Associate Cloud Engineer Free Practice Questions — Page 12
Question 110
You are running a web application on Cloud Run for a few hundred users. Some of your users complain that the initial web page of the application takes much longer to load than the following pages. You want to follow Google’s recommendations to mitigate the issue. What should you do?
A. Set the minimum number of instances for your Cloud Run service to 3.
B. Set the concurrency number to 1 for your Cloud Run service.
C. Set the maximum number of instances for your Cloud Run service to 100.
D. Update your web application to use the protocol HTTP/2 instead of HTTP/1.1.
Show Answer
Correct Answer: A
Explanation: The issue described is a classic Cloud Run cold start: the first request is slow because no instance is running, while subsequent pages are fast once the instance is warm. Google explicitly recommends configuring a minimum number of instances to keep containers warm and avoid cold starts. Setting min instances to 3 ensures capacity for a few hundred users. The other options do not address initial request latency caused by cold starts.
Question 111
An external member of your team needs list access to compute images and disks in one of your projects. You want to follow Google-recommended practices when you grant the required permissions to this user. What should you do?
A. Create a custom role, and add all the required compute.disks.list and compute.images.list permissions as includedPermissions. Grant the custom role to the user at the project level.
B. Create a custom role based on the Compute Image User role. Add the compute.disks.list to the includedPermissions field. Grant the custom role to the user at the project level.
C. Create a custom role based on the Compute Storage Admin role. Exclude unnecessary permissions from the custom role. Grant the custom role to the user at the project level.
D. Grant the Compute Storage Admin role at the project level.
Show Answer
Correct Answer: A
Explanation: The user only needs list access to compute images and disks. Google-recommended best practice is to follow the principle of least privilege by granting only the exact permissions required. Creating a custom role with just compute.images.list and compute.disks.list and granting it at the project level satisfies the requirement without granting additional permissions. The predefined roles in options B, C, and D include extra permissions beyond simple list access.
Question 112
Your team is using Linux instances on Google Cloud. You need to ensure that your team logs in to these instances in the most secure and cost efficient way. What should you do?
A. Attach a public IP to the instances and allow incoming connections from the internet on port 22 for SSH.
B. Use the gcloud compute ssh command with the --tunnel-through-iap flag. Allow ingress traffic from the IP range 35.235.240.0/20 on port 22.
C. Use a third party tool to provide remote access to the instances.
D. Create a bastion host with public internet access. Create the SSH tunnel to the instance through the bastion host.
Show Answer
Correct Answer: B
Explanation: Using Identity-Aware Proxy (IAP) for SSH via `gcloud compute ssh --tunnel-through-iap` is the most secure and cost‑efficient option. It avoids public IPs, reduces attack surface, leverages Google-managed authentication and authorization, and removes the need for extra infrastructure like bastion hosts or third‑party tools. Allowing ingress only from the IAP TCP forwarding IP range (35.235.240.0/20) on port 22 is the recommended firewall configuration.
Question 113
You are running out of primary internal IP addresses in a subnet for a custom mode VPC. The subnet has the IP range 10.0.0.0/20, and the IP addresses are primarily used by virtual machines in the project. You need to provide more IP addresses for the virtual machines. What should you do?
A. Add a secondary IP range 10.1.0.0/20 to the subnet.
B. Change the subnet IP range from 10.0.0.0/20 to 10.0.0.0/18.
C. Change the subnet IP range from 10.0.0.0/20 to 10.0.0.0/22.
D. Convert the subnet IP range from IPv4 to IPv6.
Show Answer
Correct Answer: B
Explanation: To provide more primary internal IPv4 addresses to VMs in an existing subnet, you should expand the subnet’s primary CIDR range. Google Cloud allows in-place expansion of a subnet’s primary range as long as the new range is a supernet that fully contains the original (for example, /20 to /18). This increases the pool of primary IPs without disrupting existing VMs. Adding a secondary range is mainly for alias IPs and does not increase primary VM IP capacity.
Question 114
Your company has multiple projects linked to a single billing account in Google Cloud. You need to visualize the costs with specific metrics that should be dynamically calculated based on company-specific criteria. You want to automate the process. What should you do?
A. In the Google Cloud console, visualize the costs related to the projects in the Reports section.
B. In the Google Cloud console, visualize the costs related to the projects in the Cost breakdown section.
C. In the Google Cloud console, use the export functionality of the Cost table. Create a Looker Studio dashboard on top of the CSV export.
D. Configure Cloud Billing data export to BigQuery for the billing account. Create a Looker Studio dashboard on top of the BigQuery export.
Show Answer
Correct Answer: D
Explanation: You need automated, detailed, and flexible cost data that can be dynamically calculated using company-specific logic. Exporting Cloud Billing data to BigQuery provides granular, continuously updated billing records across all projects. BigQuery enables custom calculations and aggregations, and Looker Studio can then visualize these metrics dynamically. The console reports or CSV exports are either static, limited, or not automated.
Question 115
You are building a multi-player gaming application that will store game information in a database. As the popularity of the application increases, you are concerned about delivering consistent performance. You need to ensure an optimal gaming performance for global users, without increasing the management complexity. What should you do?
A. Use Cloud SQL database with cross-region replication to store game statistics in the EU, US, and APAC regions.
B. Use Cloud Spanner to store user data mapped to the game statistics.
C. Use BigQuery to store game statistics with a Redis on Memorystore instance in the front to provide global consistency.
D. Store game statistics in a Bigtable database partitioned by username.
Show Answer
Correct Answer: B
Explanation: Cloud Spanner is designed for globally distributed applications that require strong consistency, low latency for users worldwide, and minimal operational overhead. It provides horizontal scalability, automatic replication across regions, and transactional consistency, which are critical for multi-player gaming workloads. Other options either add management complexity, lack global strong consistency, or are not optimized for transactional gaming data.
Question 116
You are building an application that stores relational data from users. Users across the globe will use this application. Your CTO is concerned about the scaling requirements because the size of the user base is unknown. You need to implement a database solution that can scale with your user growth with minimum configuration changes. Which storage solution should you use?
A. Cloud SQL
B. Firestore
C. Cloud Spanner
D. Bigtable
Show Answer
Correct Answer: C
Explanation: The application requires a globally scalable relational database with minimal configuration changes as the user base grows. Cloud Spanner is a fully managed, horizontally scalable, strongly consistent relational database designed for global distribution. Cloud SQL does not scale horizontally easily, Firestore is NoSQL (not relational), and Bigtable is wide-column NoSQL. Therefore, Cloud Spanner best meets the requirements.
Question 117
You deployed an application on a managed instance group in Compute Engine. The application accepts Transmission Control Protocol (TCP) traffic on port 389 and requires you to preserve the IP address of the client who is making a request. You want to expose the application to the internet by using a load balancer. What should you do?
A. Expose the application by using an external TCP Network Load Balancer.
B. Expose the application by using a TCP Proxy Load Balancer.
C. Expose the application by using an SSL Proxy Load Balancer.
D. Expose the application by using an internal TCP Network Load Balancer.
Show Answer
Correct Answer: A
Explanation: The application must be exposed to the internet, accept raw TCP traffic on port 389, and preserve the original client IP address. In Google Cloud, only passthrough (non‑proxy) load balancers preserve the client source IP by default. An external TCP Network Load Balancer is a Layer 4 passthrough load balancer and therefore meets all requirements. TCP Proxy and SSL Proxy Load Balancers are proxy-based and do not preserve client IP addresses by default, and an internal TCP Network Load Balancer cannot be used for internet exposure.
Question 118
You have an application that runs on Compute Engine VM instances in a custom Virtual Private Cloud (VPC). Your company’s security policies only allow the use of internal IP addresses on VM instances and do not let VM instances connect to the internet. You need to ensure that the application can access a file hosted in a Cloud Storage bucket within your project. What should you do?
A. Enable Private Service Access on the Cloud Storage Bucket.
B. Add storage.googleapis.com to the list of restricted services in a VPC Service Controls perimeter and add your project to the list of protected projects.
C. Enable Private Google Access on the subnet within the custom VP
D. Deploy a Cloud NAT instance and route the traffic to the dedicated IP address of the Cloud Storage bucket.
Show Answer
Correct Answer: C
Explanation: VM instances without external IP addresses can still access Google APIs and services, including Cloud Storage, by enabling Private Google Access on the subnet. This allows traffic to Google services to stay on Google’s network without requiring internet connectivity or external IPs. Other options either do not apply to Cloud Storage or require internet/NAT access, which violates the security policy.
Question 119
You are working for a startup that was officially registered as a business 6 months ago. As your customer base grows, your use of Google Cloud increases. You want to allow all engineers to create new projects without asking them for their credit card information. What should you do?
A. Create a Billing account, associate a payment method with it, and provide all project creators with permission to associate that billing account with their projects.
B. Grant all engineers permission to create their own billing accounts for each new project.
C. Apply for monthly invoiced billing, and have a single invoice for the project paid by the finance team.
D. Create a billing account, associate it with a monthly purchase order (PO), and send the PO to Google Cloud.
Show Answer
Correct Answer: A
Explanation: Creating a single Cloud Billing account with a payment method and granting engineers permission to link their projects to it allows project creation without individual credit cards. This centralizes billing control, aligns with standard Google Cloud practices, and avoids eligibility constraints of invoiced billing or the complexity of multiple billing accounts.
$19
Get all 314 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.