Associate Cloud Engineer Free Practice Questions — Page 6
Question 50
You have several hundred microservice applications running in a Google Kubernetes Engine (GKE) cluster. Each microservice is a deployment with resource limits configured for each container in the deployment. You've observed that the resource limits for memory and CPU are not appropriately set for many of the microservices. You want to ensure that each microservice has right sized limits for memory and CPU. What should you do?
A. Configure a Vertical Pod Autoscaler for each microservice.
B. Modify the cluster's node pool machine type and choose a machine type with more memory and CPU.
C. Configure a Horizontal Pod Autoscaler for each microservice.
D. Configure GKE cluster autoscaling.
Show Answer
Correct Answer: A
Explanation: The goal is to right-size CPU and memory limits for each microservice based on actual usage. Vertical Pod Autoscaler (VPA) is specifically designed to analyze pod resource consumption and automatically recommend or apply appropriate CPU and memory requests/limits per deployment. Horizontal Pod Autoscaler scales the number of pods, not their resource sizing. Cluster autoscaling or changing node types affects cluster capacity, not per-microservice limits. Therefore, configuring a VPA for each microservice is the correct approach.
Question 51
You are deploying a web application using Compute Engine. You created a managed instance group (MIG) to host the application. You want to follow Google-recommended practices to implement a secure and highly available solution. What should you do?
A. Use SSL proxy load balancing for the MIG and an A record in your DNS private zone with the load balancer's IP address.
B. Use SSL proxy load balancing for the MIG and a CNAME record in your DNS public zone with the load balancer’s IP address.
C. Use HTTP(S) load balancing for the MIG and a CNAME record in your DNS private zone with the load balancer’s IP address.
D. Use HTTP(S) load balancing for the MIG and an A record in your DNS public zone with the load balancer’s IP address.
Show Answer
Correct Answer: D
Explanation: For a web application on Compute Engine using a managed instance group, Google-recommended practice is to use HTTP(S) Load Balancing. It is a global, highly available Layer 7 load balancer that provides SSL/TLS termination, health checks, and autoscaling integration with MIGs. To make the application accessible over the internet, you should use a public DNS zone with an A record pointing to the load balancer’s external IP address. SSL Proxy Load Balancing is intended for non-HTTP(S) traffic, and private DNS zones would restrict access to internal networks only.
Question 52
You are a Google Cloud organization administrator. You need to configure organization policies and log sinks on Google Cloud projects that cannot be removed by project users to comply with your company's security policies. The security policies are different for each company department. Each company department has a user with the Project Owner role assigned to their projects. What should you do?
A. Use a standard naming convention for projects that includes the department name. Configure organization policies on the organization and log sinks on the projects.
B. Use a standard naming convention for projects that includes the department name. Configure both organization policies and log sinks on the projects.
C. Organize projects under folders for each department. Configure both organization policies and log sinks on the folders.
D. Organize projects under folders for each department. Configure organization policies on the organization and log sinks on the folders.
Show Answer
Correct Answer: C
Explanation: Departments require different, non-removable security configurations. Using folders per department allows you to scope both organization policies and log sinks at the folder level, where they are inherited by projects but cannot be altered by Project Owners. Naming conventions alone do not enforce policy, and applying policies at the organization level would not allow department-specific differences.
Question 53
Your company requires that Google Cloud products are created with a specific configuration to comply with your company’s security policies. You need to implement a mechanism that will allow software engineers at your company to deploy and update Google Cloud products in a preconfigured and approved manner. What should you do?
A. Create Java packages that utilize the Google Cloud Client Libraries for Java to configure Google Cloud products. Store and share the packages in a source code repository.
B. Create bash scripts that utilize the Google Cloud CLI to configure Google Cloud products. Store and share the bash scripts in a source code repository.
C. Use the Google Cloud APIs by using curl to configure Google Cloud products. Store and share the curl commands in a source code repository.
D. Create Terraform modules that utilize the Google Cloud Terraform Provider to configure Google Cloud products. Store and share the modules in a source code repository.
Show Answer
Correct Answer: D
Explanation: Terraform provides Infrastructure as Code, enabling standardized, repeatable, and auditable provisioning of Google Cloud resources. By creating and sharing Terraform modules with the Google Cloud provider, the company can enforce approved configurations, ensure compliance with security policies, support version control and reviews, and allow engineers to deploy and update resources in a controlled, consistent manner.
Question 54
Your company is running a critical workload on a single Compute Engine VM instance. Your company's disaster recovery policies require you to back up the entire instance’s disk data every day. The backups must be retained for 7 days. You must configure a backup solution that complies with your company’s security policies and requires minimal setup and configuration. What should you do?
A. Configure the instance to use persistent disk asynchronous replication.
B. Configure daily scheduled persistent disk snapshots with a retention period of 7 days.
C. Configure Cloud Scheduler to trigger a Cloud Function each day that creates a new machine image and deletes machine images that are older than 7 days.
D. Configure a bash script using gsutil to run daily through a cron job. Copy the disk’s files to a Cloud Storage bucket with archive storage class and an object lifecycle rule to delete the objects after 7 days.
Show Answer
Correct Answer: B
Explanation: Daily scheduled persistent disk snapshots are a native, fully managed Compute Engine feature that back up the entire disk with minimal configuration. You can set an automated schedule with a 7-day retention policy, meeting the disaster recovery and security requirements without custom scripting or additional services.
Question 55
You have two Google Cloud projects: project-a with VPC vpc-a (10.0.0.0/16) and project-b with VPC vpc-b (10.8.0.0/16). Your frontend application resides in vpc-a and the backend API services are deployed in vpc-b. You need to efficiently and cost-effectively enable communication between these Google Cloud projects. You also want to follow Google-recommended practices. What should you do?
A. Create an OpenVPN connection between vpc-a and vpc-b.
B. Create VPC Network Peering between vpc-a and vpc-b.
C. Configure a Cloud Router in vpc-a and another Cloud Router in vpc-b.
D. Configure a Cloud Interconnect connection between vpc-a and vpc-b.
Show Answer
Correct Answer: B
Explanation: VPC Network Peering is the Google-recommended way to connect two VPC networks in different projects for private, low-latency, high-bandwidth communication. It is simple to configure, does not require VPN gateways or routers, avoids public IPs, and is more cost-effective than VPN or Interconnect. The other options add unnecessary complexity or are designed for hybrid/on-prem connectivity rather than VPC-to-VPC within GCP.
Question 56
Your company is moving its continuous integration and delivery (CI/CD) pipeline to Compute Engine instances. The pipeline will manage the entire cloud infrastructure through code. How can you ensure that the pipeline has appropriate permissions while your system is following security best practices?
A. • Attach a single service account to the compute instances. • Add minimal rights to the service account. • Allow the service account to impersonate a Cloud Identity user with elevated permissions to create, update, or delete resources.
B. • Add a step for human approval to the CI/CD pipeline before the execution of the infrastructure provisioning. • Use the human approvals IAM account for the provisioning.
C. • Attach a single service account to the compute instances. • Add all required Identity and Access Management (IAM) permissions to this service account to create, update, or delete resources.
D. • Create multiple service accounts, one for each pipeline with the appropriate minimal Identity and Access Management (IAM) permissions. • Use a secret manager service to store the key files of the service accounts. • Allow the CI/CD pipeline to request the appropriate secrets during the execution of the pipeline.
Show Answer
Correct Answer: A
Explanation: The most secure and recommended approach on Google Cloud is to use service account impersonation. Attaching a minimally privileged service account to the Compute Engine instances and allowing it to impersonate a more privileged identity only when needed follows the principle of least privilege, avoids long‑lived service account keys, and provides strong auditability. Option D relies on storing and managing service account key files, which is explicitly discouraged by Google Cloud security best practices.
Question 57
Your manager asks you to deploy a workload to a Kubernetes cluster. You are not sure of the workload's resource requirements or how the requirements might vary depending on usage patterns, external dependencies, or other factors. You need a solution that makes cost-effective recommendations regarding CPU and memory requirements, and allows the workload to function consistently in any situation. You want to follow Google-recommended practices. What should you do?
A. Configure the Horizontal Pod Autoscaler for availability, and configure the cluster autoscaler for suggestions.
B. Configure the Horizontal Pod Autoscaler for availability, and configure the Vertical Pod Autoscaler recommendations for suggestions.
C. Configure the Vertical Pod Autoscaler recommendations for availability, and configure the Cluster autoscaler for suggestions.
D. Configure the Vertical Pod Autoscaler recommendations for availability, and configure the Horizontal Pod Autoscaler for suggestions.
Show Answer
Correct Answer: B
Explanation: Use the Horizontal Pod Autoscaler (HPA) to maintain availability by scaling the number of pods based on load, and use Vertical Pod Autoscaler (VPA) in recommendation mode to get cost-effective CPU and memory right-sizing guidance when requirements are uncertain. This aligns with Google-recommended practices: HPA for availability and VPA recommendations for resource optimization.
Question 58
After a recent security incident, your startup company wants better insight into what is happening in the Google Cloud environment. You need to monitor unexpected firewall changes and instance creation. Your company prefers simple solutions. What should you do?
A. Create a log sink to forward Cloud Audit Logs filtered for firewalls and compute instances to Cloud Storage. Use BigQuery to periodically analyze log events in the storage bucket.
B. Use Cloud Logging filters to create log-based metrics for firewall and instance actions. Monitor the changes and set up reasonable alerts.
C. Install Kibana on a compute instance. Create a log sink to forward Cloud Audit Logs filtered for firewalls and compute instances to Pub/Sub. Target the Pub/Sub topic to push messages to the Kibana instance. Analyze the logs on Kibana in real time.
D. Turn on Google Cloud firewall rules logging, and set up alerts for any insert, update, or delete events.
Show Answer
Correct Answer: B
Explanation: The requirement is to monitor unexpected firewall changes and VM instance creation with a simple solution. Cloud Logging log-based metrics can be created directly from Cloud Audit Logs for firewall rule and Compute Engine actions, and alerts can be configured to notify on changes. This uses native services, requires minimal setup, and provides timely alerting. Other options add unnecessary complexity (log sinks, external tools) or focus only on firewall logging rather than both firewalls and instance creation.
Question 59
Your customer wants you to create a secure website with autoscaling based on the compute instance CPU load. You want to enhance performance by storing static content in Cloud Storage. Which resources are needed to distribute the user traffic?
A. An external HTTP(S) load balancer with a managed SSL certificate to distribute the load and a URL map to target the requests for the static content to the Cloud Storage backend.
B. An external network load balancer pointing to the backend instances to distribute the load evenly. The web servers will forward the request to the Cloud Storage as needed.
C. An internal HTTP(S) load balancer together with Identity-Aware Proxy to allow only HTTPS traffic.
D. An external HTTP(S) load balancer to distribute the load and a URL map to target the requests for the static content to the Cloud Storage backend. Install the HTTPS certificates on the instance.
Show Answer
Correct Answer: A
Explanation: The requirements are secure access (HTTPS), autoscaling based on instance CPU load, and efficient delivery of static content from Cloud Storage. An external HTTP(S) load balancer supports autoscaling backends, provides global traffic distribution, and can use a URL map to route static content requests directly to a Cloud Storage backend. Using a managed SSL certificate on the load balancer is the recommended and scalable approach, avoiding per‑instance certificate management. Network load balancers do not support HTTP features or Cloud Storage backends, internal load balancers do not distribute internet traffic, and installing certificates on instances is unnecessary and inferior to managed SSL.
$19
Get all 314 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.