Associate Cloud Engineer Free Practice Questions — Page 15
Question 143
You have been asked to set up the billing configuration for a new Google Cloud customer. Your customer wants to group resources that share common IAM policies. What should you do?
A. Use labels to group resources that share common IAM policies.
B. Use folders to group resources that share common IAM policies.
C. Set up a proper billing account structure to group IAM policies.
D. Set up a proper project naming structure to group IAM policies.
Show Answer
Correct Answer: B
Explanation: Folders are the organizational resource in the Google Cloud resource hierarchy used to group projects and other folders so that common IAM policies can be applied and inherited. Labels are for metadata, billing accounts are for payment management, and project naming conventions do not control IAM.
Question 144
Your company has developed a new application that consists of multiple microservices. You want to deploy the application to Google Kubernetes Engine (GKE), and you want to ensure that the cluster can scale as more applications are deployed in the future. You want to avoid manual intervention when each new application is deployed. What should you do?
A. Deploy the application on GKE, and add a HorizontalPodAutoscaler to the deployment.
B. Deploy the application on GKE, and add a VerticalPodAutoscaler to the deployment.
C. Create a GKE cluster with autoscaling enabled on the node pool. Set a minimum and maximum for the size of the node pool.
D. Create a separate node pool for each application, and deploy each application to its dedicated node pool.
Show Answer
Correct Answer: C
Explanation: The requirement is to ensure the cluster automatically scales as more applications are deployed, without manual intervention. GKE Cluster Autoscaler increases or decreases the number of nodes in a node pool based on pending workloads. HorizontalPodAutoscaler scales pods within an existing deployment, not the cluster's node capacity. VerticalPodAutoscaler adjusts pod resource requests, and dedicated node pools per application increase operational overhead rather than reducing it.
Sources:
https://www.youtube.com/watch?v=txN9AwtCO0k
https://www.pass4success.com/google/discussions/exam-associate-cloud-engineer-topic-8-question-60-discussion
Question 145
Your customer has implemented a solution that uses Cloud Spanner and notices some read latency-related performance issues on one table. This table is accessed only by their users using a primary key. The table schema is shown below.
You want to resolve the issue. What should you do?
A. Remove the profile_picture field from the table.
B. Add a secondary index on the person_id column.
C. Change the primary key to not have monotonically increasing values.
D. Create a secondary index using the following Data Definition Language (DDL):
Show Answer
Correct Answer: C
Explanation: Cloud Spanner automatically indexes the primary key, so adding a secondary index on the primary key (B) provides no benefit. If the table is accessed by primary key, an index on other columns (D) is also not relevant. A monotonically increasing first primary-key column can create hotspotting because key ranges are split across servers, concentrating traffic on a small range and causing latency. Redesigning the primary key to avoid monotonically increasing values distributes load more evenly and resolves the underlying performance issue.
Question 146
You have created a new project in Google Cloud through the gcloud command line interface (CLI) and linked a billing account. You need to create a new Compute
Engine instance using the CLI. You need to perform the prerequisite steps. What should you do?
A. Create a Cloud Monitoring Workspace.
B. Create a VPC network in the project.
C. Enable the compute googleapis.com API.
D. Grant yourself the IAM role of Computer Admin.
Show Answer
Correct Answer: C
Explanation: Before you can create Compute Engine VM instances with the gcloud CLI, the Compute Engine API (compute.googleapis.com) must be enabled for the project. A default VPC network is typically created automatically unless default network creation is disabled by organization policy, so creating a VPC is not a universal prerequisite. A Cloud Monitoring Workspace is unrelated, and if you created the project and have sufficient project permissions, granting yourself Compute Admin is not an inherent prerequisite.
Question 147
You are assigned to maintain a Google Kubernetes Engine (GKE) cluster named 'dev' that was deployed on Google Cloud. You want to manage the GKE configuration using the command line interface (CLI). You have just downloaded and installed the Cloud SDK. You want to ensure that future CLI commands by default address this specific cluster What should you do?
A. Use the command gcloud config set container/cluster dev.
B. Use the command gcloud container clusters update dev.
C. Create a file called gke.default in the ~/.gcloud folder that contains the cluster name.
D. Create a file called defaults.json in the ~/.gcloud folder that contains the cluster name.
Show Answer
Correct Answer: A
Explanation: The Cloud SDK supports setting a default GKE cluster in the active gcloud configuration using `gcloud config set container/cluster CLUSTER_NAME`. This causes subsequent relevant gcloud container commands to default to that cluster. `gcloud container clusters update` modifies an existing cluster rather than setting a CLI default, and the configuration is not managed through manually created files like `gke.default` or `defaults.json`.
Question 148
You are performing a monthly security check of your Google Cloud environment and want to know who has access to view data stored in your Google Cloud
Project. What should you do?
A. Enable Audit Logs for all APIs that are related to data storage.
B. Review the IAM permissions for any role that allows for data access.
C. Review the Identity-Aware Proxy settings for each resource.
D. Create a Data Loss Prevention job.
Show Answer
Correct Answer: B
Explanation: To determine who currently has permission to view data in a Google Cloud project, review IAM roles and permissions that grant data access. Audit Logs show historical access and actions, not current entitlements. Identity-Aware Proxy controls access to protected applications rather than project data permissions, and Data Loss Prevention identifies sensitive data rather than auditing access rights.
Question 149
You are building a product on top of Google Kubernetes Engine (GKE). You have a single GKE cluster. For each of your customers, a Pod is running in that cluster, and your customers can run arbitrary code inside their Pod. You want to maximize the isolation between your customers' Pods. What should you do?
A. Use Binary Authorization and whitelist only the container images used by your customers' Pods.
B. Use the Container Analysis API to detect vulnerabilities in the containers used by your customers' Pods.
C. Create a GKE node pool with a sandbox type configured to gvisor. Add the parameter runtimeClassName: gvisor to the specification of your customers' Pods.
D. Use the cos_containerd image for your GKE nodes. Add a nodeSelector with the value cloud.google.com/gke-os-distribution: cos_containerd to the specification of your customers' Pods.
Show Answer
Correct Answer: C
Explanation: GKE Sandbox with gVisor provides an additional isolation boundary for Pods running untrusted or arbitrary code by intercepting system calls in a user-space kernel, reducing the risk of container escapes and improving tenant isolation. Binary Authorization and Container Analysis focus on image trust and vulnerability scanning rather than runtime isolation, and using cos_containerd improves the node OS/runtime but does not provide the same sandbox isolation as gVisor.
Question 150
You have created an application that is packaged into a Docker image. You want to deploy the Docker image as a workload on Google Kubernetes Engine. What should you do?
A. Upload the image to Cloud Storage and create a Kubernetes Service referencing the image.
B. Upload the image to Cloud Storage and create a Kubernetes Deployment referencing the image.
C. Upload the image to Container Registry and create a Kubernetes Service referencing the image.
D. Upload the image to Container Registry and create a Kubernetes Deployment referencing the image.
Show Answer
Correct Answer: D
Explanation: On Google Kubernetes Engine, container images should be stored in a container image registry (historically Container Registry, now commonly Artifact Registry). Workloads are created with a Kubernetes Deployment, which manages Pods and replica sets. A Kubernetes Service exposes networking to Pods but does not create or manage the workload. Therefore, upload the image to Container Registry (per the answer choices) and create a Kubernetes Deployment that references the image.
Question 151
You have just created a new project which will be used to deploy a globally distributed application. You will use Cloud Spanner for data storage. You want to create a Cloud Spanner instance. You want to perform the first step in preparation of creating the instance. What should you do?
A. Enable the Cloud Spanner API.
B. Configure your Cloud Spanner instance to be multi-regional.
C. Create a new VPC network with subnetworks in all desired regions.
D. Grant yourself the IAM role of Cloud Spanner Admin.
Show Answer
Correct Answer: A
Explanation: The first prerequisite for creating a Cloud Spanner instance in a new Google Cloud project is enabling the Cloud Spanner API. Instance configuration, such as choosing a regional or multi-regional configuration, comes afterward. Creating a VPC is not required for Cloud Spanner, and while appropriate IAM permissions are necessary, granting yourself the Cloud Spanner Admin role is not the first preparation step in the general setup flow.
Question 152
You need to manage a third-party application that will run on a Compute Engine instance. Other Compute Engine instances are already running with default configuration. Application installation files are hosted on Cloud Storage. You need to access these files from the new instance without allowing other virtual machines (VMs) to access these files. What should you do?
A. Create the instance with the default Compute Engine service account. Grant the service account permissions on Cloud Storage.
B. Create the instance with the default Compute Engine service account. Add metadata to the objects on Cloud Storage that matches the metadata on the new instance.
C. Create a new service account and assign this service account to the new instance. Grant the service account permissions on Cloud Storage.
D. Create a new service account and assign this service account to the new instance. Add metadata to the objects on Cloud Storage that matches the metadata on the new instance.
Show Answer
Correct Answer: C
Explanation: Use a dedicated service account for the new Compute Engine instance and grant only that service account the required Cloud Storage IAM permissions. Existing VMs use the default Compute Engine service account, so they will not inherit access. Object metadata does not control Cloud Storage authorization.
$19
Get all 323 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.