Google Google Certifications ASSOCIATE-CLOUD-ENGINEER Questions & Answers

• Question 221:

  Several employees at your company have been creating projects with Cloud Platform and paying for it with their personal credit cards, which the company reimburses. The company wants to centralize all these projects under a single, new billing account. What should you do?

  A. Contact [email protected] with your bank account details and request a corporate billing account for your company.

  B. Create a ticket with Google Support and wait for their call to share your credit card details over the phone.

  C. In the Google Platform Console, go to the Resource Manage and move all projects to the root Organizarion.

  D. In the Google Cloud Platform Console, create a new billing account and set up a payment method.

  Correct Answer: D

  Reference: https://www.whizlabs.com/blog/google-cloud-interview-questions/

  It's pretty straight-forward: you should establish a new billing account with a company-based payment method. Then set all the projects to use that new billing account.

• Question 222:

  Your company uses Cloud Storage to store application backup files for disaster recovery purposes. You want to follow Google's recommended practices. Which storage option should you use?

  A. Multi-Regional Storage

  B. Regional Storage

  C. Nearline Storage

  D. Coldline Storage

  Correct Answer: D

  Reference: https://cloud.google.com/storage/docs/storage-classes#nearline

  Coldline is a Cloud Storage class designed for long-term archival and disaster recovery. Coldline is perfect for the archival needs of big data or multimedia content, allowing businesses to archive years of data. Coldline provides fast and

  instant (millisecond) access to data and changes the way that companies think about storing and accessing their cold data.

  Google Cloud Storage Multi-Regional is a highly available and geo-redundant storage class. It's the best storage class for business continuity, or for serving multimedia content to geographically distributed users.

  Google Cloud Storage Regional is a highly available storage class redundant within a single region. It's ideal for pairing storage and compute resources within a region, to deliver low end-to-end latency and high throughput for workloads such

  as data transcoding or big data analytics workloads

• Question 223:

  You are using multiple configurations for gcloud. You want to review the configured Kubernetes Engine cluster of an inactive configuration using the fewest possible steps. What should you do?

  A. Use gcloud config configurations describe to review the output.

  B. Use gcloud config configurations activate and gcloud config list to review the output.

  C. Use kubectl config get-contexts to review the output.

  D. Use kubectl config use-context and kubectl config view to review the output.

  Correct Answer: D

  Reference: https://medium.com/google-cloud/kubernetes-engine-kubectl-config-b6270d2b656c

  kubectl config view -o jsonpath='{.users[].name}' # display the first user kubectl config view -o jsonpath='{.users[*].name}' # get a list of users kubectl config get-contexts # display list of contexts kubectl config current-context # display the current-context kubectl config use-context my-cluster-name # set the default context to my-cluster-name

• Question 224:

  You want to configure autohealing for network load balancing for a group of Compute Engine instances that run in multiple zones, using the fewest possible steps. You need to configure re-creation of VMs if they are unresponsive after 3 attempts of 10 seconds each. What should you do?

  A. Create an HTTP load balancer with a backend configuration that references an existing instance group. Set the health check to healthy (HTTP)

  B. Create an HTTP load balancer with a backend configuration that references an existing instance group. Define a balancing mode and set the maximum RPS to 10.

  C. Create a managed instance group. Set the Autohealing health check to healthy (HTTP)

  D. Create a managed instance group. Verify that the autoscaling setting is on.

  Correct Answer: C

  Reference : https://cloud.google.com/compute/docs/tutorials/high-availability-autohealing

  Pro Tip: Use separate health checks for load balancing and for autohealing. Health checks for load balancing detect unresponsive instances and direct traffic away from them. Health checks for autohealing detect and recreate failed instances, so they should be less aggressive than load balancing health checks. Using the same health check for these services would remove the distinction between unresponsive instances and failed instances, causing unnecessary latency and unavailability for your users.

• Question 225:

  You want to select and configure a cost-effective solution for relational data on Google Cloud Platform. You are working with a small set of operational data in one geographic location. You need to support point-in-time recovery. What should you do?

  A. Select Cloud SQL (MySQL). Verify that the enable binary logging option is selected.

  B. Select Cloud SQL (MySQL). Select the create failover replicas option.

  C. Select Cloud Spanner. Set up your instance with 2 nodes.

  D. Select Cloud Spanner. Set up your instance as multi-regional.

  Correct Answer: A

  A is Correct. You must enable binary logging to use point-in-time recovery. Enabling binary logging causes a slight reduction in write performance. https://cloud.google.com/sql/docs/mysql/backup-recovery/backups

• Question 226:

  You need to create a custom VPC with a single subnet. The subnet's range must be as large as possible. Which range should you use?

  A. 0.0.0.0/0

  B. 10.0.0.0/8

  C. 172.16.0.0/12

  D. 192.168.0.0/16

  Correct Answer: B

  B is correct. Pay attention to the question, is talking about custom VPC subnet and is not mentioning you will use automatic subnet mode creation. If you set subnet to custom, the minimum size is /8. https://cloud.google.com/vpc/docs/vpc#manually_created_subnet_ip_ranges

• Question 227:

  Every employee of your company has a Google account. Your operational team needs to manage a large number of instances on Compute Engine. Each member of this team needs only administrative access to the servers. Your security team wants to ensure that the deployment of credentials is operationally efficient and must be able to determine who accessed a given instance. What should you do?

  A. Generate a new SSH key pair. Give the private key to each member of your team. Configure the public key in the metadata of each instance.

  B. Ask each member of the team to generate a new SSH key pair and to send you their public key. Use a configuration management tool to deploy those keys on each instance.

  C. Ask each member of the team to generate a new SSH key pair and to add the public key to their Google account. Grant the "compute.osAdminLogin" role to the Google group corresponding to this team.

  D. Generate a new SSH key pair. Give the private key to each member of your team. Configure the public key as a project-wide public SSH key in your Cloud Platform project and allow project-wide public SSH keys on each instance.

  Correct Answer: C

  Reference: https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys

• Question 228:

  Your company wants to migrate their on-premises workloads to Google Cloud. The current on-premises workloads consist of:

  1.

  A Flask web application

  2.

  A backend API

  3.

  A scheduled long-running background job for ETL and reporting

  You need to keep operational costs low. You want to follow Google-recommended practices to migrate these workloads to serverless solutions on Google Cloud. What should you do?

  A. Migrate the web application to App Engine and the backend API to Cloud Run. Use Cloud Tasks to run your background job on Compute Engine.

  B. Migrate the web application to App Engine and the backend API to Cloud Run. Use Cloud Tasks to run your background job on Cloud Run.

  C. Run the web application on a Cloud Storage bucket and the backend API on Cloud Run. Use Cloud Tasks to run your background job on Cloud Run.

  D. Run the web application on a Cloud Storage bucket and the backend API on Cloud Run. Use Cloud Tasks to run your background job on Compute Engine.

  Correct Answer: B

  https://cloud.google.com/architecture/migration-to-gcp-deploying-your-workloads

• Question 229:

  You want to set up a Google Kubernetes Engine cluster. Verifiable node identity and integrity are required for the cluster, and nodes cannot be accessed from the internet. You want to reduce the operational cost of managing your cluster, and you want to follow Google-recommended practices. What should you do?

  A. Deploy a private autopilot cluster.

  B. Deploy a public autopilot cluster.

  C. Deploy a standard public cluster and enable shielded nodes.

  D. Deploy a standard private cluster and enable shielded nodes.

  Correct Answer: A

  https://cloud.google.com/kubernetes-engine/docs/how-to/shielded-gke-nodes

  "For GKE Autopilot clusters, the Shielded GKE Nodes feature is enabled by default and cannot be overridden"

• Question 230:

  You have a Bigtable instance that consists of three nodes that store personally identifiable information (PII) data. You need to log all read or write operations, including any metadata or configuration reads of this database table, in your company's Security Information and Event Management (SIEM) system. What should you do?

  A. Navigate to Cloud Monitoring in the Google Cloud console, and create a custom monitoring job for the Bigtable instance to track all changes. Create an alert by using webhook endpoints, with the SIEM endpoint as a receiver.

  B. Navigate to the Audit Logs page in the Google Cloud console, and enable Admin Write logs for the Bigtable instance. Create a Cloud Functions instance to export logs from Cloud Logging to your SIEM.

  C. Navigate to the Audit Logs page in the Google Cloud console, and enable Data Read, Data Write and Admin Read logs for the Bigtable instance. Create a Pub/Sub topic as a Cloud Logging sink destination, and add your SIEM as a subscriber to the topic.

  D. Install the Ops Agent on the Bigtable instance during configuration. Create a service account with read permissions for the Bigtable instance. Create a custom Dataflow job with this service account to export logs to the company's SIEM system.

  Correct Answer: C

  Data Access audit logs-except for BigQuery-are disabled by default and you need to enable them