Google Google Certifications ASSOCIATE-CLOUD-ENGINEER Questions & Answers

• Question 11:

  You need to configure optimal data storage for files stored in Cloud Storage for minimal cost. The files are used in a mission-critical analytics pipeline that is used continually The users are in Boston, MA (United States). What should you do?

  A. Configure regional storage for the region closest to the users. Configure a Nearline storage class.

  B. Configure regional storage for the region closest to the users. Configure a Standard storage class.

  C. Configure dual-regional storage for the dual region closest to the users. Configure a Nearline storage class.

  D. Configure dual-regional storage for the dual region closest to the users. Configure a Standard storage class.

  Correct Answer: D

  Mission critical is the keyword here which specifies that we need to have a multi-regional backup of the data to survive any regional failures. So option D is the correct choice here.

• Question 12:

  Your company has developed a n What should you do?

  A. Deploy the application on GKE, and add a HorizontalPodAutoscaler to the deployment.

  B. Deploy the application on GKE, and add a VerticalPodAutoscaler to the deployment.

  C. Create a GKE cluster with autoscaling enabled on the node pool. Set a minimum and maximum for the size of the node pool.

  D. Create a separate node pool for each application, and deploy each application to its dedicated node pool.

  Correct Answer: C

  https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-autoscaler#adding_a_node_pool_with_autoscaling

• Question 13:

  You need to manage a third-party application that will run on a Compute Engine instance. Other Compute Engine instances are already running with default configuration. Application installation files are hosted on Cloud Storage. You need to access these files from the new instance without allowing other virtual machines (VMs) to access these files. What should you do?

  A. Create the instance with the default Compute Engine service account. Grant the service account permissions on Cloud Storage.

  B. Create the instance with the default Compute Engine service account Add metadata to the objects on Cloud Storage that matches the metadata on the new instance.

  C. Create a new service account and assign this service account to the new instance. Grant the service account permissions on Cloud Storage.

  D. Create a new service account and assign this service account to the new instance. Add metadata to the objects on Cloud Storage that matches the metadata on the new instance.

  Correct Answer: C

  https://cloud.google.com/iam/docs/best-practices-for-using-and-managing- service-accounts If an application uses third-party or custom identities and needs to access a resource, such as a BigQuery dataset or a Cloud Storage bucket, it must perform a transition between principals. Because Google Cloud APIs don't recognize third-party or custom identities, the application can't propagate the end-user's identity to BigQuery or Cloud Storage. Instead, the application has to perform the access by using a different Google identity.

  Reference: https://cloud.google.com/compute/docs/access/service-accounts

• Question 14:

  Your company is moving its entire workload to Compute Engine. Some servers should be accessible through the Internet, and other servers should only be accessible over the internal network. All servers need to be able to talk to each other over specific ports and protocols. The current on-premises network relies on a demilitarized zone (DMZ) for the public servers and a Local Area Network (LAN) for the private servers. You need to design the networking infrastructure on Google Cloud to match these requirements. What should you do?

  A. 1. Create a single VPC with a subnet for the DMZ and a subnet for the LAN.

  2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public ingress traffic for the DMZ.

  B. 1. Create a single VPC with a subnet for the DMZ and a subnet for the LAN.

  2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public egress traffic for the DMZ.

  C. 1. Create a VPC with a subnet for the DMZ and another VPC with a subnet for the LAN.

  2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public ingress traffic for the DMZ.

  D. 1. Create a VPC with a subnet for the DMZ and another VPC with a subnet for the LAN.

  2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public egress traffic for the DMZ.

  Correct Answer: A

  https://cloud.google.com/vpc/docs/vpc-peering

• Question 15:

  You have created a new project in Google Cloud through the gcloud command line interface (CLI) and linked a billing account. You need to create a new Compute Engine instance using the CLI. You need to perform the prerequisite stops. What should you do?

  A. Create a Cloud Monitoring Workspace.

  B. Create a VPC network in the project.

  C. Enable the compute googleapis.com API.

  D. Grant yourself the IAM role of Computer Admin.

  Correct Answer: C

  Reference: https://isb-cancer-genomics-cloud.readthedocs.io/en/latest/sections/gcp-info/gcp-info2/LaunchVM.html

• Question 16:

  You have just created a new project which will be used to deploy a globally distributed application. You will use Cloud Spanner for data storage. You want to create a Cloud Spanner instance. You want to perform the first step in preparation of creating the instance. What should you do?

  A. Enable the Cloud Spanner API.

  B. Configure your Cloud Spanner instance to be multi-regional.

  C. Create a new VPC network with subnetworks in all desired regions.

  D. Grant yourself the IAM role of Cloud Spanner Admin.

  Correct Answer: A

  Reference: https://cloud.google.com/spanner/docs/instances

• Question 17:

  You have developed an application that consists of multiple microservices, with each microservice packaged in its own Docker container image. You want to deploy the entire application on Google Kubernetes Engine so that each microservice can be scaled individually. What should you do?

  A. Create and deploy a Custom Resource Definition per microservice.

  B. Create and deploy a Docker Compose File.

  C. Create and deploy a Job per microservice.

  D. Create and deploy a Deployment per microservice.

  Correct Answer: D

  It's one of Googles main ideas to distribute a complex system into microservices. They do it as well and encourage customers to do the same.

• Question 18:

  You will have several applications running on different Compute Engine instances in the same project. You want to specify at a more granular level the service account each instance uses when calling Google Cloud APIs. What should you do?

  A. When creating the instances, specify a Service Account for each instance.

  B. When creating the instances, assign the name of each Service Account as instance metadata.

  C. After starting the instances, use gcloud compute instances update to specify a Service Account for each instance.

  D. After starting the instances, use gcloud compute instances update to assign the name of the relevant Service Account as instance metadata.

  Correct Answer: A

  https://cloud.google.com/compute/docs/access/service- accounts#associating_a_service_account_to_an_instance

• Question 19:

  You are creating an application that will run on Google Kubernetes Engine. You have identified MongoDB as the most suitable database system for your application and want to deploy a managed MongoDB environment that provides a support SLA. What should you do?

  A. Create a Cloud Bigtable cluster, and use the HBase API.

  B. Deploy MongoDB Atlas from the Google Cloud Marketplace.

  C. Download a MongoDB installation package, and run it on Compute Engine instances.

  D. Download a MongoDB installation package, and run it on a Managed Instance Group.

  Correct Answer: C

• Question 20:

  You are managing a project for the Business Intelligence (BI) department in your company. A data pipeline ingests data into BigQuery via streaming. You want the users in the BI department to be able to run the custom SQL queries against the latest data in BigQuery. What should you do?

  A. Create a Data Studio dashboard that uses the related BigQuery tables as a source and give the BI team view access to the Data Studio dashboard.

  B. Create a Service Account for the BI team and distribute a new private key to each member of the BI team.

  C. Use Cloud Scheduler to schedule a batch Dataflow job to copy the data from BigQuery to the BI team's internal data warehouse.

  D. Assign the IAM role of BigQuery User to a Google Group that contains the members of the BI team.

  Correct Answer: D

  When applied to a dataset, this role provides the ability to read the dataset's metadata and list tables in the dataset. When applied to a project, this role also provides the ability to run jobs, including queries, within the project. A member with this role can enumerate their own jobs, cancel their own jobs, and enumerate datasets within a project. Additionally, allows the creation of new datasets within the project; the creator is granted the BigQuery Data Owner role (roles/ bigquery.dataOwner) on these new datasets. https://cloud.google.com/bigquery/docs/access-control