Google ASSOCIATE-CLOUD-ENGINEER Online Practice Questions and Exam Preparation

Google ASSOCIATE-CLOUD-ENGINEER Online Questions & Answers

• Question 131:

  You are using Container Registry to centrally store your company's container images in a separate project. In another project, you want to create a Google Kubernetes Engine (GKE) cluster. You want to ensure that Kubernetes can download images from Container Registry. What should you do?

  A. In the project where the images are stored, grant the Storage Object Viewer IAM role to the service account used by the Kubernetes nodes.
  B. When you create the GKE cluster, choose the Allow full access to all Cloud APIs option under `Access scopes'.
  C. Create a service account, and give it access to Cloud Storage. Create a P12 key for this service account and use it as an imagePullSecrets in Kubernetes.
  D. Configure the ACLs on each image in Cloud Storage to give read-only access to the default Compute Engine service account.
  A. In the project where the images are stored, grant the Storage Object Viewer IAM role to the service account used by the Kubernetes nodes.

  ---

  Explanation

  IAM permissions

  IAM permissions determine who can access resources. All users, service accounts, and other identities that interact with Container Registry must have the appropriate Cloud Storage permissions.

  By default, Google Cloud use default service accounts to interact with resources within the same project. For example, the Cloud Build service account can both push and pull images when Container Registry is in the same project.

  You must configure or modify permissions yourself if:

  You are using a service account in one project to access Container Registry in a different project

  You are using a default service account with read-only access to storage, but you want to both pull and push images

  You are using a custom service account to interact with Container Registry

  https://cloud.google.com/container-registry/docs/access-control

• Question 132:

  Your company was recently impacted by a service disruption that caused multiple Dataflow jobs to get stuck, resulting in significant downtime in downstream applications and revenue loss. You were able to resolve the issue by identifying and fixing an error you found in the code. You need to design a solution with minimal management effort to identify when jobs are stuck in the future to ensure that this issue does not occur again. What should you do?

  A. Update the Dataflow job configurations to send messages to a Pub/Sub topic when there are delays. Configure a backup Dataflow job to process jobs that are delayed. Use Cloud Tasks to trigger an alert when messages are pushed to the Pub/Sub topic.
  B. Set up Cloud Monitoring alerts on the data freshness metric for the Dataflow jobs to receive a notification when a certain threshold is reached.
  C. Set up Error Reporting to identify stack traces that indicate slowdowns in Dataflow jobs. Set up alerts based on these log entries.
  D. Use the Personalized Service Health dashboard to identify issues with Dataflow jobs across regions.
  B. Set up Cloud Monitoring alerts on the data freshness metric for the Dataflow jobs to receive a notification when a certain threshold is reached.

  ---

  Explanation

  Setting up Cloud Monitoring alerts on the data freshness metric for Dataflow jobs allows you to monitor job performance and receive notifications when jobs fall behind or get stuck, based on a predefined threshold. This provides an efficient and automated way to detect delays without requiring complex manual intervention or additional jobs.

• Question 133:

  You need to set up permissions for a set of Compute Engine instances to enable them to write data into a particular Cloud Storage bucket. You want to follow Google-recommended practices. What should you do?

  A. Create a service account with an access scope. Use the access scope `https://www.googleapis.com/auth/devstorage.write_only'.
  B. Create a service account with an access scope. Use the access scope `https://www.googleapis.com/auth/cloud-platform'.
  C. Create a service account and add it to the IAM role `storage.objectCreator' for that bucket.
  D. Create a service account and add it to the IAM role `storage.objectAdmin' for that bucket.
  C. Create a service account and add it to the IAM role `storage.objectCreator' for that bucket.

  ---

  Explanation

  https://towardsdatascience.com/enlightened-datalab-notebooks-35ce8ef374c0

  Best practice says, give minimum access that is required for the job and storage creator is minimum when you put it against admin who can do everything

• Question 134:

  You have deployed multiple Linux instances on Compute Engine. You plan on adding more instances in the coming weeks. You want to be able to access all of these instances through your SSH client over the internet without having to configure specific access on the existing and new instances. You do not want the Compute Engine instances to have a public IP. What should you do?

  A. Configure Cloud Identity-Aware Proxy for HTTPS resources.
  B. Configure Cloud Identity-Aware Proxy for SSH and TCP resources
  C. Create an SSH keypair and store the public key as a project-wide SSH Key.
  D. Create an SSH keypair and store the private key as a project-wide SSH Key.
  B. Configure Cloud Identity-Aware Proxy for SSH and TCP resources

  ---

  Explanation

  https://cloud.google.com/iap/docs/using-tcp-forwarding

• Question 135:

  The sales team has a project named Sales Data Digest that has the ID acme-data-digest You need to set up similar Google Cloud resources for the marketing team but their resources must be organized independently of the sales team. What should you do?

  A. Grant the Project Editor role to the Marketing learn for acme data digest
  B. Create a Project Lien on acme-data digest and then grant the Project Editor role to the Marketing team
  C. Create another protect with the ID acme-marketing-data-digest for the Marketing team and deploy the resources there
  D. Create a new protect named Meeting Data Digest and use the ID acme-data-digest Grant the Project Editor role to the Marketing team.
  C. Create another protect with the ID acme-marketing-data-digest for the Marketing team and deploy the resources there

  ---

  Explanation

• Question 136:

  Several employees at your company have been creating projects with Cloud Platform and paying for it with their personal credit cards, which the company reimburses. The company wants to centralize all these projects under a single, new billing account. What should you do?

  A. Contact [email protected] with your bank account details and request a corporate billing account for your company.
  B. Create a ticket with Google Support and wait for their call to share your credit card details over the phone.
  C. In the Google Platform Console, go to the Resource Manage and move all projects to the root Organizarion.
  D. In the Google Cloud Platform Console, create a new billing account and set up a payment method.
  D. In the Google Cloud Platform Console, create a new billing account and set up a payment method.

  ---

  Explanation

  https://www.whizlabs.com/blog/google-cloud-interview-questions/

  It's pretty straight-forward: you should establish a new billing account with a company-based payment method. Then set all the projects to use that new billing account.

• Question 137:

  You've deployed a microservice called myapp1 to a Google Kubernetes Engine cluster using the YAML file specified below: You need to refactor this configuration so that the database password is not stored in plain text. You want to follow Google-recommended practices. What should you do?

  

  A. Store the database password inside the Docker image of the container, not in the YAML file.
  B. Store the database password inside a Secret object. Modify the YAML file to populate the DB_PASSWORD environment variable from the Secret.
  C. Store the database password inside a ConfigMap object. Modify the YAML file to populate the DB_PASSWORD environment variable from the ConfigMap.
  D. Store the database password in a file inside a Kubernetes persistent volume, and use a persistent volume claim to mount the volume to the container.
  B. Store the database password inside a Secret object. Modify the YAML file to populate the DB_PASSWORD environment variable from the Secret.

  ---

  Explanation

  In kubernetes we always use secrets to keep sensitive and confidential data.

• Question 138:

  Your company has hired a third-party analytics company to help find patterns in user data. Your development team has generated a file containing only the data they've requested; which includes personally identifiable information. What is the best way to share the data with the other company?

  A. Create a new user for the company and grant them access to the original data source for them to query.
  B. Send the file through email.
  C. Put the data on Cloud Storage and generate a signed URL that will expire in one hour, and securely share the URL.
  D. Put the data on Cloud Storage in a public bucket and securely share the URL.
  C. Put the data on Cloud Storage and generate a signed URL that will expire in one hour, and securely share the URL.

  ---

  Explanation

• Question 139:

  You are creating a Google Kubernetes Engine (GKE) cluster with a cluster autoscaler feature enabled. You need to make sure that each node of the cluster will run a monitoring pod that sends container metrics to a third-party monitoring solution. What should you do?

  A. Deploy the monitoring pod in a StatefulSet object.
  B. Deploy the monitoring pod in a DaemonSet object.
  C. Reference the monitoring pod in a Deployment object.
  D. Reference the monitoring pod in a cluster initializer at the GKE cluster creation time.
  B. Deploy the monitoring pod in a DaemonSet object.

  ---

  Explanation

  B is right: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/ Some typical uses of a DaemonSet are:

  running a cluster storage daemon on every node running a logs collection daemon on every node running a node monitoring daemon on every node

• Question 140:

  Your boss has asked you to onboard a new user and provide them with access to their team's project. What set of steps best describes what needs to happen?

  A. Add them as a member of the project, grant them the required roles, and sync the user back to G Suite.
  B. Add the user inside of G Suite, create a user group, and add them to that user group.
  C. Add the user inside of G Suite; sync from G Suite to the Active Directory using the Directory Sync util; add them as a member and grant them the required roles.
  D. Add the user inside of G Suite, add them as a member of the project, and grant them the required roles.
  D. Add the user inside of G Suite, add them as a member of the project, and grant them the required roles.

  ---

  Explanation