Associate Cloud Engineer Free Practice Questions — Page 13
Question 120
Your team wants to deploy a specific content management system (CMS) solution to Google Cloud. You need a quick and easy way to deploy and install the solution. What should you do?
A. Search for the CMS solution in Google Cloud Marketplace. Use gcloud CLI to deploy the solution.
B. Search for the CMS solution in Google Cloud Marketplace. Deploy the solution directly from Cloud Marketplace.
C. Search for the CMS solution in Google Cloud Marketplace. Use Terraform and the Cloud Marketplace ID to deploy the solution with the appropriate parameters.
D. Use the installation guide of the CMS provider. Perform the installation through your configuration management system.
Show Answer
Correct Answer: B
Explanation: The requirement is a quick and easy deployment of a CMS on Google Cloud. Cloud Marketplace provides preconfigured solutions that can be deployed directly with minimal effort through the console. Using gcloud CLI or Terraform adds extra steps and complexity, and manual installation via provider guides is the slowest. Therefore, deploying directly from Cloud Marketplace is the fastest and simplest approach.
Question 121
You have two subnets (subnet-a and subnet-b) in the default VPC. Your database servers are running in subnet-a. Your application servers and web servers are running in subnet-b. You want to configure a firewall rule that only allows database traffic from the application servers to the database servers. What should you do?
A. • Create service accounts sa-app and sa-db. • Associate service account sa-app with the application servers and the service account sa-db with the database servers. • Create an ingress firewall rule to allow network traffic from source service account sa-app to target service account sa-db.
B. • Create network tags app-server and db-server. • Add the app-server tag to the application servers and the db-server tag to the database servers. • Create an egress firewall rule to allow network traffic from source network tag app-server to target network tag db-server.
C. • Create a service account sa-app and a network tag db-server. • Associate the service account sa-app with the application servers and the network tag db-server with the database servers. • Create an ingress firewall rule to allow network traffic from source VPC IP addresses and target the subnet-a IP addresses.
D. • Create a network tag app-server and service account sa-db. • Add the tag to the application servers and associate the service account with the database servers. • Create an egress firewall rule to allow network traffic from source network tag app-server to target service account sa-db.
Show Answer
Correct Answer: A
Explanation: To allow database traffic only from application servers to database servers, the correct approach is to use an ingress firewall rule that targets the database servers. In Google Cloud VPC, ingress rules control traffic arriving at instances. Using service accounts as source and target provides identity-based control that scales better than IP ranges or tags. Option A correctly creates service accounts for app and DB servers and uses an ingress rule allowing traffic from the app service account to the DB service account. Options B and D are incorrect because they rely on egress rules, which are not appropriate for controlling access to the database servers, and C does not properly restrict traffic to only the application servers.
Question 122
You are configuring Cloud DNS. You want to create DNS records to point home.mydomain.com, mydomain.com, and www.mydomain.com to the IP address of your Google Cloud load balancer. What should you do?
A. Create one CNAME record to point mydomain.com to the load balancer, and create two A records to point WWW and HOME to mydomain.com respectively.
B. Create one CNAME record to point mydomain.com to the load balancer, and create two AAAA records to point WWW and HOME to mydomain.com respectively.
C. Create one A record to point mydomain.com to the load balancer, and create two CNAME records to point WWW and HOME to mydomain.com respectively.
D. Create one A record to point mydomain.com to the load balancer, and create two NS records to point WWW and HOME to mydomain.com respectively.
Show Answer
Correct Answer: C
Explanation: The apex (mydomain.com) must point directly to the load balancer’s IP using an A record; a CNAME is not allowed at the root. Subdomains like www.mydomain.com and home.mydomain.com can be aliases, so they should be CNAME records pointing to mydomain.com. Other options use invalid record types (CNAME at root, AAAA without IPv6, or NS for delegation).
Question 123
All development (dev) teams in your organization are located in the United States. Each dev team has its own Google Cloud project. You want to restrict access so that each dev team can only create cloud resources in the United States (US). What should you do?
A. Create a folder to contain all the dev projects. Create an organization policy to limit resources in US locations.
B. Create an organization to contain all the dev projects. Create an Identity and Access Management (IAM) policy to limit the resources in US regions.
C. Create an Identity and Access Management (IAM) policy to restrict the resources locations in the US. Apply the policy to all dev projects.
D. Create an Identity and Access Management (IAM) policy to restrict the resources locations in all dev projects. Apply the policy to all dev roles.
Show Answer
Correct Answer: A
Explanation: To restrict where resources can be created, you must use an Organization Policy, not IAM. Google Cloud provides the resource location restriction constraint, which can be applied at the organization, folder, or project level. By placing all dev projects in a dedicated folder and applying the location constraint to that folder, you ensure that all child projects can only create resources in US locations. IAM controls who can do what, but it cannot enforce geographic resource placement.
Question 124
Your company completed the acquisition of a startup and is now merging the IT systems of both companies. The startup had a production Google Cloud project in their organization. You need to move this project into your organization and ensure that the project is billed to your organization. You want to accomplish this task with minimal effort. What should you do?
A. Use the projects.move method to move the project to your organization. Update the billing account of the project to that of your organization.
B. Ensure that you have an Organization Administrator Identity and Access Management (IAM) role assigned to you in both organizations. Navigate to the Resource Manager in the startup’s Google Cloud organization, and drag the project to your company's organization.
C. Create a Private Catalog for the Google Cloud Marketplace, and upload the resources of the startup's production project to the Catalog. Share the Catalog with your organization, and deploy the resources in your company’s project.
D. Create an infrastructure-as-code template for all resources in the project by using Terraform, and deploy that template to a new project in your organization. Delete the project from the startup’s Google Cloud organization.
Show Answer
Correct Answer: A
Explanation: Google Cloud supports moving an existing project between organizations using the Resource Manager projects.move capability (for example via gcloud beta projects move). This preserves the project and its resources, requires minimal effort compared to rebuilding, and after the move you can simply associate the project with your organization’s billing account. The other options involve unnecessary re-creation or incorrect mechanisms.
Question 125
You are running multiple microservices in a Kubernetes Engine cluster. One microservice is rendering images. The microservice responsible for the image rendering requires a large amount of CPU time compared to the memory it requires. The other microservices are workloads that are optimized for n1-standard machine types. You need to optimize your cluster so that all workloads are using resources as efficiently as possible. What should you do?
A. Assign the pods of the image rendering microservice a higher pod priority than the other microservices.
B. Create a node pool with compute-optimized machine type nodes for the image rendering microservice. Use the node pool with general-purpose machine type nodes for the other microservices.
C. Use the node pool with general-purpose machine type nodes for the image rendering microservice. Create a node pool with compute-optimized machine type nodes for the other microservices.
D. Configure the required amount of CPU and memory in the resource requests specification of the image rendering microservice deployment. Keep the resource requests for the other microservices at the default.
Show Answer
Correct Answer: B
Explanation: The image-rendering microservice is CPU-intensive but does not require much memory, which makes compute-optimized machine types the best fit. Creating a dedicated node pool with compute-optimized nodes for this workload ensures efficient CPU utilization. The remaining microservices are optimized for n1-standard (general-purpose) machine types, so running them in a separate node pool with general-purpose nodes avoids wasting resources. This mixed node-pool approach is the most efficient way to optimize resource usage across all workloads.
Question 126
Your organization has three existing Google Cloud projects. You need to bill the Marketing department for only their Google Cloud services for a new initiative within their group. What should you do?
A. 1. Verify that you are assigned the Billing Administrator IAM role for your organization's Google Cloud Project for the Marketing department. 2. Link the new project to a Marketing Billing Account.
B. 1. Verify that you are assigned the Billing Administrator IAM role for your organization's Google Cloud account. 2. Create a new Google Cloud Project for the Marketing department. 3. Set the default key-value project labels to department:marketing for all services in this project.
C. 1. Verify that you are assigned the Organization Administrator IAM role for your organization's Google Cloud account. 2. Create a new Google Cloud Project for the Marketing department. 3. Link the new project to a Marketing Billing Account.
D. 1. Verify that you are assigned the Organization Administrator IAM role for your organization's Google Cloud account. 2. Create a new Google Cloud Project for the Marketing department. 3. Set the default key-value project labels to department:marketing for all services in this project.
Show Answer
Correct Answer: A
Explanation: The requirement is to bill only the Marketing department for a new initiative. The simplest and correct way is to ensure the initiative is billed separately by linking it to a Marketing-specific billing account. This does not necessarily require creating a new project, since the question states there are already existing projects. A Billing Administrator has the permissions needed to link a project to a billing account. Organization Administrator is not required, and labels alone do not enforce billing separation. Therefore, linking the relevant project to a Marketing Billing Account (option A) best satisfies the requirement.
Question 127
You have a Compute Engine instance hosting a production application. You want to receive an email if the instance consumes more than 90% of its CPU resources for more than 15 minutes. You want to use Google services. What should you do?
A. 1. Create a consumer Gmail account. 2. Write a script that monitors the CPU usage. 3. When the CPU usage exceeds the threshold, have that script send an email using the Gmail account and smtp.gmail.com on port 25 as SMTP server.
B. 1. Create a Cloud Monitoring Workspace and associate your Google Cloud Platform (GCP) project with it. 2. Create a Cloud Monitoring Alerting Policy that uses the threshold as a trigger condition. 3. Configure your email address in the notification channel.
C. 1. Create a Cloud Monitoring Workspace and associate your GCP project with it. 2. Write a script that monitors the CPU usage and sends it as a custom metric to Cloud Monitoring. 3. Create an uptime check for the instance in Cloud Monitoring.
D. 1. In Cloud Logging, create a logs-based metric to extract the CPU usage by using this regular expression: CPU Usage: ([0-9] {1,3})% 2. In Cloud Monitoring, create an Alerting Policy based on this metric. 3. Configure your email address in the notification channel.
Show Answer
Correct Answer: B
Explanation: Cloud Monitoring (formerly Stackdriver) natively collects Compute Engine CPU metrics. By creating a Monitoring workspace/metric scope, defining an alerting policy with a threshold condition (CPU > 90% for 15 minutes), and configuring an email notification channel, you can receive automatic email alerts without custom scripts or log parsing. This is the recommended, fully managed Google Cloud solution.
Question 128
You are using Data Studio to visualize a table from your data warehouse that is built on top of BigQuery. Data is appended to the data warehouse during the day.
At night, the daily summary is recalculated by overwriting the table. You just noticed that the charts in Data Studio are broken, and you want to analyze the problem. What should you do?
A. Review the Error Reporting page in the Cloud Console to find any errors.
B. Use the BigQuery interface to review the nightly job and look for any errors.
C. Use Cloud Debugger to find out why the data was not refreshed correctly.
D. In Cloud Logging, create a filter for your Data Studio report.
Show Answer
Correct Answer: B
Explanation: The charts in Data Studio depend directly on the BigQuery table that is overwritten nightly. If they are broken, the most likely cause is a failure or schema/data issue in the nightly BigQuery job. Reviewing the job in the BigQuery interface lets you check job status, errors, and execution details. The other options target application debugging or generic logging and are not appropriate for diagnosing BigQuery table refresh problems.
Question 129
You have been asked to create robust Virtual Private Network (VPN) connectivity between a new Virtual Private Cloud (VPC) and a remote site. Key requirements include dynamic routing, a shared address space of 10.19.0.1/22, and no overprovisioning of tunnels during a failover event. You want to follow Google- recommended practices to set up a high availability Cloud VPN. What should you do?
A. Use a custom mode VPC network, configure static routes, and use active/passive routing.
B. Use an automatic mode VPC network, configure static routes, and use active/active routing.
C. Use a custom mode VPC network, use Cloud Router border gateway protocol (BGP) routes, and use active/passive routing.
D. Use an automatic mode VPC network, use Cloud Router border gateway protocol (BGP) routes, and configure policy-based routing.
Show Answer
Correct Answer: C
Explanation: The requirements call for Google‑recommended high availability Cloud VPN with dynamic routing and controlled IP addressing. A custom mode VPC is needed to explicitly define the 10.19.0.0/22 address space. Dynamic routing on Cloud VPN requires Cloud Router using BGP. To avoid overprovisioning tunnels during failover, an active/passive HA VPN configuration is appropriate. Therefore, using a custom mode VPC with Cloud Router BGP and active/passive routing is the correct choice.
$19
Get all 314 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.