Associate Cloud Engineer Free Practice Questions — Page 8
Question 72
Your customer wants you to create a secure website with autoscaling based on the compute instance CPU load. You want to enhance performance by storing static content in Cloud Storage. Which resources are needed to distribute the user traffic?
A. An external HTTP(S) load balancer with a managed SSL certificate to distribute the load and a URL map to target the requests for the static content to the Cloud Storage backend.
B. An external network load balancer pointing to the backend instances to distribute the load evenly. The web servers will forward the request to the Cloud Storage as needed.
C. An internal HTTP(S) load balancer together with Identity-Aware Proxy to allow only HTTPS traffic.
D. An external HTTP(S) load balancer to distribute the load and a URL map to target the requests for the static content to the Cloud Storage backend. Install the HTTPS certificates on the instance.
Show Answer
Correct Answer: A
Explanation: An external HTTP(S) load balancer supports URL maps that can route requests for static content to a Cloud Storage backend bucket while sending dynamic traffic to autoscaled compute backends. Using a Google-managed SSL certificate terminates HTTPS at the load balancer, which is the recommended architecture and avoids managing certificates on ephemeral autoscaled instances. A network load balancer cannot perform URL-based routing, an internal HTTP(S) load balancer is not for internet-facing traffic, and installing HTTPS certificates on instances is unnecessary when terminating TLS at the external HTTP(S) load balancer.
Question 73
You just installed the Google Cloud CLI on your new corporate laptop. You need to list the existing instances of your company on Google Cloud. What must you do before you run the gcloud compute instances list command? (Choose two.)
A. Run gcloud auth login, enter your login credentials in the dialog window, and paste the received login token to gcloud CLI.
B. Create a Google Cloud service account, and download the service account key. Place the key file in a folder on your machine where gcloud CLI can find it.
C. Download your Cloud Identity user account key. Place the key file in a folder on your machine where gcloud CLI can find it.
D. Run gcloud config set compute/zone $my_zone to set the default zone for gcloud CLI.
E. Run gcloud config set project $my_project to set the default project for gcloud CLI.
Show Answer
Correct Answer: A, E
Explanation: Before listing Compute Engine instances, you must authenticate the gcloud CLI with your user account and ensure the correct project is selected. `gcloud auth login` authenticates your identity. `gcloud config set project` sets the default project that `gcloud compute instances list` queries. Setting a default zone is not required for listing instances because the command lists instances across zones in the selected project. Service account keys or Cloud Identity user keys are not required for interactive user access.
Sources:
https://www.pass4success.com/google/discussions/exam-associate-cloud-engineer-topic-9-question-72-discussion
https://docs.cloud.google.com/sdk/gcloud
https://medium.com/@anushruthikae/gcloud-cli-for-gcp-464ed9ce00c1
Question 74
You are planning to migrate your on-premises data to Google Cloud. The data includes:
• 200 TB of video files in SAN storage
• Data warehouse data stored on Amazon Redshift
• 20 GB of PNG files stored on an S3 bucket
You need to load the video files into a Cloud Storage bucket, transfer the data warehouse data into BigQuery, and load the PNG files into a second Cloud Storage bucket. You want to follow Google-recommended practices and avoid writing any code for the migration. What should you do?
A. Use gcloud storage for the video files, Dataflow for the data warehouse data, and Storage Transfer Service for the PNG files.
B. Use Transfer Appliance for the videos, BigQuery Data Transfer Service for the data warehouse data, and Storage Transfer Service for the PNG files.
C. Use Storage Transfer Service for the video files, BigQuery Data Transfer Service for the data warehouse data, and Storage Transfer Service for the PNG files.
D. Use Cloud Data Fusion for the video files, Dataflow for the data warehouse data, and Storage Transfer Service for the PNG files.
Show Answer
Correct Answer: B
Explanation: For 200 TB of on-premises data on SAN storage, Google-recommended practice is Transfer Appliance because it is designed for large offline bulk transfers. Amazon Redshift to BigQuery is supported by BigQuery Data Transfer Service without custom code. Amazon S3 to Cloud Storage is the standard use case for Storage Transfer Service. Options using Dataflow or Cloud Data Fusion introduce unnecessary processing, and Storage Transfer Service is not the standard choice for bulk SAN data in this scenario.
Question 75
The core business of your company is to rent out construction equipment at large scale. All the equipment that is being rented out has been equipped with multiple sensors that send event information every few seconds. These signals can vary from engine status, distance traveled, fuel level, and more. Customers are billed based on the consumption monitored by these sensors. You expect high throughput – up to thousands of events per hour per device – and need to retrieve consistent data based on the time of the event. Storing and retrieving individual signals should be atomic. What should you do?
A. Create files in Cloud Storage as data comes in.
B. Create a file in Filestore per device, and append new data to that file.
C. Ingest the data into Cloud SQL. Use multiple read replicas to match the throughput.
D. Ingest the data into Bigtable. Create a row key based on the event timestamp.
Show Answer
Correct Answer: D
Explanation: Cloud Bigtable is designed for very high write throughput and low-latency access to large-scale time-series data from IoT devices. It provides atomic reads/writes at the row level, making individual signal storage and retrieval atomic. Using a row key incorporating the event timestamp supports efficient time-based access. Cloud Storage and Filestore are not appropriate for atomic event storage/querying, and Cloud SQL is not the best fit for this scale of telemetry ingestion.
Question 76
You are in charge of provisioning access for all Google Cloud users in your organization. Your company recently acquired a startup company that has their own Google Cloud organization. You need to ensure that your Site Reliability Engineers (SREs) have the same project permissions in the startup company's organization as in your own organization. What should you do?
A. In the Google Cloud console for your organization, select Create role from selection, and choose destination as the startup company's organization.
B. In the Google Cloud console for the startup company, select Create role from selection and choose source as the startup company's Google Cloud organization.
C. Use the gcloud iam roles copy command, and provide the Organization ID of the startup company's Google Cloud Organization as the destination.
D. Use the gcloud iam roles copy command, and provide the project IDs of all projects in the startup company's organization as the destination.
Show Answer
Correct Answer: C
Explanation: To give the same permissions across organizations, you copy the custom IAM role at the organization level so it can be used consistently in projects within the acquired organization's hierarchy. The console options are incorrect for cross-organization copying as described, and copying to individual projects is not the appropriate organization-wide approach.
Question 77
You need to extract text from audio files by using the Speech-to-Text API. The audio files are pushed to a Cloud Storage bucket. You need to implement a fully managed, serverless compute solution that requires authentication and aligns with Google-recommended practices. You want to automate the call to the API by submitting each file to the API as the audio file arrives in the bucket. What should you do?
A. Create an App Engine standard environment triggered by Cloud Storage bucket events to submit the file URI to the Google Speech-to-TextAPI.
B. Run a Kubernetes job to scan the bucket regularly for incoming files, and call the Speech-to-Text API for each unprocessed file.
C. Run a Python script by using a Linux cron job in Compute Engine to scan the bucket regularly for incoming files, and call the Speech-to-Text API for each unprocessed file.
D. Create a Cloud Function triggered by Cloud Storage bucket events to submit the file URI to the Google Speech-to-Text API.
Show Answer
Correct Answer: D
Explanation: Cloud Functions are a fully managed, serverless compute service that can be triggered directly by Cloud Storage object creation events. The function can authenticate using its attached service account and submit the Cloud Storage URI to the Speech-to-Text API as each file arrives. This is event-driven, avoids polling, and aligns with Google-recommended serverless architectures. App Engine Standard is serverless but is not the preferred event-driven choice for Cloud Storage-triggered processing in this scenario. Kubernetes and Compute Engine with cron require infrastructure management and polling.
Question 78
You are configuring service accounts for an application that spans multiple projects. Virtual machines (VMs) running in the web-applications project need access to BigQuery datasets in the crm-databases project. You want to follow Google-recommended practices to grant access to the service account in the web-applications project. What should you do?
A. Grant "project owner" for web-applications appropriate roles to crm-databases.
B. Grant "project owner" role to crm-databases and the web-applications project.
C. Grant "project owner" role to crm-databases and roles/bigquery.dataViewer role to web-applications.
D. Grant roles/bigquery.dataViewer role to crm-databases and appropriate roles to web-applications.
Show Answer
Correct Answer: D
Explanation: Follow least-privilege IAM. The service account used by VMs in the web-applications project should receive only the permissions it needs in its own project and be granted BigQuery read access (roles/bigquery.dataViewer) on the resources in the crm-databases project. Options granting the Project Owner role are overly broad and not recommended. Although the wording of the options is imprecise, D best matches Google-recommended cross-project access practices.
Question 79
You are building a backend service for an ecommerce platform that will persist transaction data from mobile and web clients. After the platform is launched, you expect a large volume of global transactions. Your business team wants to run SQL queries to analyze the data. You need to build a highly available and scalable data store for the platform. What should you do?
A. Create a multi-region Cloud Spanner instance with an optimized schema.
B. Create a multi-region Firestore database with aggregation query enabled.
C. Create a multi-region Cloud SQL for PostgreSQL database with optimized indexes.
D. Create a multi-region BigQuery dataset with optimized tables.
Show Answer
Correct Answer: A
Explanation: Cloud Spanner is designed for globally distributed, horizontally scalable OLTP workloads with strong consistency, high availability, and SQL support. It is well suited for high-volume global ecommerce transactions. Firestore is NoSQL, Cloud SQL does not provide the same global horizontal scalability, and BigQuery is an analytics warehouse rather than a transactional database.
Question 80
Your Dataproc cluster runs in a single Virtual Private Cloud (VPC) network in a single subnetwork with range 172.16.20.128/25. There are no private IP addresses available in the subnetwork. You want to add new VMs to communicate with your cluster using the minimum number of steps. What should you do?
A. Modify the existing subnet range to 172.16.20.0/24.
B. Create a new Secondary IP Range in the VPC and configure the VMs to use that range.
C. Create a new VPC network for the VMs. Enable VPC Peering between the VMs'VPC network and the Dataproc cluster VPC network.
D. Create a new VPC network for the VMs with a subnet of 172.32.0.0/16. Enable VPC network Peering between the Dataproc VPC network and the VMs VPC network. Configure a custom Route exchange.
Show Answer
Correct Answer: A
Explanation: Expanding the existing subnet's primary IPv4 range is the simplest way to make additional private IP addresses available for new VMs in the same VPC and subnet. Secondary IP ranges are intended for alias IPs and do not provide primary VM interface addresses. Creating a new VPC and peering adds unnecessary complexity compared with expanding the existing subnet. The change from 172.16.20.128/25 to 172.16.20.0/24 represents an expansion of the subnet's primary range.
Question 81
You have deployed an application on a Compute Engine instance. An external consultant needs to access the Linux-based instance. The consultant is connected to your corporate network through a VPN connection, but the consultant has no Google account. What should you do?
A. Instruct the external consultant to use the gcloud compute ssh command line tool by using Identity-Aware Proxy to access the instance.
B. Instruct the external consultant to use the gcloud compute ssh command line tool by using the public IP address of the instance to access it.
C. Instruct the external consultant to generate an SSH key pair, and request the public key from the consultant. Add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key.
D. Instruct the external consultant to generate an SSH key pair, and request the private key from the consultant. Add the private key to the instance yourself, and have the consultant access the instance through SSH with their public key.
Show Answer
Correct Answer: C
Explanation: The consultant does not have a Google account. Standard IAP SSH access with gcloud typically relies on Google identity unless an external identity solution is explicitly configured, which the question does not state. The straightforward and secure approach is to have the consultant generate an SSH key pair, provide only the public key, add that public key to the instance's authorized keys (or instance metadata), and have the consultant authenticate with their private key. Never request or install a user's private key. Access via a public IP is unnecessary given VPN connectivity and does not address authentication.
$19
Get all 323 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.