Tüm alıştırma soruları

1598 soru

Tüm türler1,598 Çoktan seçmeli815 Çoklu seçim537 Sayısal8 Eşleştirme64 Sıralama174

A global media streaming platform is migrating its on-premises infrastructure to Google Cloud. The environment includes a 1.2 PB archive of video assets on network-attached storage (NAS) and a live 4 TB PostgreSQL database supporting user metadata. The business requires zero downtime for the database cutover and minimal disruption for video asset migration. Arrange the operational steps in the correct architectural sequence to execute this data transfer and migration strategy.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with establishing Dedicated Interconnect network connectivity, followed by configuring Database Migration Service (DMS) with continuous CDC for the relational database. Next, petabyte-scale offline data transfer is performed via Transfer Appliance, followed by an online delta sync using Storage Transfer Service. Finally, application traffic is cut over after verifying database replication synchronization.

The proper architectural sequence begins by provisioning dedicated hybrid networking to secure communications. Continuous database replication (CDC via DMS) is started next so that transactional changes stream continuously. Bulk offline storage transfer (Transfer Appliance) is executed for the 1.2 PB dataset to avoid network saturation, followed by an online delta catch-up sync (Storage Transfer Service) to synchronize changes generated during transit. Finally, database replication lag is verified and traffic cutover is completed.

Adım Adım Çözüm

Establish secure network connectivity

Dedicated Interconnect and private VPC routing are configured.

High-speed network connectivity is a prerequisite for secure database replication and cloud management.

Initialize database replication

Database Migration Service runs continuous CDC from on-premises PostgreSQL to Cloud SQL.

Establishing continuous replication early allows the database to stay in sync with minimal lag while bulk data transfers occur.

Execute bulk data transfer

1.2 PB media archive is moved offline via Transfer Appliance.

Transfer Appliance handles multi-petabyte initial data transfers efficiently without overloading bandwidth.

Perform incremental catch-up sync

Storage Transfer Service copies files added or changed during Transfer Appliance transit.

Storage Transfer Service provides continuous cloud-to-cloud/on-prem to cloud sync for delta changes.

Perform final cutover

Replication lag hits zero, Cloud SQL is promoted, and application traffic is shifted.

Ensures zero data loss and minimal operational downtime during final service promotion.

Anahtar Kavram

Staging Hybrid Cloud Migration and Data Transfer Strategies

Soru 522Soru →

An organization is preparing to deploy a large-scale batch processing workload using Compute Engine in a newly created Google Cloud project. To ensure a successful deployment following GCP resource governance and quota management best practices, which TWO actions should the Cloud Architect take? (Select TWO.)

Geçerli olan tümünü seçin

Evaluate regional Compute Engine resource quota limits in advance and submit quota increase requests prior to starting deployment.

Assign fine-grained predefined IAM roles to project team members based on least privilege rather than primitive roles.

Grant project team members the primitive Owner role so their resource provisioning actions automatically bypass regional quotas.

Proceed with provisioning instances immediately and submit quota adjustment requests only after encountering quota limit errors.

Cevabı ve açıklamayı göster

Cevap: Evaluate regional Compute Engine resource quota limits in advance and submit quota increase requests prior to starting deployment.; Assign fine-grained predefined IAM roles to project team members based on least privilege rather than primitive roles.

Cevap

The correct actions are to evaluate regional resource quota limits in advance and submit quota increase requests prior to deployment, and to assign fine-grained predefined IAM roles based on least privilege rather than primitive roles.

Proactively requesting quota increases ensures that necessary infrastructure can be provisioned in the target region without hitting default limits. Assigning fine-grained predefined IAM roles enforces security governance and the principle of least privilege across the resource hierarchy.

Adım Adım Çözüm

Review capacity requirements against regional quotas.

Determined required compute capacity and verified default project limits in the target region.

Requesting quota increases ahead of time avoids deployment failures from insufficient regional quota.

Implement identity and access control best practices.

Granted predefined IAM roles to administrators and engineers.

Enforces least privilege access governance while avoiding the risks of primitive roles.

Anahtar Kavram

Managing Resource Quotas, Hierarchies, and Cost Optimization

Tahmini Süre:1m 0s

Soru 523Soru →

A healthcare organization is migrating its digital imaging archive and operational database from an on-premises data center to Google Cloud within a strict 14-day migration window. The data consists of $180\text{ TB}$ of static DICOM medical imaging files and a $1.2\text{ TB}$ transactional PostgreSQL database. The data center has a dedicated $200\text{ Mbps}$ internet connection available for data transfer. The application requires that database downtime during the final cutover must not exceed 1 hour. Which migration strategy should you recommend?

Order a Google Cloud Transfer Appliance to transfer the 180 TB imaging archive offline to Cloud Storage, and use Database Migration Service (DMS) with continuous replication for the PostgreSQL database.

Use Storage Transfer Service to stream both the 180 TB imaging archive and the PostgreSQL database backup directly over the 200 Mbps internet connection.

Migrate the PostgreSQL database by converting it to Cloud Spanner using Storage Transfer Service, while transferring the imaging archive over HA VPN tunnels.

Provision an HA VPN connection over the 200 Mbps link to compress and transfer both the imaging files and the PostgreSQL database before restoring them in Google Cloud.

Cevabı ve açıklamayı göster

Cevap: Order a Google Cloud Transfer Appliance to transfer the 180 TB imaging archive offline to Cloud Storage, and use Database Migration Service (DMS) with continuous replication for the PostgreSQL database.

Cevap

Order a Google Cloud Transfer Appliance for the 180 TB imaging archive and use Database Migration Service (DMS) with continuous replication for the PostgreSQL database.

The correct strategy combines offline physical transfer (Transfer Appliance) for large static archives with continuous online replication (Database Migration Service) for transactional databases. Transferring 180 TB over a 200 Mbps network line would take over 80 days, making offline appliance transport necessary to meet the 14-day window. Meanwhile, Database Migration Service continuously synchronizes PostgreSQL changes over the network, enabling a fast cutover that satisfies the sub-1-hour downtime requirement.

Adım Adım Çözüm

Calculate network transfer time for the unstructured imaging data

Transferring

180\text{ TB}

(

1.44 \times 10^{15}\text{ bits}

) over a

200\text{ Mbps}

(

2 \times 10^8\text{ bps}

) network line requires

\frac{1.44 \times 10^{15}}{2 \times 10^8} = 7,200,000\text{ seconds} \approx 83.3\text{ days}

, exceeding the 14-day window.

Determines whether online streaming or offline appliance transfer is necessary.

Select the offline transfer mechanism for static archives

Use a Google Cloud Transfer Appliance to transport the

180\text{ TB}

static DICOM files offline.

Allows petabyte-scale data ingestion into Cloud Storage without saturating or exceeding the timeline of the network connection.

Select the online database migration mechanism

Use Database Migration Service (DMS) to migrate the

1.2\text{ TB}

PostgreSQL database to Cloud SQL for PostgreSQL with continuous CDC replication.

DMS performs an initial dump and continuously replicates change logs over the network, allowing a near-zero downtime cutover well within the 1-hour requirement.

Anahtar Kavram

Selecting data transfer mechanisms based on bandwidth math and downtime constraints

Soru 524Soru →

An enterprise financial platform operates across multiple Google Cloud folders within an Organization hierarchy. The Site Reliability Engineering (SRE) team is designing a centralized operational logging architecture to route high-severity operational error logs (`severity>=ERROR`) from all current and future projects into a centralized BigQuery dataset located in a dedicated telemetry project `fin-logs-prod`. The solution must ensure that project-level administrators cannot modify or disable the log routing configuration, and the principle of least privilege must be strictly enforced for dataset access. Which TWO configuration steps should you perform to accomplish this architecture?

Geçerli olan tümünü seçin

Create an aggregated log sink at the Organization level configured with the `--include-children` flag and set the destination to the central BigQuery dataset.

Grant the `roles/bigquery.dataEditor` IAM role on the destination BigQuery dataset to the service account writer identity generated by the aggregated log sink.

Grant the primitive `roles/owner` IAM role to the log sink writer identity across the `fin-logs-prod` telemetry project.

Assign the `roles/iam.serviceAccountAdmin` IAM role to workload project service accounts so they can manage the writer identity credentials.

Configure a project-level log exclusion filter containing `severity>=ERROR` in each workload project to prevent duplicate ingestion into project-level buckets.

Cevabı ve açıklamayı göster

Cevap: Create an aggregated log sink at the Organization level configured with the `--include-children` flag and set the destination to the central BigQuery dataset.; Grant the `roles/bigquery.dataEditor` IAM role on the destination BigQuery dataset to the service account writer identity generated by the aggregated log sink.

Cevap

Create an aggregated log sink at the Organization level configured with the `--include-children` flag targeting BigQuery, and grant the `roles/bigquery.dataEditor` role on the target BigQuery dataset to the log sink writer identity service account.

To centralize log routing securely across an enterprise hierarchy without allowing project administrators to override policies, an aggregated sink must be created at the Organization level using the `--include-children` flag. Additionally, to adhere to the principle of least privilege, the sink's unique writer identity service account should only be granted `roles/bigquery.dataEditor` directly on the target BigQuery dataset.

Adım Adım Çözüm

Define organizational scope and central sink deployment

Aggregated sink captures logs from all current and future projects beneath the Organization level

Creating the sink at the Organization level with `--include-children` prevents project admins from modifying the sink settings while enforcing enterprise-wide log aggregation.

Retrieve the unique writer identity created by the aggregated sink

Identified service account formatted as `serviceAccount:[email protected]`

Cloud Logging exports require permission delegation through a system-generated writer service account identity.

Apply least-privilege IAM roles on the target BigQuery dataset resource

Writer identity can insert data into the specific BigQuery dataset without project-level administrative rights

Granting `roles/bigquery.dataEditor` on the dataset ensures least privilege access needed for log ingestion.

Anahtar Kavram

Organizational Aggregated Log Sinks and Least-Privilege IAM Routing

Tahmini Süre:3m 0s

Soru 525Soru →

A cloud engineer needs to provision additional Compute Engine virtual machines for an upcoming batch workload. Upon reviewing the project settings, the engineer discovers that the required core count exceeds the project's current regional CPU quota limit. Which of the following is the standard Google Cloud procedure to ensure the virtual machines can be successfully created?

Submit a regional quota increase request via the Google Cloud Console before running the provisioning deployment.

Assign the Owner primitive IAM role to the deployment service account so it can automatically bypass project quota limits.

Execute the resource creation scripts and allow Compute Engine to automatically request dynamic quota increases upon encountering allocation limits.

Configure the deployment script to store its Infrastructure as Code state file locally to suppress remote quota validation checks.

Cevabı ve açıklamayı göster

Cevap: Submit a regional quota increase request via the Google Cloud Console before running the provisioning deployment.

Cevap

Submit a regional quota increase request via the Google Cloud Console before running the provisioning deployment.

Submitting a quota increase request in advance through the Google Cloud Console ensures that the project has adequate regional quota limits allocated, preventing deployment failure due to resource exhaustion.

Adım Adım Çözüm

Assess current project resource utilization against regional quota boundaries.

Identified that the target CPU core requirement exceeds the existing quota threshold.

Google Cloud enforces quotas per project and region to prevent unexpected cost surges and ensure infrastructure availability.

Request an updated quota limit through the Quotas page in the Google Cloud Console.

The quota increase request is evaluated and applied to the target project.

Quota adjustments must be explicitly requested and approved before deploying capacity beyond current thresholds.

Anahtar Kavram

Managing Resource Quotas

Soru 526Soru →

An enterprise organization operates a multi-folder Google Cloud resource hierarchy. To comply with security governance, the organization must aggregate all Admin Activity and Data Access audit logs across all current and future projects in real time into an external SIEM system, while enabling centralized, agentless threat detection across all workloads. Which solution meets these requirements?

Create an organization-level Cloud Logging aggregated sink routing logs to a Pub/Sub topic connected to the SIEM, and enable Security Command Center Premium with Event Threat Detection.

Grant the Owner primitive IAM role to a central service account across all projects to pull logs via the Logging API, and rely on standard Cloud Monitoring metric thresholds for threat detection.

Configure Data Access audit logs in each project, relying solely on IAM permission boundaries to prevent unauthorized data exfiltration to external Cloud Storage buckets.

Require application teams to export audit logs to Cloud Storage encrypted with Customer-Supplied Encryption Keys (CSEK), and schedule batch transfers using Storage Transfer Service.

Cevabı ve açıklamayı göster

Cevap: Create an organization-level Cloud Logging aggregated sink routing logs to a Pub/Sub topic connected to the SIEM, and enable Security Command Center Premium with Event Threat Detection.

Cevap

Create an organization-level Cloud Logging aggregated sink routing logs to a Pub/Sub topic connected to the SIEM, and enable Security Command Center Premium with Event Threat Detection.

Creating an aggregated log sink at the Google Cloud Organization level ensures all audit logs across all present and future projects within the resource hierarchy are centralized. Exporting these logs to a Pub/Sub topic allows real-time ingestion by an external SIEM system. Combining this with Security Command Center Premium Event Threat Detection enables agentless, real-time threat monitoring directly from audit log streams.

Adım Adım Çözüm

Determine the optimal strategy for organization-wide real-time audit log export.

Configure an aggregated log sink at the Google Cloud Organization resource level targeting a Pub/Sub topic.

Organization-level aggregated sinks automatically include all child folders and projects, ensuring new projects are covered without manual configuration, while Pub/Sub enables real-time streaming to the SIEM.

Select an agentless threat detection mechanism across the cloud footprint.

Enable Security Command Center (SCC) Premium Event Threat Detection.

Event Threat Detection continuously analyzes Cloud Audit Logs streams to uncover suspicious activity (such as malware or unauthorized data access) without requiring agents inside compute instances.

Anahtar Kavram

Centralized Log Aggregation and Agentless Threat Detection using Cloud Logging and Security Command Center

Soru 527Soru →

An enterprise cloud security architect needs to enforce governance guardrails across a Google Cloud organization hierarchy. The mandate requires preventing service account key generation centrally while permitting exceptions for a specific development folder. Additionally, the team must evaluate the impact of restricting external IP attachments on compute instances in production before strict enforcement. Which TWO architectural recommendations achieve these governance objectives?

Geçerli olan tümünü seçin

Apply the boolean constraint `iam.disableServiceAccountKeyCreation` at the Organization root node and configure an inheritance override rule on the non-production Folder node to disable enforcement.

Configure the `compute.vmExternalIpAccess` constraint in dry-run mode at the targeted production Folder node to audit non-compliant public IP configurations in Cloud Audit Logs without interrupting active deployments.

Assign the primitive `roles/owner` role to security administrators at the folder level so they can manually delete service account keys and revoke public IP assignments.

Define a VPC Service Controls security perimeter around production projects to block Compute Engine virtual machines from requesting external IP addresses.

Cevabı ve açıklamayı göster

Cevap: Apply the boolean constraint `iam.disableServiceAccountKeyCreation` at the Organization root node and configure an inheritance override rule on the non-production Folder node to disable enforcement.; Configure the `compute.vmExternalIpAccess` constraint in dry-run mode at the targeted production Folder node to audit non-compliant public IP configurations in Cloud Audit Logs without interrupting active deployments.

Cevap

The cloud architect should apply the `iam.disableServiceAccountKeyCreation` constraint at the organization root with an inheritance override at the non-production folder level, and configure `compute.vmExternalIpAccess` in dry-run mode on the production folder node to audit compliance.

Applying `iam.disableServiceAccountKeyCreation` at the Organization root with a folder-level inheritance override provides centralized governance while allowing exceptions for non-production environments. Configuring `compute.vmExternalIpAccess` in dry-run mode writes violation events to Cloud Audit Logs without blocking workload deployments, enabling risk evaluation prior to full enforcement.

Adım Adım Çözüm

Evaluate central service account key enforcement and inheritance requirements.

Identify that boolean constraint `iam.disableServiceAccountKeyCreation` applied at the Organization root establishes centralized prevention, which can be overridden at lower folder nodes where required.

Google Cloud Organization Policies inherit down the resource hierarchy unless explicit override rules are defined at folder or project levels.

Determine the mechanism for impact evaluation of external IP restrictions.

Select dry-run enforcement mode for the list constraint `compute.vmExternalIpAccess` on the targeted production folder.

Dry-run mode writes audit logs when violations occur without enforcing actual resource creation failure, satisfying the audit-before-enforce requirement.

Analyze distractors involving IAM roles and security perimeters.

Reject primitive role assignments and VPC Service Controls for resource constraint governance.

Primitive roles violate least privilege governance, and VPC Service Controls guard against perimeter data exfiltration rather than managing internal resource configuration attributes.

Anahtar Kavram

Hierarchy Inheritance and Policy Overrides with Dry-Run Audit Enforcement

Soru 528Soru →

When designing a new cloud solution on Google Cloud, an architect documents the system across different abstraction levels. Arrange the architectural views in order from the highest level of abstraction (business-focused) to the lowest level of abstraction (concrete infrastructure implementation).

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence from highest to lowest abstraction is Conceptual Architecture, followed by Logical Architecture, and finally Physical Architecture.

The design process moves progressively from high abstraction to concrete execution: first establishing business requirements (Conceptual), then structuring functional components and data flows (Logical), and finally specifying exact Google Cloud services and network topologies (Physical).

Adım Adım Çözüm

Identify the conceptual phase.

Conceptual architecture focuses strictly on business capabilities and high-level requirements without technological commitments.

Designing starts by understanding business domain boundaries and strategic objectives at the highest level of abstraction.

Identify the logical phase.

Logical architecture breaks down conceptual needs into functional tiers, data flows, and interactions.

Before selecting specific vendors or products, functional components and communication patterns must be defined.

Identify the physical phase.

Physical architecture maps logical components directly into concrete Google Cloud services and infrastructure configurations.

Physical design is the final, lowest-abstraction implementation stage where specific technical resources (e.g., GKE, Cloud Spanner, VPCs) are selected and configured.

Anahtar Kavram

Architectural Abstraction Layers (Conceptual vs. Logical vs. Physical)

Soru 529Soru →

An enterprise organization maintains a central Hub VPC network connected to an on-premises data center using Dedicated Cloud Interconnect with Cloud Router dynamic routing. The architecture team provisions two new isolated workloads in Spoke-1 VPC and Spoke-2 VPC, both of which are connected to the central Hub VPC using VPC Network Peering. The application team requires direct private connectivity between Spoke-1 VPC and Spoke-2 VPC, as well as two-way routing between both Spoke VPCs and the on-premises network. Which TWO architectural modifications must be implemented to fulfill these requirements without introducing virtual routing appliances? (Select TWO.)

Geçerli olan tümünü seçin

Create a direct VPC Network Peering connection between Spoke-1 VPC and Spoke-2 VPC.

Enable custom route import and export on the VPC Network Peering connections between the central Hub VPC and each Spoke VPC.

Configure the existing VPC Network Peering connections between Spoke-1 VPC, Hub VPC, and Spoke-2 VPC to operate in transitive routing mode.

Replace the Dedicated Cloud Interconnect with HA Cloud VPN tunnels between on-premises and each Spoke VPC to automatically bypass Hub routing restrictions.

Deploy a single VPC Service Controls perimeter encompassing Spoke-1 VPC, Spoke-2 VPC, and Hub VPC to allow network traffic flow across perimeters.

Cevabı ve açıklamayı göster

Cevap: Create a direct VPC Network Peering connection between Spoke-1 VPC and Spoke-2 VPC.; Enable custom route import and export on the VPC Network Peering connections between the central Hub VPC and each Spoke VPC.

Cevap

Establish a direct VPC Network Peering connection between Spoke-1 VPC and Spoke-2 VPC, and enable custom route import/export on the VPC Network Peering connections between the central Hub VPC and each Spoke VPC.

VPC Network Peering in Google Cloud is strictly non-transitive. To enable direct private communication between Spoke-1 VPC and Spoke-2 VPC, a direct peering link must be established between them. Additionally, to extend on-premises connectivity from the Hub VPC's Cloud Interconnect to the spokes, custom routes must be exported from the Hub VPC peering connection and imported by the Spoke VPC peering connections.

Adım Adım Çözüm

Evaluate inter-spoke routing constraints under GCP networking rules.

Recognize that VPC Network Peering is non-transitive, meaning Spoke-1 cannot communicate with Spoke-2 via the Hub VPC.

Direct peering between Spoke-1 VPC and Spoke-2 VPC must be configured to allow low-latency, private inter-spoke traffic.

Determine how on-premises routes learned by Cloud Router in the Hub VPC can be extended to spoke VPC networks.

Identify that custom route export must be enabled on the Hub VPC peering side and custom route import on the Spoke VPC peering sides.

Importing and exporting custom routes allows the BGP-learned on-premises routes to propagate dynamically across peered networks without extra routing appliances.

Anahtar Kavram

VPC Network Peering Non-Transitivity and Custom Route Exchange

Soru 530Soru →

An enterprise logistics organization is designing the architecture on Google Cloud for two new distinct internal applications. The first application is an event-driven stateless HTTP webhook service that receives unpredictable bursty traffic and must scale to zero instances during quiet hours to minimize idle costs. The second application is a legacy backend routing daemon that requires custom OS kernel network parameters (sysctl tuning) and raw non-HTTP TCP protocol bindings. Which TWO compute architecture options should you select to meet these technical requirements while minimizing operational overhead? (Select TWO)

Geçerli olan tümünü seçin

Deploy the stateless event-driven HTTP webhook service to fully managed Cloud Run.

Deploy the legacy backend routing daemon requiring kernel sysctl tuning to Compute Engine Virtual Machines.

Deploy the stateless event-driven HTTP webhook service onto a dedicated Google Kubernetes Engine (GKE) Standard cluster.

Deploy the legacy backend routing daemon to Cloud Run by packaging the custom sysctl kernel modules inside the container image.

Purchase 3-year Committed Use Discounts (CUDs) for the peak resource requirements of the stateless HTTP webhook service.

Cevabı ve açıklamayı göster

Cevap: Deploy the stateless event-driven HTTP webhook service to fully managed Cloud Run.; Deploy the legacy backend routing daemon requiring kernel sysctl tuning to Compute Engine Virtual Machines.

Cevap

Select Cloud Run for the stateless HTTP webhook service and Compute Engine VMs for the legacy backend routing daemon.

Cloud Run provides serverless stateless container execution with scale-to-zero functionality, perfectly matching the HTTP webhook workload while minimizing operational overhead. Compute Engine provides root-level OS access and kernel customizability needed for sysctl tuning and custom network protocols.

Adım Adım Çözüm

Analyze requirements for the first application (stateless HTTP, bursty traffic, scale-to-zero requirement).

Fully managed Cloud Run fits stateless HTTP microservices with zero-instance scaling capability and zero baseline operational cost.

Cloud Run abstracts cluster management while providing pay-per-use request scaling down to zero.

Analyze requirements for the second application (custom OS kernel parameters, sysctl tuning, raw TCP).

Compute Engine Virtual Machines provide full OS access needed to modify kernel sysctl parameters and run non-HTTP network protocols.

Serverless container platforms like Cloud Run run in restricted sandboxes and do not allow host kernel modification.

Anahtar Kavram

Selecting GCP Compute Platforms based on statefulness, OS control, scaling characteristics, and operational overhead.

Soru 531Soru →

Your cloud architecture team needs to migrate a local Terraform state file containing critical Google Cloud infrastructure to a centralized, multi-user Google Cloud Storage (GCS) remote backend with state locking and service account impersonation. What is the correct sequence of steps to perform this state migration securely?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with provisioning a GCS bucket with Object Versioning, followed by defining the backend configuration block in code, authenticating via service account impersonation, and finally running terraform init with the -migrate-state flag to copy local state to GCS.

Migrating Terraform state requires establishing the underlying storage bucket first, updating the codebase to point to the new backend, authenticating the CLI session with short-lived service account credentials, and invoking terraform init with the -migrate-state flag to copy local state objects safely.

Adım Adım Çözüm

Provision the destination Cloud Storage bucket configured with Object Versioning.

A secure GCS bucket is created to store state snapshots and protect against state corruption.

Terraform cannot create its own backend storage bucket automatically during state initialization; the bucket resource must pre-exist.

Configure the `backend "gcs"` block in the main Terraform module.

The Terraform CLI is informed of the new remote backend target location.

Terraform requires the target backend declared in source code to recognize that state migration is requested.

Authenticate to GCP and assume the deployment service account identity.

The active session gains short-lived IAM credentials required for bucket access.

State operations require direct object read/write and locking access to the GCS bucket.

Execute `terraform init -migrate-state` in the directory containing the local state.

Terraform copies state items from local disk into GCS and locks the state file.

The `-migrate-state` flag instructs Terraform to safely copy state resources to the newly configured remote backend.

Anahtar Kavram

Terraform Remote State Migration to GCS with Locking and Versioning

Soru 532Soru →

A cloud administrator needs to ensure that Compute Engine virtual machines created within a specific environment folder cannot be assigned public IP addresses. Which Google Cloud mechanism should be used to enforce this restriction across all projects within that folder?

Apply the `constraints/compute.vmExternalIpAccess` Organization Policy constraint at the target folder level to restrict external IP addresses.

Grant the primitive Owner role (`roles/owner`) to project administrators so they can audit and remove public IP configurations.

Define a VPC Service Controls perimeter around the folder to block external network interface configuration.

Assign the Service Account User role (`roles/iam.serviceAccountUser`) to developers across all projects in the folder.

Cevabı ve açıklamayı göster

Cevap: Apply the `constraints/compute.vmExternalIpAccess` Organization Policy constraint at the target folder level to restrict external IP addresses.

Cevap

Apply the `constraints/compute.vmExternalIpAccess` Organization Policy constraint at the target folder level to restrict external IP addresses.

Applying the `constraints/compute.vmExternalIpAccess` Organization Policy constraint at the folder level programmatically prevents any VM created within child projects from receiving external IP addresses, fulfilling the organizational compliance mandate.

Adım Adım Çözüm

Identify the governance requirement.

The requirement is to prevent VM instances from receiving public IP addresses across an entire folder.

Centralized resource configuration guardrails are managed via Organization Policies.

Select the appropriate constraint.

The `constraints/compute.vmExternalIpAccess` constraint defines rules governing external IP address configuration on Compute Engine instances.

Applying this constraint at a folder node ensures all child projects automatically inherit the policy restriction.

Anahtar Kavram

Organization Policies and Constraints

Soru 533Soru →

An online retail platform uses Cloud Build to automate continuous deployment of microservices to Google Kubernetes Engine (GKE) clusters across staging and production environments. To maintain strict security and governance, the deployment pipeline must run with the minimum permissions required to impersonate the workload's runtime service account, while ensuring that automated Terraform infrastructure updates prevent concurrent state corruption. Which architecture strategy should the cloud team implement?

Grant the Cloud Build service account the Service Account User role (roles/iam.serviceAccountUser) on the runtime service account, and configure a Cloud Storage backend with object versioning and state locking for Terraform state management.

Grant the Cloud Build service account the Service Account Admin role (roles/iam.serviceAccountAdmin) across the project, and store Terraform state files in a local directory during pipeline execution.

Grant the primitive Owner role to the Cloud Build service account, and maintain Terraform state files in an unversioned Cloud Storage bucket without state locking.

Grant the Cloud Build service account the Service Account User role on the runtime service account, and save Terraform state locally within the Cloud Build workspace container.

Cevabı ve açıklamayı göster

Cevap: Grant the Cloud Build service account the Service Account User role (roles/iam.serviceAccountUser) on the runtime service account, and configure a Cloud Storage backend with object versioning and state locking for Terraform state management.

Cevap

Granting the Service Account User role (roles/iam.serviceAccountUser) on the specific runtime service account to the Cloud Build service account follows least privilege for workload execution. Configuring a remote Cloud Storage backend with state locking and object versioning secures Terraform state against concurrency conflicts and corruption.

The correct strategy enforces the principle of least privilege by granting the Cloud Build service account the Service Account User role specifically on the runtime service account rather than project-wide admin permissions. Concurrently, managing Terraform state using a remote Cloud Storage backend with object versioning and state locking ensures that automated pipeline runs do not suffer from state loss or concurrent execution conflicts.

Adım Adım Çözüm

Analyze the IAM permission requirements for pipeline execution

Determined that the Cloud Build service account only needs to impersonate/attach the runtime service account, which requires roles/iam.serviceAccountUser on the target service account resource.

Granting roles/iam.serviceAccountAdmin or primitive roles violates the principle of least privilege.

Analyze the Infrastructure as Code (IaC) state management requirements

Identified that Terraform state must be stored in a centralized remote location with locking (Cloud Storage backend) to prevent concurrent writes.

Ephemeral local storage within Cloud Build runners loses state between builds, causing state corruption and resource duplication.

Combine security and state management solutions

Selected the approach pairing roles/iam.serviceAccountUser on the target identity with a versioned, lock-enabled Cloud Storage backend.

This satisfies both zero-trust access control and robust automated CI/CD state governance.

Anahtar Kavram

Continuous Deployment Pipeline Security and Declarative Infrastructure State Governance

Tahmini Süre:2m 0s

Soru 534Soru →

A DevOps engineer needs to configure access for a service account so that deployment pipelines can attach it to newly created Compute Engine virtual machine instances within a development project. The pipeline should not be granted administrative control over other service accounts or broad management rights over project resources. Which IAM role assignment strategy follows Google Cloud's principle of least privilege?

Grant the Service Account User role (roles/iam.serviceAccountUser) on the specific target service account resource.

Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) at the project level.

Grant the primitive Editor role (roles/editor) on the parent folder containing the project.

Configure VPC Service Controls perimeter rules without assigning IAM permissions.

Cevabı ve açıklamayı göster

Cevap: Grant the Service Account User role (roles/iam.serviceAccountUser) on the specific target service account resource.

Cevap

Grant the Service Account User role (roles/iam.serviceAccountUser) on the specific target service account resource.

Granting the Service Account User role (roles/iam.serviceAccountUser) bound specifically to the target service account resource allows the deployment identity to attach that service account to Compute Engine instances. This directly satisfies the requirement using the fine-grained predefined role and narrowest resource scope possible.

Adım Adım Çözüm

Identify the minimal permission required for compute workload deployment.

The deployment identity only requires permission to bind/use the service account with compute resources.

Attaching a service account to a Compute Engine instance requires the iam.serviceAccounts.actAs permission.

Evaluate the standard IAM predefined role that grants the actAs permission.

The Service Account User role (roles/iam.serviceAccountUser) provides the necessary actAs capability.

This role allows principals to attach the service account to GCP resources.

Select the narrowest resource scope in the GCP hierarchy.

Binding the role directly on the target service account identity limits access to only that specific resource.

Resource hierarchy inheritance allows fine-grained IAM policy bindings directly on individual service account resources.

Anahtar Kavram

Applying Least Privilege with Service Account User Roles and Hierarchy Scoping

Soru 535Soru →

A cloud security architect is establishing central governance controls across an enterprise Google Cloud environment. The security policy mandates two key compliance rules for all projects residing under the 'Production' folder: first, cloud resources must only be provisioned within US regions; second, developers must be prevented from creating user-managed service account keys. Which TWO administrative actions should the architect perform to enforce these controls? (Select TWO.)

Geçerli olan tümünü seçin

Apply the `constraints/gcp.resourceLocations` Organization Policy on the 'Production' folder and configure it to allow location values matching `in:us-locations`.

Grant the primitive Owner role (`roles/owner`) at the folder level to security administrators while revoking compute deployment roles from developers.

Apply the `constraints/iam.disableServiceAccountKeyCreation` Organization Policy on the 'Production' folder and set its enforcement to enabled.

Configure a VPC Service Controls perimeter around the 'Production' folder and configure an egress policy blocking key management service calls.

Cevabı ve açıklamayı göster

Cevap: Apply the `constraints/gcp.resourceLocations` Organization Policy on the 'Production' folder and configure it to allow location values matching `in:us-locations`.; Apply the `constraints/iam.disableServiceAccountKeyCreation` Organization Policy on the 'Production' folder and set its enforcement to enabled.

Cevap

The correct configuration requires applying two distinct Organization Policies at the folder level: setting `constraints/gcp.resourceLocations` to restrict allowed regions to `in:us-locations`, and enabling `constraints/iam.disableServiceAccountKeyCreation` to block user-managed key creation.

Organization Policies provide centralized constraint management across the resource hierarchy. Applying `constraints/gcp.resourceLocations` configured for `in:us-locations` restricts deployment locations to US regions. Concurrently, enforcing `constraints/iam.disableServiceAccountKeyCreation` prevents service account key generation for all projects under the targeted folder.

Adım Adım Çözüm

Identify the appropriate policy mechanism for location restrictions

The `constraints/gcp.resourceLocations` list constraint allows governance teams to define allowed location groups (such as `in:us-locations`) across inherited project hierarchies.

Organization policies provide centralized, declarative rules to restrict resource provisioning parameters regardless of IAM permissions.

Identify the appropriate policy mechanism for blocking service account key creation

The boolean constraint `constraints/iam.disableServiceAccountKeyCreation` prevents users from creating external service account keys when enforced.

Restricting long-lived credential creation reduces security risk and forces reliance on short-lived tokens or Workload Identity.

Determine the optimal resource hierarchy scope for enforcement

Applying both constraints to the 'Production' folder ensures automatic inheritance across all current and future production projects.

Organization policies inherit down the resource hierarchy from folders to child projects.

Anahtar Kavram

Centralized Governance using Google Cloud Organization Policies and Hierarchy Constraints

Soru 536Soru →

A Site Reliability Engineering (SRE) team needs to set up real-time operational alerting whenever application logs contain critical error events. Sequence the correct administrative steps required to construct a metric-based alerting workflow from Cloud Logging to Cloud Monitoring.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with writing the log filter query in Cloud Logging to select error logs, followed by creating a counter log-based metric from that filter, configuring a notification channel in Cloud Monitoring, and finally constructing an alerting policy that evaluates the log-based metric threshold and targets the notification channel.

The operational workflow begins by isolating relevant log entries using a log filter in Cloud Logging. Once filtered, a counter log-based metric is created to translate these log events into time-series data. Next, a notification channel is defined in Cloud Monitoring to serve as the alert destination. Finally, an alerting policy is created that monitors the custom log-based metric against specified thresholds and dispatches notifications via the defined channel.

Adım Adım Çözüm

Write a log filter query in Cloud Logging.

Identifies and isolates relevant application error log entries.

Log entries must be selected via a log filter before a log-based metric can aggregate them.

Create a counter log-based metric in Cloud Logging.

Converts log count data into a time-series metric available in Cloud Monitoring.

Cloud Monitoring alerting policies operate on time-series metrics rather than unaggregated log streams.

Set up a notification channel in Cloud Monitoring.

Establishes a destination (e.g., Email, Webhook, PagerDuty) for operational notifications.

An alerting policy requires a valid notification channel to dispatch alerts when triggered.

Create an alerting policy referencing the log-based metric and notification channel.

Enables automated monitoring of the metric rate and triggers incidents when thresholds are crossed.

Combines the metric condition threshold and notification endpoint into an active operational monitoring rule.

Anahtar Kavram

Log-based metric creation and operational alerting workflow

Soru 537Soru →

An IoT smart city energy utility enterprise is designing its cloud solution architecture on Google Cloud to handle device management and telemetry processing. The architecture comprises two distinct workloads:

1. A stateless HTTP ingestion endpoint receiving intermittent spikes of JSON payloads from smart meters. The service must scale rapidly during peak hours, scale down to zero instances when idle to reduce costs, and require minimal infrastructure management.
2. A specialized network protocol parser running a long-lived daemon that requires custom OS kernel sysctl modifications for low-level socket buffer tuning and high-speed local NVMe scratch disk access.

Which TWO architectural choices should you select to meet these requirements with optimal operational efficiency? (Select TWO.)

Geçerli olan tümünü seçin

Deploy the stateless HTTP ingestion endpoint on Cloud Run with container concurrency and auto-scaling configured.

Deploy the specialized network protocol parser on Google Kubernetes Engine (GKE) nodes configured with local SSD storage and custom node system configurations for sysctl tuning.

Deploy the stateless HTTP ingestion endpoint on a dedicated Google Kubernetes Engine (GKE) Standard cluster configured with Horizontal Pod Autoscaler.

Deploy the specialized network protocol parser on Cloud Run by packaging the custom sysctl parameters into the container build manifest.

Deploy the stateless HTTP ingestion endpoint on a Compute Engine Managed Instance Group (MIG) behind an External HTTP(S) Load Balancer.

Cevabı ve açıklamayı göster

Cevap: Deploy the stateless HTTP ingestion endpoint on Cloud Run with container concurrency and auto-scaling configured.; Deploy the specialized network protocol parser on Google Kubernetes Engine (GKE) nodes configured with local SSD storage and custom node system configurations for sysctl tuning.

Cevap

Select the stateless HTTP ingestion endpoint deployment on Cloud Run, and the specialized network protocol parser deployment on Google Kubernetes Engine (GKE) with custom node configuration and Local SSDs.

Cloud Run is the optimal compute platform for stateless HTTP services with variable traffic because it automatically scales down to zero when idle and eliminates server maintenance overhead. For workloads requiring custom host OS kernel modifications (sysctl parameters) and direct hardware attachments like Local SSDs, Google Kubernetes Engine (GKE) provides the necessary node configuration flexibility while remaining a managed orchestration platform.

Adım Adım Çözüm

Analyze workload 1 requirements

Workload 1 requires stateless HTTP processing, rapid autoscaling to zero, and minimal operational overhead.

Cloud Run fits fully managed stateless HTTP container requirements perfectly without incurring node baseline costs or cluster administration duties.

Analyze workload 2 requirements

Workload 2 requires host kernel parameter tuning (sysctl) and high-speed local NVMe disk access.

GKE allows custom sysctl settings via system configuration and supports Local SSD node pools, whereas fully managed serverless environments restrict host kernel modification and direct hardware access.

Anahtar Kavram

Selecting GCP Compute Platforms based on workload statefulness, scaling characteristics, kernel tuning demands, and operational overhead limits.

Soru 538Soru →

An organization needs to prevent authorized users from exfiltrating sensitive data stored in Cloud Storage buckets to unauthorized external locations outside the organization, even if the users possess valid IAM read permissions. Which Google Cloud security feature should be implemented to enforce this perimeter boundary?

Configure VPC Service Controls to establish a security perimeter around Cloud Storage resources.

Rely exclusively on fine-grained IAM Storage Object Viewer roles assigned to trusted users.

Assign primitive Owner roles to service accounts to restrict resource modification permissions.

Enforce Customer-Supplied Encryption Keys (CSEK) for all data written to the Cloud Storage buckets.

Cevabı ve açıklamayı göster

Cevap: Configure VPC Service Controls to establish a security perimeter around Cloud Storage resources.

Cevap

Configure VPC Service Controls to establish a security perimeter around Cloud Storage resources.

VPC Service Controls allow security teams to define perimeters around Google Cloud APIs and resources like Cloud Storage. This blocks data egress and prevents unauthorized data transfers to resources outside the perimeter, even when the request is made by an authenticated user with valid IAM permissions.

Adım Adım Çözüm

Analyze the security requirement.

The target requirement is to prevent exfiltration of data to unauthorized external locations by users who have legitimate IAM access.

Standard IAM authorization allows reading data, but does not constrain where that data can be transferred.

Select the appropriate network perimeter control in GCP.

VPC Service Controls define network security perimeters around GCP services.

VPC Service Controls restrict egress communication and API access to resources strictly within the defined security perimeter.

Anahtar Kavram

Data exfiltration prevention with VPC Service Controls

Soru 539Soru →

A regional financial enterprise is building a core transaction processing system hosted entirely in a single Google Cloud region (us-east4). The workload requires full SQL compliance, complex table joins, strict ACID transactional consistency, high availability with automatic cross-zone failover, and point-in-time recovery. The enterprise security policy dictates that encryption keys must be managed centrally by the internal security team using Cloud KMS with automated key rotation. To control operational expenditure, the enterprise explicitly wants to avoid paying for globally distributed database infrastructure when regional scope is sufficient. Which storage and database architecture should you recommend to meet these requirements?

Deploy Cloud SQL for PostgreSQL configured with High Availability (HA) across multiple zones within the region, and configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS.

Deploy a multi-region Cloud Spanner instance configured with Customer-Managed Encryption Keys (CMEK) integrated with Cloud KMS.

Deploy Cloud SQL for PostgreSQL configured with High Availability (HA) across multiple zones, and implement Customer-Supplied Encryption Keys (CSEK) managed in local application deployment manifests.

Deploy a single-zone Cloud SQL instance with IAM database authentication enabled, relying on strict IAM permission controls alone to prevent data exfiltration across the perimeter.

Cevabı ve açıklamayı göster

Cevap: Deploy Cloud SQL for PostgreSQL configured with High Availability (HA) across multiple zones within the region, and configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS.

Cevap

Deploy Cloud SQL for PostgreSQL configured with High Availability (HA) across multiple zones within the region, and configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS.

The option advocating Cloud SQL for PostgreSQL configured with High Availability and Customer-Managed Encryption Keys (CMEK) directly addresses all requirements. High Availability mode provisions a standby instance in a second zone within the target region to guarantee automatic failover and point-in-time recovery for relational ACID transactions. CMEK leverages Cloud KMS for key governance as required by security policy, while avoiding the cost overhead of multi-region database engines.

Adım Adım Çözüm

Analyze database functional and spatial scope requirements.

The application requires relational SQL capabilities, ACID compliance, and zone redundancy within a single GCP region without requiring multi-region global replication.

Matching workload scope prevents over-provisioning expensive global resources.

Evaluate database service suitability.

Cloud SQL for PostgreSQL with High Availability provides cross-zone synchronous replication and automatic failover within a single region, satisfying all operational needs cost-effectively.

Cloud Spanner provides global multi-region scale but introduces unnecessary expense and complexity for single-region requirements.

Evaluate encryption key management governance constraints.

Customer-Managed Encryption Keys (CMEK) via Cloud KMS allow central security teams to control and rotate key access policies natively in GCP.

CMEK meets centralized Cloud KMS key management policies, whereas CSEK requires manual application-side key handling.

Anahtar Kavram

Selecting optimal regional relational storage services and CMEK encryption architecture based on architectural scope and cost governance.

Tahmini Süre:3m 0s

Soru 540Soru →

A financial enterprise is updating its cloud governance posture across its Google Cloud resource hierarchy. The lead security architect needs to enforce two enterprise-wide governance requirements across all projects under the Production folder:

1. Prevent cloud engineers from generating long-lived service account JSON keys.
2. Prevent Compute Engine virtual machines from being assigned external public IP addresses.

Which TWO Organization Policy constraints must the architect enforce at the Production folder level to satisfy these compliance requirements? (Select TWO.)

Geçerli olan tümünü seçin

Enforce constraints/iam.disableServiceAccountKeyCreation

Enforce constraints/compute.vmExternalIpAccess set to Deny All

Assign primitive IAM Viewer roles to developers and revoke Service Account Admin permissions across the folder

Configure a VPC Service Controls perimeter around the Production folder and block all egress traffic to external IP addresses

Cevabı ve açıklamayı göster

Cevap: Enforce constraints/iam.disableServiceAccountKeyCreation; Enforce constraints/compute.vmExternalIpAccess set to Deny All

Cevap

The correct options are enforcing constraints/iam.disableServiceAccountKeyCreation and enforcing constraints/compute.vmExternalIpAccess set to Deny All at the folder level.

Enforcing `constraints/iam.disableServiceAccountKeyCreation` prevents users from creating new service account keys within the target hierarchy. Enforcing `constraints/compute.vmExternalIpAccess` with a deny policy blocks VM instances from being configured with external IP addresses. Together, these two Organization Policies directly fulfill both security governance mandates.

Adım Adım Çözüm

Identify the requirement to disable long-lived service account JSON keys across the folder hierarchy.

Select the boolean organization policy constraint `constraints/iam.disableServiceAccountKeyCreation`.

Organization policies enforce centralized resource constraints across inherited folders and projects.

Identify the requirement to restrict Compute Engine instances from receiving external public IP addresses.

Select the list organization policy constraint `constraints/compute.vmExternalIpAccess` and set it to block/deny external IP attachment.

This constraint specifically restricts external IP configuration on VM network interfaces.

Anahtar Kavram

Organization Policies for IAM and Compute Security Controls

ÖncekiSayfa 27 / 80Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram