Associate Cloud Engineer Free Practice Questions — Page 4
Question 31
Your digital media company stores a large number of video files on-premises. Each video file ranges from 100 MB to 100 GB. You are currently storing 150 TB of video data in your on-premises network, with no room for expansion. You need to migrate all infrequently accessed video files older than one year to Cloud Storage to ensure that on-premises storage remains available for new files. You must also minimize costs and control bandwidth usage. What should you do?
A. Use Storage Transfer Service to move the data from the selected on-premises file storage systems to a Cloud Storage bucket.
B. Use Transfer Appliance to request an appliance. Load the data locally, and ship the appliance back to Google for ingestion into Cloud Storage.
C. Set up a Cloud Interconnect connection between the on-premises network and Google Cloud. Establish a private endpoint for Filestore access. Transfer the data from the existing Network File System (NFS) to Filestore.
D. Create a Cloud Storage bucket. Establish an Identity and Access Management (IAM) role with write permissions to the bucket. Use the gsutil tool to directly copy files over the network to Cloud Storage.
Show Answer
Correct Answer: B
Explanation: Transfer Appliance is the best fit for migrating a very large on-premises dataset (150 TB) while minimizing network bandwidth usage and associated costs. The requirement explicitly emphasizes controlling bandwidth usage. Storage Transfer Service is appropriate for online transfers and supports bandwidth throttling, but it still relies on the network. Transfer Appliance is designed for large-scale offline migrations, avoiding WAN saturation. Filestore is not a migration target for archival storage, and gsutil would consume significant network bandwidth.
Question 32
You need to create and manage service accounts for your workloads running on Google Cloud. You want to follow Google-recommended practices. What should you do? (Choose two.)
A. Create as few service accounts as possible.
B. Delete any unused service accounts immediately.
C. Create single-purpose service accounts.
D. Manage service accounts as resources.
E. Use random names for the service accounts.
Show Answer
Correct Answer: C, D
Explanation: Google IAM best practices recommend creating single-purpose service accounts and managing service accounts as resources. They also recommend following naming conventions, identifying and disabling unused service accounts before deleting them, rather than deleting them immediately. Creating as few service accounts as possible and using random names are not recommended.
Question 33
You are planning to migrate your on-premises VMs to Google Cloud. You need to set up a landing zone in Google Cloud before migrating the VMs. You must ensure that all VM in your production environment can communicate with each other through private IP addresses. You need to allow all VMs in your Google Cloud organization to accept connections on specific TCP ports. You want to follow Google-recommended practices, and you need to minimize your operational costs. What should you do?
A. Create individual VPCs per Google Cloud project. Peer all he VPC together. Apply organization policies on the organization level.
B. Create individual VPCs for each Google Cloud project. Peer ail ne VPCs together. Apply hierarchical firewall policies on the organization level.
C. Create a host VPC project with each production project as its service project. Apply organization policies on the organization level.
D. Create a host VPC project with each production project as its service project. Apply hierarchical firewall policies on the organization level.
Show Answer
Correct Answer: D
Explanation: A Shared VPC (host project with production projects attached as service projects) is the recommended enterprise landing zone pattern because it provides private IP connectivity across service projects within the same VPC while centralizing network administration. To allow specific TCP ports consistently across the organization, use hierarchical firewall policies at the organization or folder level. Organization policies do not define firewall port rules. This approach minimizes operational overhead compared with managing many peered VPCs.
Question 34
Your company's machine learning team requires a scalable and flexible platform to fine-tune large language models utilizing a large volume of proprietary data on Google Cloud. You are tasked with building a solution for this team. What should you do?
A. Use Dataflow as a platform to run the fine-tuning jobs
B. Use a Compute Engine managed instance group as a platform to deploy Jupyter Notebooks and run fine-tuning jobs.
C. Use Cloud Run and GPU as a platform to run the fine-tuning jobs.
D. Use Google Kubernetes Engine (GKE) and hardware accelerators as a platform to run the fine-tuning jobs.
Show Answer
Correct Answer: D
Explanation: Fine-tuning large language models requires scalable distributed training with GPU/TPU hardware accelerators and orchestration. GKE supports containerized ML workloads, distributed training frameworks, autoscaling, and GPU node pools, making it well suited for large-scale LLM fine-tuning. Dataflow is for data processing rather than model training, Compute Engine managed instance groups lack the orchestration capabilities of Kubernetes for complex training workloads, and Cloud Run is designed for stateless serving and jobs rather than long-running distributed GPU training.
Question 35
You need to migrate multiple PostgreSQL databases from your on-premises data center to Google Cloud. You want to significantly improve the performance of your databases while minimizing changes to your data schema and application code. You expect to exceed 150 TB of data per geographical region. You want to follow Google-recommended practices and minimize your operational costs. What should you do?
A. Migrate your data to AlloyDB.
B. Migrate your data to Spanner.
C. Migrate your data to Firebase.
D. Migrate your data to Bigtable.
Show Answer
Correct Answer: B
Explanation: Spanner is the Google-recommended choice when you need relational databases at very large scale (well beyond 150 TB per region) with strong performance and minimal operations. AlloyDB offers PostgreSQL compatibility but has cluster storage limits that make this requirement problematic, while Firebase and Bigtable are not PostgreSQL relational database replacements and would require major application changes.
Sources:
https://cloud.google.com/blog/products/databases/reduce-downtime-for-postgresql-migration-to-google-cloud-sql
Question 36
You are planning to deploy an application to Google Cloud. Your application processes asynchronous events from Google services and must be accessible from the public Internet. You need to identify how to deploy your application. You want to follow a standardized process while minimizing development costs. You also want to have no costs when your workloads are not in use. What should you do?
A. Deploy your code to GKE. Use Pub/Sub for event delivery.
B. Deploy your code to Compute Engine. Use Pub/Sub for event delivery.
C. Deploy your code to GKE. Use Eventarc for event delivery.
D. Deploy your code to Cloud Run. Use Eventarc for event delivery.
Show Answer
Correct Answer: D
Explanation: Cloud Run is a fully managed serverless compute platform that follows a standardized deployment model, scales to zero when idle (no compute charges when not in use), and minimizes operational and development overhead. Eventarc is the recommended event routing service for asynchronous events from Google Cloud services and can trigger Cloud Run services. GKE and Compute Engine require managing infrastructure and do not scale to zero in the same way.
Question 37
You are managing the security configuration of your company’s Google Cloud organization. The Operations team needs specific permissions on both a Google Kubernetes Engine (GKE) cluster and a Cloud SQL instance. Two predefined Identity and Access Management (IAM) roles exist that contain a subset of the permissions needed by the team. You need to configure the necessary IAM permissions for this team while following Google-recommended practices. What should you do?
A. Create a custom IAM role that combines the permissions from the two relevant predefined roles.
B. Grant the team the two predefined IAM roles.
C. Create a custom IAM role that includes only the required permissions from the predefined roles.
D. Grant the team the IAM roles of Kubernetes Engine Admin and Cloud SQL Admin.
Show Answer
Correct Answer: B
Explanation: Google recommends using predefined IAM roles whenever they satisfy the required access. IAM principals can be granted multiple predefined roles, avoiding the maintenance burden of custom roles. Custom roles are appropriate only when predefined roles cannot meet the required permission set. Granting broad admin roles violates least privilege.
Question 38
You are deploying an application to Google Kubernetes Engine (GKE). The application needs to make API calls to a private Cloud Storage bucket. You need to configure your application Pods to authenticate to the Cloud Storage API, but your organization policy prevents the usage of service account keys. You want to follow Google-recommended practices. What should you do?
A. Create the GKE cluster with Workload Identity Federation. Configure the default node service account to access the bucket. Deploy the application into the cluster so the application can use the node service account permissions. Use Identity and Access Management (IAM) to grant the service account access to the bucket.
B. Create the GKE cluster with Workload Identity Federation. Create a Google service account and a Kubernetes ServiceAccount, and configure both service accounts to use Workload Identity Federation. Attach the Kubernetes ServiceAccount to the application Pods and configure the Google service account to access the bucket with Identity and Access Management (IAM).
C. Create the GKE cluster and deploy the application. Request a security exception to create a Google service account key. Set the constraints/iam.serviceAccountKeyExpiryHours organization policy to 24 hours.
D. Create the GKE cluster and deploy the application. Request a security exception to create a Google service account key. Set the constraints/iam.serviceAccountKeyExpiryHours organization policy to 8 hours.
Show Answer
Correct Answer: B
Explanation: Workload Identity Federation for GKE is the recommended approach to let Pods authenticate to Google Cloud APIs without service account keys. Create a Kubernetes ServiceAccount mapped to a Google service account, grant the Google service account IAM access to the Cloud Storage bucket, and run the Pods with the Kubernetes ServiceAccount. This provides least-privilege access and avoids using node credentials or service account keys.
Question 39
Your company is seeking a scalable solution to retain and explore application logs hosted on Compute Engine. You must be able to analyze your logs with SQL queries, and you want to be able to create charts to identify patterns and trends in your logs over time. You want to follow Google-recommended practices and minimize your operational costs. What should you do?
A. Use a custom script to push your application logs to BigQuery for exploration.
B. Ingest your application logs to Cloud Logging by using Ops Agent, and explore your logs in Logs Explorer.
C. Ingest your application logs to Cloud Logging by using Ops Agent, and explore your logs with Log Analytics.
D. Use a custom script to push your application logs to Cloud SQL for exploration.
Show Answer
Correct Answer: C
Explanation: Cloud Logging with the Ops Agent is the recommended way to collect application logs from Compute Engine. Log Analytics provides SQL-based querying over Cloud Logging data and supports creating charts to analyze trends over time, while minimizing operational overhead compared with custom ingestion pipelines or Cloud SQL.
Question 40
You have an application running inside a Compute Engine instance. You want to provide the application with secure access to a BigQuery dataset. You must ensure that credentials are only valid for a short period of time, and your application will only have access to the intended BigQuery dataset. You want to follow Google-recommended practices and minimize your operational costs. What should you do?
A. Attach a new service account to the instance every hour, and grant the service account the BigQuery Data Viewer IAM role on the project.
B. Attach a custom service account to the instance, and grant the service account the BigQuery Data Viewer IAM role on the dataset.
C. Attach a new service account to the instance every hour, and grant the service account the BigQuery Data Viewer IAM role on the dataset.
D. Attach a custom service account to the instance, and grant the service account the BigQuery Data Viewer IAM role on the project.
Show Answer
Correct Answer: B
Explanation: Use a custom service account attached to the Compute Engine instance. Compute Engine automatically provides short-lived access tokens for the attached service account through the metadata server, following Google-recommended practices without manual credential rotation. Grant the BigQuery Data Viewer role at the dataset level to enforce least privilege, limiting access to only the intended dataset while minimizing operational overhead.
$19
Get all 323 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.