Google ASSOCIATE-CLOUD-ENGINEER Online Practice Questions and Exam Preparation

Google ASSOCIATE-CLOUD-ENGINEER Online Questions & Answers

• Question 281:

  Your company has a large quantity of unstructured data in different file formats. You want to perform ETL transformations on the data. You need to make the data accessible on Google Cloud so it can be processed by a Dataflow job. What should you do?

  A. Upload the data to BigQuery using the bq command line tool.
  B. Upload the data to Cloud Storage using the gcloud storage command.
  C. Upload the data into Cloud SQL using the import function in the Google Cloud console.
  D. Upload the data into Cloud Spanner using the import function in the Google Cloud console.
  B. Upload the data to Cloud Storage using the gcloud storage command.

  ---

  Explanation

  Unstructured is the keyword in this questions. All possible answers are structured, but Cloud Storage.

• Question 282:

  You are assigned to maintain a Google Kubernetes Engine (GKE) cluster named `dev' that was deployed on Google Cloud. You want to manage the GKE configuration using the command line interface (CLI). You have just downloaded and installed the Cloud SDK. You want to ensure that future CLI commands by default address this specific cluster What should you do?

  A. Use the command gcloud config set container/cluster dev.
  B. Use the command gcloud container clusters update dev.
  C. Create a file called gke.default in the ~/.gcloud folder that contains the cluster name.
  D. Create a file called defaults.json in the ~/.gcloud folder that contains the cluster name.
  A. Use the command gcloud config set container/cluster dev.

  ---

  Explanation

  To set a default cluster for gcloud commands, run the following command: gcloud config set container/cluster CLUSTER_NAME https://cloud.google.com/kubernetes- engine/docs/how-to/managing-clusters?hl=en https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-access-for-kubectl#gcloud-config

• Question 283:

  Your company wants to standardize the creation and management of multiple Google Cloud resources using Infrastructure as Code. You want to minimize the amount of repetitive code needed to manage the environment. What should you do?

  A. Develop templates for the environment using Cloud Deployment Manager.
  B. Use curl in a terminal to send a REST request to the relevant Google API for each individual resource.
  C. Use the Cloud Console interface to provision and manage all related resources.
  D. Create a bash script that contains all requirement steps as gcloud commands.
  A. Develop templates for the environment using Cloud Deployment Manager.

  ---

  Explanation

  You can use Google Cloud Deployment Manager to create a set of Google Cloud resources and manage them as a unit, called a deployment. For example, if your team's development environment needs two virtual machines (VMs) and a BigQuery database, you can define these resources in a configuration file, and use Deployment Manager to create, change, or delete these resources. You can make the configuration file part of your team's code repository, so that anyone can create the same environment with consistent results.

  https://cloud.google.com/deployment-manager/docs/quickstart https://cloud.google.com/deployment-manager/docs/fundamentals (see templates)

• Question 284:

  You've just enabled an API for the developers. A couple of minutes later, one of the developers pastes a screenshot into Slack. The screenshot indicates that the API isn't enabled. You can see that the project ID is correct. What is the most likely reason for this error?

  A. The API hasn't completed the process to become fully enabled yet.
  B. The developer is using the wrong project.
  C. The developer didn't run the gcloud refresh api command.
  D. The developer is trying to use the wrong API.
  A. The API hasn't completed the process to become fully enabled yet.

  ---

  Explanation

• Question 285:

  You have a developer laptop with the Cloud SDK installed on Ubuntu. The Cloud SDK was installed from the Google Cloud Ubuntu package repository. You want to test your application locally on your laptop with Cloud Datastore. What should you do?

  A. Export Cloud Datastore data using gcloud datastore export.
  B. Create a Cloud Datastore index using gcloud datastore indexes create.
  C. Install the google-cloud-sdk-datastore-emulator component using the apt get install command.
  D. Install the cloud-datastore-emulator component using the gcloud components install command.
  C. Install the google-cloud-sdk-datastore-emulator component using the apt get install command.

  ---

  Explanation

  https://cloud.google.com/sdk/docs/downloads-apt-get

  The question is not about the datastore command itself but from where we should run the update command on the Ubuntu to install the component.

• Question 286:

  You're working as a Cloud Engineer for a small company. The lead developer needs to create some new projects in order to get started with deploying the codebase. She tried to create a project and received an error. She messaged you on Slack to ask for help, though, she couldn't recall the exact error message. You checked and found that she does have Project Creator permissions. Keeping in mind the principle of least privilege, what is the best role to grant her so that she can create billable projects?

  A. The "Billing Account Administrator" role.
  B. The "Billing Account User" role.
  C. The "Project Owner" role.
  D. The "Billing Account Viewer" role.
  B. The "Billing Account User" role.

  ---

  Explanation

• Question 287:

  Your management has asked an external auditor to review all the resources in a specific project. The security team has enabled the Organization Policy called Domain Restricted Sharing on the organization node by specifying only your Cloud Identity domain. You want the auditor to only be able to view, but not modify, the resources in that project. What should you do?

  A. Ask the auditor for their Google account, and give them the Viewer role on the project.
  B. Ask the auditor for their Google account, and give them the Security Reviewer role on the project.
  C. Create a temporary account for the auditor in Cloud Identity, and give that account the Viewer role on the project.
  D. Create a temporary account for the auditor in Cloud Identity, and give that account the Security Reviewer role on the project.
  C. Create a temporary account for the auditor in Cloud Identity, and give that account the Viewer role on the project.

  ---

  Explanation

  oles/viewer Read access to all resources. Get and list access for all resources.

  Using primitive roles The following table lists the primitive roles that you can grant to access a project, the description of what the role does, and the permissions bundled within that role. Avoid using primitive roles except when absolutely necessary. These roles are very powerful, and include a large number of permissions across all Google Cloud services. For more details on when you should use primitive roles, see the Identity and Access Management FAQ.

  IAM predefined roles are much more granular, and allow you to carefully manage the set of permissions that your users have access to. See Understanding Roles for a list of roles that can be granted at the project level. Creating custom roles can further increase the control you have over user permissions.

  https://cloud.google.com/resource-manager/docs/access-control-proj#using_primitive_roles

• Question 288:

  You're running an n-tier application on Compute Engine with an Apache web server serving up web requests. You want to consolidate all of your logging into Stackdriver. What's the best approach to get the Apache logs into Stackdriver?

  A. Create a log sink and export it to Stackdriver.
  B. Stackdriver logs application data from all instances by default.
  C. Enable Stackdriver monitoring when creating the instance.
  D. Install the Stackdriver monitoring and logging agents on the instance.
  D. Install the Stackdriver monitoring and logging agents on the instance.

  ---

  Explanation

• Question 289:

  You are building a product on top of Google Kubernetes Engine (GKE). You have a single GKE cluster. For each of your customers, a Pod is running in that cluster, and your customers can run arbitrary code inside their Pod. You want to maximize the isolation between your customers' Pods. What should you do?

  A. Use Binary Authorization and whitelist only the container images used by your customers' Pods.
  B. Use the Container Analysis API to detect vulnerabilities in the containers used by your customers' Pods.
  C. Create a GKE node pool with a sandbox type configured to gvisor. Add the parameter runtimeClassName: gvisor to the specification of your customers' Pods.
  D. Use the cos_containerd image for your GKE nodes. Add a nodeSelector with the value cloud.google.com/gke-os-distribution: cos_containerd to the specification of your customers' Pods.
  C. Create a GKE node pool with a sandbox type configured to gvisor. Add the parameter runtimeClassName: gvisor to the specification of your customers' Pods.

  ---

  Explanation

  https://cloud.google.com/kubernetes-engine/sandbox/

• Question 290:

  You have files in a Cloud Storage bucket that you need to share with your suppliers. You want to restrict the time that the files are available to your suppliers to 1 hour. You want to follow Google recommended practices. What should you do?

  A. Create a service account with just the permissions to access files in the bucket. Create a JSON key for the service account. Execute the command gsutil signurl -m 1h gs:///*.
  B. Create a service account with just the permissions to access files in the bucket. Create a JSON key for the service account. Execute the command gsutil signurl -d 1h gs:///**.
  C. Create a service account with just the permissions to access files in the bucket. Create a JSON key for the service account. Execute the command gsutil signurl -p 60m gs:///.
  D. Create a JSON key for the Default Compute Engine Service Account. Execute the command gsutil signurl -t 60m gs:///***
  B. Create a service account with just the permissions to access files in the bucket. Create a JSON key for the service account. Execute the command gsutil signurl -d 1h gs:///**.

  ---

  Explanation

  This command correctly specifies the duration that the signed url should be valid for by using the -d flag. The default is 1 hour so omitting the -d flag would have also resulted in the same outcome. Times may be specified with no suffix (default hours), or with s = seconds, m = minutes, h = hours, d = days. The max duration allowed is 7d.Ref: https://cloud.google.com/storage/docs/gsutil/commands/signurl