Google ASSOCIATE-CLOUD-ENGINEER Online Practice Questions and Exam Preparation

Google ASSOCIATE-CLOUD-ENGINEER Online Questions & Answers

• Question 111:

  You need to create a custom IAM role for use with a GCP service. All permissions in the role must be suitable for production use. You also want to clearly share with your organization the status of the custom role. This will be the first version of the custom role. What should you do?

  A. Use permissions in your role that use the `supported' support level for role permissions. Set the role stage to ALPHA while testing the role permissions.
  B. Use permissions in your role that use the `supported' support level for role permissions. Set the role stage to BETA while testing the role permissions.
  C. Use permissions in your role that use the `testing' support level for role permissions. Set the role stage to ALPHA while testing the role permissions.
  D. Use permissions in your role that use the `testing' support level for role permissions. Set the role stage to BETA while testing the role permissions.
  A. Use permissions in your role that use the `supported' support level for role permissions. Set the role stage to ALPHA while testing the role permissions.

  ---

  Explanation

  Testing and deploying

  Custom roles include a launch stage, which is stored in the stage property for the role. The launch stage is informational; it helps you keep track of whether each role is ready for widespread use.

  Each custom role can have one of the following launch stages:

  Launch stages

  ALPHA The role is still being developed or tested, or it includes permissions for Google Cloud services or features that are not yet public. It is not ready for widespread use. BETA The role has been tested on a limited basis, or it includes

  permissions for Google Cloud services or features that are not generally available. GA The role has been widely tested, and all of its permissions are for Google Cloud services or features that are generally available.

• Question 112:

  You have deployed an application on a Compute Engine instance. An external consultant needs to access the Linux-based instance. The consultant is connected to your corporate network through a VPN connection, but the consultant has no Google account.

  What should you do?

  A. Instruct the external consultant to use the gcloud compute ssh command line tool by using Identity- Aware Proxy to access the instance.
  B. Instruct the external consultant to use the gcloud compute ssh command line tool by using the public IP address of the instance to access it.
  C. Instruct the external consultant to generate an SSH key pair, and request the public key from the consultant. Add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key.
  D. Instruct the external consultant to generate an SSH key pair, and request the private key from the consultant. Add the private key to the instance yourself, and have the consultant access the instance through SSH with their public key.
  C. Instruct the external consultant to generate an SSH key pair, and request the public key from the consultant. Add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key.

  ---

  Explanation

  The best option is to instruct the external consultant to generate an SSH key pair, and request the public key from the consultant. Then, add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key. This way, you can grant the consultant access to the instance without requiring a Google account or exposing the instance's public IP address. This option also follows the best practice of using user-managed SSH keys instead of service account keys for SSH access1. Option A is not feasible because the external consultant does not have a Google account, and therefore cannot use Identity-Aware Proxy (IAP) to access the instance. IAP requires the user to authenticate with a Google account and have the appropriate IAM permissions to access the instance2. Option B is not secure because it exposes the instance's public IP address, which can increase the risk of unauthorized access or attacks. Option D is not correct because it reverses the roles of the public and private keys. The public key should be added to the instance, and the private key should be kept by the consultant. Sharing the private key with anyone else can compromise the security of the SSH connection3.

  References:

  1: https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys

  2: https://cloud.google.com/iap/docs/using-tcp-forwarding

  3: https://cloud.google.com/compute/docs/instances/connecting- advanced#sshbetweeninstances

• Question 113:

  Your team uses a third-party monitoring solution. They've asked you to deploy it to the nodes in your Kubernetes Engine Cluster. What's the best way to do that?

  A. Deploy the monitoring pod as a DaemonSet.
  B. Deploy the monitoring pod as a Deployment.
  C. Use Deployment Manager to deploy the monitoring solution.
  D. Connect to each node via SSH and install the monitoring solution.
  A. Deploy the monitoring pod as a DaemonSet.

  ---

  Explanation

• Question 114:

  Your company's infrastructure is on-premises, but all machines are running at maximum capacity. You want to burst to Google Cloud. The workloads on Google Cloud must be able to directly communicate to the workloads on-premises using a private IP range. What should you do?

  A. In Google Cloud, configure the VPC as a host for Shared VPC.
  B. In Google Cloud, configure the VPC for VPC Network Peering.
  C. Create bastion hosts both in your on-premises environment and on Google Cloud. Configure both as proxy servers using their public IP addresses.
  D. Set up Cloud VPN between the infrastructure on-premises and Google Cloud.
  D. Set up Cloud VPN between the infrastructure on-premises and Google Cloud.

  ---

  Explanation

  "Google Cloud VPC Network Peering allows internal IP address connectivity across two Virtual Private Cloud (VPC) networks regardless of whether they belong to the same project or the same organization." https://cloud.google.com/vpc/ docs/vpc-peering

  while "Cloud Interconnect provides low latency, high availability connections that enable you to reliably transfer data between your on-premises and Google Cloud Virtual Private Cloud (VPC) networks." https://cloud.google.com/networkconnectivity/docs/interconnect/concepts/overview

  and "HA VPN is a high-availability (HA) Cloud VPN solution that lets you securely connect your on-premises network to your VPC network through an IPsec VPN connection in a single region." https://cloud.google.com/network-connectivity/docs/ vpn/concepts/overview

  so, cloud vpn is the best answer for the question requirement

• Question 115:

  The DevOps group in your organization needs full control of Compute Engine resources in your development project. However, they should not have permission to create or update any other resources in the project. You want to follow Google's recommendations for setting permissions for the DevOps group. What should you do?

  A. Grant the basic role roles/viewer and the predefined role roles/compute.admin to the DevOps group.
  B. Create an IAM policy and grant all compute.instanceAdmin.* permissions to the policy. Attach the policy to the DevOps group.
  C. Create a custom role at the folder level and grant all compute.instanceAdmin.* permissions to the role. Grant the custom role to the DevOps group.
  D. Grant the basic role roles/editor to the DevOps group.
  C. Create a custom role at the folder level and grant all compute.instanceAdmin.* permissions to the role. Grant the custom role to the DevOps group.

  ---

  Explanation

• Question 116:

  Your team has been working towards using desired state configuration for your entire infrastructure, which is why they're excited to store the Kubernetes Deployments in YAML. You created a Kubernetes Deployment with the kubectl apply command and passed on a YAML file. You need to edit the number of replicas. What steps should you take to update the Deployment?

  A. Edit the number of replicas in the YAML file and rerun the kubectl apply.
  B. Edit the YAML and push it to Github so that the git triggers deploy the change.
  C. Disregard the YAML file. Use the kubectl scale command.
  D. Edit the number of replicas in the YAML file and run the kubectl set image command.
  A. Edit the number of replicas in the YAML file and rerun the kubectl apply.

  ---

  Explanation

• Question 117:

  Your developers are trying to connect to an Ubuntu server over SSH to diagnose some errors. However, the connection times out. Which command should help solve the problem?

  A. gcloud compute firewall-rules create "open-ssh" --network $NETWORK --allow tcp:22
  B. gcloud compute firewall-rules create "open-ssh"
  C. gcloud compute firewall-rules create "open-ssh" --network $NETWORK --deny tcp:22
  D. gcloud compute firewall-rules create "open-ssh" --network $NETWORK --allow tcp:3389
  A. gcloud compute firewall-rules create "open-ssh" --network $NETWORK --allow tcp:22

  ---

  Explanation

• Question 118:

  You are migrating a production-critical on-premises application that requires 96 vCPUs to perform its task. You want to make sure the application runs in a similar environment on GCP. What should you do?

  A. When creating the VM, use machine type n1-standard-96.
  B. When creating the VM, use Intel Skylake as the CPU platform.
  C. Create the VM using Compute Engine default settings. Use gcloud to modify the running instance to have 96 vCPUs.
  D. Start the VM using Compute Engine default settings, and adjust as you go based on Rightsizing Recommendations.
  A. When creating the VM, use machine type n1-standard-96.

  ---

  Explanation

  https://cloud.google.com/compute/docs/machine-types

• Question 119:

  Your company runs its Linux workloads on Compute Engine instances. Your company will be working with a new operations partner that does not use Google Accounts. You need to grant access to the instances to your operations partner so they can maintain the installed tooling. What should you do?

  A. Enable Cloud IAP for the Compute Engine instances, and add the operations partner as a Cloud IAP Tunnel User.
  B. Tag all the instances with the same network tag. Create a firewall rule in the VPC to grant TCP access on port 22 for traffic from the operations partner to instances with the network tag.
  C. Set up Cloud VPN between your Google Cloud VPC and the internal network of the operations partner.
  D. Ask the operations partner to generate SSH key pairs, and add the public keys to the VM instances.
  A. Enable Cloud IAP for the Compute Engine instances, and add the operations partner as a Cloud IAP Tunnel User.

  ---

  Explanation

  A is the correct answer,

  IAP controls access to your App Engine apps and Compute Engine VMs running on Google Cloud. It leverages user identity and the context of a request to determine if a user should be allowed access. IAP is a building block toward

  BeyondCorp, an enterprise security model that enables employees to work from untrusted networks without using a VPN.

  By default, IAP uses Google identities and IAM. By leveraging Identity Platform instead, you can authenticate users with a wide range of external identity providers, such as:

  Email/password

  OAuth (Google, Facebook, Twitter, GitHub, Microsoft, etc.)

  SAML

  OIDC

  Phone number

  Custom

  Anonymous

  This is useful if your application is already using an external authentication system, and migrating your users to Google accounts is impractical.

• Question 120:

  You have a development project with appropriate IAM roles defined. You are creating a production project and want to have the same IAM roles on the new project, using the fewest possible steps. What should you do?

  A. Use gcloud iam roles copy and specify the production project as the destination project.
  B. Use gcloud iam roles copy and specify your organization as the destination organization.
  C. In the Google Cloud Platform Console, use the `create role from role' functionality.
  D. In the Google Cloud Platform Console, use the `create role' functionality and select all applicable permissions.
  A. Use gcloud iam roles copy and specify the production project as the destination project.

  ---

  Explanation

  https://cloud.google.com/sdk/gcloud/reference/iam/roles/copy It's at project level and Iam role copy