Associate Cloud Engineer Free Practice Questions — Page 11
Question 102
During a recent audit of your existing Google Cloud resources, you discovered several users with email addresses outside of your Google Workspace domain. You want to ensure that your resources are only shared with users whose email addresses match your domain. You need to remove any mismatched users, and you want to avoid having to audit your resources to identify mismatched users. What should you do?
A. Create a Cloud Scheduler task to regularly scan your projects and delete mismatched users.
B. Create a Cloud Scheduler task to regularly scan your resources and delete mismatched users.
C. Set an organizational policy constraint to limit identities by domain to automatically remove mismatched users.
D. Set an organizational policy constraint to limit identities by domain, and then retroactively remove the existing mismatched users
Show Answer
Correct Answer: D
Explanation: Enforce the organization policy constraint for domain-restricted sharing (limit identities by domain) to prevent future IAM bindings to identities outside the allowed domain. Because this constraint is not retroactive, existing external principals must be identified and removed separately. Therefore, the correct approach is to enable the policy and then retroactively remove the existing mismatched users.
Question 103
Your application development team has created Docker images for an application that will be deployed on Google Cloud. Your team does not want to manage the infrastructure associated with this application. You need to ensure that the application can scale automatically as it gains popularity. What should you do?
A. Create an instance template with the container image, and deploy a Managed Instance Group with Autoscaling.
B. Upload Docker images to Artifact Registry, and deploy the application on Google Kubernetes Engine using Standard mode.
C. Upload Docker images to the Cloud Storage, and deploy the application on Google Kubernetes Engine using Standard mode.
D. Upload Docker images to Artifact Registry, and deploy the application on Cloud Run.
Show Answer
Correct Answer: D
Explanation: Cloud Run is a fully managed serverless platform for running containerized applications. It automatically scales based on demand, including scaling to zero, and removes the need to manage infrastructure. Artifact Registry is the appropriate service for storing Docker images on Google Cloud. Managed Instance Groups and GKE Standard both require infrastructure or node management, and Cloud Storage is not a container image registry.
Question 104
You have a batch workload that runs every night and uses a large number of virtual machines (VMs). It is fault-tolerant and can tolerate some of the VMs being terminated. The current cost of VMs is too high. What should you do?
A. Run a test using simulated maintenance events. If the test is successful, use Spot N2 Standard VMs when running future jobs.
B. Run a test using simulated maintenance events. If the test is successful, use N2 Standard VMs when running future jobs.
C. Run a test using a managed instance group. If the test is successful, use N2 Standard VMs in the managed instance group when running future jobs.
D. Run a test using N1 standard VMs instead of N2. If the test is successful, use N1 Standard VMs when running future jobs.
Show Answer
Correct Answer: A
Explanation: Spot VMs are designed for fault-tolerant, batch, and stateless workloads and provide substantial cost savings in exchange for the possibility of termination. Because the workload can tolerate VM termination, testing with simulated maintenance events helps validate resilience before using Spot N2 Standard VMs in production. Regular N2 or N1 VMs do not address the cost problem as effectively, and a managed instance group alone does not provide the same cost reduction.
Question 105
The DevOps group in your organization needs full control of Compute Engine resources in your development project. However, they should not have permission to create or update any other resources in the project. You want to follow Google’s recommendations for setting permissions for the DevOps group. What should you do?
A. Grant the basic role roles/viewer and the predefined role roles/compute.admin to the DevOps group.
B. Create an IAM policy and grant all compute.instanceAdmin.* permissions to the policy. Attach the policy to the DevOps group.
C. Create a custom role at the folder level and grant all compute.instanceAdmin.* permissions to the role. Grant the custom role to the DevOps group.
D. Grant the basic role roles/editor to the DevOps group.
Show Answer
Correct Answer: A
Explanation: Granting the predefined Compute Admin role provides full control of Compute Engine resources, while the basic Viewer role provides read-only access to other project resources. Option B is invalid because IAM policies are not created this way for project-specific permission sets. Option C is invalid because custom roles cannot be created at the folder level. Option D is overly broad and grants edit permissions across many Google Cloud resources.
Question 106
Your team is running an on-premises ecommerce application. The application contains a complex set of microservices written in Python, and each microservice is running on Docker containers. Configurations are injected by using environment variables. You need to deploy your current application to a serverless Google Cloud cloud solution. What should you do?
A. Use your existing CI/CD pipeline. Use the generated Docker images and deploy them to Cloud Run. Update the configurations and the required endpoints.
B. Use your existing continuous integration and delivery (CI/CD) pipeline. Use the generated Docker images and deploy them to Cloud Function. Use the same configuration as on-premises.
C. Use the existing codebase and deploy each service as a separate Cloud Function. Update the configurations and the required endpoints.
D. Use your existing codebase and deploy each service as a separate Cloud Run. Use the same configurations as on-premises.
Show Answer
Correct Answer: A
Explanation: Cloud Run is the appropriate serverless platform for existing containerized microservices. Since the services already run in Docker containers and use environment variables for configuration, you can reuse the CI/CD pipeline to build and deploy the images to Cloud Run. Configuration and service endpoints typically need to be updated for the Cloud Run environment. Cloud Functions is intended for function-based workloads rather than deploying an existing set of containerized microservices, and using the same on-premises configuration unchanged is not appropriate.
Question 107
You have deployed an application on a single Compute Engine instance. The application writes logs to disk. Users start reporting errors with the application. You want to diagnose the problem. What should you do?
A. Navigate to Cloud Logging and view the application logs.
B. Configure a health check on the instance and set a “consecutive successes” Healthy threshold value of 1.
C. Connect to the instance’s serial console and read the application logs.
D. Install and configure the Ops agent and view the logs from Cloud Logging.
Show Answer
Correct Answer: D
Explanation: Because the application writes logs only to the VM's local disk, they are not automatically available in Cloud Logging. Installing and configuring the Google Cloud Ops Agent collects and forwards application and system logs to Cloud Logging, where they can be analyzed. Cloud Logging alone won't contain those local application logs unless an agent is already configured. A health check does not diagnose application errors, and the serial console is intended for boot/kernel/serial output rather than reading arbitrary application log files on disk.
Question 108
Your company has an internal application for managing transactional orders. The application is used exclusively by employees in a single physical location. The application requires strong consistency, fast queries, and ACID guarantees for multi-table transactional updates. The first version of the application is implemented in PostgreSQL, and you want to deploy it to the cloud with minimal code changes. Which database is most appropriate for this application?
A. Bigtable
B. BigQuery
C. Cloud SQL
D. Firestore
Show Answer
Correct Answer: C
Explanation: Cloud SQL is the best fit because it supports PostgreSQL directly, preserving compatibility and requiring minimal code changes. It provides ACID transactions, strong consistency, and relational multi-table transactional support, making it appropriate for an internal transactional order management application. Bigtable is a NoSQL wide-column store, BigQuery is an analytical data warehouse, and Firestore is a document database rather than a relational SQL database.
Question 109
You want to host your video encoding software on Compute Engine. Your user base is growing rapidly, and users need to be able to encode their videos at any time without interruption or CPU limitations. You must ensure that your encoding solution is highly available, and you want to follow Google-recommended practices to automate operations. What should you do?
A. Deploy your solution on multiple standalone Compute Engine instances, and increase the number of existing instances when CPU utilization on Cloud Monitoring reaches a certain threshold.
B. Deploy your solution on multiple standalone Compute Engine instances, and replace existing instances with high-CPU instances when CPU utilization on Cloud Monitoring reaches a certain threshold.
C. Deploy your solution to an instance group, and increase the number of available instances whenever you see high CPU utilization in Cloud Monitoring.
D. Deploy your solution to an instance group, and set the autoscaling based on CPU utilization.
Show Answer
Correct Answer: D
Explanation: A managed instance group (MIG) with autoscaling based on CPU utilization is the Google-recommended approach for high availability and automated scaling. It automatically adds or removes instances in response to CPU load, ensuring capacity during demand spikes while minimizing manual operations. The other options rely on standalone instances or manual intervention, which do not follow recommended automated operational practices.
Question 110
Your company is using Google Workspace to manage employee accounts. Anticipated growth will increase the number of personnel from 100 employees to 1,000 employees within 2 years. Most employees will need access to your company’s Google Cloud account. The systems and processes will need to support 10x growth without performance degradation, unnecessary complexity, or security issues. What should you do?
A. Migrate the users to Active Directory. Connect the Human Resources system to Active Directory. Turn on Google Cloud Directory Sync (GCDS) for Cloud Identity. Turn on Identity Federation from Cloud Identity to Active Directory.
B. Organize the users in Cloud Identity into groups. Enforce multi-factor authentication in Cloud Identity.
C. Turn on identity federation between Cloud Identity and Google Workspace. Enforce multi-factor authentication for domain wide delegation.
D. Use a third-party identity provider service through federation. Synchronize the users from Google Workplace to the third-party provider in real time.
Show Answer
Correct Answer: B
Explanation: Google Workspace and Cloud Identity use the same underlying identity system; there is no separate identity federation to configure between them, making C technically invalid. Introducing Active Directory or a third-party IdP adds unnecessary complexity contrary to the requirements. Organizing users with Cloud Identity groups supports scalable access management, and enforcing multi-factor authentication improves security as the organization grows.
Question 111
You have created an application that is packaged into a Docker image. You want to deploy the Docker image as a workload on Google Kubernetes Engine. What should you do?
A. Upload the image to Cloud Storage and create a Kubernetes Service referencing the image.
B. Upload the image to Cloud Storage and create a Kubernetes Deployment referencing the image.
C. Upload the image to Artifact Registry and create a Kubernetes Service referencing the image.
D. Upload the image to Artifact Registry and create a Kubernetes Deployment referencing the image.
Show Answer
Correct Answer: D
Explanation: Container images for GKE should be stored in Artifact Registry (the recommended Google Cloud container registry). Workloads are deployed using a Kubernetes Deployment, while a Service provides networking and load balancing rather than deploying containers.
$19
Get all 323 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.