Associate Cloud Engineer Free Practice Questions — Page 9
Question 80
You are working in a team that has developed a new application that needs to be deployed on Kubernetes. The production application is business critical and should be optimized for reliability. You need to provision a Kubernetes cluster and want to follow Google-recommended practices. What should you do?
A. Create a GKE Autopilot cluster. Enroll the cluster in the rapid release channel.
B. Create a GKE Autopilot cluster. Enroll the cluster in the stable release channel.
C. Create a zonal GKE standard cluster. Enroll the cluster in the stable release channel.
D. Create a regional GKE standard cluster. Enroll the cluster in the rapid release channel.
Show Answer
Correct Answer: B
Explanation: Google-recommended practices for production workloads favor GKE Autopilot because it enforces best practices, reduces operational risk, and improves reliability through managed infrastructure and opinionated defaults. For a business‑critical application optimized for reliability, the stable release channel is preferred over rapid, as it prioritizes stability and longer validation over new features. Therefore, an Autopilot cluster on the stable release channel is the best choice.
Question 81
You have a Bigtable instance that consists of three nodes that store personally identifiable information (PII) data. You need to log all read or write operations, including any metadata or configuration reads of this database table, in your company’s Security Information and Event Management (SIEM) system. What should you do?
A. • Navigate to Cloud Monitoring in the Google Cloud console, and create a custom monitoring job for the Bigtable instance to track all changes. • Create an alert by using webhook endpoints, with the SIEM endpoint as a receiver.
B. • Navigate to the Audit Logs page in the Google Cloud console, and enable Admin Write logs for the Bigtable instance. • Create a Cloud Functions instance to export logs from Cloud Logging to your SIEM.
C. • Navigate to the Audit Logs page in the Google Cloud console, and enable Data Read, Data Write and Admin Read logs for the Bigtable instance. • Create a Pub/Sub topic as a Cloud Logging sink destination, and add your SIEM as a subscriber to the topic.
D. • Install the Ops Agent on the Bigtable instance during configuration. • Create a service account with read permissions for the Bigtable instance. • Create a custom Dataflow job with this service account to export logs to the company’s SIEM system.
Show Answer
Correct Answer: C
Explanation: To log all read and write operations, including metadata and configuration reads, you must use Cloud Audit Logs for Bigtable. Data Access logs (Data Read and Data Write) capture table-level read/write operations, while Admin Read logs capture configuration and metadata access. These logs can then be exported in near real time by creating a Cloud Logging sink to Pub/Sub, which is a standard, scalable integration point for SIEM systems. Other options either miss required log types or rely on unsupported agents or monitoring rather than audit logging.
Question 82
You recently discovered that your developers are using many service account keys during their development process. While you work on a long term improvement, you need to quickly implement a process to enforce short-lived service account credentials in your company. You have the following requirements:
• All service accounts that require a key should be created in a centralized project called pj-sa.
• Service account keys should only be valid for one day.
You need a Google-recommended solution that minimizes cost. What should you do?
A. Implement a Cloud Run job to rotate all service account keys periodically in pj-sa. Enforce an org policy to deny service account key creation with an exception to pj-sa.
B. Implement a Kubernetes CronJob to rotate all service account keys periodically. Disable attachment of service accounts to resources in all projects with an exception to pj-sa.
C. Enforce an org policy constraint allowing the lifetime of service account keys to be 24 hours. Enforce an org policy constraint denying service account key creation with an exception on pj-sa.
D. Enforce a DENY org policy constraint over the lifetime of service account keys for 24 hours. Disable attachment of service accounts to resources in all projects with an exception to pj-sa.
Show Answer
Correct Answer: C
Explanation: Google provides org policy constraints to control service account key behavior. You can set constraints/iam.serviceAccountKeyExpiryHours to enforce a maximum 24-hour lifetime for all keys, and constraints/iam.disableServiceAccountKeyCreation to deny key creation everywhere except an allowed project (pj-sa). This enforces short-lived keys centrally, is Google‑recommended, and avoids the operational cost of custom rotation jobs.
Question 83
Your company is running a three-tier web application on virtual machines that use a MySQL database. You need to create an estimated total cost of cloud infrastructure to run this application on Google Cloud instances and Cloud SQL. What should you do?
A. Create a Google spreadsheet with multiple Google Cloud resource combinations. On a separate sheet, import the current Google Cloud prices and use these prices for the calculations within formulas.
B. Use the Google Cloud Pricing Calculator and select the Cloud Operations template to define your web application with as much detail as possible.
C. Implement a similar architecture on Google Cloud, and run a reasonable load test on a smaller scale. Check the billing information, and calculate the estimated costs based on the real load your system usually handles.
D. Use the Google Cloud Pricing Calculator to determine the cost of every Google Cloud resource you expect to use. Use similar size instances for the web server, and use your current on-premises machines as a comparison for Cloud SQL.
Show Answer
Correct Answer: D
Explanation: To estimate cloud infrastructure costs without deploying anything, the recommended approach is to use the Google Cloud Pricing Calculator and explicitly model each expected resource. Selecting comparable Compute Engine instance sizes for the web and application tiers and mapping current on‑premises database capacity to Cloud SQL provides a realistic, supportable estimate. The other options are either manual, inaccurate, or based on non‑existent or inappropriate templates.
Question 84
You are using Looker Studio to visualize a table from your data warehouse that is built on top of BigQuery. Data is appended to the data warehouse during the day. At night, the daily summary is recalculated by overwriting the table. You just noticed that the charts in Looker Studio are broken, and you want to analyze the problem. What should you do?
A. In Cloud Logging, create a filter for your Looker Studio report.
B. Use the open source CLI tool, Snapshot Debugger, to find out why the data was not refreshed correctly.
C. Review the Error Reporting page in the Google Cloud console to find any errors.
D. Use the BigQuery interface to review the nightly job and look for any errors.
Show Answer
Correct Answer: D
Explanation: Looker Studio charts breaking after a nightly overwrite strongly suggests an issue with the BigQuery job that rebuilds the table (for example, schema changes, failed jobs, or partial writes). The most direct and relevant step is to inspect the BigQuery interface for the nightly job’s execution details and errors. Logging, Error Reporting, or debugging tools are not as appropriate for diagnosing data pipeline or query job failures in BigQuery.
Question 85
Your company wants to migrate their on-premises workloads to Google Cloud. The current on-premises workloads consist of:
• A Flask web application
• A backend API
• A scheduled long-running background job for ETL and reporting
You need to keep operational costs low. You want to follow Google-recommended practices to migrate these workloads to serverless solutions on Google Cloud. What should you do?
A. Migrate the web application to App Engine and the backend API to Cloud Run. Use Cloud Tasks to run your background job on Compute Engine.
B. Migrate the web application to App Engine and the backend API to Cloud Run. Use Cloud Tasks to run your background job on Cloud Run.
C. Run the web application on a Cloud Storage bucket and the backend API on Cloud Run. Use Cloud Tasks to run your background job on Cloud Run.
D. Run the web application on a Cloud Storage bucket and the backend API on Cloud Run. Use Cloud Tasks to run your background job on Compute Engine.
Show Answer
Correct Answer: B
Explanation: The requirement is to migrate to low-cost, Google-recommended serverless solutions. App Engine is well suited for a Flask web application with minimal ops overhead. Cloud Run is recommended for containerized backend APIs and background processing, scaling to zero when idle. Cloud Tasks can trigger HTTP-based workloads on Cloud Run for scheduled or asynchronous jobs. Options A and D include Compute Engine, which is not serverless, and options C and D incorrectly place a dynamic Flask web app on Cloud Storage, which only supports static content. Therefore, B best satisfies all requirements.
Question 86
You want to set up a Google Kubernetes Engine cluster. Verifiable node identity and integrity are required for the cluster, and nodes cannot be accessed from the internet. You want to reduce the operational cost of managing your cluster, and you want to follow Google-recommended practices. What should you do?
A. Deploy a private autopilot cluster.
B. Deploy a public autopilot cluster.
C. Deploy a standard public cluster and enable shielded nodes.
D. Deploy a standard private cluster and enable shielded nodes.
Show Answer
Correct Answer: A
Explanation: The requirements are: verifiable node identity and integrity, no internet access to nodes, reduced operational effort to manage the cluster, and adherence to Google‑recommended practices. GKE Autopilot is explicitly designed to reduce cluster management overhead by having Google manage nodes, scaling, and configuration. Autopilot clusters have Shielded GKE Nodes enabled by default, which provides verifiable node identity and integrity, and Autopilot clusters run nodes in a private VPC context so nodes are not directly accessible from the internet. While a standard private cluster with shielded nodes (D) meets the security requirements, it requires more hands‑on management and does not best satisfy the goal of reducing the operational cost of managing the cluster. Therefore, the best answer is A.
Question 87
You have an on-premises data analytics set of binaries that processes data files in memory for about 45 minutes every midnight. The sizes of those data files range from 1 gigabyte to 16 gigabytes. You want to migrate this application to Google Cloud with minimal effort and cost. What should you do?
A. Create a container for the set of binaries. Use Cloud Scheduler to start a Cloud Run job for the container.
B. Create a container for the set of binaries. Deploy the container to Google Kubernetes Engine (GKE) and use the Kubernetes scheduler to start the application.
C. Upload the code to Cloud Functions. Use Cloud Scheduler to start the application.
D. Lift and shift to a VM on Compute Engine. Use an instance schedule to start and stop the instance.
Show Answer
Correct Answer: D
Explanation: The requirement emphasizes minimal effort and cost. A lift-and-shift to a Compute Engine VM allows you to run the existing binaries without refactoring or containerization. You can schedule the VM to start at midnight and stop after the 45‑minute job, paying only for the runtime. Cloud Run or GKE would require containerization and additional setup effort, while Cloud Functions is unsuitable due to execution and memory limits.
Question 88
You are responsible for a web application on Compute Engine. You want your support team to be notified automatically if users experience high latency for at least 5 minutes. You need a Google-recommended solution with no development cost. What should you do?
A. Export Cloud Monitoring metrics to BigQuery and use a Looker Studio dashboard to monitor your web application’s latency.
B. Create an alert policy to send a notification when the HTTP response latency exceeds the specified threshold.
C. Implement an App Engine service which invokes the Cloud Monitoring API and sends a notification in case of anomalies.
D. Use the Cloud Monitoring dashboard to observe latency and take the necessary actions when the response latency exceeds the specified threshold.
Show Answer
Correct Answer: B
Explanation: The requirement is automatic notification after sustained high latency (5 minutes), using a Google‑recommended solution with no development cost. Cloud Monitoring alerting policies natively support latency metrics, threshold conditions with duration, and notification channels (email, SMS, etc.) without custom code. Options A and C require additional services and development, and D is manual rather than automatic. Therefore, creating an alert policy is the correct choice.
Question 89
During a recent audit of your existing Google Cloud resources, you discovered several users with email addresses outside of your Google Workspace domain. You want to ensure that your resources are only shared with users whose email addresses match your domain. You need to remove any mismatched users, and you want to avoid having to audit your resources to identify mismatched users. What should you do?
A. Create a Cloud Scheduler task to regularly scan your projects and delete mismatched users.
B. Create a Cloud Scheduler task to regularly scan your resources and delete mismatched users.
C. Set an organizational policy constraint to limit identities by domain to automatically remove mismatched users.
D. Set an organizational policy constraint to limit identities by domain, and then retroactively remove the existing mismatched users
Show Answer
Correct Answer: D
Explanation: Use an organization policy constraint (Domain Restricted Sharing) to limit which email domains can be added to IAM policies going forward. This prevents future sharing with external domains without requiring ongoing audits. Because organization policies are not retroactive, you must also manually remove the existing mismatched users after enforcing the policy.
$19
Get all 314 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.