Associate Cloud Engineer Free Practice Questions — Page 10
Question 92
You are running multiple microservices in a Kubernetes Engine cluster. One microservice is rendering images. The microservice responsible for the image rendering requires a large amount of CPU time compared to the memory it requires. The other microservices are workloads that are optimized for n2-standard machine types. You need to optimize your cluster so that all workloads are using resources as efficiently as possible. What should you do?
A. Assign the pods of the image rendering microservice a higher pod priority than the other microservices.
B. Create a node pool with compute-optimized machine type nodes for the image rendering microservice. Use the node pool with general-purpose machine type nodes for the other microservices.
C. Use the node pool with general-purpose machine type nodes for the image rendering microservice. Create a node pool with compute-optimized machine type nodes for the other microservices.
D. Configure the required amount of CPU and memory in the resource requests specification of the image rendering microservice deployment. Keep the resource requests for the other microservices at the default.
Show Answer
Correct Answer: B
Explanation: Use separate node pools with machine types matched to workload characteristics. The image rendering service is CPU-intensive and benefits from compute-optimized machine types, while the other microservices are already optimized for n2-standard (general-purpose) nodes. This improves resource efficiency and scheduling without affecting workload priorities.
Question 93
You are working in a team that has developed a new application that needs to be deployed on Kubernetes. The production application is business critical and should be optimized for reliability. You need to provision a Kubernetes cluster and want to follow Google-recommended practices. What should you do?
A. Create a GKE Autopilot cluster. Enroll the cluster in the rapid release channel.
B. Create a GKE Autopilot cluster. Enroll the cluster in the stable release channel.
C. Create a zonal GKE standard cluster. Enroll the cluster in the stable release channel.
D. Create a regional GKE standard cluster. Enroll the cluster in the rapid release channel.
Show Answer
Correct Answer: B
Explanation: Google generally recommends GKE Autopilot as the default mode for most workloads because it provides a managed, opinionated configuration that improves operational reliability. For a business-critical production application optimized for reliability, the stable release channel is preferred over rapid because it receives the most mature Kubernetes versions with more validation before rollout. Option C uses a zonal cluster, which is less reliable than regional, but the question emphasizes following Google-recommended practices; Autopilot is the recommended default. Option D uses the rapid channel, which is not appropriate for maximizing stability.
Question 94
You have a Bigtable instance that consists of three nodes that store personally identifiable information (PII) data. You need to log all read or write operations, including any metadata or configuration reads of this database table, in your company’s Security Information and Event Management (SIEM) system. What should you do?
A. • Navigate to Cloud Monitoring in the Google Cloud console, and create a custom monitoring job for the Bigtable instance to track all changes. • Create an alert by using webhook endpoints, with the SIEM endpoint as a receiver.
B. • Navigate to the Audit Logs page in the Google Cloud console, and enable Admin Write logs for the Bigtable instance. • Create a Cloud Functions instance to export logs from Cloud Logging to your SIEM.
C. • Navigate to the Audit Logs page in the Google Cloud console, and enable Data Read, Data Write and Admin Read logs for the Bigtable instance. • Create a Pub/Sub topic as a Cloud Logging sink destination, and add your SIEM as a subscriber to the topic.
D. • Install the Ops Agent on the Bigtable instance during configuration. • Create a service account with read permissions for the Bigtable instance. • Create a custom Dataflow job with this service account to export logs to the company’s SIEM system.
Show Answer
Correct Answer: C
Explanation: To capture all read and write operations as well as metadata/configuration reads for Cloud Bigtable, you must enable the relevant Cloud Audit Logs: Data Read, Data Write, and Admin Read. Data Access logs (Data Read/Data Write/Admin Read) are disabled by default and must be enabled. Export the resulting Cloud Logging entries via a Logging sink to Pub/Sub, which is a standard integration point for forwarding logs to an external SIEM. Monitoring and Ops Agent do not provide audit logging, and Admin Write alone would not capture data reads/writes.
Question 95
You recently discovered that your developers are using many service account keys during their development process. While you work on a long term improvement, you need to quickly implement a process to enforce short-lived service account credentials in your company. You have the following requirements:
• All service accounts that require a key should be created in a centralized project called pj-sa.
• Service account keys should only be valid for one day.
You need a Google-recommended solution that minimizes cost. What should you do?
A. Implement a Cloud Run job to rotate all service account keys periodically in pj-sa. Enforce an org policy to deny service account key creation with an exception to pj-sa.
B. Implement a Kubernetes CronJob to rotate all service account keys periodically. Disable attachment of service accounts to resources in all projects with an exception to pj-sa.
C. Enforce an org policy constraint allowing the lifetime of service account keys to be 24 hours. Enforce an org policy constraint denying service account key creation with an exception on pj-sa.
D. Enforce a DENY org policy constraint over the lifetime of service account keys for 24 hours. Disable attachment of service accounts to resources in all projects with an exception to pj-sa.
Show Answer
Correct Answer: C
Explanation: Use Organization Policy constraints to enforce a maximum service account key lifetime of 24 hours and to deny service account key creation everywhere except the centralized project (pj-sa). This is the Google-recommended, policy-based approach that minimizes operational overhead and cost. Options requiring custom rotation jobs add unnecessary maintenance, and the key expiry constraint is an allow/list-style constraint rather than a DENY constraint.
Question 96
Your company is running a three-tier web application on virtual machines that use a MySQL database. You need to create an estimated total cost of cloud infrastructure to run this application on Google Cloud instances and Cloud SQL. What should you do?
A. Create a Google spreadsheet with multiple Google Cloud resource combinations. On a separate sheet, import the current Google Cloud prices and use these prices for the calculations within formulas.
B. Use the Google Cloud Pricing Calculator and select the Cloud Operations template to define your web application with as much detail as possible.
C. Implement a similar architecture on Google Cloud, and run a reasonable load test on a smaller scale. Check the billing information, and calculate the estimated costs based on the real load your system usually handles.
D. Use the Google Cloud Pricing Calculator to determine the cost of every Google Cloud resource you expect to use. Use similar size instances for the web server, and use your current on-premises machines as a comparison for Cloud SQL.
Show Answer
Correct Answer: D
Explanation: The recommended way to estimate Google Cloud infrastructure costs is to use the Google Cloud Pricing Calculator by adding each expected resource (such as Compute Engine VMs and Cloud SQL) and configuring them to match the anticipated workload. Option B refers to a 'Cloud Operations template,' which is not the appropriate approach for estimating a three-tier application's infrastructure costs. Option A is manual and unnecessary, while Option C requires deploying infrastructure instead of using the intended estimation tool.
Question 97
You are using Looker Studio to visualize a table from your data warehouse that is built on top of BigQuery. Data is appended to the data warehouse during the day. At night, the daily summary is recalculated by overwriting the table. You just noticed that the charts in Looker Studio are broken, and you want to analyze the problem. What should you do?
A. In Cloud Logging, create a filter for your Looker Studio report.
B. Use the open source CLI tool, Snapshot Debugger, to find out why the data was not refreshed correctly.
C. Review the Error Reporting page in the Google Cloud console to find any errors.
D. Use the BigQuery interface to review the nightly job and look for any errors.
Show Answer
Correct Answer: D
Explanation: The charts broke after the nightly process that overwrites the BigQuery table. The most direct place to investigate is the BigQuery job history and execution details for the overwrite job to identify failures, schema changes, or other errors that would affect Looker Studio. Cloud Logging and Error Reporting are less targeted for diagnosing a BigQuery table refresh issue, and Snapshot Debugger is unrelated to BigQuery data refreshes.
Question 98
Your company wants to migrate their on-premises workloads to Google Cloud. The current on-premises workloads consist of:
• A Flask web application
• A backend API
• A scheduled long-running background job for ETL and reporting
You need to keep operational costs low. You want to follow Google-recommended practices to migrate these workloads to serverless solutions on Google Cloud. What should you do?
A. Migrate the web application to App Engine and the backend API to Cloud Run. Use Cloud Tasks to run your background job on Compute Engine.
B. Migrate the web application to App Engine and the backend API to Cloud Run. Use Cloud Tasks to run your background job on Cloud Run.
C. Run the web application on a Cloud Storage bucket and the backend API on Cloud Run. Use Cloud Tasks to run your background job on Cloud Run.
D. Run the web application on a Cloud Storage bucket and the backend API on Cloud Run. Use Cloud Tasks to run your background job on Compute Engine.
Show Answer
Correct Answer: B
Explanation: The goal is to migrate to serverless services while keeping operational costs low. App Engine is a suitable managed platform for a Flask web application, Cloud Run is well suited for containerized backend APIs, and using Cloud Tasks to trigger Cloud Run keeps the background processing serverless. Options using Compute Engine are not fully serverless, and serving a Flask web application from Cloud Storage is inappropriate because Cloud Storage only hosts static websites.
Question 99
You want to set up a Google Kubernetes Engine cluster. Verifiable node identity and integrity are required for the cluster, and nodes cannot be accessed from the internet. You want to reduce the operational cost of managing your cluster, and you want to follow Google-recommended practices. What should you do?
A. Deploy a private autopilot cluster.
B. Deploy a public autopilot cluster.
C. Deploy a standard public cluster and enable shielded nodes.
D. Deploy a standard private cluster and enable shielded nodes.
Show Answer
Correct Answer: A
Explanation: A private Autopilot cluster best satisfies all requirements: Autopilot minimizes cluster management overhead in line with Google-recommended practices, private clusters prevent nodes from being directly accessible from the internet, and Shielded GKE Nodes (providing verifiable node identity and integrity) are enabled by default in Autopilot. Standard clusters would require more operational management.
Question 100
You have an on-premises data analytics set of binaries that processes data files in memory for about 45 minutes every midnight. The sizes of those data files range from 1 gigabyte to 16 gigabytes. You want to migrate this application to Google Cloud with minimal effort and cost. What should you do?
A. Create a container for the set of binaries. Use Cloud Scheduler to start a Cloud Run job for the container.
B. Create a container for the set of binaries. Deploy the container to Google Kubernetes Engine (GKE) and use the Kubernetes scheduler to start the application.
C. Upload the code to Cloud Functions. Use Cloud Scheduler to start the application.
D. Lift and shift to a VM on Compute Engine. Use an instance schedule to start and stop the instance.
Show Answer
Correct Answer: D
Explanation: The requirement emphasizes minimal effort and cost. A lift-and-shift migration to a Compute Engine VM allows you to run the existing binaries without refactoring or containerizing them. Using an instance schedule to start the VM before the nightly 45-minute batch job and stop it afterward minimizes runtime costs while requiring the least migration effort. Cloud Run Jobs would require containerization, Cloud Functions are not suitable for this long-running, memory-intensive workload, and GKE adds unnecessary operational complexity.
Question 101
You are responsible for a web application on Compute Engine. You want your support team to be notified automatically if users experience high latency for at least 5 minutes. You need a Google-recommended solution with no development cost. What should you do?
A. Export Cloud Monitoring metrics to BigQuery and use a Looker Studio dashboard to monitor your web application’s latency.
B. Create an alert policy to send a notification when the HTTP response latency exceeds the specified threshold.
C. Implement an App Engine service which invokes the Cloud Monitoring API and sends a notification in case of anomalies.
D. Use the Cloud Monitoring dashboard to observe latency and take the necessary actions when the response latency exceeds the specified threshold.
Show Answer
Correct Answer: B
Explanation: Cloud Monitoring alerting policies are the managed, recommended way to automatically notify a team when a metric such as HTTP response latency exceeds a threshold for a specified duration (for example, 5 minutes). This requires no custom development. The other options either require custom implementation, only provide visualization without automatic notification, or are not appropriate for alerting.
$19
Get all 323 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.