Google ASSOCIATE-CLOUD-ENGINEER Online Practice Questions and Exam Preparation

Google ASSOCIATE-CLOUD-ENGINEER Online Questions & Answers

• Question 241:

  You are managing a fleet of Compute Engine Linux instances in a Google Cloud project. Your company's engineering team requires SSH access to all instances to perform routine maintenance tasks. You need to manage the SSH access for the engineering team, and you want to minimize operational overhead when engineers join or leave the team. What should you do?

  A. Create a single SSH key pair to be shared by all engineering team members. Add the public SSH key to project metadata.
  B. Create an SSH key pair for each engineer on the team, and add the public SSH key to the metadata of the relevant instances.
  C. Create a Google Group for all engineering team members, and grant them the Compute Viewer IAM role. Manage group membership when engineers join or leave the team.
  D. Create a Google Group for all engineering team members, and set up OS Login for this group on the project. Manage group membership when engineers join or leave the team.
  D. Create a Google Group for all engineering team members, and set up OS Login for this group on the project. Manage group membership when engineers join or leave the team.

  ---

  Explanation

  OS Login and Google Groups Integration:

  OS Login is a Google-recommended best practice for managing SSH access to Compute Engine instances. It ties SSH access to IAM roles and user identities, allowing you to centrally manage permissions. By setting up OS Login for a

  Google Group, you can easily grant or revoke SSH access to all instances for team members simply by managing group membership. This greatly reduces operational overhead when engineers join or leave the team.

• Question 242:

  You are running out of primary internal IP addresses in a subnet for a custom mode VPC. The subnet has the IP range 10.0.0.0/20, and the IP addresses are primarily used by virtual machines in the project. You need to provide more IP addresses for the virtual machines. What should you do?

  A. Add a secondary IP range 10.1.0.0/20 to the subnet.
  B. Change the subnet IP range from 10.0.0.0/20 to 10.0.0.0/18.
  C. Change the subnet IP range from 10.0.0.0/20 to 10.0.0.0/22.
  D. Convert the subnet IP range from IPv4 to IPv6.
  B. Change the subnet IP range from 10.0.0.0/20 to 10.0.0.0/18.

  ---

  Explanation

  https://cloud.google.com/vpc/docs/create-modify-vpc-networks#expand-subnet

• Question 243:

  Your organization has a dedicated person who creates and manages all service accounts for Google Cloud projects. You need to assign this person the minimum role for projects. What should you do?

  A. Add the user to roles/iam.roleAdmin role.
  B. Add the user to roles/iam.securityAdmin role.
  C. Add the user to roles/iam.serviceAccountUser role.
  D. Add the user to roles/iam.serviceAccountAdmin role.
  D. Add the user to roles/iam.serviceAccountAdmin role.

  ---

  Explanation

  To allow a user to manage service accounts, grant one of the following roles:

  Service Account User (roles/iam.serviceAccountUser): Includes permissions to list service accounts, get details about a service account, and impersonate a service account. Service Account Admin (roles/iam.serviceAccountAdmin): Includes permissions to list service accounts and get details about a service account. Also includes permissions to create, update, and delete service accounts, and to view or change the IAM policy on a service account.

• Question 244:

  Users of your application are complaining of slowness when loading the application. You realize the slowness is because the App Engine deployment serving the application is deployed in us-central whereas all users of this application are closest to europe-west3. You want to change the region of the App Engine application to europe-west3 to minimize latency.

  What's the best way to change the App Engine region?

  A. Create a new project and create an App Engine instance in europe-west3
  B. Use the gcloud app region set command and supply the name of the new region.
  C. From the console, under the App Engine page, click edit, and change the region drop- down.
  D. Contact Google Cloud Support and request the change.
  A. Create a new project and create an App Engine instance in europe-west3

  ---

  Explanation

  App engine is a regional service, which means the infrastructure that runs your app(s) is located in a specific region and is managed by Google to be redundantly available across all the zones within that region. Once an app engine deployment is created in a region, it cant be changed. The only way is to create a new project and create an App Engine instance in europe-west3, send all user traffic to this instance and delete the app engine instance in us-central.

  Ref: https://cloud.google.com/appengine/docs/locations

• Question 245:

  You are asked to set up application performance monitoring on Google Cloud projects A, B, and C as a single pane of glass. You want to monitor CPU, memory, and disk. What should you do?

  A. Enable API and then share charts from project A, B, and
  B. Enable API and then give the metrics.reader role to projects A, B, and
  D. Enable API, create a workspace under project A, and then add project B and
  D. Enable API, create a workspace under project A, and then add project B and

  ---

  Explanation

  Keep Project A as host project in workspace and Project B and C as Service Project, and monitor the metrics of the Project A for a centralized view.

• Question 246:

  Your organization uses G Suite for communication and collaboration. All users in your organization have a G Suite account. You want to grant some G Suite users access to your Cloud Platform project. What should you do?

  A. Enable Cloud Identity in the GCP Console for your domain.
  B. Grant them the required IAM roles using their G Suite email address.
  C. Create a CSV sheet with all users' email addresses. Use the gcloud command line tool to convert them into Google Cloud Platform accounts.
  D. In the G Suite console, add the users to a special group called [email protected]. Rely on the default behavior of the Cloud Platform to grant users access if they are members of this group.
  B. Grant them the required IAM roles using their G Suite email address.

  ---

  Explanation

  https://cloud.google.com/resource-manager/docs/creating-managing-organization

• Question 247:

  For analysis purposes, you need to send all the logs from all of your Compute Engine instances to a BigQuery dataset called platform-logs. You have already installed the Stackdriver Logging agent on all the instances. You want to minimize cost. What should you do?

  A. 1. Give the BigQuery Data Editor role on the platform-logs dataset to the service accounts used by your instances. 2. Update your instances' metadata to add the following value: logs-destination: bq://platform-logs.
  B. 1. In Stackdriver Logging, create a logs export with a Cloud Pub/Sub topic called logs as a sink. 2.Create a Cloud Function that is triggered by messages in the logs topic. 3.Configure that Cloud Function to drop logs that are not from Compute Engine and to insert Compute Engine logs in the platform-logs dataset.
  C. 1. In Stackdriver Logging, create a filter to view only Compute Engine logs. 2.Click Create Export. 3.Choose BigQuery as Sink Service, and the platform-logs dataset as Sink Destination.
  D. 1. Create a Cloud Function that has the BigQuery User role on the platform-logs dataset. 2.Configure this Cloud Function to create a BigQuery Job that executes this query: INSERT INTO dataset.platform-logs (timestamp, log) SELECT timestamp, log FROM compute.logs WHERE timestamp > DATE_SUB(CURRENT_DATE(), INTERVAL 1 DAY) 3.Use Cloud Scheduler to trigger this Cloud Function once a day.
  C. 1. In Stackdriver Logging, create a filter to view only Compute Engine logs. 2.Click Create Export. 3.Choose BigQuery as Sink Service, and the platform-logs dataset as Sink Destination.

  ---

  Explanation

  C. is correct, Sinks control how Cloud Logging routes logs. Using sinks, you can route some or all of your logs to supported destinations.

• Question 248:

  You need to update a deployment in Deployment Manager without any resource downtime in the deployment. Which command should you use?

  A. gcloud deployment-manager deployments create --config
  B. gcloud deployment-manager deployments update --config
  C. gcloud deployment-manager resources create --config
  D. gcloud deployment-manager resources update --config
  B. gcloud deployment-manager deployments update --config

  ---

  Explanation

  https://cloud.google.com/sdk/gcloud/reference/deployment-manager/deployments/update Additional tip, update and create resource is not even a command under deployment management service.

• Question 249:

  Your team is building a website that handles votes from a large user population. The incoming votes will arrive at various rates. You want to optimize the storage and processing of the votes. What should you do?

  A. Save the incoming votes to Firestore. Use Cloud Scheduler to trigger a Cloud Functions instance to periodically process the votes.
  B. Use a dedicated instance to process the incoming votes. Send the votes directly to this instance.
  C. Save the incoming votes to a JSON file on Cloud Storage. Process the votes in a batch at the end of the day.
  D. Save the incoming votes to Pub/Sub. Use the Pub/Sub topic to trigger a Cloud Functions instance to process the votes.
  D. Save the incoming votes to Pub/Sub. Use the Pub/Sub topic to trigger a Cloud Functions instance to process the votes.

  ---

  Explanation

  Pub/Sub is a scalable and reliable messaging service that can handle large volumes of data from different sources at different rates. It allows you to decouple the producers and consumers of the data, and provides a durable and persistent storage for the messages until they are delivered. Cloud Functions is a serverless platform that can execute code in response to events, such as messages published to a Pub/Sub topic. It can scale automatically based on the load, and you only pay for the resources you use. By using Pub/Sub and Cloud Functions, you can optimize the storage and processing of the votes, as you can handle the variable rates of incoming votes, process them in real time or near real time, and avoid managing servers or VMs.

  References: Pub/Sub documentation Cloud Functions documentation Choosing a messaging service for Google Cloud

• Question 250:

  You have an App Engine application running in us-east1. You've noticed 90% of your traffic comes from the West Coast. You'd like to change the region. What's the best way to change the App Engine region?

  A. Use the gcloud app region set command and supply the name of the new region.
  B. Contact Google Cloud Support and request the change.
  C. From the console, under the App Engine page, click edit, and change the region drop-down.
  D. Create a new project and create an App Engine instance in us-west2.
  D. Create a new project and create an App Engine instance in us-west2.

  ---

  Explanation