Associate Cloud Engineer Free Practice Questions — Page 7
Question 62
Your company uses BigQuery to store and analyze data. Upon submitting your query in BigQuery, the query fails with a quotaExceeded error. You need to diagnose the issue causing the error. What should you do? (Choose two.)
A. Use BigQuery BI Engine to analyze the issue.
B. Use the INFORMATION_SCHEMA views to analyze the underlying issue.
C. Configure Cloud Trace to analyze the issue.
D. Search errors in Cloud Audit Logs to analyze the issue.
E. View errors in Cloud Monitoring to analyze the issue.
Show Answer
Correct Answer: B, D
Explanation: Use BigQuery INFORMATION_SCHEMA views (such as JOBS* views) to inspect job metadata, errors, and resource usage to identify which quota was exceeded. Cloud Audit Logs record BigQuery API activity and error details, helping diagnose quotaExceeded failures and the context in which they occurred. BI Engine is for accelerating queries, Cloud Trace is for distributed tracing, and Cloud Monitoring is not the primary diagnostic source for individual BigQuery quotaExceeded query failures.
Question 63
You have several hundred microservice applications running in a Google Kubernetes Engine (GKE) cluster. Each microservice is a deployment with resource limits configured for each container in the deployment. You've observed that the resource limits for memory and CPU are not appropriately set for many of the microservices. You want to ensure that each microservice has right sized limits for memory and CPU. What should you do?
A. Configure a Vertical Pod Autoscaler for each microservice.
B. Modify the cluster's node pool machine type and choose a machine type with more memory and CPU.
C. Configure a Horizontal Pod Autoscaler for each microservice.
D. Configure GKE cluster autoscaling.
Show Answer
Correct Answer: A
Explanation: Vertical Pod Autoscaler (VPA) is designed to analyze actual CPU and memory usage and automatically recommend or apply appropriately sized resource requests (and, depending on configuration, update pods with new values). This directly addresses incorrectly sized per-container resources for each microservice. Horizontal Pod Autoscaler changes the number of pod replicas rather than per-pod CPU/memory sizing. Cluster autoscaler and larger node types only adjust cluster capacity, not individual pod resource limits.
Question 64
You are deploying a web application using Compute Engine. You created a managed instance group (MIG) to host the application. You want to follow Google-recommended practices to implement a secure and highly available solution. What should you do?
A. Use SSL proxy load balancing for the MIG and an A record in your DNS private zone with the load balancer's IP address.
B. Use SSL proxy load balancing for the MIG and a CNAME record in your DNS public zone with the load balancer’s IP address.
C. Use HTTP(S) load balancing for the MIG and a CNAME record in your DNS private zone with the load balancer’s IP address.
D. Use HTTP(S) load balancing for the MIG and an A record in your DNS public zone with the load balancer’s IP address.
Show Answer
Correct Answer: D
Explanation: For a web application on a managed instance group, Google recommends an external HTTP(S) Load Balancer, which provides global load balancing, SSL/TLS termination, health checks, and high availability. To make the application publicly reachable, the domain should resolve to the load balancer's public IP address using an A record in a public DNS zone. SSL Proxy Load Balancing is intended for generic SSL/TCP traffic rather than HTTP(S) web applications, and private DNS zones are not appropriate for public internet access.
Question 65
You are a Google Cloud organization administrator. You need to configure organization policies and log sinks on Google Cloud projects that cannot be removed by project users to comply with your company's security policies. The security policies are different for each company department. Each company department has a user with the Project Owner role assigned to their projects. What should you do?
A. Use a standard naming convention for projects that includes the department name. Configure organization policies on the organization and log sinks on the projects.
B. Use a standard naming convention for projects that includes the department name. Configure both organization policies and log sinks on the projects.
C. Organize projects under folders for each department. Configure both organization policies and log sinks on the folders.
D. Organize projects under folders for each department. Configure organization policies on the organization and log sinks on the folders.
Show Answer
Correct Answer: C
Explanation: Folders provide per-department administrative boundaries. Organization policies and aggregated log sinks can be applied at the folder level, inherited by projects, and cannot be removed by Project Owners on individual projects. Because each department requires different policies, applying them at the organization level would not satisfy the requirement for department-specific configurations. Naming conventions do not enforce policy.
Question 66
Your company requires that Google Cloud products are created with a specific configuration to comply with your company’s security policies. You need to implement a mechanism that will allow software engineers at your company to deploy and update Google Cloud products in a preconfigured and approved manner. What should you do?
A. Create Java packages that utilize the Google Cloud Client Libraries for Java to configure Google Cloud products. Store and share the packages in a source code repository.
B. Create bash scripts that utilize the Google Cloud CLI to configure Google Cloud products. Store and share the bash scripts in a source code repository.
C. Use the Google Cloud APIs by using curl to configure Google Cloud products. Store and share the curl commands in a source code repository.
D. Create Terraform modules that utilize the Google Cloud Terraform Provider to configure Google Cloud products. Store and share the modules in a source code repository.
Show Answer
Correct Answer: D
Explanation: Terraform modules with the Google Cloud Terraform Provider provide Infrastructure as Code, allowing standardized, reusable, version-controlled, and approved configurations that engineers can deploy consistently while enforcing organizational security policies. Scripts, client libraries, or raw API calls can automate provisioning but do not provide the same declarative, reusable module pattern for governed infrastructure deployments.
Question 67
Your company is running a critical workload on a single Compute Engine VM instance. Your company's disaster recovery policies require you to back up the entire instance’s disk data every day. The backups must be retained for 7 days. You must configure a backup solution that complies with your company’s security policies and requires minimal setup and configuration. What should you do?
A. Configure the instance to use persistent disk asynchronous replication.
B. Configure daily scheduled persistent disk snapshots with a retention period of 7 days.
C. Configure Cloud Scheduler to trigger a Cloud Function each day that creates a new machine image and deletes machine images that are older than 7 days.
D. Configure a bash script using gsutil to run daily through a cron job. Copy the disk’s files to a Cloud Storage bucket with archive storage class and an object lifecycle rule to delete the objects after 7 days.
Show Answer
Correct Answer: B
Explanation: Scheduled persistent disk snapshots are the native, managed backup solution for Compute Engine disks. They can be configured to run daily with a 7-day retention policy, satisfying the backup and retention requirements with minimal setup. Asynchronous replication is for disaster recovery rather than backup retention, machine images require more custom automation for retention in this option, and copying files with gsutil does not back up the entire disk consistently or minimally.
Question 68
You have two Google Cloud projects: project-a with VPC vpc-a (10.0.0.0/16) and project-b with VPC vpc-b (10.8.0.0/16). Your frontend application resides in vpc-a and the backend API services are deployed in vpc-b. You need to efficiently and cost-effectively enable communication between these Google Cloud projects. You also want to follow Google-recommended practices. What should you do?
A. Create an OpenVPN connection between vpc-a and vpc-b.
B. Create VPC Network Peering between vpc-a and vpc-b.
C. Configure a Cloud Router in vpc-a and another Cloud Router in vpc-b.
D. Configure a Cloud Interconnect connection between vpc-a and vpc-b.
Show Answer
Correct Answer: B
Explanation: VPC Network Peering is the recommended Google Cloud solution for enabling private, low-latency communication between VPC networks in different projects. It is simpler and more cost-effective than managing VPNs, Cloud Routers alone do not provide connectivity, and Cloud Interconnect is intended for connecting on-premises networks to Google Cloud rather than connecting two GCP VPCs.
Question 69
Your company is moving its continuous integration and delivery (CI/CD) pipeline to Compute Engine instances. The pipeline will manage the entire cloud infrastructure through code. How can you ensure that the pipeline has appropriate permissions while your system is following security best practices?
A. • Attach a single service account to the compute instances. • Add minimal rights to the service account. • Allow the service account to impersonate a Cloud Identity user with elevated permissions to create, update, or delete resources.
B. • Add a step for human approval to the CI/CD pipeline before the execution of the infrastructure provisioning. • Use the human approvals IAM account for the provisioning.
C. • Attach a single service account to the compute instances. • Add all required Identity and Access Management (IAM) permissions to this service account to create, update, or delete resources.
D. • Create multiple service accounts, one for each pipeline with the appropriate minimal Identity and Access Management (IAM) permissions. • Use a secret manager service to store the key files of the service accounts. • Allow the CI/CD pipeline to request the appropriate secrets during the execution of the pipeline.
Show Answer
Correct Answer: A
Explanation: Option A best matches Google Cloud security best practices by keeping the VM's attached service account minimally privileged and using impersonation only when elevated permissions are required, avoiding permanently broad permissions or long-lived service account keys. Option C grants excessive standing privileges, B relies on a human identity for automation, and D depends on storing and using service account key files, which Google recommends avoiding in favor of attached service accounts and impersonation.
Sources:
https://docs.cloud.google.com/kubernetes-engine/docs/concepts/best-practices-continuous-integration-delivery-kubernetes
Question 70
Your manager asks you to deploy a workload to a Kubernetes cluster. You are not sure of the workload's resource requirements or how the requirements might vary depending on usage patterns, external dependencies, or other factors. You need a solution that makes cost-effective recommendations regarding CPU and memory requirements, and allows the workload to function consistently in any situation. You want to follow Google-recommended practices. What should you do?
A. Configure the Horizontal Pod Autoscaler for availability, and configure the cluster autoscaler for suggestions.
B. Configure the Horizontal Pod Autoscaler for availability, and configure the Vertical Pod Autoscaler recommendations for suggestions.
C. Configure the Vertical Pod Autoscaler recommendations for availability, and configure the Cluster autoscaler for suggestions.
D. Configure the Vertical Pod Autoscaler recommendations for availability, and configure the Horizontal Pod Autoscaler for suggestions.
Show Answer
Correct Answer: B
Explanation: Horizontal Pod Autoscaler (HPA) is used to maintain application availability by scaling the number of pod replicas based on load. Vertical Pod Autoscaler (VPA) is designed to right-size CPU and memory requests; when you are uncertain of resource requirements, using VPA in recommendation mode provides cost-effective CPU and memory recommendations without automatically changing workloads. Cluster Autoscaler scales nodes, not pod resource requests, and does not provide CPU/memory recommendations for workloads.
Question 71
After a recent security incident, your startup company wants better insight into what is happening in the Google Cloud environment. You need to monitor unexpected firewall changes and instance creation. Your company prefers simple solutions. What should you do?
A. Create a log sink to forward Cloud Audit Logs filtered for firewalls and compute instances to Cloud Storage. Use BigQuery to periodically analyze log events in the storage bucket.
B. Use Cloud Logging filters to create log-based metrics for firewall and instance actions. Monitor the changes and set up reasonable alerts.
C. Install Kibana on a compute instance. Create a log sink to forward Cloud Audit Logs filtered for firewalls and compute instances to Pub/Sub. Target the Pub/Sub topic to push messages to the Kibana instance. Analyze the logs on Kibana in real time.
D. Turn on Google Cloud firewall rules logging, and set up alerts for any insert, update, or delete events.
Show Answer
Correct Answer: B
Explanation: Cloud Audit Logs already capture administrative actions such as firewall rule changes and Compute Engine instance creation. The simplest native approach is to create Cloud Logging log-based metrics using filters for those audit events and configure alerting policies. This provides monitoring and notifications without the added complexity of exporting logs to Cloud Storage, Pub/Sub, or external analysis tools. Firewall Rules Logging only logs traffic decisions, not administrative create/update/delete changes.
$19
Get all 323 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.