Google ASSOCIATE-CLOUD-ENGINEER Online Practice Questions and Exam Preparation

Google ASSOCIATE-CLOUD-ENGINEER Online Questions & Answers

• Question 1:

  You have two subnets (subnet-a and subnet-b) in the default VPC. Your database servers are running in subnet-a. Your application servers and web servers are running in subnet-b. You want to configure a firewall rule that only allows database traffic from the application servers to the database servers. What should you do?

  A. Create service accounts sa-app and sa-db. Associate service account: sa-app with the application servers and the service account sa-db with the database servers. Create an ingress firewall rule to allow network traffic from source service account sa-app to target service account sa-db.
  B. Create network tags app-server and db-server. Add the app-server lag lo the application servers and the db-server lag to the database servers. Create an egress firewall rule to allow network traffic from source network tag app-server to target network tag db-server.
  C. Create a service account sa-app and a network tag db-server. Associate the service account sa-app with the application servers and the network tag db- server with the database servers. Create an ingress firewall rule to allow network traffic from source VPC IP addresses and target the subnet-a IP addresses.
  D. Create a network lag app-server and service account sa-db. Add the tag to the application servers and associate the service account with the database servers. Create an egress firewall rule to allow network traffic from source network tag app-server to target service account sa-db.
  A. Create service accounts sa-app and sa-db. Associate service account: sa-app with the application servers and the service account sa-db with the database servers. Create an ingress firewall rule to allow network traffic from source service account sa-app to target service account sa-db.

  ---

  Explanation

  From the TomFoot link

  'for example, allow my "application x" servers to access my "database y."'

• Question 2:

  You are running a web application on Cloud Run for a few hundred users. Some of your users complain that the initial web page of the application takes much longer to load than the following pages. You want to follow Google's recommendations to mitigate the issue. What should you do?

  A. Set the minimum number of instances for your Cloud Run service to 3.
  B. Set the concurrency number to 1 for your Cloud Run service.
  C. Set the maximum number of instances for your Cloud Run service to 100.
  D. Update your web application to use the protocol HTTP/2 instead of HTTP/1.1.
  A. Set the minimum number of instances for your Cloud Run service to 3.

  ---

  Explanation

  https://cloud.google.com/functions/docs/configuring/min-instances

  Even though the initial # of instances present in the VM is not stated, setting a min amount of instances "can further help you avoid cold starts and reduce application latency".

• Question 3:

  You have an application that uses Cloud Spanner as a backend database. The application has a very predictable traffic pattern. You want to automatically scale up or down the number of Spanner nodes depending on traffic. What should you do?

  A. Create a cron job that runs on a scheduled basis to review stackdriver monitoring metrics, and then resize the Spanner instance accordingly.
  B. Create a Stackdriver alerting policy to send an alert to oncall SRE emails when Cloud Spanner CPU exceeds the threshold. SREs would scale resources up or down accordingly.
  C. Create a Stackdriver alerting policy to send an alert to Google Cloud Support email when Cloud Spanner CPU exceeds your threshold. Google support would scale resources up or down accordingly.
  D. Create a Stackdriver alerting policy to send an alert to webhook when Cloud Spanner CPU is over or under your threshold. Create a Cloud Function that listens to HTTP and resizes Spanner resources accordingly.
  D. Create a Stackdriver alerting policy to send an alert to webhook when Cloud Spanner CPU is over or under your threshold. Create a Cloud Function that listens to HTTP and resizes Spanner resources accordingly.

  ---

  Explanation

  Create a Cloud Monitoring alerting policy to send an alert to webhook when Cloud Spanner CPU is over or under your threshold. Create a Cloud Function that listens to HTTP and resizes Spanner resources accordingly.

• Question 4:

  You have successfully created a development environment in a project for an application. This application uses Compute Engine and Cloud SQL. Now, you need to create a production environment for this application. The security team has forbidden the existence of network routes between these 2 environments, and asks you to follow Google-recommended practices. What should you do?

  A. Create a new project, enable the Compute Engine and Cloud SQL APIs in that project, and replicate the setup you have created in the development environment.
  B. Create a new production subnet in the existing VPC and a new production Cloud SQL instance in your existing project, and deploy your application using those resources.
  C. Create a new project, modify your existing VPC to be a Shared VPC, share that VPC with your new project, and replicate the setup you have in the development environment in that new project, in the Shared VPC.
  D. Ask the security team to grant you the Project Editor role in an existing production project used by another division of your company. Once they grant you that role, replicate the setup you have in the development environment in that project.
  A. Create a new project, enable the Compute Engine and Cloud SQL APIs in that project, and replicate the setup you have created in the development environment.

  ---

  Explanation

  A - correct. Best practice is to create a new project for each environment, such as production and testing. There are no routes between VPCs in these projects by default, so that satisfies the requirement by the security team.

  B. Nope. not best practice and allows communication.

  C. While this is best practice to create a new project for a different environment, it explicitly breaks the security team's rule of having no path between environments by nature of the shared VPC. The shared VPC allows entities in both VPCs to communicate as if they were in the same VPC. That's definitely wrong.

  D. One - not best practice to replicate in the setup in that project. Two - why do they suddenly need the project editor rule? Just a bad answer. Wrong.

• Question 5:

  Regarding audit logs, which of the following is a Google recommended best practice?

  A. Export your audit logs to App Engine
  B. Export your audit logs to Pub/Sub.
  C. Flush your audit logs monthly so you can more easily notice security events.
  D. Export your audit logs to Cloud Storage and store them for a long period of time.
  D. Export your audit logs to Cloud Storage and store them for a long period of time.

  ---

  Explanation

• Question 6:

  Your company uses Pub/Sub for event-driven workloads. You have a subscription named email-updates attached to the new-orders topic. You need to fetch and acknowledge waiting messages from this subscription. What should you do?

  A. Use the gcloud pubsub subscriptions seek email-updates command.
  B. Use the gcloud pubsub topics describe new-orders command.
  C. Use the gcloud pubsub subscriptions pull email-updates --auto-ack command.
  D. Use the gcloud pubsub topics list-subscriptions new-orders --filter="email- command.updates"
  C. Use the gcloud pubsub subscriptions pull email-updates --auto-ack command.

  ---

  Explanation

  The subscriptions pull command actually retrieves (pulls) any pending messages on the specified subscription. Adding --auto-ack causes each message to be acknowledged immediately upon retrieval, removing it from the subscription's backlog.

• Question 7:

  You need to produce a list of the enabled Google Cloud Platform APIs for a GCP project using the gcloud command line in the Cloud Shell. The project name is my-project. What should you do?

  A. Run gcloud projects list to get the project ID, and then run gcloud services list --project .
  B. Run gcloud init to set the current project to my-project, and then run gcloud services list --available.
  C. Run gcloud info to view the account value, and then run gcloud services list --account .
  D. Run gcloud projects describe to verify the project value, and then run gcloud services list --available.
  A. Run gcloud projects list to get the project ID, and then run gcloud services list --project .

  ---

  Explanation

  A is the correct answer, log to gcloud and run the commands, doesnt make sense to run cloud init and gcloud services list --available gives you the full services that are available.

• Question 8:

  You are working with a user to set up an application in a new VPC behind a firewall. The user is concerned about data egress. You want to configure the fewest open egress ports. What should you do?

  A. Set up a low-priority (65534) rule that blocks all egress and a high-priority rule (1000) that allows only the appropriate ports.
  B. Set up a high-priority (1000) rule that pairs both ingress and egress ports.
  C. Set up a high-priority (1000) rule that blocks all egress and a low-priority (65534) rule that allows only the appropriate ports.
  D. Set up a high-priority (1000) rule to allow the appropriate ports.
  A. Set up a low-priority (65534) rule that blocks all egress and a high-priority rule (1000) that allows only the appropriate ports.

  ---

  Explanation

  Implied rules Every VPC network has two implied firewall rules. These rules exist, but are not shown in the Cloud Console: Implied allow egress rule. An egress rule whose action is allow, destination is 0.0.0.0/0, and priority is the lowest possible (65535) lets any instance send traffic to any destination, except for traffic blocked by Google Cloud. A higher priority firewall rule may restrict outbound access. Internet access is allowed if no other firewall rules deny outbound traffic and if the instance has an external IP address or uses a Cloud NAT instance. For more information, see Internet access requirements. Implied deny ingress rule. An ingress rule whose action is deny, source is 0.0.0.0/0, and priority is the lowest possible (65535) protects all instances by blocking incoming connections to them. A higher priority rule might allow incoming access. The default network includes some additional rules that override this one, allowing certain types of incoming connections. https://cloud.google.com/vpc/docs/firewalls#default_firewall_rules

• Question 9:

  You need to deploy an application in Google Cloud using savorless technology. You want to test a new version of the application with a small percentage of production traffic. What should you do?

  A. Deploy the application lo Cloud. Run. Use gradual rollouts for traffic spelling.
  B. Deploy the application lo Google Kubemetes Engine. Use Anthos Service Mesh for traffic splitting.
  C. Deploy the application to Cloud functions. Saucily the version number in the functions name.
  D. Deploy the application to App Engine. For each new version, create a new service.
  A. Deploy the application lo Cloud. Run. Use gradual rollouts for traffic spelling.

  ---

  Explanation

• Question 10:

  You have a virtual machine that is currently configured with 2 vCPUs and 4 GB of memory. It is running out of memory. You want to upgrade the virtual machine to have 8 GB of memory. What should you do?

  A. Rely on live migration to move the workload to a machine with more memory.
  B. Use gcloud to add metadata to the VM. Set the key to required-memory-size and the value to 8 GB.
  C. Stop the VM, change the machine type to n1-standard-8, and start the VM.
  D. Stop the VM, increase the memory to 8 GB, and start the VM.
  D. Stop the VM, increase the memory to 8 GB, and start the VM.

  ---

  Explanation

  Stop the VM, increase the memory to 8 GB, and start the VM.