Associate Cloud Engineer Free Practice Questions — Page 3
Question 20
You are planning to migrate your on-premises VMs to Google Cloud. You need to set up a landing zone in Google Cloud before migrating the VMs. You must ensure that all VM in your production environment can communicate with each other through private IP addresses. You need to allow all VMs in your Google Cloud organization to accept connections on specific TCP ports. You want to follow Google-recommended practices, and you need to minimize your operational costs. What should you do?
A. Create individual VPCs per Google Cloud project. Peer all he VPC together. Apply organization policies on the organization level.
B. Create individual VPCs for each Google Cloud project. Peer ail ne VPCs together. Apply hierarchical firewall policies on the organization level.
C. Create a host VPC project with each production project as its service project. Apply organization policies on the organization level.
D. Create a host VPC project with each production project as its service project. Apply hierarchical firewall policies on the organization level.
Show Answer
Correct Answer: D
Explanation: A Shared VPC (host project with service projects) is the Google‑recommended landing zone pattern that allows all production VMs to communicate privately on the same VPC without costly and complex VPC peering. To allow all VMs in the organization to accept connections on specific TCP ports, you must use hierarchical firewall policies at the organization level; organization policies cannot define firewall rules. This approach centralizes networking and security while minimizing operational cost.
Question 21
Your company's machine learning team requires a scalable and flexible platform to fine-tune large language models utilizing a large volume of proprietary data on Google Cloud. You are tasked with building a solution for this team. What should you do?
A. Use Dataflow as a platform to run the fine-tuning jobs
B. Use a Compute Engine managed instance group as a platform to deploy Jupyter Notebooks and run fine-tuning jobs.
C. Use Cloud Run and GPU as a platform to run the fine-tuning jobs.
D. Use Google Kubernetes Engine (GKE) and hardware accelerators as a platform to run the fine-tuning jobs.
Show Answer
Correct Answer: D
Explanation: Fine-tuning large language models requires scalable, flexible orchestration of GPU/TPU-accelerated workloads, support for distributed training, and integration with large proprietary datasets. Google Kubernetes Engine (GKE) with hardware accelerators is purpose-built for this scenario, offering container orchestration, autoscaling, scheduling of GPUs/TPUs, and mature ML tooling. Dataflow is designed for data processing pipelines, not model training; Compute Engine managed instance groups lack advanced ML orchestration; and Cloud Run is not well suited for long-running, resource-intensive GPU training jobs.
Question 22
You need to migrate multiple PostgreSQL databases from your on-premises data center to Google Cloud. You want to significantly improve the performance of your databases while minimizing changes to your data schema and application code. You expect to exceed 150 TB of data per geographical region. You want to follow Google-recommended practices and minimize your operational costs. What should you do?
A. Migrate your data to AlloyDB.
B. Migrate your data to Spanner.
C. Migrate your data to Firebase.
D. Migrate your data to Bigtable.
Show Answer
Correct Answer: A
Explanation: AlloyDB is Google’s PostgreSQL‑compatible, fully managed database designed to deliver significant performance improvements with minimal to no schema or application changes. It follows Google‑recommended practices for PostgreSQL migrations and reduces operational overhead. Although a single AlloyDB cluster has a storage limit, you can use multiple clusters per region to exceed 150 TB, meeting the scale requirement while keeping costs and complexity lower than alternatives. Spanner, Bigtable, and Firebase would require substantial schema and application changes.
Question 23
You are planning to deploy an application to Google Cloud. Your application processes asynchronous events from Google services and must be accessible from the public Internet. You need to identify how to deploy your application. You want to follow a standardized process while minimizing development costs. You also want to have no costs when your workloads are not in use. What should you do?
A. Deploy your code to GKE. Use Pub/Sub for event delivery.
B. Deploy your code to Compute Engine. Use Pub/Sub for event delivery.
C. Deploy your code to GKE. Use Eventarc for event delivery.
D. Deploy your code to Cloud Run. Use Eventarc for event delivery.
Show Answer
Correct Answer: D
Explanation: Cloud Run is a fully managed serverless platform that follows standardized deployment processes, scales to zero when idle (no cost when not in use), and minimizes development and operational overhead. Eventarc provides native, standardized delivery of asynchronous events from Google services to Cloud Run over HTTPS, while allowing the service to be publicly accessible. GKE and Compute Engine require managing infrastructure and incur costs even when idle, making them less suitable for the stated requirements.
Question 24
You are managing the security configuration of your company’s Google Cloud organization. The Operations team needs specific permissions on both a Google Kubernetes Engine (GKE) cluster and a Cloud SQL instance. Two predefined Identity and Access Management (IAM) roles exist that contain a subset of the permissions needed by the team. You need to configure the necessary IAM permissions for this team while following Google-recommended practices. What should you do?
A. Create a custom IAM role that combines the permissions from the two relevant predefined roles.
B. Grant the team the two predefined IAM roles.
C. Create a custom IAM role that includes only the required permissions from the predefined roles.
D. Grant the team the IAM roles of Kubernetes Engine Admin and Cloud SQL Admin.
Show Answer
Correct Answer: B
Explanation: Google-recommended practice is to use predefined IAM roles whenever they meet the requirements, because they are maintained and updated by Google. IAM allows assigning multiple roles to the same principal, and granting the two predefined roles together provides the needed permissions without creating and maintaining a custom role. Custom roles should be used only when predefined roles cannot satisfy the requirement.
Question 25
You are deploying an application to Google Kubernetes Engine (GKE). The application needs to make API calls to a private Cloud Storage bucket. You need to configure your application Pods to authenticate to the Cloud Storage API, but your organization policy prevents the usage of service account keys. You want to follow Google-recommended practices. What should you do?
A. Create the GKE cluster with Workload Identity Federation. Configure the default node service account to access the bucket. Deploy the application into the cluster so the application can use the node service account permissions. Use Identity and Access Management (IAM) to grant the service account access to the bucket.
B. Create the GKE cluster with Workload Identity Federation. Create a Google service account and a Kubernetes ServiceAccount, and configure both service accounts to use Workload Identity Federation. Attach the Kubernetes ServiceAccount to the application Pods and configure the Google service account to access the bucket with Identity and Access Management (IAM).
C. Create the GKE cluster and deploy the application. Request a security exception to create a Google service account key. Set the constraints/iam.serviceAccountKeyExpiryHours organization policy to 24 hours.
D. Create the GKE cluster and deploy the application. Request a security exception to create a Google service account key. Set the constraints/iam.serviceAccountKeyExpiryHours organization policy to 8 hours.
Show Answer
Correct Answer: B
Explanation: Google-recommended practice for GKE workloads accessing Google Cloud APIs without service account keys is Workload Identity. By creating a Google service account, binding it to a Kubernetes ServiceAccount, and attaching that Kubernetes ServiceAccount to the Pods, the application can obtain short-lived credentials securely. IAM is then used to grant the Google service account access to the Cloud Storage bucket. This avoids service account keys and does not rely on the node service account.
Question 26
Your company is seeking a scalable solution to retain and explore application logs hosted on Compute Engine. You must be able to analyze your logs with SQL queries, and you want to be able to create charts to identify patterns and trends in your logs over time. You want to follow Google-recommended practices and minimize your operational costs. What should you do?
A. Use a custom script to push your application logs to BigQuery for exploration.
B. Ingest your application logs to Cloud Logging by using Ops Agent, and explore your logs in Logs Explorer.
C. Ingest your application logs to Cloud Logging by using Ops Agent, and explore your logs with Log Analytics.
D. Use a custom script to push your application logs to Cloud SQL for exploration.
Show Answer
Correct Answer: C
Explanation: Cloud Logging with the Ops Agent is the Google-recommended way to ingest application logs from Compute Engine. Log Analytics provides an SQL-based interface over logs stored in Cloud Logging, supports aggregations and time-series analysis, and integrates with charting for trend analysis. It avoids custom pipelines, reduces operational overhead, and is more cost-effective than exporting logs to BigQuery or Cloud SQL for this use case.
Question 27
You have an application running inside a Compute Engine instance. You want to provide the application with secure access to a BigQuery dataset. You must ensure that credentials are only valid for a short period of time, and your application will only have access to the intended BigQuery dataset. You want to follow Google-recommended practices and minimize your operational costs. What should you do?
A. Attach a new service account to the instance every hour, and grant the service account the BigQuery Data Viewer IAM role on the project.
B. Attach a custom service account to the instance, and grant the service account the BigQuery Data Viewer IAM role on the dataset.
C. Attach a new service account to the instance every hour, and grant the service account the BigQuery Data Viewer IAM role on the dataset.
D. Attach a custom service account to the instance, and grant the service account the BigQuery Data Viewer IAM role on the project.
Show Answer
Correct Answer: B
Explanation: Use a custom service account attached to the Compute Engine instance so the application receives short-lived credentials automatically via the metadata server. Granting the BigQuery Data Viewer role at the dataset level follows least privilege, limiting access only to the intended dataset. This aligns with Google-recommended practices and avoids the operational overhead and cost of rotating service accounts.
Question 28
Your company was recently impacted by a service disruption that caused multiple Dataflow jobs to get stuck, resulting in significant downtime in downstream applications and revenue loss. You were able to resolve the issue by identifying and fixing an error you found in the code. You need to design a solution with minimal management effort to identify when jobs are stuck in the future to ensure that this issue does not occur again. What should you do?
A. Update the Dataflow job configurations to send messages to a Pub/Sub topic when there are delays. Configure a backup Dataflow job to process jobs that are delayed. Use Cloud Tasks to trigger an alert when messages are pushed to the Pub/Sub topic.
B. Set up Cloud Monitoring alerts on the data freshness metric for the Dataflow jobs to receive a notification when a certain threshold is reached.
C. Set up Error Reporting to identify stack traces that indicate slowdowns in Dataflow jobs. Set up alerts based on these log entries.
D. Use the Personalized Service Health dashboard to identify issues with Dataflow jobs across regions.
Show Answer
Correct Answer: B
Explanation: Cloud Monitoring provides built-in Dataflow metrics, including data freshness, which directly indicates whether a streaming or batch job is processing data on time. If a job becomes stuck, data freshness increases and crosses a threshold. Creating alerts on this metric requires no custom code, minimal operational effort, and provides timely notifications, making it the most appropriate and low-maintenance solution.
Question 29
You work for a financial services company that operates as a stock market broker. Your company is planning to migrate to Google Cloud. You need to plan the network design in Google Cloud. Your design must:
• Minimize the latency between all production systems.
• Minimize costs related to your development environment.
What should you do?
A. Create a VPC in the Standard Tier and one in the Premium Tier. Deploy production workloads in the Standard Tier and development workloads in the Premium Tier.
B. Create a VPC in the Standard Tier and one in the Premium Tier. Deploy development workloads in the Standard Tier and production workloads in the Premium Tier.
C. Create a VPC in the Premium Tier, and deploy both production and development workloads on this VP
D. Create a VPC in the Standard Tier, and deploy both production and development workloads on this VPC.
Show Answer
Correct Answer: B
Explanation: Production systems for a latency-sensitive stock broker should use Google Cloud Premium Tier to benefit from Google’s global, low-latency backbone. Development environments are less latency-critical and should use the cheaper Standard Tier to minimize costs. Separating them into two VPCs allows applying the appropriate network tier to each environment.
$19
Get all 314 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.