Associate Cloud Engineer Free Practice Questions — Page 15
Question 140
You need to configure optimal data storage for files stored in Cloud Storage for minimal cost. The files are used in a mission-critical analytics pipeline that is used continually. The users are in Boston, MA (United States). What should you do?
A. Configure regional storage for the region closest to the users. Configure a Nearline storage class.
B. Configure regional storage for the region closest to the users. Configure a Standard storage class.
C. Configure dual-regional storage for the dual region closest to the users. Configure a Nearline storage class.
D. Configure dual-regional storage for the dual region closest to the users. Configure a Standard storage class.
Show Answer
Correct Answer: B
Explanation: The pipeline is mission-critical and used continually, so the Standard storage class is required (Nearline is for infrequent access and would add retrieval costs and latency). The question also emphasizes minimal cost and that users are located in a single geographic area (Boston). Regional storage in the closest region provides the lowest cost while still delivering low latency and high availability. Dual-regional storage increases availability but also increases cost and is not explicitly required by the question.
Question 141
An employee was terminated, but their access to Google Cloud was not removed until 2 weeks later. You need to find out if this employee accessed any sensitive customer information after their termination. What should you do?
A. View System Event Logs in Cloud Logging. Search for the user's email as the principal.
B. View System Event Logs in Cloud Logging. Search for the service account associated with the user.
C. View Data Access audit logs in Cloud Logging. Search for the user's email as the principal.
D. View the Admin Activity log in Cloud Logging. Search for the service account associated with the user.
Show Answer
Correct Answer: C
Explanation: To determine whether a terminated employee accessed sensitive customer information, you must review logs that record actual data reads. In Google Cloud, Data Access audit logs capture user-driven API calls that read, write, or modify user-provided data. Searching these logs by the user’s email (principal) will show whether they accessed sensitive data after termination. System Event and Admin Activity logs do not record detailed data access.
Question 142
You are developing a new web application that will be deployed on Google Cloud Platform. As part of your release cycle, you want to test updates to your application on a small portion of real user traffic. The majority of the users should still be directed towards a stable version of your application. What should you do?
A. Deploy the application on App Engine. For each update, create a new version of the same service. Configure traffic splitting to send a small percentage of traffic to the new version.
B. Deploy the application on App Engine. For each update, create a new service. Configure traffic splitting to send a small percentage of traffic to the new service.
C. Deploy the application on Kubernetes Engine. For a new release, update the deployment to use the new version.
D. Deploy the application on Kubernetes Engine. For a new release, create a new deployment for the new version. Update the service to use the new deployment.
Show Answer
Correct Answer: A
Explanation: The requirement is to send a small percentage of real user traffic to a new release while keeping most users on a stable version (canary/traffic splitting). Google App Engine natively supports multiple versions of the same service and allows configurable traffic splitting between versions. This enables safe testing, easy rollback, and zero downtime. Creating new services is unnecessary, and the Kubernetes options do not explicitly address controlled traffic splitting without additional setup.
Question 143
You need to add a group of new users to Cloud Identity. Some of the users already have existing Google accounts. You want to follow one of Google's recommended practices and avoid conflicting accounts. What should you do?
A. Invite the user to transfer their existing account.
B. Invite the user to use an email alias to resolve the conflict.
C. Tell the user that they must delete their existing account.
D. Tell the user to remove all personal email from the existing account.
Show Answer
Correct Answer: A
Explanation: Google’s recommended practice for resolving account conflicts when users already have consumer Google accounts is to invite them to transfer (migrate) the existing account. This converts the consumer account into a managed Cloud Identity account while preserving access rights and data where possible, and avoids creating conflicting accounts. Using email aliases or forcing deletion/modification of personal accounts is not the recommended approach for this scenario.
Question 144
The sales team has a project named Sales Data Digest that has the ID acme-data-digest. You need to set up similar Google Cloud resources for the marketing team but their resources must be organized independently of the sales team. What should you do?
A. Grant the Project Editor role to the Marketing team for acme-data-digest.
B. Create a Project Lien on acme-data-digest and then grant the Project Editor role to the Marketing team.
C. Create another project with the ID acme-marketing-data-digest for the Marketing team and deploy the resources there.
D. Create a new project named Marketing Data Digest and use the ID acme-data-digest. Grant the Project Editor role to the Marketing team.
Show Answer
Correct Answer: C
Explanation: Google Cloud resources are organized and isolated at the project level. Since the marketing team must have similar resources but be organized independently from the sales team, you should create a separate project for them. Granting roles within the existing sales project (options A and B) would not provide isolation, and project liens are unrelated to resource organization. Option D is invalid because project IDs must be globally unique and cannot be reused. Therefore, creating a new project such as acme-marketing-data-digest is the correct approach.
Question 145
You have deployed multiple Linux instances on Compute Engine. You plan on adding more instances in the coming weeks. You want to be able to access all of these instances through your SSH client over the internet without having to configure specific access on the existing and new instances. You do not want the
Compute Engine instances to have a public IP. What should you do?
A. Configure Cloud Identity-Aware Proxy for HTTPS resources.
B. Configure Cloud Identity-Aware Proxy for SSH and TCP resources
C. Create an SSH keypair and store the public key as a project-wide SSH Key.
D. Create an SSH keypair and store the private key as a project-wide SSH Key.
Show Answer
Correct Answer: B
Explanation: The instances must be reachable via SSH from the internet without public IPs and without per‑instance configuration, including future instances. Cloud Identity‑Aware Proxy (IAP) for SSH and TCP resources provides SSH access through an IAP tunnel using identity‑based access control, works with instances that have no external IP addresses, and centralizes access without modifying each VM. HTTPS IAP is not applicable to SSH, and project‑wide SSH keys still require network-level access to the VM.
Question 146
Your company has an internal application for managing transactional orders. The application is used exclusively by employees in a single physical location. The application requires strong consistency, fast queries, and ACID guarantees for multi-table transactional updates. The first version of the application is implemented in PostgreSQL, and you want to deploy it to the cloud with minimal code changes. Which database is most appropriate for this application?
A. BigQuery
B. Cloud SQL
C. Cloud Spanner
D. Cloud Datastore
Show Answer
Correct Answer: B
Explanation: The application already runs on PostgreSQL and must be moved to the cloud with minimal code changes. It requires strong consistency, fast queries, and full ACID guarantees for multi-table transactions, all of which are natively provided by PostgreSQL. Cloud SQL for PostgreSQL is a fully managed service that preserves PostgreSQL semantics, making it the most appropriate and cost‑effective choice for a single-location, internal transactional application. Cloud Spanner adds global distribution and horizontal scaling that are unnecessary here and would require more changes and higher cost, while BigQuery and Cloud Datastore are not suitable for transactional, relational workloads.
Question 147
You need to manage a Cloud Spanner instance for best query performance. Your instance in production runs in a single Google Cloud region. You need to improve performance in the shortest amount of time. You want to follow Google best practices for service configuration. What should you do?
A. Create an alert in Cloud Monitoring to alert when the percentage of high priority CPU utilization reaches 45%. If you exceed this threshold, add nodes to your instance.
B. Create an alert in Cloud Monitoring to alert when the percentage of high priority CPU utilization reaches 45%. Use database query statistics to identify queries that result in high CPU usage, and then rewrite those queries to optimize their resource usage.
C. Create an alert in Cloud Monitoring to alert when the percentage of high priority CPU utilization reaches 65%. If you exceed this threshold, add nodes to your instance.
D. Create an alert in Cloud Monitoring to alert when the percentage of high priority CPU utilization reaches 65%. Use database query statistics to identify queries that result in high CPU usage, and then rewrite those queries to optimize their resource usage.
Show Answer
Correct Answer: C
Explanation: For a single-region Cloud Spanner instance, Google best practices recommend keeping high-priority CPU utilization below 65%. The fastest way to improve query performance in production is to scale compute by adding nodes when this threshold is exceeded. Query rewrites take longer and are not the shortest path. The 45% threshold applies to multi-region instances, not single-region.
Question 149
Your company is moving its entire workload to Compute Engine. Some servers should be accessible through the Internet, and other servers should only be accessible over the internal network. All servers need to be able to talk to each other over specific ports and protocols. The current on-premises network relies on a demilitarized zone (DMZ) for the public servers and a Local Area Network (LAN) for the private servers. You need to design the networking infrastructure on
Google Cloud to match these requirements. What should you do?
A. 1. Create a single VPC with a subnet for the DMZ and a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public ingress traffic for the DMZ.
B. 1. Create a single VPC with a subnet for the DMZ and a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public egress traffic for the DMZ.
C. 1. Create a VPC with a subnet for the DMZ and another VPC with a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public ingress traffic for the DMZ.
D. 1. Create a VPC with a subnet for the DMZ and another VPC with a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public egress traffic for the DMZ.
Show Answer
Correct Answer: A
Explanation: A single VPC with separate subnets for the DMZ and LAN best matches the on‑premises DMZ/LAN model. In Google Cloud, subnets within the same VPC can communicate using internal IPs, and firewall rules are used to explicitly allow only the required ports and protocols between instances. Public-facing servers in the DMZ require an ingress firewall rule to allow Internet traffic, while private LAN servers remain internal. Using multiple VPCs would require VPC peering or other connectivity mechanisms, which are not mentioned and add unnecessary complexity.
Question 150
You are managing a project for the Business Intelligence (BI) department in your company. A data pipeline ingests data into BigQuery via streaming. You want the users in the BI department to be able to run the custom SQL queries against the latest data in BigQuery. What should you do?
A. Create a Data Studio dashboard that uses the related BigQuery tables as a source and give the BI team view access to the Data Studio dashboard.
B. Create a Service Account for the BI team and distribute a new private key to each member of the BI team.
C. Use Cloud Scheduler to schedule a batch Dataflow job to copy the data from BigQuery to the BI team's internal data warehouse.
D. Assign the IAM role of BigQuery User to a Google Group that contains the members of the BI team.
Show Answer
Correct Answer: D
Explanation: The requirement is for BI users to run custom SQL queries directly against the latest streamed data in BigQuery. Granting access via IAM is the correct approach. Assigning the BigQuery User role at the project level allows members to run query jobs while following best practice by managing access through a Google Group. Other options either restrict users to predefined dashboards, introduce unnecessary security risks, or add needless data movement and latency.
$19
Get all 314 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.