Google Google Certifications ASSOCIATE-CLOUD-ENGINEER Questions & Answers

• Question 91:

  Your company set up a complex organizational structure on Google Could Platform. The structure includes hundreds of folders and projects. Only a few team members should be able to view the hierarchical structure. You need to assign minimum permissions to these team members and you want to follow Google-recommended practices. What should you do?

  A. Add the users to roles/browser role.

  B. Add the users to roles/iam.roleViewer role.

  C. Add the users to a group, and add this group to roles/browser role.

  D. Add the users to a group, and add this group to roles/iam.roleViewer role.

  Correct Answer: C

  We need to apply the GCP Best practices. roles/browser Browser Read access to browse the hierarchy for a project, including the folder, organization, and IAM policy. This role doesn't include permission to view resources in the project. https://cloud.google.com/iam/docs/understanding-roles

• Question 92:

  Your organization needs to grant users access to query datasets in BigQuery but prevent them from accidentally deleting the datasets. You want a solution that follows Google-recommended practices. What should you do?

  A. Add users to roles/bigquery user role only, instead of roles/bigquery dataOwner.

  B. Add users to roles/bigquery dataEditor role only, instead of roles/bigquery dataOwner.

  C. Create a custom role by removing delete permissions, and add users to that role only.

  D. Create a custom role by removing delete permissions. Add users to the group, and then add the group to the custom role.

  Correct Answer: D

  A - Works, but doesn't follow GCP best practices B - Doesn't work as the role grants permission to delete datasets C - Works, but is more complicated than A and doesn't follow Google best practices D - Correct, more complicated than A, but it follows Google Best Practices.

• Question 93:

  Your organization has strict requirements to control access to Google Cloud projects. You need to enable your Site Reliability Engineers (SREs) to approve requests from the Google Cloud support team when an SRE opens a support case. You want to follow Google-recommended practices. What should you do?

  A. Add your SREs to roles/iam.roleAdmin role.

  B. Add your SREs to roles/accessapproval approver role.

  C. Add your SREs to a group and then add this group to roles/iam roleAdmin role.

  D. Add your SREs to a group and then add this group to roles/accessapproval approver role.

  Correct Answer: D

  Add your SREs to a group and then add this group to roles/accessapproval approver role. -Google recommendation.

• Question 94:

  You need to host an application on a Compute Engine instance in a project shared with other teams. You want to prevent the other teams from accidentally causing downtime on that application. Which feature should you use?

  A. Use a Shielded VM.

  B. Use a Preemptible VM.

  C. Use a sole-tenant node.

  D. Enable deletion protection on the instance.

  Correct Answer: D

  Preventing Accidental VM Deletion

  This document describes how to protect specific VM instances from deletion by setting the deletionProtection property on an Instance resource. To learn more about VM instances, read the Instances documentation.

  As part of your workload, there might be certain VM instances that are critical to running your application or services, such as an instance running a SQL server, a server used as a license manager, and so on. These VM instances might need

  to stay running indefinitely so you need a way to protect these VMs from being deleted.

  By setting the deletionProtection flag, a VM instance can be protected from accidental deletion. If a user attempts to delete a VM instance for which you have set the deletionProtection flag, the request fails. Only a user that has been granted

  a role with compute.instances.create permission can reset the flag to allow the resource to be deleted.

  https://cloud.google.com/compute/docs/instances/preventing-accidental-vm-deletion

• Question 95:

  You have a developer laptop with the Cloud SDK installed on Ubuntu. The Cloud SDK was installed from the Google Cloud Ubuntu package repository. You want to test your application locally on your laptop with Cloud Datastore. What should you do?

  A. Export Cloud Datastore data using gcloud datastore export.

  B. Create a Cloud Datastore index using gcloud datastore indexes create.

  C. Install the google-cloud-sdk-datastore-emulator component using the apt get install command.

  D. Install the cloud-datastore-emulator component using the gcloud components install command.

  Correct Answer: C

  https://cloud.google.com/sdk/docs/downloads-apt-get

  The question is not about the datastore command itself but from where we should run the update command on the Ubuntu to install the component.

• Question 96:

  Your finance team wants to view the billing report for your projects. You want to make sure that the finance team does not get additional permissions to the project. What should you do?

  A. Add the group for the finance team to roles/billing user role.

  B. Add the group for the finance team to roles/billing admin role.

  C. Add the group for the finance team to roles/billing viewer role.

  D. Add the group for the finance team to roles/billing project/Manager role.

  Correct Answer: C

  "Billing Account Viewer access would usually be granted to finance teams, it provides access to spend information, but does not confer the right to link or unlink projects or otherwise manage the properties of the billing account."

  https://cloud.google.com/billing/docs/how-to/billing-access

• Question 97:

  You create a Deployment with 2 replicas in a Google Kubernetes Engine cluster that has a single preemptible node pool. After a few minutes, you use kubectl to examine the status of your Pod and observe that one of them is still in Pending status:

  

  What is the most likely cause?

  A. The pending Pod's resource requests are too large to fit on a single node of the cluster.

  B. Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod.

  C. The node pool is configured with a service account that does not have permission to pull the container image used by the pending Pod.

  D. The pending Pod was originally scheduled on a node that has been preempted between the creation of the Deployment and your verification of the Pods' status. It is currently being rescheduled on a new node.

  Correct Answer: B

  Reasons for a Pod Status Pending: Troubleshooting Reason #1: Not enough CPU Troubleshooting Reason #2: Not enough memory Troubleshooting Reason #3: Not enough CPU and memory https://managedkube.com/kubernetes/k8sbot/troubleshooting/pending/pod/2019/02/22/pending-pod.html

• Question 98:

  You want to find out when users were added to Cloud Spanner Identity Access Management (IAM) roles on your Google Cloud Platform (GCP) project. What should you do in the GCP Console?

  A. Open the Cloud Spanner console to review configurations.

  B. Open the IAM and admin console to review IAM policies for Cloud Spanner roles.

  C. Go to the Stackdriver Monitoring console and review information for Cloud Spanner.

  D. Go to the Stackdriver Logging console, review admin activity logs, and filter them for Cloud Spanner IAM roles.

  Correct Answer: D

  Activity logs captures the time when the users were given the IAM roles for Cloud Spanner

• Question 99:

  Your company implemented BigQuery as an enterprise data warehouse. Users from multiple business units run queries on this data warehouse. However, you notice that query costs for BigQuery are very high, and you need to control costs. Which two methods should you use? (Choose two.)

  A. Split the users from business units to multiple projects.

  B. Apply a user- or project-level custom query quota for BigQuery data warehouse.

  C. Create separate copies of your BigQuery data warehouse for each business unit.

  D. Split your BigQuery data warehouse into multiple data warehouses for each business unit.

  E. Change your BigQuery query model from on-demand to flat rate. Apply the appropriate number of slots to each Project.

  Correct Answer: BE

  Refer below link - first of all you can define quotas on project or user level and 2nd one is you can change from on demand to flat rate model and define the parameters based on your requirement --

  https://cloud.google.com/bigquery/docs/custom-quotas https://cloud.google.com/bigquery/pricing#flat_rate_pricing

• Question 100:

  You are building a product on top of Google Kubernetes Engine (GKE). You have a single GKE cluster. For each of your customers, a Pod is running in that cluster, and your customers can run arbitrary code inside their Pod. You want to maximize the isolation between your customers' Pods. What should you do?

  A. Use Binary Authorization and whitelist only the container images used by your customers' Pods.

  B. Use the Container Analysis API to detect vulnerabilities in the containers used by your customers' Pods.

  C. Create a GKE node pool with a sandbox type configured to gvisor. Add the parameter runtimeClassName: gvisor to the specification of your customers' Pods.

  D. Use the cos_containerd image for your GKE nodes. Add a nodeSelector with the value cloud.google.com/gke-os-distribution: cos_containerd to the specification of your customers' Pods.

  Correct Answer: C

  Reference: https://cloud.google.com/kubernetes-engine/sandbox/