Google Google Certifications ASSOCIATE-CLOUD-ENGINEER Questions & Answers

• Question 1:

  You have been asked to set up the billing configuration for a new Google Cloud customer. Your customer wants to group resources that share common IAM policies. What should you do?

  A. Use labels to group resources that share common IAM policies

  B. Use folders to group resources that share common IAM policies

  C. Set up a proper billing account structure to group IAM policies

  D. Set up a proper project naming structure to group IAM policies

  Correct Answer: B

  Folders are nodes in the Cloud Platform Resource Hierarchy. A folder can contain projects, other folders, or a combination of both. Organizations can use folders to group projects under the organization node in a hierarchy. For example, your organization might contain multiple departments, each with its own set of Google Cloud resources. Folders allow you to group these resources on a per-department basis. Folders are used to group resources that share common IAM policies. While a folder can contain multiple folders or resources, a given folder or resource can have exactly one parent. https://cloud.google.com/resource-manager/docs/creating-managing-folders

• Question 2:

  You are developing a new web application that will be deployed on Google Cloud Platform. As part of your release cycle, you want to test updates to your application on a small portion of real user traffic. The majority of the users should still be directed towards a stable version of your application. What should you do?

  A. Deploy me application on App Engine For each update, create a new version of the same service Configure traffic splitting to send a small percentage of traffic to the new version

  B. Deploy the application on App Engine For each update, create a new service Configure traffic splitting to send a small percentage of traffic to the new service.

  C. Deploy the application on Kubernetes Engine For a new release, update the deployment to use the new version

  D. Deploy the application on Kubernetes Engine For a now release, create a new deployment for the new version Update the service e to use the now deployment.

  Correct Answer: A

  Keyword, Version, traffic splitting, App Engine supports traffic splitting for versions before releasing.

• Question 3:

  Your auditor wants to view your organization's use of data in Google Cloud. The auditor is most interested in auditing who accessed data in Cloud Storage buckets. You need to help the auditor access the data they need. What should you do?

  A. Assign the appropriate permissions, and then use Cloud Monitoring to review metrics

  B. Use the export logs API to provide the Admin Activity Audit Logs in the format they want

  C. Turn on Data Access Logs for the buckets they want to audit, and Then build a query in the log viewer that filters on Cloud Storage

  D. Assign the appropriate permissions, and then create a Data Studio report on Admin Activity Audit Logs

  Correct Answer: C

  Types of audit logs Cloud Audit Logs provides the following audit logs for each Cloud project, folder, and organization: Admin Activity audit logs Data Access audit logs System Event audit logs Policy Denied audit logs ***Data Access audit logs contain API calls that read the configuration or metadata of resources, as well as user-driven API calls that create, modify, or read user-provided resource data. https://cloud.google.com/logging/docs/audit#types https://cloud.google.com/ logging/docs/audit#data-access Cloud Storage: When Cloud Storage usage logs are enabled, Cloud Storage writes usage data to the Cloud Storage bucket, which generates Data Access audit logs for the bucket. The generated Data Access audit log has its caller identity redacted.

• Question 4:

  You are managing a Data Warehouse on BigQuery. An external auditor will review your company's processes, and multiple external consultants will need view access to the data. You need to provide them with view access while following

  Google-recommended practices.

  What should you do?

  A. Grant each individual external consultant the role of BigQuery Editor

  B. Grant each individual external consultant the role of BigQuery Viewer

  C. Create a Google Group that contains the consultants and grant the group the role of BigQuery Editor D. Create a Google Group that contains the consultants, and grant the group the role of BigQuery Viewer

  Correct Answer: D

• Question 5:

  Your organization has three existing Google Cloud projects. You need to bill the Marketing department for only their Google Cloud services for a new initiative within their group. What should you do?

  A. 1. Verify that you ace assigned the Billing Administrator IAM role tor your organization's Google Cloud Project for the Marketing department

  2. Link the new project to a Marketing Billing Account

  B. 1. Verify that you are assigned the Billing Administrator IAM role for your organization's Google Cloud account

  2.

  Create a new Google Cloud Project for the Marketing department

  3.

  Set the default key-value project labels to department marketing for all services in this project

  C. 1. Verify that you are assigned the Organization Administrator IAM role for your organization's Google Cloud account

  2.

  Create a new Google Cloud Project for the Marketing department

  3.

  Link the new project to a Marketing Billing Account.

  D. 1. Verity that you are assigned the Organization Administrator IAM role for your organization's Google Cloud account

  2.

  Create a new Google Cloud Project for the Marketing department

  3.

  Set the default key value project labels to department marketing for all services in this protect

  Correct Answer: A

  Option A seems the only valid answer as Billing Admin can link a new project to a billing acc

  B and D assumes you have the resourcemanager.projects.create permission to create a new project. According to https://cloud.google.com/resource-manager/docs/creating-managing-labels#permissions resourcemanager.projects.update permission is needed to edit the labels neither Billing Adminstrator nor Organization Adminstrator has resourcemanager.projects.update permission to edit the labels they only can see the labels of a project as both have only resourcemanager.projects.get permission so Options B and D are both wrong

  C is wrong because neither does Organizational admin have resourcemanager.projects.create permission to create a project nor does it have permission to link a project to a billing account - > https://cloud.google.com/iam/docs/ understanding-roles#resourcemanager.organizationAdmin

• Question 6:

  You need to produce a list of the enabled Google Cloud Platform APIs for a GCP project using the gcloud command line in the Cloud Shell. The project name is my-project. What should you do?

  A. Run gcloud projects list to get the project ID, and then run gcloud services list --project .

  B. Run gcloud init to set the current project to my-project, and then run gcloud services list --available.

  C. Run gcloud info to view the account value, and then run gcloud services list --account .

  D. Run gcloud projects describe to verify the project value, and then run gcloud services list --available.

  Correct Answer: A

  A is the correct answer, log to gcloud and run the commands, doesnt make sense to run cloud init and gcloud services list --available gives you the full services that are available.

• Question 7:

  You are building a new version of an application hosted in an App Engine environment. You want to test the new version with 1% of users before you completely switch your application over to the new version. What should you do?

  A. Deploy a new version of your application in Google Kubernetes Engine instead of App Engine and then use GCP Console to split traffic.

  B. Deploy a new version of your application in a Compute Engine instance instead of App Engine and then use GCP Console to split traffic.

  C. Deploy a new version as a separate app in App Engine. Then configure App Engine using GCP Console to split traffic between the two apps.

  D. Deploy a new version of your application in App Engine. Then go to App Engine settings in GCP Console and split traffic between the current version and newly deployed versions accordingly.

  Correct Answer: D

  Splitting the question to the key requirements

  1.

  new version of an application hosted in an App Engine environment.

  2.

  test the new version with 1% of users

  App engine supports versioning and traffic splitting so no need to involve anything else (source - https://cloud.google.com/appengine#all-features)

  A. ....'Google Kubernetes Engine'.... - No need to involve GKE. Not the right option

  B. ....'Compute Engine instance'.... - No need to involve Compute Engine.

  C. ....'Separate app in App Engine'....- No need to deploy as a separate app. versioning is supported already. Not the right option.

  D. This is the right answer.

• Question 8:

  You are setting up a Windows VM on Compute Engine and want to make sure you can log in to the VM via RDP. What should you do?

  A. After the VM has been created, use your Google Account credentials to log in into the VM.

  B. After the VM has been created, use gcloud compute reset-windows-password to retrieve the login credentials for the VM.

  C. When creating the VM, add metadata to the instance using `windows-password' as the key and a password as the value.

  D. After the VM has been created, download the JSON private key for the default Compute Engine service account. Use the credentials in the JSON file to log in to the VM.

  Correct Answer: B

  Correct Answer is B.

  B. After the VM has been created, use gcloud compute reset-windows-password to retrieve the login credentials for the VM.

  https://cloud.google.com/sdk/gcloud/reference/beta/compute/reset-windows-password

• Question 9:

  You want to configure an SSH connection to a single Compute Engine instance for users in the dev1 group. This instance is the only resource in this particular Google Cloud Platform project that the dev1 users should be able to connect to. What should you do?

  A. Set metadata to enable-oslogin=true for the instance. Grant the dev1 group the compute.osLogin role. Direct them to use the Cloud Shell to ssh to that instance.

  B. Set metadata to enable-oslogin=true for the instance. Set the service account to no service account for that instance. Direct them to use the Cloud Shell to ssh to that instance.

  C. Enable block project wide keys for the instance. Generate an SSH key for each user in the dev1 group. Distribute the keys to dev1 users and direct them to use their third-party tools to connect.

  D. Enable block project wide keys for the instance. Generate an SSH key and associate the key with that instance. Distribute the key to dev1 users and direct them to use their third-party tools to connect.

  Correct Answer: A

  Granting OS Login IAM roles

  After you enable OS Login on one or more instances in your project, those VMs accept connections only from user accounts that have the necessary IAM roles in your project or organization.

• Question 10:

  You deployed a new application inside your Google Kubernetes Engine cluster using the YAML file specified below.

  

  You check the status of the deployed pods and notice that one of them is still in PENDING status: You want to find out why the pod is stuck in pending status. What should you do?

  

  A. Review details of the myapp-service Service object and check for error messages.

  B. Review details of the myapp-deployment Deployment object and check for error messages.

  C. Review details of myapp-deployment-58ddbbb995-lp86m Pod and check for warning messages.

  D. View logs of the container in myapp-deployment-58ddbbb995-lp86m pod and check for warning messages.

  Correct Answer: C

  Reference: https://cloud.google.com/run/docs/gke/troubleshooting