currently restricts external IP addresses on Compute Engine instances at the Organization node using `constraints/compute.vmExternalIpAccess`. The administrator wants to allow external IP access exclusively for virtual machines within a single designated project under the 'Production' folder, while ensuring that interactive serial port access (`constraints/compute.disableGlobalSerialPortAccess`) remains blocked across all projects in the organization. Which TWO policy management actions must the administrator perform to achieve these requirements?

A DevOps engineer needs to grant a third-party monitoring service account access to inspect Cloud Pub/Sub topic and subscription configurations within project `proj-telemetry-prod`. The service account must not be granted permissions to publish or acknowledge message content, nor should it have access to unrelated resources in the project. Which IAM role assignment adheres to the principle of least privilege?

An Associate Cloud Engineer needs to deploy a new version of a stateless web application running on an existing regional Managed Instance Group (MIG) with zero downtime using the gcloud CLI. Order the steps required to execute this deployment correctly from first to last.

An organization is configuring VPC Network Peering to connect two Virtual Private Cloud (VPC) networks, `prod-vpc` and `shared-services-vpc`, across different projects in Google Cloud. Which of the following statements regarding VPC Network Peering behavior and operational requirements are correct?

A cloud security engineer needs to enforce strict security baselines for all new Google Cloud projects created within a resource hierarchy folder named `Production-Workloads`. Specifically, the policy must ensure two outcomes across all current and future projects in that folder: default VPC networks are not created during project initialization, and default service accounts are not automatically granted the primitive Editor role upon creation. Which TWO organization policy constraints must be enforced at the `Production-Workloads` folder level to achieve these requirements?

A cloud engineer needs to grant a service account read access to files stored in a Cloud Storage bucket named `customer-analytics-data`. Uniform Bucket-Level Access is currently enabled on the bucket. When an automated script attempts to apply fine-grained object Access Control Lists (ACLs) to grant read permission, the operation fails. Which action should the engineer take to properly grant the service account read access while adhering to Google Cloud security best practices?

An infrastructure team is provisioning Compute Engine instances using the gcloud command-line tool. The workload consists of stateless batch processing tasks running on Spot VMs, and each VM requires execution of a local shell script during boot. Which TWO gcloud configuration practices are correct for this scenario?

An infrastructure engineering team needs to set up a new isolated environment in Google Cloud using the `gcloud` CLI. Place the operational commands in the correct sequential order required to provision the custom VPC network, create a regional subnet, apply a targeted firewall rule, and launch a Compute Engine VM instance.