Google ASSOCIATE-CLOUD-ENGINEER Online Practice Questions and Exam Preparation

Google ASSOCIATE-CLOUD-ENGINEER Online Questions & Answers

• Question 311:

  Every employee of your company has a Google account. Your operational team needs to manage a large number of instances on Compute Engine. Each member of this team needs only administrative access to the servers. Your security team wants to ensure that the deployment of credentials is operationally efficient and must be able to determine who accessed a given instance. What should you do?

  A. Generate a new SSH key pair. Give the private key to each member of your team. Configure the public key in the metadata of each instance.
  B. Ask each member of the team to generate a new SSH key pair and to send you their public key. Use a configuration management tool to deploy those keys on each instance.
  C. Ask each member of the team to generate a new SSH key pair and to add the public key to their Google account. Grant the "compute.osAdminLogin" role to the Google group corresponding to this team.
  D. Generate a new SSH key pair. Give the private key to each member of your team. Configure the public key as a project-wide public SSH key in your Cloud Platform project and allow project-wide public SSH keys on each instance.
  C. Ask each member of the team to generate a new SSH key pair and to add the public key to their Google account. Grant the "compute.osAdminLogin" role to the Google group corresponding to this team.

  ---

  Explanation

  https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys

• Question 312:

  You have an application running inside a Compute Engine instance. You want to provide the application with secure access to a BigQuery dataset. You must ensure that credentials are only valid for a short period of time, and your application will only have access to the intended BigQuery dataset. You want to follow Google-recommended practices and minimize your operational costs. What should you do?

  A. Attach a new service account to the instance every hour, and grant the service account the BigQuery Data Viewer IAM role on the project.
  B. Attach a custom service account to the instance, and grant the service account the BigQuery Data Viewer IAM role on the dataset.
  C. Attach a new service account to the instance every hour, and grant the service account the BigQuery Data Viewer IAM role on the dataset.
  D. Attach a custom service account to the instance, and grant the service account the BigQuery Data Viewer IAM role on the project.
  C. Attach a new service account to the instance every hour, and grant the service account the BigQuery Data Viewer IAM role on the dataset.

  ---

  Explanation

  Attaching a new service account to the instance every hour and granting the service account the BigQuery Data Viewer IAM role on the dataset ensures that the credentials are valid only for a short period of time and restrict access to the specific BigQuery dataset. This approach follows the principle of least privilege, minimizing the scope of access and ensuring secure and time-limited credentials.

• Question 313:

  You need to set a budget alert for use of Compute Engineer services on one of the three Google Cloud Platform projects that you manage. All three projects are linked to a single billing account. What should you do?

  A. Verify that you are the project billing administrator. Select the associated billing account and create a budget and alert for the appropriate project.
  B. Verify that you are the project billing administrator. Select the associated billing account and create a budget and a custom alert.
  C. Verify that you are the project administrator. Select the associated billing account and create a budget for the appropriate project.
  D. Verify that you are project administrator. Select the associated billing account and create a budget and a custom alert.
  A. Verify that you are the project billing administrator. Select the associated billing account and create a budget and alert for the appropriate project.

  ---

  Explanation

  Billing Administrator is in between organization and projects, So he can chose and select appropriate project.

• Question 314:

  You are in charge of provisioning access for all Google Cloud users in your organization. Your company recently acquired a startup company that has their own Google Cloud organization. You need to ensure that your Site Reliability Engineers (SREs) have the same project permissions in the startup company's organization as in your own organization. What should you do?

  A. In the Google Cloud console for your organization, select Create role from selection, and choose destination as the startup company's organization
  B. In the Google Cloud console for the startup company, select Create role from selection and choose source as the startup company's Google Cloud organization.
  C. Use the gcloud iam roles copy command, and provide the Organization ID of the startup company's Google Cloud Organization as the destination.
  D. Use the gcloud iam roles copy command, and provide the project IDs of all projects in the startup company s organization as the destination.
  C. Use the gcloud iam roles copy command, and provide the Organization ID of the startup company's Google Cloud Organization as the destination.

  ---

  Explanation

  https://cloud.google.com/architecture/best-practices-vpc-design#shared- service Cloud VPN is another alternative. Because Cloud VPN establishes reachability through managed IPsec tunnels, it doesn't have the aggregate limits of VPC Network Peering. Cloud VPN uses a VPN Gateway for connectivity and doesn't consider the aggregate resource use of the IPsec peer. The drawbacks of Cloud VPN include increased costs (VPN tunnels and traffic egress), management overhead required to maintain tunnels, and the performance overhead of IPsec.

• Question 315:

  Your organization needs to grant users access to query datasets in BigQuery but prevent them from accidentally deleting the datasets. You want a solution that follows Google-recommended practices. What should you do?

  A. Add users to roles/bigquery user role only, instead of roles/bigquery dataOwner.
  B. Add users to roles/bigquery dataEditor role only, instead of roles/bigquery dataOwner.
  C. Create a custom role by removing delete permissions, and add users to that role only.
  D. Create a custom role by removing delete permissions. Add users to the group, and then add the group to the custom role.
  D. Create a custom role by removing delete permissions. Add users to the group, and then add the group to the custom role.

  ---

  Explanation

  A - Works, but doesn't follow GCP best practices B - Doesn't work as the role grants permission to delete datasets C - Works, but is more complicated than A and doesn't follow Google best practices D - Correct, more complicated than A, but it follows Google Best Practices.

• Question 316:

  You are deploying a production application on Compute Engine. You want to prevent anyone from accidentally destroying the instance by clicking the wrong button. What should you do?

  A. Disable the flag "Delete boot disk when instance is deleted."
  B. Enable delete protection on the instance.
  C. Disable Automatic restart on the instance.
  D. Enable Preemptibility on the instance.
  B. Enable delete protection on the instance.

  ---

  Explanation

  Preventing Accidental VM Deletion This document describes how to protect specific VM instances from deletion by setting the deletionProtection property on an Instance resource. To learn more about VM instances, read the Instances documentation. As part of your workload, there might be certain VM instances that are critical to running your application or services, such as an instance running a SQL server, a server used as a license manager, and so on. These VM instances might need to stay running indefinitely so you need a way to protect these VMs from being deleted. By setting the deletionProtection flag, a VM instance can be protected from accidental deletion. If a user attempts to delete a VM instance for which you have set the deletionProtection flag, the request fails. Only a user that has been granted a role with compute.instances.create permission can reset the flag to allow the resource to be deleted. https://cloud.google.com/compute/docs/instances/preventing-accidental-vm-deletion

  https://googlecloudplatform.uservoice.com/forums/302595-compute-engine/suggestions/14227521-set-delete-boot-disk-when-instance-is-deleted-to

• Question 317:

  Your manager needs you to test out the latest version of MS-SQL on a Windows instance. You've created the VM and need to connect into the instance. What steps should you follow to connect to the instance?

  A. Generate a Windows password in the console, then use a client capable of communicating via RDP and provide the credentials.
  B. Generate a Windows password in the console, then use the RDP button to connect in through the console.
  C. Connect in with your own RDP client using your Google Cloud username and password.
  D. From the console click the SSH button to automatically connect.
  A. Generate a Windows password in the console, then use a client capable of communicating via RDP and provide the credentials.
  B. Generate a Windows password in the console, then use the RDP button to connect in through the console.

  ---

  Explanation

• Question 318:

  You are building an archival solution for your data warehouse and have selected Cloud Storage to archive your data. Your users need to be able to access this archived data once a quarter for some regulatory requirements. You want to select a cost-efficient option. Which storage option should you use?

  A. Cold Storage
  B. Nearline Storage
  C. Regional Storage
  D. Multi-Regional Storage
  B. Nearline Storage

  ---

  Explanation

  Nearline, Coldline, and Archive offer ultra low-cost, highly-durable, highly available archival storage. For data accessed less than once a year, Archive is a cost-effective storage option for long-term preservation of data. Coldline is also ideal for cold storage--data your business expects to touch less than once a quarter. For warmer storage, choose Nearline: data you expect to access less than once a month, but possibly multiple times throughout the year. All storage classes are available across all GCP regions and provide unparalleled sub-second access speeds with a consistent API.

  https://cloud.google.com/storage/archival

• Question 319:

  Your auditor wants to view your organization's use of data in Google Cloud. The auditor is most interested in auditing who accessed data in Cloud Storage buckets. You need to help the auditor access the data they need. What should you do?

  A. Turn on Data Access Logs for the buckets they want to audit, and then build a query in the log viewer that filters on Cloud Storage.
  B. Assign the appropriate permissions, and then create a Data Studio report on Admin Activity Audit Logs.
  C. Assign the appropriate permissions, and the use Cloud Monitoring to review metrics.
  D. Use the export logs API to provide the Admin Activity Audit Logs in the format they want.
  D. Use the export logs API to provide the Admin Activity Audit Logs in the format they want.

  ---

  Explanation

  https://cloud.google.com/storage/docs/audit-logging

• Question 320:

  You need to select and configure compute resources for a set of batch processing jobs. These jobs take around 2 hours to complete and are run nightly. You want to minimize service costs. What should you do?

  A. Select Google Kubernetes Engine. Use a single-node cluster with a small instance type.
  B. Select Google Kubernetes Engine. Use a three-node cluster with micro instance types.
  C. Select Compute Engine. Use preemptible VM instances of the appropriate standard machine type.
  D. Select Compute Engine. Use VM instance types that support micro bursting.
  C. Select Compute Engine. Use preemptible VM instances of the appropriate standard machine type.

  ---

  Explanation

  For cost-saving and not immediate fault-tolerant workloads like batch jobs use Preemptible VM instances