Google Google Certifications ASSOCIATE-CLOUD-ENGINEER Questions & Answers

• Question 351:

  You installed the Google Cloud CLI on your workstation and set the proxy configuration. However, you are worried that your proxy credentials will be recorded in the gcloud CLI logs. You want to prevent your proxy credentials from being logged.

  What should you do?

  A. Configure username and password by using gcloud configure set proxy/username and gcloud configure set proxy/ proxy/password commands.

  B. Encode username and password in sha256 encoding, and save it to a text file. Use filename as a value in the gcloud configure set core/custom_ca_certs_file command.

  C. Provide values for CLOUDSDK_USERNAME and CLOUDSDK_PASSWORD in the gcloud CLI tool configure file.

  D. Set the CLOUDSDK_PROXY_USERNAME and CLOUDSDK_PROXY PASSWORD properties by using environment variables in your command line tool.

  Correct Answer: D

• Question 352:

  A team of data scientists infrequently needs to use a Google Kubernetes Engine (GKE) cluster that you manage. They require GPUs for some long-running, non-restartable jobs.

  You want to minimize cost. What should you do?

  A. Enable node auto-provisioning on the GKE cluster.

  B. Create a VerticalPodAutscaler for those workloads.

  C. Create a node pool with preemptible VMs and GPUs attached to those VMs.

  D. Create a node pool of instances with GPUs, and enable autoscaling on this node pool with a minimum size of 1.

  Correct Answer: A

  auto-provisioning = Attaches and deletes node pools to cluster based on the requirements. Hence creating a GPU node pool, and auto-scaling would be better https://cloud.google.com/kubernetes-engine/docs/how- to/node-auto-provisioning

• Question 353:

  You have deployed an application on a Compute Engine instance. An external consultant needs to access the Linux-based instance. The consultant is connected to your corporate network through a VPN connection, but the consultant has no Google account.

  What should you do?

  A. Instruct the external consultant to use the gcloud compute ssh command line tool by using Identity- Aware Proxy to access the instance.

  B. Instruct the external consultant to use the gcloud compute ssh command line tool by using the public IP address of the instance to access it.

  C. Instruct the external consultant to generate an SSH key pair, and request the public key from the consultant. Add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key.

  D. Instruct the external consultant to generate an SSH key pair, and request the private key from the consultant. Add the private key to the instance yourself, and have the consultant access the instance through SSH with their public key.

  Correct Answer: C

  Explanation: The best option is to instruct the external consultant to generate an SSH key pair, and request the public key from the consultant. Then, add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key. This way, you can grant the consultant access to the instance without requiring a Google account or exposing the instance's public IP address. This option also follows the best practice of using user-managed SSH keys instead of service account keys for SSH access1. Option A is not feasible because the external consultant does not have a Google account, and therefore cannot use Identity-Aware Proxy (IAP) to access the instance. IAP requires the user to authenticate with a Google account and have the appropriate IAM permissions to access the instance2. Option B is not secure because it exposes the instance's public IP address, which can increase the risk of unauthorized access or attacks. Option D is not correct because it reverses the roles of the public and private keys. The public key should be added to the instance, and the private key should be kept by the consultant. Sharing the private key with anyone else can compromise the security of the SSH connection3. References:

  1: https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys

  2: https://cloud.google.com/iap/docs/using-tcp-forwarding

  3: https://cloud.google.com/compute/docs/instances/connecting- advanced#sshbetweeninstances

• Question 354:

  Your team is building a website that handles votes from a large user population. The incoming votes will arrive at various rates. You want to optimize the storage and processing of the votes. What should you do?

  A. Save the incoming votes to Firestore. Use Cloud Scheduler to trigger a Cloud Functions instance to periodically process the votes.

  B. Use a dedicated instance to process the incoming votes. Send the votes directly to this instance.

  C. Save the incoming votes to a JSON file on Cloud Storage. Process the votes in a batch at the end of the day.

  D. Save the incoming votes to Pub/Sub. Use the Pub/Sub topic to trigger a Cloud Functions instance to process the votes.

  Correct Answer: D

  Explanation: Pub/Sub is a scalable and reliable messaging service that can handle large volumes of data from different sources at different rates. It allows you to decouple the producers and consumers of the data, and provides a durable and persistent storage for the messages until they are delivered. Cloud Functions is a serverless platform that can execute code in response to events, such as messages published to a Pub/Sub topic. It can scale automatically based on the load, and you only pay for the resources you use. By using Pub/Sub and Cloud Functions, you can optimize the storage and processing of the votes, as you can handle the variable rates of incoming votes, process them in real time or near real time, and avoid managing servers or VMs. References: Pub/Sub documentation Cloud Functions documentation Choosing a messaging service for Google Cloud

• Question 355:

  Your team has developed a stateless application which requires it to be run directly on virtual machines. The application is expected to receive a fluctuating amount of traffic and needs to scale automatically. You need to deploy the application. What should you do?

  A. Deploy the application on a managed instance group and configure autoscaling.

  B. Deploy the application on a Kubernetes Engine cluster and configure node pool autoscaling.

  C. Deploy the application on Cloud Functions and configure the maximum number instances.

  D. Deploy the application on Cloud Run and configure autoscaling.

  Correct Answer: A

  Explanation: A managed instance group (MIG) is a group of identical virtual machines (VMs) that you can manage as a single entity. You can use a MIG to deploy and maintain a stateless application that runs directly on VMs. A MIG can automatically scale the number of VMs based on the load or a schedule. A MIG can also automatically heal the VMs if they become unhealthy or unavailable. A MIG is suitable for applications that need to run on VMs rather than containers or serverless platforms. B is incorrect because Kubernetes Engine is a managed service for running containerized applications on a cluster of nodes. It is not necessary to use Kubernetes Engine if the application does not use containers and can run directly on VMs. C is incorrect because Cloud Functions is a serverless platform for running event-driven code in response to triggers. It is not suitable for applications that need to run continuously and handle HTTP requests. D is incorrect because Cloud Run is a serverless platform for running stateless containerized applications. It is not suitable for applications that do not use containers and can run directly on VMs.

  References: Managed instance groups documentation Choosing a compute option for Google Cloud

• Question 356:

  You just installed the Google Cloud CLI on your new corporate laptop. You need to list the existing instances of your company on Google Cloud. What must you do before you run the gcloud compute instances list command? Choose 2 answers

  A. Run gcloud auth login, enter your login credentials in the dialog window, and paste the received login token to gcloud CLI.

  B. Create a Google Cloud service account, and download the service account key. Place the key file in a folder on your machine where gcloud CLI can find it.

  C. Download your Cloud Identity user account key. Place the key file in a folder on your machine where gcloud CLI can find it.

  D. Run gcloud config set compute/zone $my_zone to set the default zone for gcloud CLI.

  E. Run gcloud config set project $my_project to set the default project for gcloud CLI.

  Correct Answer: AE

  Explanation: Before you run the gcloud compute instances list command, you need to do two things: authenticate with your user account and set the default project for gcloud CLI. To authenticate with your user account, you need to run gcloud auth login, enter your login credentials in the dialog window, and paste the received login token to gcloud CLI. This will authorize the gcloud CLI to access Google Cloud resources on your behalf1. To set the default project for gcloud CLI, you need to run gcloud config set project $my_project, where $my_project is the ID of the project that contains the instances you want to list. This will save you from having to specify the project flag for every gcloud command2. Option B is not recommended, because using a service account key increases the risk of credential leakage and misuse. It is also not necessary, because you can use your user account to authenticate to the gcloud CLI3. Option C is not correct, because there is no such thing as a Cloud Identity user account key. Cloud Identity is a service that provides identity and access management for Google Cloud users and groups4. Option D is not required, because the gcloud compute instances list command does not depend on the default zone. You can list instances from all zones or filter by a specific zone using the -- filter flag. References:

  1: https://cloud.google.com/sdk/docs/authorizing

  2: https://cloud.google.com/sdk/gcloud/reference/config/set

  3: https://cloud.google.com/iam/docs/best-practices-for-managing-service-account- keys

  4: https://cloud.google.com/identity/docs/overview : https://cloud.google.com/sdk/gcloud/reference/ compute/instances/list

• Question 357:

  Your company has developed a new application that consists of multiple microservices. You want to deploy the application to Google Kubernetes Engine (GKE), and you want to ensure that the cluster can scale as more applications are deployed in the future. You want to avoid manual intervention when each new application is deployed. What should you do?

  A. Deploy the application on GKE, and add a HorizontalPodAutoscaler to the deployment.

  B. Deploy the application on GKE, and add a VerticalPodAutoscaler to the deployment.

  C. Create a GKE cluster with autoscaling enabled on the node pool. Set a minimum and maximum for the size of the node pool.

  D. Create a separate node pool for each application, and deploy each application to its dedicated node pool.

  Correct Answer: C

  Explanation: https://cloud.google.com/kubernetes-engine/docs/how-to/cluster- autoscaler#adding_a_node_pool_with_autoscaling

• Question 358:

  You are deploying a web application using Compute Engine. You created a managed instance group (MIG) to host the application. You want to follow Google-recommended practices to implement a secure and highly available solution. What should you do?

  A. Use SSL proxy load balancing for the MIG and an A record in your DNS private zone with the load balancer's IP address.

  B. Use SSL proxy load balancing for the MIG and a CNAME record in your DNS public zone with the load balancer's IP address.

  C. Use HTTP(S) load balancing for the MIG and a CNAME record in your DNS private zone with the load balancer's IP address.

  D. Use HTTP(S) load balancing for the MIG and an A record in your DNS public zone with the load balancer's IP address.

  Correct Answer: D

  Explanation: HTTP(S) load balancing is a Google-recommended practice for distributing web traffic across multiple regions and zones, and providing high availability, scalability, and security for web applications. It supports both IPv4 and IPv6 addresses, and can handle SSL/TLS termination and encryption. It also integrates with Cloud CDN, Cloud Armor, and Cloud Identity-Aware Proxy for enhanced performance and protection. A MIG can be used as a backend service for HTTP

  (S) load balancing, and can automatically scale and heal the VM instances that host the web application. To configure DNS for HTTP(S) load balancing, you need to create an A record in your DNS public zone with the load balancer's IP

  address. This will map your domain name to the load balancer's IP address, and allow users to access your web application using the domain name. A CNAME record is not recommended, as it can cause latency and DNS resolution issues.

  A private zone is not suitable, as it is only visible within your VPC network, and not to the public internet.

  References:

  HTTP(S) Load Balancing documentation

  Setting up DNS records for HTTP(S) load balancing Choosing a load balancer

• Question 359:

  You have files in a Cloud Storage bucket that you need to share with your suppliers. You want to restrict the time that the files are available to your suppliers to 1 hour. You want to follow Google recommended practices. What should you do?

  A. Create a service account with just the permissions to access files in the bucket. Create a JSON key for the service account. Execute the command gsutil signurl -m 1h gs:///*.

  B. Create a service account with just the permissions to access files in the bucket. Create a JSON key for the service account. Execute the command gsutil signurl -d 1h gs:///**.

  C. Create a service account with just the permissions to access files in the bucket. Create a JSON key for the service account. Execute the command gsutil signurl -p 60m gs:///.

  D. Create a JSON key for the Default Compute Engine Service Account. Execute the command gsutil signurl -t 60m gs:///***

  Correct Answer: B

  Explanation: This command correctly specifies the duration that the signed url should be valid for by using the -d flag. The default is 1 hour so omitting the -d flag would have also resulted in the same outcome. Times may be specified with no suffix (default hours), or with s = seconds, m = minutes, h = hours, d = days. The max duration allowed is 7d.Ref: https://cloud.google.com/storage/docs/gsutil/commands/signurl

• Question 360:

  You need to extract text from audio files by using the Speech-to-Text API. The audio files are pushed to a Cloud Storage bucket. You need to implement a fully managed, serverless compute solution that requires authentication and aligns with Google-recommended practices. You want to automate the call to the API by submitting each file to the API as the audio file arrives in the bucket. What should you do?

  A. Run a Kubernetes job to scan the bucket regularly for incoming files, and call the Speech-to-Text API for each unprocessed file.

  B. Create an App Engine standard environment triggered by Cloud Storage bucket events to submit the file URI to the Google Speech-to-Text API.

  C. Run a Python script by using a Linux cron job in Compute Engine to scan the bucket regularly for incoming files, and call the Speech-to-Text API for each unprocessed file.

  D. Create a Cloud Function triggered by Cloud Storage bucket events to submit the file URI to the Google Speech-to-Text API.

  Correct Answer: B