Google ASSOCIATE-CLOUD-ENGINEER Online Practice Questions and Exam Preparation

Google ASSOCIATE-CLOUD-ENGINEER Online Questions & Answers

• Question 11:

  You are the team lead of a group of 10 developers. You provided each developer with an individual Google Cloud Project that they can use as their personal sandbox to experiment with different Google Cloud solutions. You want to be notified if any of the developers are spending above $500 per month on their sandbox environment. What should you do?

  A. Create a single budget for all projects and configure budget alerts on this budget.
  B. Create a separate billing account per sandbox project and enable BigQuery billing exports. Create a Data Studio dashboard to plot the spending per billing account.
  C. Create a budget per project and configure budget alerts on all of these budgets.
  D. Create a single billing account for all sandbox projects and enable BigQuery billing exports. Create a Data Studio dashboard to plot the spending per project.
  C. Create a budget per project and configure budget alerts on all of these budgets.

  ---

  Explanation

  https://cloud.google.com/billing/docs/how-to/budgets

• Question 12:

  You need to verify that a Google Cloud Platform service account was created at a particular time. What should you do?

  A. Filter the Activity log to view the Configuration category. Filter the Resource type to Service Account.
  B. Filter the Activity log to view the Configuration category. Filter the Resource type to Google Project.
  C. Filter the Activity log to view the Data Access category. Filter the Resource type to Service Account.
  D. Filter the Activity log to view the Data Access category. Filter the Resource type to Google Project.
  A. Filter the Activity log to view the Configuration category. Filter the Resource type to Service Account.

  ---

  Explanation

  Filter the Activity log to view the Configuration category. Filter the Resource type to Service Account.

• Question 13:

  You want to verify the IAM users and roles assigned within a GCP project named my-project. What should you do?

  A. Run gcloud iam roles list. Review the output section.
  B. Run gcloud iam service-accounts list. Review the output section.
  C. Navigate to the project and then to the IAM section in the GCP Console. Review the members and roles.
  D. Navigate to the project and then to the Roles section in the GCP Console. Review the roles and status.
  C. Navigate to the project and then to the IAM section in the GCP Console. Review the members and roles.

  ---

  Explanation

  C is the only logical answers. If you go IAM and Admin > IAM: You can see Principals and Roles. Users, groups, service accounts are Principals

• Question 14:

  Your company stores data from multiple sources that have different data storage requirements. These data include:

  1.Customer data that is structured and read with complex queries

  2.Historical log data that is large in volume and accessed infrequently

  3.Real-time sensor data with high-velocity writes, which needs to be available for analysis but can tolerate some data loss.

  You need to design the most cost-effective storage solution that fulfills all data storage requirements. What should you do?

  A. Use Firestore for customer data, Cloud Storage (Nearline) for historical logs, and Bigtable for sensor data.
  B. Use Cloud SQL for customer data. Cloud Storage (Coldline) for historical logs, and BigQuery for sensor data.
  C. Use Cloud SQL for customer data. Cloud Storage (Archive) for historical logs, and Bigtable for sensor data.
  D. Use Spanner for all data.
  C. Use Cloud SQL for customer data. Cloud Storage (Archive) for historical logs, and Bigtable for sensor data.

  ---

  Explanation

  Customer Data: Structured and queried with complexity

  Cloud SQL is well suited for structured, relational data and supports complex SQL queries. It is a managed relational database service that provides a familiar SQL interface, which is ideal for customer data with complex querying needs.

  Historical Log Data: Large in volume and accessed infrequently Cloud Storage offers various storage classes optimized for cost based on access frequency. For data that is rarely accessed, the Archive storage class is the most cost-effective

  option. Although Archive has longer retrieval times compared to other classes, it is appropriate when the data is kept solely for audit or compliance purposes and isn't expected to be read often.

  Real-Time Sensor Data: High-velocity writes and available for analysis (with some tolerance for data loss)

  Bigtable is designed to handle high ingestion rates and large volumes of time-series or sensor data. It provides low-latency reads and writes, making it an excellent choice for real-time analytics of sensor data. Its design also aligns well with

  scenarios where occasional data loss is acceptable.

• Question 15:

  Your company set up a complex organizational structure on Google Could Platform. The structure includes hundreds of folders and projects. Only a few team members should be able to view the hierarchical structure. You need to assign minimum permissions to these team members and you want to follow Google-recommended practices. What should you do?

  A. Add the users to roles/browser role.
  B. Add the users to roles/iam.roleViewer role.
  C. Add the users to a group, and add this group to roles/browser role.
  D. Add the users to a group, and add this group to roles/iam.roleViewer role.
  C. Add the users to a group, and add this group to roles/browser role.

  ---

  Explanation

  We need to apply the GCP Best practices. roles/browser Browser Read access to browse the hierarchy for a project, including the folder, organization, and IAM policy. This role doesn't include permission to view resources in the project. https://cloud.google.com/iam/docs/understanding-roles

• Question 16:

  You are a Google Cloud organization administrator. You need to configure organization policies and log sinks on Google Cloud projects that cannot be removed by project users to comply with your company's security policies. The security policies are different for each company department. Each company department has a user with the Project Owner role assigned to their projects. What should you do?

  A. Organize projects under folders for each department. Configure both organization policies and log sinks on the folders.
  B. Organize projects under folders for each department. Configure organization policies on the organization and log sinks on the folders.
  C. Use a standard naming convention for projects that includes the department name. Configure organization policies on the organization and log sinks on the projects.
  D. Use a standard naming convention for projects that includes the department name. Configure both organization policies and log sinks on the projects.
  A. Organize projects under folders for each department. Configure both organization policies and log sinks on the folders.

  ---

  Explanation

• Question 17:

  You created a cluster.YAML file containing

  resources: name: cluster type: container.v1.cluster properties: zone: europe-west1-b cluster: description: My GCP ACE cluster initialNodeCount: 2

  You want to use Cloud Deployment Manager to create this cluster in GKE. What should you do?

  A. gcloud deployment-manager deployments create my-gcp-ace-cluster --config cluster.yaml
  B. gcloud deployment-manager deployments create my-gcp-ace-cluster --type container.v1.cluster -- config cluster.yaml
  C. gcloud deployment-manager deployments apply my-gcp-ace-cluster --type container.v1.cluster --config cluster.yaml
  D. gcloud deployment-manager deployments apply my-gcp-ace-cluster --config cluster.yaml
  D. gcloud deployment-manager deployments apply my-gcp-ace-cluster --config cluster.yaml

  ---

  Explanation

  gcloud deployment-manager deployments create creates deployments based on the configuration file. (Infrastructure as code). All the configuration related to the artifacts is in the configuration file. This command correctly creates a cluster based on the provided cluster.yaml configuration file.

  Ref: https://cloud.google.com/sdk/gcloud/reference/deployment- manager/deployments/create

• Question 18:

  You have an application running in Google Kubernetes Engine (GKE) with cluster autoscaling enabled. The application exposes a TCP endpoint. There are several replicas of this application. You have a Compute Engine instance in the same region, but in another Virtual Private Cloud (VPC), called gce-network, that has no overlapping IP ranges with the first VPC. This instance needs to connect to the application on GKE. You want to minimize effort. What should you do?

  A. 1. In GKE, create a Service of type LoadBalancer that uses the application's Pods as backend. 2.Set the service's externalTrafficPolicy to Cluster. 3.Configure the Compute Engine instance to use the address of the load balancer that has been created.
  B. 1. In GKE, create a Service of type NodePort that uses the application's Pods as backend. 2.Create a Compute Engine instance called proxy with 2 network interfaces, one in each VPC. 3.Use iptables on this instance to forward traffic from gce-network to the GKE nodes. 4.Configure the Compute Engine instance to use the address of proxy in gce-network as endpoint.
  C. 1. In GKE, create a Service of type LoadBalancer that uses the application's Pods as backend. 2.Add an annotation to this service: cloud.google.com/load-balancer-type: Internal 3.Peer the two VPCs together. 4.Configure the Compute Engine instance to use the address of the load balancer that has been created.
  D. 1. In GKE, create a Service of type LoadBalancer that uses the application's Pods as backend. 2.Add a Cloud Armor Security Policy to the load balancer that whitelists the internal IPs of the MIG's instances. 3.Configure the Compute Engine instance to use the address of the load balancer that has been created.
  A. 1. In GKE, create a Service of type LoadBalancer that uses the application's Pods as backend. 2.Set the service's externalTrafficPolicy to Cluster. 3.Configure the Compute Engine instance to use the address of the load balancer that has been created.

  ---

  Explanation

  It's never mentioned in the question that traffic cannot go through the Internet but it's mentioned that effort should be minimized. A requires a lot less effort than C to accomplish the same (no VPC peering, per example).

• Question 19:

  Your developers have some application metrics that they're tracking. They'd like to be able to create alerts based on these metrics. What steps need to happen in order to alert based on these metrics?

  A. In the UI create a new logging metric with the required filters, edit the application code to set the metric value when needed, and create an alert in Stackdriver based on the new metric.
  B. Create a custom monitoring metric in code, edit the application code to set the metric value when needed, create an alert in Stackdriver based on the new metric.
  C. Add the Stackdriver monitoring and logging agent to the instances running the code.
  D. Create a custom monitoring metric in code, in the UI create a matching logging metric, and create an alert in Stackdriver based on the new metric.
  B. Create a custom monitoring metric in code, edit the application code to set the metric value when needed, create an alert in Stackdriver based on the new metric.

  ---

  Explanation

• Question 20:

  You will have several applications running on different Compute Engine instances in the same project. You want to specify at a more granular level the service account each instance uses when calling Google Cloud APIs. What should you do?

  A. When creating the instances, specify a Service Account for each instance.
  B. When creating the instances, assign the name of each Service Account as instance metadata.
  C. After starting the instances, use gcloud compute instances update to specify a Service Account for each instance.
  D. After starting the instances, use gcloud compute instances update to assign the name of the relevant Service Account as instance metadata.
  A. When creating the instances, specify a Service Account for each instance.

  ---

  Explanation

  https://cloud.google.com/compute/docs/access/service- accounts#associating_a_service_account_to_an_instance