Associate Cloud Engineer Free Practice Questions — Page 14
Question 130
You have been asked to set up the billing configuration for a new Google Cloud customer. Your customer wants to group resources that share common IAM policies. What should you do?
A. Use labels to group resources that share common IAM policies.
B. Use folders to group resources that share common IAM policies.
C. Set up a proper billing account structure to group IAM policies.
D. Set up a proper project naming structure to group IAM policies.
Show Answer
Correct Answer: B
Explanation: In Google Cloud’s resource hierarchy, folders are specifically designed to group projects and other folders so that common IAM policies can be applied and inherited. This makes folders the correct mechanism for grouping resources that share access controls. Labels, billing accounts, and naming conventions do not enforce IAM policy inheritance.
Question 131
Your company has developed a new application that consists of multiple microservices. You want to deploy the application to Google Kubernetes Engine (GKE), and you want to ensure that the cluster can scale as more applications are deployed in the future. You want to avoid manual intervention when each new application is deployed. What should you do?
A. Deploy the application on GKE, and add a HorizontalPodAutoscaler to the deployment.
B. Deploy the application on GKE, and add a VerticalPodAutoscaler to the deployment.
C. Create a GKE cluster with autoscaling enabled on the node pool. Set a minimum and maximum for the size of the node pool.
D. Create a separate node pool for each application, and deploy each application to its dedicated node pool.
Show Answer
Correct Answer: C
Explanation: The requirement is to ensure the *cluster* can automatically scale as more applications are deployed, without manual intervention. Horizontal or Vertical Pod Autoscalers (A, B) only adjust pod resources within existing cluster capacity and do not add nodes. Enabling node pool autoscaling allows GKE to automatically add or remove nodes based on overall workload demand, which is exactly what is needed for future applications. Creating separate node pools per app (D) increases operational overhead and does not inherently solve automatic scaling.
Question 132
Your customer has implemented a solution that uses Cloud Spanner and notices some read latency-related performance issues on one table. This table is accessed only by their users using a primary key. The table schema is shown below.
You want to resolve the issue. What should you do?
A. Remove the profile_picture field from the table.
B. Add a secondary index on the person_id column.
C. Change the primary key to not have monotonically increasing values.
D. Create a secondary index using the following Data Definition Language (DDL):
Show Answer
Correct Answer: C
Explanation: Cloud Spanner distributes data by primary key ranges. If the primary key is monotonically increasing, accesses (and especially inserts) concentrate on the end of the key space, causing hotspotting that can manifest as latency. Since the table is accessed only by the primary key, adding secondary indexes provides no benefit (the primary key is already indexed), and removing a column doesn’t address access patterns. Redesigning the primary key to avoid monotonically increasing values (for example, by adding randomness or hashing) spreads load evenly and resolves the latency issue.
Question 133
You have created a new project in Google Cloud through the gcloud command line interface (CLI) and linked a billing account. You need to create a new Compute
Engine instance using the CLI. You need to perform the prerequisite steps. What should you do?
A. Create a Cloud Monitoring Workspace.
B. Create a VPC network in the project.
C. Enable the compute googleapis.com API.
D. Grant yourself the IAM role of Computer Admin.
Show Answer
Correct Answer: C
Explanation: Before you can create or manage Compute Engine resources with the gcloud CLI, the Compute Engine API (compute.googleapis.com) must be enabled in the project. Other options are not prerequisites: a default VPC network is created automatically, Cloud Monitoring is not required, and if you created the project you already have sufficient IAM permissions.
Question 134
You are assigned to maintain a Google Kubernetes Engine (GKE) cluster named 'dev' that was deployed on Google Cloud. You want to manage the GKE configuration using the command line interface (CLI). You have just downloaded and installed the Cloud SDK. You want to ensure that future CLI commands by default address this specific cluster What should you do?
A. Use the command gcloud config set container/cluster dev.
B. Use the command gcloud container clusters update dev.
C. Create a file called gke.default in the ~/.gcloud folder that contains the cluster name.
D. Create a file called defaults.json in the ~/.gcloud folder that contains the cluster name.
Show Answer
Correct Answer: A
Explanation: To ensure that gcloud CLI commands default to a specific GKE cluster, you must set the cluster as a configuration property in Cloud SDK. The command `gcloud config set container/cluster dev` sets the default GKE cluster for future gcloud container commands. The other options either modify the cluster itself or reference non-existent configuration files and do not affect CLI defaults.
Question 135
You are performing a monthly security check of your Google Cloud environment and want to know who has access to view data stored in your Google Cloud
Project. What should you do?
A. Enable Audit Logs for all APIs that are related to data storage.
B. Review the IAM permissions for any role that allows for data access.
C. Review the Identity-Aware Proxy settings for each resource.
D. Create a Data Loss Prevention job.
Show Answer
Correct Answer: B
Explanation: The question asks who currently has access to view data in a Google Cloud project. Current access is determined by IAM roles and permissions, not by logs of past activity. Reviewing IAM permissions for roles that grant data access directly shows which users, groups, or service accounts can view the data. Audit Logs only show historical access, Identity-Aware Proxy is unrelated, and DLP is for data inspection, not access control.
Question 136
You are building a product on top of Google Kubernetes Engine (GKE). You have a single GKE cluster. For each of your customers, a Pod is running in that cluster, and your customers can run arbitrary code inside their Pod. You want to maximize the isolation between your customers' Pods. What should you do?
A. Use Binary Authorization and whitelist only the container images used by your customers' Pods.
B. Use the Container Analysis API to detect vulnerabilities in the containers used by your customers' Pods.
C. Create a GKE node pool with a sandbox type configured to gvisor. Add the parameter runtimeClassName: gvisor to the specification of your customers' Pods.
D. Use the cos_containerd image for your GKE nodes. Add a nodeSelector with the value cloud.google.com/gke-os-distribution: cos_containerd to the specification of your customers' Pods.
Show Answer
Correct Answer: C
Explanation: To maximize isolation when customers run arbitrary code in Pods on a shared GKE cluster, use GKE Sandbox with gVisor. Creating a node pool configured for gVisor and setting runtimeClassName: gvisor runs each Pod in a sandboxed user-space kernel, significantly improving isolation between Pods and protecting the host kernel. The other options focus on image trust or vulnerability scanning and do not provide runtime isolation.
Question 137
You have created an application that is packaged into a Docker image. You want to deploy the Docker image as a workload on Google Kubernetes Engine. What should you do?
A. Upload the image to Cloud Storage and create a Kubernetes Service referencing the image.
B. Upload the image to Cloud Storage and create a Kubernetes Deployment referencing the image.
C. Upload the image to Container Registry and create a Kubernetes Service referencing the image.
D. Upload the image to Container Registry and create a Kubernetes Deployment referencing the image.
Show Answer
Correct Answer: D
Explanation: To run a Docker image on Google Kubernetes Engine, the image must be stored in a container image registry accessible to GKE (Container Registry or Artifact Registry). Workloads are created using Kubernetes controllers like Deployments, which manage Pods. A Service is optional and only needed for networking. Therefore, upload the image to Container Registry and create a Kubernetes Deployment referencing the image.
Question 138
You have just created a new project which will be used to deploy a globally distributed application. You will use Cloud Spanner for data storage. You want to create a Cloud Spanner instance. You want to perform the first step in preparation of creating the instance. What should you do?
A. Enable the Cloud Spanner API.
B. Configure your Cloud Spanner instance to be multi-regional.
C. Create a new VPC network with subnetworks in all desired regions.
D. Grant yourself the IAM role of Cloud Spanner Admin.
Show Answer
Correct Answer: A
Explanation: Before you can create or manage any Cloud Spanner resources in a new Google Cloud project, the Cloud Spanner API must be enabled. This is the required first preparatory step, especially for CLI, IaC, or API-based workflows. Other options (such as choosing multi-region or networking) occur during or after instance creation, and VPC networking is not required for Cloud Spanner.
Question 139
You need to manage a third-party application that will run on a Compute Engine instance. Other Compute Engine instances are already running with default configuration. Application installation files are hosted on Cloud Storage. You need to access these files from the new instance without allowing other virtual machines (VMs) to access these files. What should you do?
A. Create the instance with the default Compute Engine service account. Grant the service account permissions on Cloud Storage.
B. Create the instance with the default Compute Engine service account. Add metadata to the objects on Cloud Storage that matches the metadata on the new instance.
C. Create a new service account and assign this service account to the new instance. Grant the service account permissions on Cloud Storage.
D. Create a new service account and assign this service account to the new instance. Add metadata to the objects on Cloud Storage that matches the metadata on the new instance.
Show Answer
Correct Answer: C
Explanation: To ensure that only the new Compute Engine instance can access the application files in Cloud Storage, you must isolate its identity. Other instances already use the default Compute Engine service account, so granting permissions to that account would allow all of them access. Creating a new, dedicated service account, assigning it only to the new instance, and granting that service account Cloud Storage permissions ensures exclusive access. Metadata-based options do not control access to Cloud Storage objects.
$19
Get all 314 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.