Google Google Certifications ASSOCIATE-CLOUD-ENGINEER Questions & Answers

• Question 151:

  Your organization has three existing Google Cloud projects. You need to bill the Marketing department for only their Google Cloud services for a new initiative within their group. What should you do?

  A. 1. Verify that you ace assigned the Billing Administrator IAM role tor your organization's Google Cloud Project for the Marketing department

  2. Link the new project to a Marketing Billing Account

  B. 1. Verify that you are assigned the Billing Administrator IAM role for your organization's Google Cloud account

  2.

  Create a new Google Cloud Project for the Marketing department

  3.

  Set the default key-value project labels to department marketing for all services in this project

  C. 1. Verify that you are assigned the Organization Administrator IAM role for your organization's Google Cloud account

  2.

  Create a new Google Cloud Project for the Marketing department

  3.

  Link the new project to a Marketing Billing Account.

  D. 1. Verity that you are assigned the Organization Administrator IAM role for your organization's Google Cloud account

  2.

  Create a new Google Cloud Project for the Marketing department

  3.

  Set the default key value project labels to department marketing for all services in this protect

  Correct Answer: A

  Option A seems the only valid answer as Billing Admin can link a new project to a billing acc

  B and D assumes you have the resourcemanager.projects.create permission to create a new project. According to https://cloud.google.com/resource-manager/docs/creating-managing-labels#permissions resourcemanager.projects.update permission is needed to edit the labels neither Billing Adminstrator nor Organization Adminstrator has resourcemanager.projects.update permission to edit the labels they only can see the labels of a project as both have only resourcemanager.projects.get permission so Options B and D are both wrong

  C is wrong because neither does Organizational admin have resourcemanager.projects.create permission to create a project nor does it have permission to link a project to a billing account - > https://cloud.google.com/iam/docs/ understanding-roles#resourcemanager.organizationAdmin

• Question 152:

  You need to produce a list of the enabled Google Cloud Platform APIs for a GCP project using the gcloud command line in the Cloud Shell. The project name is my-project. What should you do?

  A. Run gcloud projects list to get the project ID, and then run gcloud services list --project .

  B. Run gcloud init to set the current project to my-project, and then run gcloud services list --available.

  C. Run gcloud info to view the account value, and then run gcloud services list --account .

  D. Run gcloud projects describe to verify the project value, and then run gcloud services list --available.

  Correct Answer: A

  A is the correct answer, log to gcloud and run the commands, doesnt make sense to run cloud init and gcloud services list --available gives you the full services that are available.

• Question 153:

  You are building a new version of an application hosted in an App Engine environment. You want to test the new version with 1% of users before you completely switch your application over to the new version. What should you do?

  A. Deploy a new version of your application in Google Kubernetes Engine instead of App Engine and then use GCP Console to split traffic.

  B. Deploy a new version of your application in a Compute Engine instance instead of App Engine and then use GCP Console to split traffic.

  C. Deploy a new version as a separate app in App Engine. Then configure App Engine using GCP Console to split traffic between the two apps.

  D. Deploy a new version of your application in App Engine. Then go to App Engine settings in GCP Console and split traffic between the current version and newly deployed versions accordingly.

  Correct Answer: D

  Splitting the question to the key requirements

  1.

  new version of an application hosted in an App Engine environment.

  2.

  test the new version with 1% of users

  App engine supports versioning and traffic splitting so no need to involve anything else (source - https://cloud.google.com/appengine#all-features)

  A. ....'Google Kubernetes Engine'.... - No need to involve GKE. Not the right option

  B. ....'Compute Engine instance'.... - No need to involve Compute Engine.

  C. ....'Separate app in App Engine'....- No need to deploy as a separate app. versioning is supported already. Not the right option.

  D. This is the right answer.

• Question 154:

  You want to configure an SSH connection to a single Compute Engine instance for users in the dev1 group. This instance is the only resource in this particular Google Cloud Platform project that the dev1 users should be able to connect to. What should you do?

  A. Set metadata to enable-oslogin=true for the instance. Grant the dev1 group the compute.osLogin role. Direct them to use the Cloud Shell to ssh to that instance.

  B. Set metadata to enable-oslogin=true for the instance. Set the service account to no service account for that instance. Direct them to use the Cloud Shell to ssh to that instance.

  C. Enable block project wide keys for the instance. Generate an SSH key for each user in the dev1 group. Distribute the keys to dev1 users and direct them to use their third-party tools to connect.

  D. Enable block project wide keys for the instance. Generate an SSH key and associate the key with that instance. Distribute the key to dev1 users and direct them to use their third-party tools to connect.

  Correct Answer: A

  Granting OS Login IAM roles

  After you enable OS Login on one or more instances in your project, those VMs accept connections only from user accounts that have the necessary IAM roles in your project or organization.

• Question 155:

  You are setting up a Windows VM on Compute Engine and want to make sure you can log in to the VM via RDP. What should you do?

  A. After the VM has been created, use your Google Account credentials to log in into the VM.

  B. After the VM has been created, use gcloud compute reset-windows-password to retrieve the login credentials for the VM.

  C. When creating the VM, add metadata to the instance using `windows-password' as the key and a password as the value.

  D. After the VM has been created, download the JSON private key for the default Compute Engine service account. Use the credentials in the JSON file to log in to the VM.

  Correct Answer: B

  Correct Answer is B.

  B. After the VM has been created, use gcloud compute reset-windows-password to retrieve the login credentials for the VM.

  https://cloud.google.com/sdk/gcloud/reference/beta/compute/reset-windows-password

• Question 156:

  You deployed a new application inside your Google Kubernetes Engine cluster using the YAML file specified below.

  

  You check the status of the deployed pods and notice that one of them is still in PENDING status:

  

  You want to find out why the pod is stuck in pending status. What should you do?

  A. Review details of the myapp-service Service object and check for error messages.

  B. Review details of the myapp-deployment Deployment object and check for error messages.

  C. Review details of myapp-deployment-58ddbbb995-lp86m Pod and check for warning messages.

  D. View logs of the container in myapp-deployment-58ddbbb995-lp86m pod and check for warning messages.

  Correct Answer: C

  Reference: https://cloud.google.com/run/docs/gke/troubleshooting

• Question 157:

  You are using Container Registry to centrally store your company's container images in a separate project. In another project, you want to create a Google Kubernetes Engine (GKE) cluster. You want to ensure that Kubernetes can download images from Container Registry. What should you do?

  A. In the project where the images are stored, grant the Storage Object Viewer IAM role to the service account used by the Kubernetes nodes.

  B. When you create the GKE cluster, choose the Allow full access to all Cloud APIs option under `Access scopes'.

  C. Create a service account, and give it access to Cloud Storage. Create a P12 key for this service account and use it as an imagePullSecrets in Kubernetes.

  D. Configure the ACLs on each image in Cloud Storage to give read-only access to the default Compute Engine service account.

  Correct Answer: A

  IAM permissions

  IAM permissions determine who can access resources. All users, service accounts, and other identities that interact with Container Registry must have the appropriate Cloud Storage permissions.

  By default, Google Cloud use default service accounts to interact with resources within the same project. For example, the Cloud Build service account can both push and pull images when Container Registry is in the same project.

  You must configure or modify permissions yourself if:

  You are using a service account in one project to access Container Registry in a different project

  You are using a default service account with read-only access to storage, but you want to both pull and push images

  You are using a custom service account to interact with Container Registry

  https://cloud.google.com/container-registry/docs/access-control

• Question 158:

  You are building an application that will run in your data center. The application will use Google Cloud Platform (GCP) services like AutoML. You created a service account that has appropriate access to AutoML. You need to enable authentication to the APIs from your on-premises environment. What should you do?

  A. Use service account credentials in your on-premises application.

  B. Use gcloud to create a key file for the service account that has appropriate permissions.

  C. Set up direct interconnect between your data center and Google Cloud Platform to enable authentication for your on-premises applications.

  D. Go to the IAM and admin console, grant a user account permissions similar to the service account permissions, and use this user account for authentication from your data center.

  Correct Answer: B

  To use a service account outside of Google Cloud, such as on other platforms or on-premises, you must first establish the identity of the service account. Public/private key pairs provide a secure way of accomplishing this goal. https://cloud.google.com/iam/docs/creating-managing-service-account-keys

• Question 159:

  You built an application on Google Cloud Platform that uses Cloud Spanner. Your support team needs to monitor the environment but should not have access to table data. You need a streamlined solution to grant the correct permissions to your support team, and you want to follow Google-recommended practices. What should you do?

  A. Add the support team group to the roles/monitoring.viewer role

  B. Add the support team group to the roles/spanner.databaseUser role.

  C. Add the support team group to the roles/spanner.databaseReader role.

  D. Add the support team group to the roles/stackdriver.accounts.viewer role.

  Correct Answer: A

  A is correct, the team need to monitor the environment not read the data.

• Question 160:

  For analysis purposes, you need to send all the logs from all of your Compute Engine instances to a BigQuery dataset called platform-logs. You have already installed the Stackdriver Logging agent on all the instances. You want to minimize cost. What should you do?

  A. 1. Give the BigQuery Data Editor role on the platform-logs dataset to the service accounts used by your instances.

  2. Update your instances' metadata to add the following value: logs-destination: bq://platform-logs.

  B. 1. In Stackdriver Logging, create a logs export with a Cloud Pub/Sub topic called logs as a sink.

  2.

  Create a Cloud Function that is triggered by messages in the logs topic.

  3.

  Configure that Cloud Function to drop logs that are not from Compute Engine and to insert Compute Engine logs in the platform-logs dataset.

  C. 1. In Stackdriver Logging, create a filter to view only Compute Engine logs.

  2.

  Click Create Export.

  3.

  Choose BigQuery as Sink Service, and the platform-logs dataset as Sink Destination.

  D. 1. Create a Cloud Function that has the BigQuery User role on the platform-logs dataset.

  2.

  Configure this Cloud Function to create a BigQuery Job that executes this query:

  INSERT INTO dataset.platform-logs (timestamp, log)

  SELECT timestamp, log FROM compute.logs

  WHERE timestamp > DATE_SUB(CURRENT_DATE(), INTERVAL 1 DAY)

  3.

  Use Cloud Scheduler to trigger this Cloud Function once a day.

  Correct Answer: C

  C. is correct, Sinks control how Cloud Logging routes logs. Using sinks, you can route some or all of your logs to supported destinations.