Associate Cloud Engineer Free Practice Questions — Page 14
Question 132
You are working for a startup that was officially registered as a business 6 months ago. As your customer base grows, your use of Google Cloud increases. You want to allow all engineers to create new projects without asking them for their credit card information. What should you do?
A. Create a Billing account, associate a payment method with it, and provide all project creators with permission to associate that billing account with their projects.
B. Grant all engineers permission to create their own billing accounts for each new project.
C. Apply for monthly invoiced billing, and have a single invoice for the project paid by the finance team.
D. Create a billing account, associate it with a monthly purchase order (PO), and send the PO to Google Cloud.
Show Answer
Correct Answer: A
Explanation: A Cloud Billing account with a payment method allows multiple projects to be billed centrally. Granting engineers permission to link new projects to that billing account lets them create projects without entering personal credit card information. Monthly invoiced billing requires eligibility (including business age and spending thresholds), which is not met here, and engineers should not create separate billing accounts.
Question 133
Your team wants to deploy a specific content management system (CMS) solution to Google Cloud. You need a quick and easy way to deploy and install the solution. What should you do?
A. Search for the CMS solution in Google Cloud Marketplace. Use gcloud CLI to deploy the solution.
B. Search for the CMS solution in Google Cloud Marketplace. Deploy the solution directly from Cloud Marketplace.
C. Search for the CMS solution in Google Cloud Marketplace. Use Terraform and the Cloud Marketplace ID to deploy the solution with the appropriate parameters.
D. Use the installation guide of the CMS provider. Perform the installation through your configuration management system.
Show Answer
Correct Answer: B
Explanation: The quickest and easiest way to deploy a supported CMS on Google Cloud is to find it in Google Cloud Marketplace and deploy it directly from the Marketplace. Marketplace provides preconfigured deployment flows that simplify installation. Using the gcloud CLI or Terraform is more appropriate for automation or infrastructure-as-code, while manually following the vendor installation guide is more time-consuming.
Question 134
You have two subnets (subnet-a and subnet-b) in the default VPC. Your database servers are running in subnet-a. Your application servers and web servers are running in subnet-b. You want to configure a firewall rule that only allows database traffic from the application servers to the database servers. What should you do?
A. • Create service accounts sa-app and sa-db. • Associate service account sa-app with the application servers and the service account sa-db with the database servers. • Create an ingress firewall rule to allow network traffic from source service account sa-app to target service account sa-db.
B. • Create network tags app-server and db-server. • Add the app-server tag to the application servers and the db-server tag to the database servers. • Create an egress firewall rule to allow network traffic from source network tag app-server to target network tag db-server.
C. • Create a service account sa-app and a network tag db-server. • Associate the service account sa-app with the application servers and the network tag db-server with the database servers. • Create an ingress firewall rule to allow network traffic from source VPC IP addresses and target the subnet-a IP addresses.
D. • Create a network tag app-server and service account sa-db. • Add the tag to the application servers and associate the service account with the database servers. • Create an egress firewall rule to allow network traffic from source network tag app-server to target service account sa-db.
Show Answer
Correct Answer: A
Explanation: Use an ingress VPC firewall rule on the database instances, allowing only the application instances as the source. Google Cloud firewall rules can target instances by service account, and using source and target service accounts provides identity-based control. Options B and D incorrectly use egress rules for this requirement, and C does not properly restrict traffic from only the application servers.
Question 135
You are configuring Cloud DNS. You want to create DNS records to point home.mydomain.com, mydomain.com, and www.mydomain.com to the IP address of your Google Cloud load balancer. What should you do?
A. Create one CNAME record to point mydomain.com to the load balancer, and create two A records to point WWW and HOME to mydomain.com respectively.
B. Create one CNAME record to point mydomain.com to the load balancer, and create two AAAA records to point WWW and HOME to mydomain.com respectively.
C. Create one A record to point mydomain.com to the load balancer, and create two CNAME records to point WWW and HOME to mydomain.com respectively.
D. Create one A record to point mydomain.com to the load balancer, and create two NS records to point WWW and HOME to mydomain.com respectively.
Show Answer
Correct Answer: C
Explanation: The zone apex (mydomain.com) should use an A record pointing to the IPv4 address of the Google Cloud load balancer. Subdomains such as www.mydomain.com and home.mydomain.com can use CNAME records that alias to mydomain.com. A CNAME should not be used at the zone apex in this scenario, AAAA is for IPv6 addresses, and NS records are for delegation, not host-to-IP mapping.
Question 136
All development (dev) teams in your organization are located in the United States. Each dev team has its own Google Cloud project. You want to restrict access so that each dev team can only create cloud resources in the United States (US). What should you do?
A. Create a folder to contain all the dev projects. Create an organization policy to limit resources in US locations.
B. Create an organization to contain all the dev projects. Create an Identity and Access Management (IAM) policy to limit the resources in US regions.
C. Create an Identity and Access Management (IAM) policy to restrict the resources locations in the US. Apply the policy to all dev projects.
D. Create an Identity and Access Management (IAM) policy to restrict the resources locations in all dev projects. Apply the policy to all dev roles.
Show Answer
Correct Answer: A
Explanation: Resource location restrictions in Google Cloud are enforced with Organization Policy constraints (such as resourceLocations), not IAM. Organization Policy can be applied at the organization, folder, or project level and inherits to child resources. Placing all development projects in a dedicated folder and applying the location constraint there restricts only those projects to US locations.
Question 137
Your company completed the acquisition of a startup and is now merging the IT systems of both companies. The startup had a production Google Cloud project in their organization. You need to move this project into your organization and ensure that the project is billed to your organization. You want to accomplish this task with minimal effort. What should you do?
A. Use the projects.move method to move the project to your organization. Update the billing account of the project to that of your organization.
B. Ensure that you have an Organization Administrator Identity and Access Management (IAM) role assigned to you in both organizations. Navigate to the Resource Manager in the startup’s Google Cloud organization, and drag the project to your company's organization.
C. Create a Private Catalog for the Google Cloud Marketplace, and upload the resources of the startup's production project to the Catalog. Share the Catalog with your organization, and deploy the resources in your company’s project.
D. Create an infrastructure-as-code template for all resources in the project by using Terraform, and deploy that template to a new project in your organization. Delete the project from the startup’s Google Cloud organization.
Show Answer
Correct Answer: A
Explanation: The supported and least-effort approach is to move the existing Google Cloud project into the destination organization using the project move capability (projects.move or the equivalent gcloud command), then change the project's Cloud Billing account to one owned by the acquiring organization. Recreating the environment with Terraform or Marketplace is unnecessary, and dragging projects in the console is not the prescribed cross-organization migration method.
Question 138
You are running multiple microservices in a Kubernetes Engine cluster. One microservice is rendering images. The microservice responsible for the image rendering requires a large amount of CPU time compared to the memory it requires. The other microservices are workloads that are optimized for n1-standard machine types. You need to optimize your cluster so that all workloads are using resources as efficiently as possible. What should you do?
A. Assign the pods of the image rendering microservice a higher pod priority than the other microservices.
B. Create a node pool with compute-optimized machine type nodes for the image rendering microservice. Use the node pool with general-purpose machine type nodes for the other microservices.
C. Use the node pool with general-purpose machine type nodes for the image rendering microservice. Create a node pool with compute-optimized machine type nodes for the other microservices.
D. Configure the required amount of CPU and memory in the resource requests specification of the image rendering microservice deployment. Keep the resource requests for the other microservices at the default.
Show Answer
Correct Answer: B
Explanation: Use separate node pools with machine types matched to workload characteristics. The image rendering service is CPU-intensive and low-memory, so it should run on compute-optimized machine types (such as C2/C3 families), while the other microservices that are optimized for n1-standard should remain on general-purpose nodes. Pod priority does not optimize resource efficiency, and resource requests alone do not change the underlying machine type or improve hardware fit.
Question 139
Your organization has three existing Google Cloud projects. You need to bill the Marketing department for only their Google Cloud services for a new initiative within their group. What should you do?
A. 1. Verify that you are assigned the Billing Administrator IAM role for your organization's Google Cloud Project for the Marketing department. 2. Link the new project to a Marketing Billing Account.
B. 1. Verify that you are assigned the Billing Administrator IAM role for your organization's Google Cloud account. 2. Create a new Google Cloud Project for the Marketing department. 3. Set the default key-value project labels to department:marketing for all services in this project.
C. 1. Verify that you are assigned the Organization Administrator IAM role for your organization's Google Cloud account. 2. Create a new Google Cloud Project for the Marketing department. 3. Link the new project to a Marketing Billing Account.
D. 1. Verify that you are assigned the Organization Administrator IAM role for your organization's Google Cloud account. 2. Create a new Google Cloud Project for the Marketing department. 3. Set the default key-value project labels to department:marketing for all services in this project.
Show Answer
Correct Answer: C
Explanation: To isolate billing for a new initiative, the recommended approach is to create a separate Google Cloud project and link it to the Marketing billing account. Project creation requires organization-level permissions, while labels do not determine billing segregation. Linking the dedicated project to the Marketing billing account ensures only that initiative's usage is billed there.
Sources:
https://docs.cloud.google.com/billing/docs/release-notes
Question 140
You have a Compute Engine instance hosting a production application. You want to receive an email if the instance consumes more than 90% of its CPU resources for more than 15 minutes. You want to use Google services. What should you do?
A. 1. Create a consumer Gmail account. 2. Write a script that monitors the CPU usage. 3. When the CPU usage exceeds the threshold, have that script send an email using the Gmail account and smtp.gmail.com on port 25 as SMTP server.
B. 1. Create a Cloud Monitoring Workspace and associate your Google Cloud Platform (GCP) project with it. 2. Create a Cloud Monitoring Alerting Policy that uses the threshold as a trigger condition. 3. Configure your email address in the notification channel.
C. 1. Create a Cloud Monitoring Workspace and associate your GCP project with it. 2. Write a script that monitors the CPU usage and sends it as a custom metric to Cloud Monitoring. 3. Create an uptime check for the instance in Cloud Monitoring.
D. 1. In Cloud Logging, create a logs-based metric to extract the CPU usage by using this regular expression: CPU Usage: ([0-9] {1,3})% 2. In Cloud Monitoring, create an Alerting Policy based on this metric. 3. Configure your email address in the notification channel.
Show Answer
Correct Answer: B
Explanation: Compute Engine automatically exports CPU utilization metrics to Cloud Monitoring. The correct Google-managed solution is to create a Cloud Monitoring alerting policy on the built-in CPU utilization metric with a condition of above 90% for 15 minutes, then configure an email notification channel. No custom scripts, custom metrics, uptime checks, or logs-based metrics are required.
Question 142
You have been asked to create robust Virtual Private Network (VPN) connectivity between a new Virtual Private Cloud (VPC) and a remote site. Key requirements include dynamic routing, a shared address space of 10.19.0.1/22, and no overprovisioning of tunnels during a failover event. You want to follow Google- recommended practices to set up a high availability Cloud VPN. What should you do?
A. Use a custom mode VPC network, configure static routes, and use active/passive routing.
B. Use an automatic mode VPC network, configure static routes, and use active/active routing.
C. Use a custom mode VPC network, use Cloud Router border gateway protocol (BGP) routes, and use active/passive routing.
D. Use an automatic mode VPC network, use Cloud Router border gateway protocol (BGP) routes, and configure policy-based routing.
Show Answer
Correct Answer: C
Explanation: High Availability Cloud VPN best practice for dynamic routing is to use Cloud Router with BGP. A custom mode VPC is appropriate because the network addressing is explicitly defined rather than relying on automatically created subnets. The requirement to avoid overprovisioning of tunnels during failover aligns with an active/passive HA VPN configuration when using a single HA VPN gateway. Static routes and policy-based routing do not meet the dynamic routing requirement.
$19
Get all 323 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.