Associate Cloud Engineer Free Practice Questions — Page 16
Question 153
You need to configure optimal data storage for files stored in Cloud Storage for minimal cost. The files are used in a mission-critical analytics pipeline that is used continually. The users are in Boston, MA (United States). What should you do?
A. Configure regional storage for the region closest to the users. Configure a Nearline storage class.
B. Configure regional storage for the region closest to the users. Configure a Standard storage class.
C. Configure dual-regional storage for the dual region closest to the users. Configure a Nearline storage class.
D. Configure dual-regional storage for the dual region closest to the users. Configure a Standard storage class.
Show Answer
Correct Answer: B
Explanation: Standard storage is appropriate because the data is accessed continually; Nearline is intended for infrequently accessed data. For minimal cost, regional storage in the region closest to the users is preferred unless cross-region resilience is an explicit requirement. 'Mission-critical' alone does not necessarily mandate dual-region storage, while dual-region increases cost.
Sources:
https://cloud.google.com/storage
https://cloud.google.com/storage?ds_rl=1242853&ds_rl=1245734&ds_rl=1242853&ds_rl=1245734
Question 154
An employee was terminated, but their access to Google Cloud was not removed until 2 weeks later. You need to find out if this employee accessed any sensitive customer information after their termination. What should you do?
A. View System Event Logs in Cloud Logging. Search for the user's email as the principal.
B. View System Event Logs in Cloud Logging. Search for the service account associated with the user.
C. View Data Access audit logs in Cloud Logging. Search for the user's email as the principal.
D. View the Admin Activity log in Cloud Logging. Search for the service account associated with the user.
Show Answer
Correct Answer: C
Explanation: Data Access audit logs record read and write access to user data and are the appropriate logs to determine whether a user accessed sensitive customer information. Searching by the terminated employee's user email as the principal identifies actions performed under that identity. System Event logs record Google system actions, and Admin Activity logs record administrative configuration changes rather than data reads.
Question 155
You are developing a new web application that will be deployed on Google Cloud Platform. As part of your release cycle, you want to test updates to your application on a small portion of real user traffic. The majority of the users should still be directed towards a stable version of your application. What should you do?
A. Deploy the application on App Engine. For each update, create a new version of the same service. Configure traffic splitting to send a small percentage of traffic to the new version.
B. Deploy the application on App Engine. For each update, create a new service. Configure traffic splitting to send a small percentage of traffic to the new service.
C. Deploy the application on Kubernetes Engine. For a new release, update the deployment to use the new version.
D. Deploy the application on Kubernetes Engine. For a new release, create a new deployment for the new version. Update the service to use the new deployment.
Show Answer
Correct Answer: A
Explanation: App Engine natively supports traffic splitting between multiple versions of the same service, making it straightforward to route a small percentage of production traffic to a new version while the majority continues to use the stable version. Creating a new service is unnecessary for version-based canary testing. Although GKE can implement canary deployments, the question asks for the built-in approach that directly matches the requirement.
Question 156
You need to add a group of new users to Cloud Identity. Some of the users already have existing Google accounts. You want to follow one of Google's recommended practices and avoid conflicting accounts. What should you do?
A. Invite the user to transfer their existing account.
B. Invite the user to use an email alias to resolve the conflict.
C. Tell the user that they must delete their existing account.
D. Tell the user to remove all personal email from the existing account.
Show Answer
Correct Answer: A
Explanation: Google recommends resolving consumer Google account conflicts by inviting users to transfer/migrate their existing account to the managed Cloud Identity or Google Workspace account when appropriate, avoiding conflicting accounts. Email aliases do not resolve account ownership conflicts, and forcing deletion or manual email removal is not the recommended practice.
Question 157
The sales team has a project named Sales Data Digest that has the ID acme-data-digest. You need to set up similar Google Cloud resources for the marketing team but their resources must be organized independently of the sales team. What should you do?
A. Grant the Project Editor role to the Marketing team for acme-data-digest.
B. Create a Project Lien on acme-data-digest and then grant the Project Editor role to the Marketing team.
C. Create another project with the ID acme-marketing-data-digest for the Marketing team and deploy the resources there.
D. Create a new project named Marketing Data Digest and use the ID acme-data-digest. Grant the Project Editor role to the Marketing team.
Show Answer
Correct Answer: C
Explanation: Projects are the primary isolation boundary in Google Cloud for resources, IAM, billing, and organization. To keep the marketing team's resources independent from the sales team's resources, create a separate project with its own unique project ID and deploy the equivalent resources there. Granting roles on the existing project does not provide isolation, a project lien only prevents deletion, and reusing the existing project ID is not possible because project IDs are globally unique.
Question 158
You have deployed multiple Linux instances on Compute Engine. You plan on adding more instances in the coming weeks. You want to be able to access all of these instances through your SSH client over the internet without having to configure specific access on the existing and new instances. You do not want the
Compute Engine instances to have a public IP. What should you do?
A. Configure Cloud Identity-Aware Proxy for HTTPS resources.
B. Configure Cloud Identity-Aware Proxy for SSH and TCP resources
C. Create an SSH keypair and store the public key as a project-wide SSH Key.
D. Create an SSH keypair and store the private key as a project-wide SSH Key.
Show Answer
Correct Answer: B
Explanation: Cloud Identity-Aware Proxy (IAP) for SSH and TCP forwarding allows secure SSH access to Compute Engine instances that do not have external IP addresses. It centralizes access control and avoids configuring per-instance public access. Project-wide SSH keys simplify key distribution but do not solve connectivity to private instances without a public IP.
Question 159
Your company has an internal application for managing transactional orders. The application is used exclusively by employees in a single physical location. The application requires strong consistency, fast queries, and ACID guarantees for multi-table transactional updates. The first version of the application is implemented in PostgreSQL, and you want to deploy it to the cloud with minimal code changes. Which database is most appropriate for this application?
A. BigQuery
B. Cloud SQL
C. Cloud Spanner
D. Cloud Datastore
Show Answer
Correct Answer: B
Explanation: Cloud SQL for PostgreSQL is the best fit because the application already uses PostgreSQL and the requirement is to migrate with minimal code changes. Cloud SQL provides a managed PostgreSQL service with ACID transactions, strong consistency, and good performance for a single-location transactional application. Cloud Spanner also provides strong consistency and ACID transactions, but it is intended for horizontally scalable, globally distributed workloads, which are not required here.
Question 160
You need to manage a Cloud Spanner instance for best query performance. Your instance in production runs in a single Google Cloud region. You need to improve performance in the shortest amount of time. You want to follow Google best practices for service configuration. What should you do?
A. Create an alert in Cloud Monitoring to alert when the percentage of high priority CPU utilization reaches 45%. If you exceed this threshold, add nodes to your instance.
B. Create an alert in Cloud Monitoring to alert when the percentage of high priority CPU utilization reaches 45%. Use database query statistics to identify queries that result in high CPU usage, and then rewrite those queries to optimize their resource usage.
C. Create an alert in Cloud Monitoring to alert when the percentage of high priority CPU utilization reaches 65%. If you exceed this threshold, add nodes to your instance.
D. Create an alert in Cloud Monitoring to alert when the percentage of high priority CPU utilization reaches 65%. Use database query statistics to identify queries that result in high CPU usage, and then rewrite those queries to optimize their resource usage.
Show Answer
Correct Answer: C
Explanation: For a production Cloud Spanner instance in a single region, Google recommends monitoring high-priority CPU utilization and keeping it below 65%. If sustained high-priority CPU exceeds this threshold, the fastest and recommended way to improve performance is to increase compute capacity by adding nodes (or processing units). Query optimization is valuable for long-term efficiency but does not provide the shortest path to improving performance in this scenario.
Question 162
Your company is moving its entire workload to Compute Engine. Some servers should be accessible through the Internet, and other servers should only be accessible over the internal network. All servers need to be able to talk to each other over specific ports and protocols. The current on-premises network relies on a demilitarized zone (DMZ) for the public servers and a Local Area Network (LAN) for the private servers. You need to design the networking infrastructure on
Google Cloud to match these requirements. What should you do?
A. 1. Create a single VPC with a subnet for the DMZ and a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public ingress traffic for the DMZ.
B. 1. Create a single VPC with a subnet for the DMZ and a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public egress traffic for the DMZ.
C. 1. Create a VPC with a subnet for the DMZ and another VPC with a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public ingress traffic for the DMZ.
D. 1. Create a VPC with a subnet for the DMZ and another VPC with a subnet for the LAN. 2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public egress traffic for the DMZ.
Show Answer
Correct Answer: A
Explanation: A single VPC with separate subnets for public-facing (DMZ) and private (LAN) workloads is the standard Google Cloud design. Firewall rules control east-west traffic between instances/subnets and allow Internet ingress only to the DMZ instances. Options C and D place DMZ and LAN in separate VPCs but omit the required VPC Network Peering or other connectivity, so they do not satisfy the requirement that all servers communicate. Option B incorrectly focuses on public egress instead of the required public ingress.
Question 163
You are managing a project for the Business Intelligence (BI) department in your company. A data pipeline ingests data into BigQuery via streaming. You want the users in the BI department to be able to run the custom SQL queries against the latest data in BigQuery. What should you do?
A. Create a Data Studio dashboard that uses the related BigQuery tables as a source and give the BI team view access to the Data Studio dashboard.
B. Create a Service Account for the BI team and distribute a new private key to each member of the BI team.
C. Use Cloud Scheduler to schedule a batch Dataflow job to copy the data from BigQuery to the BI team's internal data warehouse.
D. Assign the IAM role of BigQuery User to a Google Group that contains the members of the BI team.
Show Answer
Correct Answer: D
Explanation: To let BI users run custom SQL against the latest streamed data already in BigQuery, grant them appropriate BigQuery permissions rather than copying data or restricting them to dashboards. Assigning the BigQuery User role to a Google Group allows members to run query jobs (with appropriate dataset access also assumed). Using a Google Group follows IAM best practices for managing team access.
$19
Get all 323 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.