Associate Cloud Engineer Free Practice Questions — Page 5
Question 41
Your company was recently impacted by a service disruption that caused multiple Dataflow jobs to get stuck, resulting in significant downtime in downstream applications and revenue loss. You were able to resolve the issue by identifying and fixing an error you found in the code. You need to design a solution with minimal management effort to identify when jobs are stuck in the future to ensure that this issue does not occur again. What should you do?
A. Update the Dataflow job configurations to send messages to a Pub/Sub topic when there are delays. Configure a backup Dataflow job to process jobs that are delayed. Use Cloud Tasks to trigger an alert when messages are pushed to the Pub/Sub topic.
B. Set up Cloud Monitoring alerts on the data freshness metric for the Dataflow jobs to receive a notification when a certain threshold is reached.
C. Set up Error Reporting to identify stack traces that indicate slowdowns in Dataflow jobs. Set up alerts based on these log entries.
D. Use the Personalized Service Health dashboard to identify issues with Dataflow jobs across regions.
Show Answer
Correct Answer: B
Explanation: Cloud Dataflow exposes a built-in data freshness metric that indicates how far behind processing is. If a streaming job becomes stuck or stops making progress, data freshness increases. Creating a Cloud Monitoring alert on this metric provides a managed, low-effort way to detect stuck jobs and notify operators. The other options either rely on features that do not exist for this purpose or are not intended to detect stuck Dataflow processing.
Question 42
You work for a financial services company that operates as a stock market broker. Your company is planning to migrate to Google Cloud. You need to plan the network design in Google Cloud. Your design must:
• Minimize the latency between all production systems.
• Minimize costs related to your development environment.
What should you do?
A. Create a VPC in the Standard Tier and one in the Premium Tier. Deploy production workloads in the Standard Tier and development workloads in the Premium Tier.
B. Create a VPC in the Standard Tier and one in the Premium Tier. Deploy development workloads in the Standard Tier and production workloads in the Premium Tier.
C. Create a VPC in the Premium Tier, and deploy both production and development workloads on this VP
D. Create a VPC in the Standard Tier, and deploy both production and development workloads on this VPC.
Show Answer
Correct Answer: B
Explanation: Premium Tier uses Google's global backbone to minimize latency and improve performance, making it appropriate for latency-sensitive production trading systems. Standard Tier is less expensive and suitable for development environments where the lowest possible latency is not required. Using separate VPCs with different network service tiers allows production to use Premium Tier while reducing costs for development.
Question 43
Your company stores data from multiple sources that have different data storage requirements. These data include:
1. Customer data that is structured and read with complex queries
2. Historical log data that is large in volume and accessed infrequently
3. Real-time sensor data with high-velocity writes, which needs to be available for analysis but can tolerate some data loss
You need to design the most cost-effective storage solution that fulfills all data storage requirements. What should you do?
A. Use Firestore for customer data, Cloud Storage (Nearline) for historical logs, and Bigtable for sensor data.
B. Use Cloud SQL for customer data. Cloud Storage (Coldline) for historical logs, and BigQuery for sensor data.
C. Use Cloud SQL for customer data. Cloud Storage (Archive) for historical logs, and Bigtable for sensor data.
D. Use Spanner for all data.
Show Answer
Correct Answer: C
Explanation: Cloud SQL is the best fit for structured relational customer data that requires complex queries. Cloud Storage Archive is the most cost-effective class for historical data that is accessed very infrequently. Cloud Bigtable is designed for high-throughput, low-latency writes and time-series workloads such as real-time sensor data, making it a better fit than BigQuery for sustained high-velocity ingestion. Spanner is unnecessarily expensive for these stated requirements.
Question 44
You are planning to migrate your containerized workloads to Google Kubernetes Engine (GKE). You need to determine which GKE option to use. Your solution must have high availability, minimal downtime, and the ability to promptly apply security updates to your nodes. You also want to pay only for the compute resources that your workloads use without managing nodes. You want to follow Google-recommended practices and minimize operational costs. What should you do?
A. Configure a Standard regional GKE duster.
B. Configure a Standard zonal GKE duster.
C. Configure a Standard multi-zonal GKE cluster.
D. Configure an Autopilot GKE cluster.
Show Answer
Correct Answer: D
Explanation: Autopilot GKE is the Google-recommended mode for most workloads. It provides a managed, highly available control plane, automatically manages and upgrades nodes with prompt security updates, eliminates node management, and bills based on the compute resources requested by workloads rather than requiring you to manage node capacity. This best satisfies the requirements for high availability, minimal operational overhead, and paying only for workload compute usage.
Question 45
Your company would like to store invoices and other financial documents in Google Cloud. You need to identify a Google-managed solution to store this information for your company. You must ensure that the documents are kept for a duration of three years. Your company’s analysts need frequent access to invoices from the past six months. After six months, invoices should be archived for audit purposes only. You want to minimize costs and follow Google-recommended practices. What should you do?
A. Use Cloud Storage with Object Lifecycle Management to change the object storage class to Coldline after six months.
B. Use Cloud Storage with Object Lifecycle Management to change the object storage class to Standard after six months.
C. Store your documents on Filestore, and move the documents to Cloud Storage with object storage class set to Coldline after six months.
D. Store your documents on Filestore, and move the documents to Cloud Storage with object storage class set to Standard after six months.
Show Answer
Correct Answer: A
Explanation: Cloud Storage is the appropriate Google-managed service for storing documents. Analysts need frequent access during the first six months, so objects can remain in the Standard storage class initially. After six months, Object Lifecycle Management should automatically transition them to Coldline, which is designed for infrequently accessed data and reduces storage costs while keeping the data available for audit. Filestore is intended for managed file shares, not long-term archival object storage.
Question 46
You are planning to migrate a database and a backend application to a Standard Google Kubernetes Engine (GKE) cluster. You need to prevent data loss and make sure there are enough nodes available for your backend application based on the demands of your workloads. You want to follow Google-recommended practices and minimize the amount of manual work required. What should you do?
A. Run your database as a StatefulSet. Configure cluster autoscaling to handle changes in the demands of your workloads.
B. Run your database as a single Pod. Run the resize command when you notice changes in the demands of your workloads.
C. Run your database as a DaemonSet. Run the resize command when you notice changes in the demands of your workloads.
D. Run your database as a Deployment. Configure cluster autoscaling to handle changes in the demands of your workloads.
Show Answer
Correct Answer: A
Explanation: Stateful workloads such as databases should run as StatefulSets to provide stable identities and persistent storage, helping prevent data loss. For ensuring sufficient nodes with minimal manual effort, Google recommends GKE cluster autoscaling, which automatically adjusts node capacity based on workload demand. The alternatives either use an inappropriate workload controller for databases or require manual resizing.
Question 47
Your company uses a multi-cloud strategy that includes Google Cloud. You want to centralize application logs in a third-party software-as-a-service (SaaS) tool from all environments. You need to integrate logs originating from Cloud Logging, and you want to ensure the export occurs with the least amount of delay possible. What should you do?
A. Create a Cloud Logging sink and configure BigQuery as the destination. Configure the SaaS tool to query BigQuery to retrieve the logs.
B. Create a Cloud Logging sink and configure Pub/Sub as the destination. Configure the SaaS tool to subscribe to the Pub/Sub topic to retrieve the logs.
C. Create a Cloud Logging sink and configure Cloud Storage as the destination. Configure the SaaS tool to read the Cloud Storage bucket to retrieve the logs.
D. Use a Cloud Scheduler cron job to trigger a Cloud Function that queries Cloud Logging and sends the logs to the SaaS tool.
Show Answer
Correct Answer: B
Explanation: Use a Cloud Logging sink with a Pub/Sub destination to stream logs in near real time. A SaaS consumer can subscribe to the Pub/Sub topic and receive log entries with minimal latency. BigQuery and Cloud Storage are better suited for analytics or archival rather than low-latency export, and polling Cloud Logging with Cloud Scheduler and Cloud Functions introduces unnecessary delay and complexity.
Question 48
You are deploying an application to Cloud Run. Your application requires the use of an API that runs on Google Kubernetes Engine (GKE). You need to ensure that your Cloud Run service can privately reach the API on GKE, and you want to follow Google-recommended practices. What should you do?
A. Deploy an ingress resource on the GKE cluster to expose the API to the internet. Use Cloud Armor to filter for IP addresses that can connect to the API. On the Cloud Run service, configure the application to fetch its public IP address and update the Cloud Armor policy on startup to allow this IP address to call the API on ports 80 and 443.
B. Create an ingress firewall rule on the VPC to allow connections from 0.0.0.0/0 on ports 80 and 443.
C. Create an egress firewall rule on the VPC to allow connections to 0.0.0.0/ on ports 80 and 443.
D. Deploy an internal Application Load Balancer to expose the API on GKE to the VPC. Configure Cloud DNS with the IP address of the internal Application Load Balancer. Deploy a Serverless VPC Access connector to allow the Cloud Run service to call the API through the FQDN on Cloud DNS.
Show Answer
Correct Answer: D
Explanation: Cloud Run needs private connectivity into a VPC to reach a private service on GKE. Exposing the GKE API through an internal Application Load Balancer keeps it private within the VPC, Cloud DNS provides internal name resolution, and a Serverless VPC Access connector enables the Cloud Run service to send traffic into the VPC. The other options either expose the service publicly or only modify firewall rules without providing the required private connectivity path.
Question 49
Your organization is migrating to Google Cloud. You want only users with company-issued Google accounts to access your Google Cloud environment. You must ensure that users of the same department can only access resources within their own department. You want to minimize operational costs while following Google-recommended practices. What should you do?
A. Assign users to the relevant Google Groups, and provide access to cloud resources through Identity and Access Management (IAM) roles. Periodically identify and remove non-company issued Google accounts.
B. Assign users to the relevant Google Groups, and provide access to cloud resources through Identity and Access Management (IAM) roles. Use organization policies to block non-company issued emails.
C. Create a folder for each department in Resource Manager. Grant the users of each department the Folder Admin role on the folder of their department.
D. Create a folder for each department in Resource Manager. Grant all company users the Folder Admin role on the organization level.
Show Answer
Correct Answer: B
Explanation: Use Google Groups to manage department membership and assign IAM roles to groups, which is the recommended scalable access management pattern. Enforce that only company-managed identities can be used by applying organization-level policy constraints that restrict allowed identity domains, minimizing ongoing operational effort. Folder Admin grants administrative permissions rather than least-privilege resource access and is not appropriate for simply segregating departmental access.
Question 50
You are developing an application that will be deployed on Google Cloud. The application will use a service account to retrieve data from BigQuery. Before you deploy your application, you want to test the permissions of this service account from your local machine to ensure there will be no authentication issues. You want to ensure that you use the most secure method while following Google-recommended practices. What should you do?
A. Generate a service account key, and configure the gcloud CLI to use this key. Issue a relevant BigQuery request through the gdoud CLI to test the access.
B. Grant the service account the BigQuery Administrator IAM role to ensure the service account has all required access.
C. Configure the gcloud CLI to use service account impersonation. Issue a relevant BigQuery request through the gcloud CLI to test the access.
D. Configure the gcloud CLI with Application Default Credentials using your user account. Issue a relevant BigQuery request through the gcloud CLI to test the access.
Show Answer
Correct Answer: C
Explanation: Service account impersonation is the Google-recommended, most secure way to test a service account's permissions from a local machine because it avoids creating and distributing long-lived service account keys. You can configure the gcloud CLI to impersonate the service account and then issue a BigQuery command to verify the effective permissions. Generating a key is less secure, granting BigQuery Administrator violates least privilege, and using your own Application Default Credentials tests your user identity rather than the service account.
$19
Get all 323 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.