Examkin

Tüm alıştırma soruları

1591 soru

Tüm türler1,591Çoktan seçmeli816Çoklu seçim491Sayısal12Eşleştirme10Sıralama262
Soru 1501Soru →

A DevOps team is configuring an automated deployment runner in project `proj-ci-runner` that needs to deploy compute resources into target project `proj-prod-app`. Following Google Cloud security best practices, the team wants to avoid long-lived credentials while enforcing the principle of least privilege. Which two actions should the team perform to configure service account access correctly?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Grant the service account in `proj-ci-runner` the Service Account Token Creator role (`roles/iam.serviceAccountTokenCreator`) on the deployment service account in `proj-prod-app`.; Grant the target deployment service account in `proj-prod-app` the specific predefined resource management roles required to deploy resources in `proj-prod-app`.

Cevap

The correct configuration requires granting the runner service account in `proj-ci-runner` the Service Account Token Creator role on the deployment service account in `proj-prod-app`, and granting the target service account specific predefined roles in `proj-prod-app`.
To grant cross-project access securely without service account keys, the source service account must be granted the Service Account Token Creator role on the target service account in the target project. Furthermore, the target service account itself must be granted fine-grained predefined roles on the target project to perform deployment operations under the principle of least privilege.

Adım Adım Çözüm

1
Identify identity delegation requirements for cross-project deployment.
The runner service account must impersonate a dedicated deployment service account in the destination project.
Service account impersonation generates short-lived OAuth 2.0 tokens, eliminating static JSON key management risks.
2
Configure IAM permissions for impersonation.
Assign `roles/iam.serviceAccountTokenCreator` to the build runner service account on the deployment service account in `proj-prod-app`.
This grants permission to generate token credentials for the target deployment service account.
3
Apply least privilege permissions to the target service account.
Assign predefined resource management roles to the deployment service account inside `proj-prod-app`.
Predefined roles ensure the service account only has permissions necessary for provisioning target resources.

Anahtar Kavram

Cross-Project Service Account Impersonation
Tahmini Süre:1m 30s
Soru 1502Soru →

A cloud operations engineer creates a custom Log Router sink in Cloud Logging to export critical application logs from a production project to a Pub/Sub topic in a centralized security project. After creating the sink, the engineer observes that log entries are not arriving in the destination topic. Which action must the engineer perform to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Grant the service account writer identity generated by the Log Router sink the Pub/Sub Publisher role on the destination Pub/Sub topic.

Cevap

Grant the service account writer identity generated by the Log Router sink the Pub/Sub Publisher role on the destination Pub/Sub topic.
When configuring a Cloud Logging Log Router sink to route logs to a resource (such as a Pub/Sub topic, Cloud Storage bucket, or BigQuery dataset) in another project, Cloud Logging creates a unique service account called a writer identity. To allow log routing, this writer identity must be granted appropriate write permissions (e.g., Pub/Sub Publisher) on the destination resource.

Adım Adım Çözüm

1
Identify the service account created for log routing.
Obtain the unique writer identity string associated with the Log Router sink.
Cloud Logging uses a sink-specific writer identity to publish logs to destinations.
2
Configure IAM permissions on the target resource.
Grant the Pub/Sub Publisher role to the writer identity on the destination Pub/Sub topic in the central project.
Cross-project log exporting requires explicit write authorization on the sink destination.

Anahtar Kavram

Log Router Sink Writer Identity and Cross-Project IAM Permissions
Soru 1503Soru →

An organization requires that sensitive financial audit logs stored in a Cloud Storage bucket in the europe-west1 region be encrypted using Customer-Managed Encryption Keys (CMEK) managed via Cloud KMS. A cloud engineer creates a Cloud KMS Key Ring named audit-keyring in the us-central1 region and a CryptoKey named audit-key inside it. When attempting to set audit-key as the default encryption key for the europe-west1 Cloud Storage bucket, the command fails. How should the engineer resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Create a new Key Ring in the europe-west1 region and a new CryptoKey inside it, then configure the Cloud Storage bucket to use the new key.

Cevap

Create a new Key Ring in the europe-west1 region and a new CryptoKey inside it, then configure the Cloud Storage bucket to use the new key.
Customer-Managed Encryption Keys (CMEK) require that the Cloud KMS Key Ring be created in the exact same location (region or multi-region) as the resource being encrypted (in this case, europe-west1). Because Cloud KMS Key Rings are immutable and cannot be moved or deleted, the engineer must create a new Key Ring in europe-west1.

Adım Adım Çözüm

1
Identify location constraint requirements for CMEK integration
Determine that Cloud KMS key rings must reside in the exact same region as the targeted Cloud Storage bucket (europe-west1).
Google Cloud CMEK requires location matching between the storage resource and the KMS Key Ring to maintain regional data locality and latency requirements.
2
Evaluate existing KMS resource management capabilities
Recognize that Cloud KMS Key Rings cannot be deleted, moved, or renamed once created.
Key Rings are permanent resource containers within GCP resource hierarchy.
3
Execute correct deployment workflow
Provision a new Key Ring in europe-west1 and encrypt the Cloud Storage bucket using a CryptoKey created within that new Key Ring.
Creating a new regional Key Ring satisfies both immutability rules and CMEK location matching criteria.

Anahtar Kavram

Cloud KMS Key Ring Location Matching and Immutability
Soru 1504Soru →

A cloud administrator needs to track specific HTTP 500 error patterns contained within application log entries and receive automated notifications whenever the error frequency exceeds a set threshold within a 5-minute window. Which TWO actions should the administrator perform in Google Cloud Observability to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a counter log-based metric in Cloud Logging using a log filter matching the HTTP 500 error entries.; Create an alerting policy in Cloud Monitoring that monitors the counter log-based metric and defines the threshold condition.

Cevap

To track log patterns and receive alerts based on log occurrence frequency, the administrator must create a counter log-based metric in Cloud Logging filtered for the HTTP 500 errors and configure a Cloud Monitoring alerting policy that monitors this new metric.
Creating a counter log-based metric allows Cloud Logging to aggregate log occurrences matching a specific filter into a numeric time-series metric. Setting up an alerting policy in Cloud Monitoring based on this metric ensures that notifications are sent when the metric exceeds the defined rate threshold.

Adım Adım Çözüm

1
Define a counter log-based metric in Cloud Logging
Cloud Logging converts incoming log entries matching the filter (HTTP 500 errors) into a time-series metric readable by Cloud Monitoring.
Standard metrics do not track custom application log patterns automatically; a log-based metric bridges log data into Cloud Monitoring.
2
Configure a Cloud Monitoring alerting policy
An alerting policy continuously evaluates the log-based metric rate against the specified threshold (e.g., 10 occurrences per 5 minutes) and triggers configured notification channels upon breach.
Alerting policies evaluate time-series metrics to generate incident alerts and notify operations teams.

Anahtar Kavram

Log-based Metrics and Cloud Monitoring Alerting Policies
Tahmini Süre:1m 30s
Soru 1505Soru →

A security operations team is configuring Cloud KMS key management policies for encryption keys protecting Pub/Sub topics. According to corporate compliance rules, the cryptographic keys must automatically rotate every 90 days. Additionally, if an individual key version is suspected of being compromised, security administrators must immediately render that specific version unusable for encryption and decryption operations while preserving the historical KeyRing structure. Which TWO configurations or management actions should the security administrator execute? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an automated rotation schedule on the CryptoKey specifying a rotation period of 90 days.; Change the state of the compromised CryptoKeyVersion to Disabled.

Cevap

The security administrator must set an automated rotation schedule on the CryptoKey with a 90-day period and disable the compromised CryptoKeyVersion.
Automated key rotation is configured by setting a rotation period on the CryptoKey. When a key version is compromised, changing its state to Disabled immediately halts its ability to perform encrypt or decrypt operations without needing to destroy resources or alter KeyRings.

Adım Adım Çözüm

1
Configure key rotation requirements.
Automated 90-day rotation is configured directly on the CryptoKey properties.
Cloud KMS natively supports scheduled automatic creation of new primary key versions based on a defined rotation period.
2
Address key version exposure.
Set the state of the affected CryptoKeyVersion to Disabled.
Disabling a key version prevents cryptographic operations using that version immediately while keeping the resource history intact.

Anahtar Kavram

Cloud KMS Key Lifecycle and Rotation Management
Tahmini Süre:1m 30s
Soru 1506Soru →

An organization processes financial batch jobs using a Compute Engine Managed Instance Group (MIG) equipped with an autoscaler. During sudden traffic drops, the autoscaler immediately terminates instances, causing several active, long-running batch jobs to fail prematurely. The cloud engineering team must ensure active jobs complete safely while still allowing the MIG to scale down gracefully when load decreases. Which TWO actions should the team implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure scale-in controls within the MIG autoscaling policy and specify a stabilization period.; Apply instance protection from scale-in to specific Compute Engine instances while they are executing long-running jobs.

Cevap

To protect active long-running batch jobs during autoscaling scale-in events, the team should configure scale-in controls with a stabilization period in the MIG autoscaling policy and apply instance protection from scale-in on VM instances actively processing jobs.
Configuring scale-in controls with a stabilization period establishes a trailing evaluation window that prevents sudden scale-in spikes. Additionally, enabling instance protection from scale-in on specific active instances explicitly guarantees that the MIG autoscaler will not terminate those instances while they complete long-running batch jobs.

Adım Adım Çözüm

1
Analyze the autoscaling behavior during scale-in events.
Identified that rapid autoscaler scale-in immediately deletes VM instances carrying active workloads.
Standard autoscaling scales down as soon as metrics drop unless scale-in parameters or protection flags are configured.
2
Configure MIG-level scale-in controls.
Setting a stabilization period forces the autoscaler to evaluate peak load over a trailing time window before removing instances.
Stabilization windows prevent abrupt VM terminations during momentary metric fluctuations.
3
Apply instance protection on target VMs.
Specific instances running critical jobs are shielded from deletion until their tasks finish.
Instance protection explicitly overrides autoscaler selection for deletion on designated compute instances.

Anahtar Kavram

Managed Instance Group Scale-in Control and Instance Protection
Soru 1507Soru →

A cloud administrator is setting up centralized compliance controls for a data analytics department organized inside a Google Cloud folder named 'Analytics'. The administrator needs to prevent Cloud Storage buckets within any projects under this folder from being publicly accessible, and also ensure that new projects under this folder do not automatically create a default VPC network. Which TWO of the following configurations correctly achieve these objectives using Organization Policies?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Apply the `constraints/storage.publicAccessPrevention` constraint at the 'Analytics' folder level and configure it to enforce public access prevention for all nested projects.; Apply the `constraints/compute.skipDefaultVpcCreation` constraint at the 'Analytics' folder level to disable automatic default network creation when new projects are created.

Cevap

The correct configurations are enforcing `constraints/storage.publicAccessPrevention` at the 'Analytics' folder level and enforcing `constraints/compute.skipDefaultVpcCreation` at the same folder level.
To satisfy both requirements, an administrator must enforce specific Organization Policy constraints at the target folder level ('Analytics'). Setting `constraints/storage.publicAccessPrevention` prevents public bucket exposure across all contained projects. Setting `constraints/compute.skipDefaultVpcCreation` ensures that auto-creation of default VPC networks is skipped whenever a new project is created in that folder.

Adım Adım Çözüm

1
Identify the required guardrail for restricting public Cloud Storage access across child projects.
Determine that the predefined Organization Policy constraint `constraints/storage.publicAccessPrevention` enforces public access restrictions across all projects in the target folder.
Organization policies inherit down the resource hierarchy from folders to child projects.
2
Identify the required guardrail for preventing automatic default VPC creation in newly created projects.
Determine that the boolean constraint `constraints/compute.skipDefaultVpcCreation` controls automatic network creation during project provisioning.
Applying this constraint at the folder level ensures all newly created projects under the 'Analytics' folder inherit the restriction.
3
Evaluate distractors related to IAM roles and policy inheritance.
Reject options that confuse IAM permissions with Organization Policy constraint enforcement or attempt to override Org Policies using IAM Deny rules.
Organization Policies constrain resource configurations, whereas IAM rules govern user/service account permissions.

Anahtar Kavram

Organization Policy constraints enforced at a folder level automatically inherit down the resource hierarchy to all contained projects, allowing centralized enforcement of resource restrictions such as public storage prevention and default network creation suppression.
Tahmini Süre:1m 30s
Soru 1508Soru →

An engineer needs to configure a custom service account for an application running on a Google Compute Engine VM instance in project `prod-data-pipeline`. The application requires permission to write objects to Cloud Storage buckets within the project. What is the correct sequence of steps to configure least-privilege access and attach the service account to the VM instance?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps is: First, create the custom service account (`app-writer`). Second, grant the required IAM role (`roles/storage.objectAdmin`) to the service account email. Third, provision the Compute Engine VM instance with the service account attached and `cloud-platform` scope. Fourth, run application code on the VM to authenticate via Application Default Credentials (ADC).
The correct deployment order follows the GCP resource dependency lifecycle: First, create the service account resource to generate its unique email identifier. Second, grant the required predefined IAM role to the service account identity at the project level. Third, create the Compute Engine VM instance, attaching the custom service account with the `cloud-platform` scope so that IAM controls access. Fourth, launch the workload application which retrieves short-lived access tokens from the instance metadata server via Application Default Credentials.

Adım Adım Çözüm

1
Create the service account identity in the target project.
Service account email `[email protected]` is generated.
An IAM identity must exist before IAM policy bindings or compute resource attachments can reference it.
2
Bind the required predefined IAM role to the service account identity.
The service account gains `roles/storage.objectAdmin` permissions on project `prod-data-pipeline`.
Permissions must be bound to the identity before compute workloads rely on it to perform storage operations.
3
Attach the service account during Compute Engine VM creation.
The Compute Engine VM `app-vm` is configured with the custom service account identity.
Attaching the service account at instance creation ensures the instance metadata server provides credentials for this identity.
4
Run application code leveraging metadata server ADC.
The application seamlessly authenticates without long-lived service account keys.
Application Default Credentials automatically query `http://metadata.google.internal` for short-lived access tokens.

Anahtar Kavram

Provisioning and attaching custom service accounts to Compute Engine instances using gcloud CLI and least-privilege IAM bindings.
Soru 1509Soru →

A company is setting up Customer-Managed Encryption Keys (CMEK) in Google Cloud KMS to protect sensitive data stored in a BigQuery dataset located in the us-central1 region. Following the principle of least privilege and separation of duties, the infrastructure team needs to allow BigQuery to automatically encrypt and decrypt data using the KMS key, while preventing the BigQuery service account from performing administrative operations on the key. Which configuration correctly satisfies these security requirements?

Cevabı ve açıklamayı göster

Cevap: Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific KMS key to the BigQuery service agent.

Cevap

Grant the Cloud KMS CryptoKey Encrypter/Decrypter role on the specific KMS key to the BigQuery service agent.
Granting the Cloud KMS CryptoKey Encrypter/Decrypter role directly on the specific key to the BigQuery service agent adheres to the principle of least privilege. It enables the service to perform required cryptographic encryption and decryption operations for CMEK without granting key management or administrative rights.

Adım Adım Çözüm

1
Identify the service principal requiring access
The BigQuery service agent (service-[PROJECT_NUMBER]@gcp-sa-bigquery.iam.gserviceaccount.com) requires access to perform cryptographic operations.
GCP services use service agents to perform CMEK operations on behalf of users.
2
Apply the principle of least privilege and separation of duties
Assign the predefined role Cloud KMS CryptoKey Encrypter/Decrypter (roles/cloudkms.cryptoKeyEncrypterDecrypter) directly on the targeted key resource.
This role allows the service agent to encrypt and decrypt data while restricting administrative capabilities such as key creation, rotation scheduling, or disabling versions.

Anahtar Kavram

Cloud KMS Service Agent IAM Roles and Separation of Duties
Soru 1510Soru →

A DevOps team manages a web microservice behind an External HTTP(S) Load Balancer in Google Cloud. To maintain strict service level objectives, they need to establish an automated alerting system that notifies the Site Reliability Engineering (SRE) team via PagerDuty whenever the HTTP 5xx error rate from the load balancer exceeds 2% of total requests over a 5-minute rolling window. Which configuration sequence in Google Cloud Observability should the team perform to meet this operational goal?

Cevabı ve açıklamayı göster

Cevap: Create an alerting policy in Cloud Monitoring selecting the load balancer HTTP response count metric, define a threshold condition for HTTP 5xx response codes over a 5-minute alignment window, and attach a configured PagerDuty notification channel.

Cevap

Create an alerting policy in Cloud Monitoring based on the load balancer HTTP response count metric, configure a threshold condition for 5xx codes over a 5-minute window, and attach the PagerDuty notification channel.
The standard and effective way to alert on infrastructure performance in GCP is to create a Cloud Monitoring alerting policy based on GCP-collected metrics (such as Load Balancer response counts), define threshold logic over an alignment period, and link notification channels like PagerDuty.

Adım Adım Çözüm

1
Configure the Notification Channel in Cloud Monitoring
PagerDuty integration is established as a recognized notification channel target.
Alert policies require predefined notification channels to send alerts when conditions are triggered.
2
Create an Alerting Policy selecting the Load Balancer metric
The metric for HTTP response status codes from the External HTTP(S) Load Balancer is targeted.
Cloud Monitoring captures load balancer traffic metrics natively without guest agent installation.
3
Define threshold conditions and aggregate over a 5-minute rolling window
An alert condition evaluates if 5xx errors exceed 2% over the 5-minute alignment duration.
This matches the operational requirement to monitor error rates over a specific time window.

Anahtar Kavram

Cloud Monitoring Alerting Policies and Notification Channels
Tahmini Süre:1m 30s
Soru 1511Soru →

An Associate Cloud Engineer is managing a specialized analytics application deployed on a Compute Engine virtual machine in the us-central1-a zone. To process a new data pipeline, the engineer updates the VM configuration to attach an NVIDIA GPU. When attempting to start the VM, the operation fails with a QUOTA_EXCEEDED error for GPU resources in that zone. The application must remain in us-central1-a due to strict low-latency requirements with adjacent infrastructure. Which action should the engineer take to resolve this issue following Google-recommended practices?

Cevabı ve açıklamayı göster

Cevap: Submit a quota increase request for the required GPU resource type in the us-central1 region via the Google Cloud Console.

Cevap

Submit a quota increase request for the required GPU resource type in the us-central1 region via the Google Cloud Console.
When a Compute Engine instance fails to launch due to a QUOTA_EXCEEDED error, the official Google Cloud practice is to request a quota limit increase via the Cloud Console Quotas page or gcloud CLI. This allows Google Cloud to evaluate the request and raise the limit for the target region.

Adım Adım Çözüm

1
Identify the root cause of the VM startup failure
The failure is caused by exceeding the project quota allocation for GPUs in the specified zone.
Google Cloud enforces quotas to prevent unexpected resource consumption and ensure system stability.
2
Evaluate workload architectural constraints
The VM must stay within us-central1-a due to latency dependencies.
Moving the instance to another zone or region is restricted by architectural requirements.
3
Request a quota increase
Submit a quota increase request through the Quotas page in the Google Cloud Console for GPU resources in the us-central1 region.
Submitting a formal request is the standard procedure to obtain additional capacity from Google Cloud.

Anahtar Kavram

Managing Compute Engine Quotas and Zonal Resource Allocations
Soru 1512Soru →

An enterprise organization requires that all Compute Engine virtual machine instances residing within a folder named 'Production' mandate OS Login for user authentication to disable instance-level SSH keys. Which approach correctly enforces this constraint across the resource hierarchy?

Cevabı ve açıklamayı göster

Cevap: Apply the constraints/compute.requireOsLogin Organization Policy constraint at the 'Production' folder level and set its enforcement to Enforced.

Cevap

Apply the constraints/compute.requireOsLogin Organization Policy constraint at the 'Production' folder level with enforcement enabled.
Applying the boolean constraint `constraints/compute.requireOsLogin` at the folder level and enabling enforcement ensures that all virtual machines created within child projects under the 'Production' folder are mandated to use OS Login, suppressing instance-level SSH key access through inherited resource hierarchy guardrails.

Adım Adım Çözüm

1
Identify the proper mechanism for restricting resource configurations across a resource hierarchy subset.
Recognize that Organization Policy constraints (such as constraints/compute.requireOsLogin) govern resource behaviors, while IAM policies grant permissions.
Organization Policies allow administrators to set programmatic restrictions across organizations, folders, or projects.
2
Determine the optimal resource hierarchy location for policy application.
Target the 'Production' folder level.
Setting the policy at the folder level ensures centralized governance for all current and future child projects in that folder without requiring manual per-project configuration.
3
Verify policy inheritance rules in Google Cloud.
Confirm that folder-level enforcement trickles down to all contained projects.
Resource hierarchy inheritance ensures child nodes inherit parent organization policy constraints unless an explicit override is configured.

Anahtar Kavram

Organization Policy Enforcement and Resource Hierarchy Inheritance
Tahmini Süre:1m 30s
Soru 1513Soru →

A security team alerts a cloud administrator that a specific version of a Cloud KMS CryptoKey used for encrypting database backups may have been exposed. The administrator must quickly stop any new data from being encrypted with the compromised key version while retaining the ability to decrypt existing backups. Additionally, the organization wants to comply with Cloud KMS resource lifecycle constraints. Which two actions should the administrator take to resolve this security incident? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable the compromised key version and set a new, uncompromised key version as the primary key version for the CryptoKey.; Retain the KeyRing and CryptoKey resource metadata in Google Cloud, recognizing that Cloud KMS KeyRings and CryptoKeys cannot be deleted once created.

Cevap

The administrator should disable the compromised key version while creating a new primary version for new encryptions, and recognize that KeyRing and CryptoKey metadata resources cannot be deleted in Cloud KMS.
Disabling the affected CryptoKey version prevents any service from using it to encrypt new data while preserving decrypt capabilities when re-enabled. Setting a new primary version ensures seamless transition for ongoing encryption. Furthermore, Cloud KMS enforces immutability on KeyRing and CryptoKey objects, meaning these administrative containers cannot be deleted.

Adım Adım Çözüm

1
Analyze key state management for compromised key material.
Disabling a key version prevents future encrypt operations using that version without deleting the material immediately.
Allows rotation to a new primary key version while keeping existing ciphertexts decryptable when required.
2
Evaluate Cloud KMS resource lifecycle constraints.
Cloud KMS KeyRings and CryptoKeys cannot be deleted from a project.
Maintains immutable audit records and resource naming consistency across GCP.

Anahtar Kavram

Cloud KMS Key Lifecycle Management and KeyRing Immutability
Soru 1514Soru →

A cloud administrator needs to grant an external automated system temporary access to collect metrics from Compute Engine instances within a Google Cloud project. To adhere to Google Cloud security standards, the administrator must avoid generating and downloading long-lived service account JSON keys. Which implementation strategy should the administrator select?

Cevabı ve açıklamayı göster

Cevap: Create a dedicated service account with the predefined Monitoring Viewer role and configure Workload Identity Federation to issue short-lived credentials to the external system.

Cevap

Create a dedicated service account with the predefined Monitoring Viewer role and configure Workload Identity Federation to issue short-lived credentials to the external system.
The correct strategy uses a dedicated service account bound strictly to the required predefined role (Monitoring Viewer) and uses Workload Identity Federation to grant short-lived access without creating long-lived private key files.

Adım Adım Çözüm

1
Identify the required level of access for metric collection
The predefined role roles/monitoring.viewer provides read access to monitoring metrics under the principle of least privilege.
Primitive roles like Owner grant excessive permissions beyond what is needed.
2
Determine the authentication mechanism for workloads outside Google Cloud
Workload Identity Federation allows external workloads to exchange credentials from external identity providers for short-lived Google Cloud service account tokens.
Exporting long-lived service account JSON keys creates maintenance overhead and security risks associated with credential leakage.

Anahtar Kavram

Service Account Management and Secure Authentication Best Practices
Soru 1515Soru →

An IT operations team needs to set up observability for a fleet of Compute Engine virtual machines. They require collecting detailed system memory and disk utilization metrics, as well as automatically exporting all ERROR and CRITICAL level application logs to a centralized BigQuery dataset located in a separate security administration project. Which TWO actions should the team take to meet these requirements following Google Cloud recommended practices?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Install and configure the unified Google Cloud Ops Agent on the Compute Engine VM instances.; Create a Log Router sink in Cloud Logging with a severity filter of ERROR or higher, and assign the sink's writer service account the BigQuery Data Editor role on the target dataset.

Cevap

The team must install the unified Google Cloud Ops Agent on the Compute Engine VM instances and create a Log Router sink targeting BigQuery while granting the sink's writer service account the BigQuery Data Editor role.
To collect system-level memory and detailed disk telemetry alongside logs from Compute Engine VMs, installing the unified Google Cloud Ops Agent is the standard Google Cloud recommendation. For exporting specific log levels across projects, setting up a Log Router sink with a severity filter targeting BigQuery and assigning the sink's writer identity the BigQuery Data Editor role properly establishes routing with least-privilege security.

Adım Adım Çözüm

1
Identify the telemetry collection requirement for Compute Engine instances
The unified Google Cloud Ops Agent is required to collect OS-level memory, disk metrics, and logs from VM instances.
Legacy Stackdriver agents are deprecated and do not represent Google Cloud best practices.
2
Configure log routing and destination IAM permissions
Define a Log Router sink filtered by severity (ERROR and CRITICAL) pointing to the destination BigQuery dataset.
Log Router sinks allow filtering logs and streaming them to BigQuery for long-term analytics.
3
Apply least privilege access permissions
Grant the sink's writer identity service account the predefined BigQuery Data Editor role on the destination dataset.
Using predefined resource-specific roles adheres to security best practices over primitive roles.

Anahtar Kavram

Telemetry collection via Google Cloud Ops Agent and Log Router sink delegation with IAM least privilege
Soru 1516Soru →

A cloud security engineer is tasked with establishing service account governance and credential security standards across several Google Cloud projects. Which of the following administrative actions and security practices align with Google Cloud recommendations for managing service accounts? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enforce the organization policy constraint `iam.disableServiceAccountKeyCreation` to prevent users from generating static, downloadable JSON service account keys.; Use service account impersonation and short-lived credentials for automated tools and pipelines instead of exporting persistent key files.

Cevap

Enforcing the organization policy constraint `iam.disableServiceAccountKeyCreation` and utilizing service account impersonation with short-lived credentials represent recommended Google Cloud security practices.
Google Cloud security best practices dictate minimizing the use of long-lived service account keys by enforcing the `iam.disableServiceAccountKeyCreation` organization policy. For automated processes needing authentication, using service account impersonation generates temporary, short-lived OAuth2 access tokens or identity tokens without persisting sensitive key files.

Adım Adım Çözüm

1
Evaluate key management options
Identify that static, downloadable JSON service account keys introduce significant risk if leaked or mismanaged.
Google Cloud strongly recommends restricting static key generation via organization policies.
2
Evaluate authentication mechanism for automation
Determine that service account impersonation using IAM short-lived tokens provides secure, temporary credentials without key management overhead.
Short-lived tokens automatically expire, minimizing exposure windows.
3
Reject non-compliant IAM and infrastructure management options
Eliminate options advocating static key storage on disks, broad primitive project Editor roles, or invalid API enablement scopes.
These violate least-privilege security mandates and procedural GCP resource configuration rules.

Anahtar Kavram

Service Account Governance and Short-Lived Credentials
Soru 1517Soru →

A DevOps engineer is configuring telemetry collection for a batch processing workload running on Linux Compute Engine virtual machines. Upon opening the Google Cloud Monitoring console, the engineer notices that basic hypervisor metrics such as CPU utilization and disk I/O are visible, but guest OS memory utilization and internal system logs are missing. Which action should the engineer take to collect these missing metrics and logs?

Cevabı ve açıklamayı göster

Cevap: Install and run the Google Cloud Ops Agent on each Compute Engine virtual machine instance.

Cevap

Install and run the Google Cloud Ops Agent on each Compute Engine virtual machine instance.
The correct option installs the Google Cloud Ops Agent on the virtual machines. The Ops Agent is the recommended solution for gathering guest OS metrics (such as memory usage and swap space) as well as internal system and application log files from Compute Engine instances.

Adım Adım Çözüm

1
Identify the telemetry requirement
Determine that OS memory metrics and system logs require an in-guest telemetry agent, as hypervisors only capture external host metrics like CPU and disk bytes.
Hypervisor monitoring cannot read internal operating system state such as active RAM usage or log files.
2
Select the correct Google Cloud agent solution
Choose the Google Cloud Ops Agent, which combines metric collection (OpenTelemetry-based) and log collection (Fluent Bit-based) into a single unified process.
Google Cloud recommends the Ops Agent for all current Compute Engine VM monitoring and logging needs.

Anahtar Kavram

Google Cloud Ops Agent deployment for Compute Engine guest OS observability
Tahmini Süre:1m 30s
Soru 1518Soru →

A cloud security administrator needs to prevent Compute Engine VM instances from being assigned external IP addresses across all projects contained within the 'Engineering' folder. Additionally, one specific testing project inside that folder requires external IPs for synthetic user testing. Which two steps must the administrator take to configure this resource hierarchy constraint correctly?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Apply the organization policy constraint restricting external IP access at the 'Engineering' folder level.; Override the inherited organization policy on the specific testing project node to allow external IP address assignment.

Cevap

To enforce this configuration, the administrator must apply the organization policy constraint at the folder level to cover all child projects by default, and then override the inherited policy directly on the testing project node to permit external IPs.
Applying the organization policy constraint at the folder level ensures that all projects within the 'Engineering' folder inherit the external IP restriction. To grant the necessary exception, overriding the policy at the specific testing project node allows external IP allocation without breaking compliance for the rest of the folder.

Adım Adım Çözüm

1
Identify the resource hierarchy scope for the baseline restriction.
The baseline constraint must apply broadly to all projects under the 'Engineering' folder.
Setting organization policies at higher nodes in the hierarchy ensures consistent governance across child resources.
2
Apply the external IP restriction policy at the folder level.
All projects inside the 'Engineering' folder inherit the restriction.
GCP Organization Policies evaluate down the resource hierarchy tree.
3
Configure a policy override at the targeted child project level.
The testing project bypasses the inherited restriction while keeping other projects secure.
Explicit project-level policy rules take precedence over inherited parent folder rules when inheritance is overridden.

Anahtar Kavram

GCP Organization Policies allow central governance across the resource hierarchy (Organization -> Folder -> Project), where inherited policies can be overridden at lower nodes to accommodate specific project exceptions.
Tahmini Süre:1m 30s
Soru 1519Soru →

A cloud administration team needs to ensure that IAM roles within a specific organizational Folder can only be granted to user accounts belonging to their verified corporate Google Workspace domain. They want to prevent project owners within that Folder from adding external Gmail or third-party accounts to IAM policies. Which administrative action correctly enforces this restriction across all current and future projects inside the Folder?

Cevabı ve açıklamayı göster

Cevap: Apply the Domain Restricted Sharing Organization Policy constraint (constraints/iam.allowedPolicyMemberDomains) on the Folder node and specify the corporate Google Workspace Directory Customer ID.

Cevap

Apply the Domain Restricted Sharing Organization Policy constraint on the target Folder node with the allowed corporate Directory Customer ID.
The correct approach configures the Domain Restricted Sharing Organization Policy constraint (`constraints/iam.allowedPolicyMemberDomains`) at the Folder level. Organization Policies establish constraints on resource configurations and propagate down the Google Cloud resource hierarchy to all child projects.

Adım Adım Çözüm

1
Identify the requirement
The goal is to restrict identity domains for IAM role assignments across all child resources under a specific Folder.
Organization Policies are designed to restrict configuration options across the resource hierarchy.
2
Select the appropriate constraint mechanism
Use the constraints/iam.allowedPolicyMemberDomains constraint.
This specific Organization Policy constraint evaluates IAM policy additions against allowed Google Workspace Directory Customer IDs.
3
Determine hierarchy placement
Set the policy configuration at the Folder node.
Organization policies applied at a Folder propagate down to all child folders and projects contained within it.

Anahtar Kavram

Organization Policies enforce resource hierarchy constraints (such as Domain Restricted Sharing) to restrict allowed configurations independently of IAM permission grants.
Tahmini Süre:1m 15s
Soru 1520Soru →

An operations team is auditing security compliance for a project in Google Cloud. During the audit, they discover that a developer generated a user-managed JSON service account key for local testing, which violates the organization's credential management policy. The team needs to immediately neutralize this specific compromised credential file without disabling the service account itself, as other production workloads rely on the service account. Which action should the operations team take?

Cevabı ve açıklamayı göster

Cevap: Delete the specific user-managed key using the gcloud iam service-accounts keys delete command or Google Cloud Console.

Cevap

Delete the specific user-managed key using the gcloud iam service-accounts keys delete command or Google Cloud Console.
Deleting the specific service account key directly revokes the public/private key pair associated with the JSON file without altering the service account identity or disrupting other resources using different authentication mechanisms.

Adım Adım Çözüm

1
Identify the security requirement
The target credential (the user-managed JSON key) must be invalidated without disrupting the service account itself.
Production workloads still depend on the underlying service account identity.
2
Evaluate key management lifecycle operations in Google Cloud IAM
Service account keys are managed independently of the service account resource.
Deleting a specific key ID permanently revokes authentication attempts using that private key file while preserving the identity.
3
Select the appropriate CLI/Console management action
Execute key deletion via `gcloud iam service-accounts keys delete KEY_ID --iam-account=SA_EMAIL`.
This directly revokes the compromised credential while keeping active workloads running.

Anahtar Kavram

Service Account Key Lifecycle and Management
ÖncekiSayfa 76 / 80Sonraki
Tüm alıştırma soruları — Google Cloud Associate Cloud Engineer | Examkin