Google ASSOCIATE-CLOUD-ENGINEER Online Practice Questions and Exam Preparation

Google ASSOCIATE-CLOUD-ENGINEER Online Questions & Answers

• Question 171:

  Your developers have been thoroughly logging everything that happens in the API. The API allows end users to request the data as JSON, XML, CSV, and XLS. Supporting all of these formats is taking a lot of developer effort. Management would like to start tracking which options are used over the next month. Without modifying the code, what's the fastest way to be able to report on this data at the end of the month?

  A. Create a custom counter logging metric that uses a regex to extract the data format into a label. At the end of the month, use the metric viewer to see the group by the label.
  B. Create a log sink that filters for rows that mention the data format. Export that to BigQuery, and run a query at the end of the month.
  C. Create a custom monitoring metric in code and edit the API code to set the metric each time the API is called.
  D. Export the logs to excel, and search for the different fields.
  A. Create a custom counter logging metric that uses a regex to extract the data format into a label. At the end of the month, use the metric viewer to see the group by the label.

  ---

  Explanation

• Question 172:

  Your security team has asked you to present them some numbers based on the logs that are exported to BigQuery. Due to the team structure, your manager has asked you to determine how much the query will cost. What's the best way to determine the cost?

  A. It's not possible to estimate the cost of a query.
  B. Create the query and execute the query in "cost estimation mode"
  C. Create the query and use the dry-run option to determine the amount of data read, then use the price calculator to determine the cost.
  D. Use the BigQuery index viewer to determine how many records you'll be reading.
  C. Create the query and use the dry-run option to determine the amount of data read, then use the price calculator to determine the cost.

  ---

  Explanation

• Question 173:

  You have one project called proj-sa where you manage all your service accounts. You want to be able to use a service account from this project to take snapshots of VMs running in another project called proj-vm. What should you do?

  A. Download the private key from the service account, and add it to each VMs custom metadata.
  B. Download the private key from the service account, and add the private key to each VM's SSH keys.
  C. Grant the service account the IAM Role of Compute Storage Admin in the project called proj-vm.
  D. When creating the VMs, set the service account's API scope for Compute Engine to read/write.
  C. Grant the service account the IAM Role of Compute Storage Admin in the project called proj-vm.

  ---

  Explanation

  Grant the service account the IAM Role of Compute Storage Admin in the project called proj-vm.

• Question 174:

  You are configuring service accounts for an application that spans multiple projects. Virtual machines (VMs) running in the web-applications project need access to BigQuery datasets in crm-databases-proj. You want to follow Google-recommended practices to give access to the service account in the web-applications project. What should you do?

  A. Give "project owner" for web-applications appropriate roles to crm-databases- proj
  B. Give "project owner" role to crm-databases-proj and the web-applications project.
  C. Give "project owner" role to crm-databases-proj and bigquery.dataViewer role to web-applications.
  D. Give bigquery.dataViewer role to crm-databases-proj and appropriate roles to web-applications.
  D. Give bigquery.dataViewer role to crm-databases-proj and appropriate roles to web-applications.

  ---

  Explanation

  https://cloud.google.com/blog/products/gcp/best-practices-for-working-with-google-cloud-audit-logging

• Question 175:

  You have downloaded and installed the gcloud command line interface (CLI) and have authenticated with your Google Account. Most of your Compute Engine instances in your project run in the europe-west1-d zone. You want to avoid having to specify this zone with each CLI command when managing these instances. What should you do?

  A. Set the europe-west1-d zone as the default zone using the gcloud config subcommand.
  B. In the Settings page for Compute Engine under Default location, set the zone to europe-west1-d.
  C. In the CLI installation directory, create a file called default.conf containing zone=europe-west1-d.
  D. Create a Metadata entry on the Compute Engine page with key compute/zone and value europe-west1-d.
  A. Set the europe-west1-d zone as the default zone using the gcloud config subcommand.

  ---

  Explanation

  Change your default zone and region in the metadata server

  Note: This only applies to the default configuration.

  You can change the default zone and region in your metadata server by making a request to the metadata server. For example:

  gcloud compute project-info add-metadata \

  --metadata google-compute-default-region=europe-west1,google-compute-default-zone=europe-west1-b

  The gcloud command-line tool only picks up on new default zone and region changes after you rerun the gcloud init command. After updating your default metadata, run gcloud init to reinitialize your default configuration.

  https://cloud.google.com/compute/docs/gcloud-compute#change_your_default_zone_and_region_in_the_metadata_server

• Question 176:

  You're working on creating a script that can extract the IP address of a Kubernetes Service. Your coworker sent you a code snippet that they had saved. Which one is the best starting point for your code?

  A. kubectl get svc -o filtered- json='{.items[*].status.loadBalancer.ingress[0].ip}'
  B. kubectl get svc -o jsonpath='{.items[*].status.loadBalancer.ingress[0].ip}'
  C. kubectl get svc -o html
  D. kubectl get svc
  B. kubectl get svc -o jsonpath='{.items[*].status.loadBalancer.ingress[0].ip}'

  ---

  Explanation

• Question 177:

  You are hosting an application from Compute Engine virtual machines (VMs) in us-central1-a. You want to adjust your design to support the failure of a single Compute Engine zone, eliminate downtime, and minimize cost. What should you do?

  A. - Create Compute Engine resources in us-central1-b. -Balance the load across both us-central1-a and us-central1-b.
  B. - Create a Managed Instance Group and specify us-central1-a as the zone. -Configure the Health Check with a short Health Interval.
  C. - Create an HTTP(S) Load Balancer. - Create one or more global forwarding rules to direct traffic to your VMs.
  D. - Perform regular backups of your application. - Create a Cloud Monitoring Alert and be notified if your application becomes unavailable. -Restore from backups when notified.
  A. - Create Compute Engine resources in us-central1-b. -Balance the load across both us-central1-a and us-central1-b.

  ---

  Explanation

  This seems straightforward. "A" is the only answer that involves putting instances in more than one zone!

  A. Yes, creating instances in another zone and balancing the loads will fix this problem

  B. Wrong. This keeps all the instances in one zone, but the question says we want to protect against zone failures.

  C. Wrong. This keeps all the instances in one zone, but the question says we want to protect against zone failures.

  D. Wrong. This keeps all the instances in one zone, but the question says we want to protect against zone failures.

• Question 178:

  You create a Deployment with 2 replicas in a Google Kubernetes Engine cluster that has a single preemptible node pool. After a few minutes, you use kubectl to examine the status of your Pod and observe that one of them is still in Pending status:

  

  What is the most likely cause?

  A. The pending Pod's resource requests are too large to fit on a single node of the cluster.
  B. Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod.
  C. The node pool is configured with a service account that does not have permission to pull the container image used by the pending Pod.
  D. The pending Pod was originally scheduled on a node that has been preempted between the creation of the Deployment and your verification of the Pods' status. It is currently being rescheduled on a new node.
  B. Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod.

  ---

  Explanation

  Reasons for a Pod Status Pending: Troubleshooting Reason #1: Not enough CPU Troubleshooting Reason #2: Not enough memory Troubleshooting Reason #3: Not enough CPU and memory https://managedkube.com/kubernetes/k8sbot/troubleshooting/pending/pod/2019/02/22/pending-pod.html

• Question 179:

  You are deploying a web application using Compute Engine. You created a managed instance group (MIG) to host the application. You want to follow Google-recommended practices to implement a secure and highly available solution. What should you do?

  A. Use SSL proxy load balancing for the MIG and an A record in your DNS private zone with the load balancer's IP address.
  B. Use SSL proxy load balancing for the MIG and a CNAME record in your DNS public zone with the load balancer's IP address.
  C. Use HTTP(S) load balancing for the MIG and a CNAME record in your DNS private zone with the load balancer's IP address.
  D. Use HTTP(S) load balancing for the MIG and an A record in your DNS public zone with the load balancer's IP address.
  D. Use HTTP(S) load balancing for the MIG and an A record in your DNS public zone with the load balancer's IP address.

  ---

  Explanation

  HTTP(S) load balancing is a Google-recommended practice for distributing web traffic across multiple regions and zones, and providing high availability, scalability, and security for web applications. It supports both IPv4 and IPv6 addresses, and can handle SSL/TLS termination and encryption. It also integrates with Cloud CDN, Cloud Armor, and Cloud Identity-Aware Proxy for enhanced performance and protection. A MIG can be used as a backend service for HTTP

  (S) load balancing, and can automatically scale and heal the VM instances that host the web application. To configure DNS for HTTP(S) load balancing, you need to create an A record in your DNS public zone with the load balancer's IP

  address. This will map your domain name to the load balancer's IP address, and allow users to access your web application using the domain name. A CNAME record is not recommended, as it can cause latency and DNS resolution issues.

  A private zone is not suitable, as it is only visible within your VPC network, and not to the public internet.

  References:

  HTTP(S) Load Balancing documentation

  Setting up DNS records for HTTP(S) load balancing Choosing a load balancer

• Question 180:

  You are deploying an application on Google Cloud that requires a relational database for storage. To satisfy your company's security policies, your application must connect to your database through an encrypted and authenticated connection that requires minimal management and integrates with Identity and Access Management (IAM). What should you do?

  A. Deploy a Cloud SQL database with the SSL mode set to encrypted only, configure SSL/TLS client certificates, and configure a database user and password.
  B. Deploy a Cloud SQL database with the SSL mode set to encrypted only, configure SSL/TLS client certificates, and configure IAM database authentication.
  C. Deploy a Cloud SQL database and configure IAM database authentication. Access the database through the Cloud SQL Auth Proxy.
  D. Deploy a Cloud SQL database and configure a database user and password. Access the database through the Cloud SQL Auth Proxy.
  C. Deploy a Cloud SQL database and configure IAM database authentication. Access the database through the Cloud SQL Auth Proxy.

  ---

  Explanation