Google ASSOCIATE-CLOUD-ENGINEER Online Practice Questions and Exam Preparation

Google ASSOCIATE-CLOUD-ENGINEER Online Questions & Answers

• Question 31:

  You have a website hosted on App Engine standard environment. You want 1% of your users to see a new test version of the website. You want to minimize complexity. What should you do?

  A. Deploy the new version in the same application and use the --migrate option.
  B. Deploy the new version in the same application and use the --splits option to give a weight of 99 to the current version and a weight of 1 to the new version.
  C. Create a new App Engine application in the same project. Deploy the new version in that application. Use the App Engine library to proxy 1% of the requests to the new version.
  D. Create a new App Engine application in the same project. Deploy the new version in that application. Configure your network load balancer to send 1% of the traffic to that new application.
  B. Deploy the new version in the same application and use the --splits option to give a weight of 99 to the current version and a weight of 1 to the new version.

  ---

  Explanation

  B is the correct answer as there is only one app engine can be created per project

• Question 32:

  You are deploying an application to Cloud Run. Your application requires the use of an API that runs on Google Kubernetes Engine (GKE). You need to ensure that your Cloud Run service can privately reach the API on GKE, and you want to follow Google-recommended practices. What should you do?

  A. Deploy an ingress resource on the GKE cluster to expose the API to the internet. Use Cloud Armor to filter for IP addresses that can connect to the API. On the Cloud Run service, configure the application to fetch its public IP address and update the Cloud Armor policy on startup to allow this IP address to call the API on ports 80 and 443.
  B. Create an ingress firewall rule on the VPC to allow connections from 0.0.0.0/0 on ports 80 and 443.
  C. Create an egress firewall rule on the VPC to allow connections to 0.0.0.0/ on ports 80 and 443.
  D. Deploy an internal Application Load Balancer to expose the API on GKE to the VPC. Configure Cloud DNS with the IP address of the internal Application Load Balancer. Deploy a Serverless VPC Access connector to allow the Cloud Run service to call the API through the FQDN on Cloud DNS.
  D. Deploy an internal Application Load Balancer to expose the API on GKE to the VPC. Configure Cloud DNS with the IP address of the internal Application Load Balancer. Deploy a Serverless VPC Access connector to allow the Cloud Run service to call the API through the FQDN on Cloud DNS.

  ---

  Explanation

  This approach follows Google-recommended practices:

  Internal Application Load Balancer (ILB): By deploying an ILB on GKE, the API is only accessible within your Virtual Private Cloud (VPC), ensuring private connectivity. Cloud DNS Configuration: Using Cloud DNS with the ILB's IP address

  allows you to resolve a fully qualified domain name (FQDN) for the API, making it easier to manage and maintain. Serverless VPC Access Connector: Deploying this connector enables your Cloud Run service to communicate with resources

  in your VPC (such as the internal API on GKE) via private IP addresses.

• Question 33:

  An external member of your team needs list access to compute images and disks in one of your projects. You want to follow Google-recommended practices when you grant the required permissions to this user. What should you do?

  A. Create a custom role, and add all the required compute.disks.list and compute.images.list permissions as includedPermissions. Grant the custom role to the user at the project level.
  B. Create a custom role based on the Compute Image User role. Add the compute.disks.list to the includedPermissions field. Grant the custom role to the user at the project level.
  C. Create a custom role based on the Compute Storage Admin role. Exclude unnecessary permissions from the custom role. Grant the custom role to the user at the project level.
  D. Grant the Compute Storage Admin role at the project level.
  A. Create a custom role, and add all the required compute.disks.list and compute.images.list permissions as includedPermissions. Grant the custom role to the user at the project level.

  ---

  Explanation

  https://cloud.google.com/iam/docs/custom-roles-permissions-support

  Both compute.disks.list and compute.images.list are available as permissions for custom roles. Makes more sense to make a new custom role than going off an admin one then adjusting it.

• Question 34:

  You need to create a copy of a custom Compute Engine virtual machine (VM) to facilitate an expected increase in application traffic due to a business acquisition. What should you do?

  A. Create a Compute Engine snapshot of your base VM. Create your images from that snapshot.
  B. Create a Compute Engine snapshot of your base VM. Create your instances from that snapshot.
  C. Create a custom Compute Engine image from a snapshot. Create your images from that image.
  D. Create a custom Compute Engine image from a snapshot. Create your instances from that image.
  B. Create a Compute Engine snapshot of your base VM. Create your instances from that snapshot.

  ---

  Explanation

  The questions says to create A COPY, not multiple copies. If we were doing more than one VM then we would select D for custom image.

  https://cloud.google.com/compute/docs/machine-images

• Question 35:

  Your company developed a mobile game that is deployed on Google Cloud. Gamers are connecting to the game with their personal phones over the Internet. The game sends UDP packets to update the servers about the gamers' actions while they are playing in multiplayer mode. Your game backend can scale over multiple virtual machines (VMs), and you want to expose the VMs over a single IP address. What should you do?

  A. Configure an SSL Proxy load balancer in front of the application servers.
  B. Configure an Internal UDP load balancer in front of the application servers.
  C. Configure an External HTTP(s) load balancer in front of the application servers.
  D. Configure an External Network load balancer in front of the application servers.
  D. Configure an External Network load balancer in front of the application servers.

  ---

  Explanation

  cell phones are sending UDP packets and the only that can receive that type of traffic is a External Network TCP/UDP https://cloud.google.com/load- balancing/docs/network https://cloud.google.com/load-balancing/docs/choosing-loadbalancer#lb-decision-tree

• Question 36:

  You need to assign a Cloud Identity and Access Management (Cloud IAM) role to an external auditor. The auditor needs to have permissions to review your Google Cloud Platform (GCP) Audit Logs and also to review your Data Access logs. What should you do?

  A. Assign the auditor the IAM role roles/logging.privateLogViewer. Perform the export of logs to Cloud Storage.
  B. Assign the auditor the IAM role roles/logging.privateLogViewer. Direct the auditor to also review the logs for changes to Cloud IAM policy.
  C. Assign the auditor's IAM user to a custom role that has logging.privateLogEntries.list permission. Perform the export of logs to Cloud Storage.
  D. Assign the auditor's IAM user to a custom role that has logging.privateLogEntries.list permission. Direct the auditor to also review the logs for changes to Cloud IAM policy.
  B. Assign the auditor the IAM role roles/logging.privateLogViewer. Direct the auditor to also review the logs for changes to Cloud IAM policy.

  ---

  Explanation

  Background

  Google Cloud provides Cloud Audit Logs, which is an integral part of Cloud Logging. It consists of two log streams for each project: Admin Activity and Data Access. Admin Activity logs contain log entries for API calls or other administrative

  actions that modify the configuration or metadata of resources. Admin Activity logs are always enabled. There is no charge for your Admin Activity audit logs. Data Access logs record API calls that create, modify, or read user-provided data.

  Data Access audit logs are disabled by default because they can be large.

  logging.viewer: The logging.viewer role gives the security admin team the ability to view the Admin Activity logs.

  logging.privateLogViewer : The logging.privateLogViewer role gives the ability to view the Data Access logs.

• Question 37:

  You have a Dockerfile that you need to deploy on Kubernetes Engine. What should you do?

  A. Use kubectl app deploy .
  B. Use gcloud app deploy .
  C. Create a docker image from the Dockerfile and upload it to Container Registry. Create a Deployment YAML file to point to that image. Use kubectl to create the deployment with that file.
  D. Create a docker image from the Dockerfile and upload it to Cloud Storage. Create a Deployment YAML file to point to that image. Use kubectl to create the deployment with that file.
  C. Create a docker image from the Dockerfile and upload it to Container Registry. Create a Deployment YAML file to point to that image. Use kubectl to create the deployment with that file.

  ---

  Explanation

  Reference https://cloud.google.com/kubernetes-engine/docs/tutorials/hello-app

  C is correct.

  A can be eliminated because kubectl app * is not a valid command

  B can be eliminated because gcloud app deploy deploys on app engine, not on kubernetes (also it still requires a config file pointing to the image).

  D is not correct, since you cannot deploy a container image directly from GCS

• Question 38:

  Your company runs a variety of applications and workloads on Google Cloud, and you are responsible for managing cloud costs. You need to identify a solution that enables you to perform detailed cost analysis. You also must be able to visualize the cost data in multiple ways on the same dashboard. What should you do?

  A. Use the cost breakdown report with the available filters from Cloud Billing to visualize the data.
  B. Enable the Cloud Billing export to BigQuery, and use Looker Studio to visualize the data.
  C. Run queries in Cloud Monitoring. Create dashboards to visualize the billing metrics.
  D. Enable Cloud Monitoring metrics export to BigQuery, and use Looker to visualize the data.
  B. Enable the Cloud Billing export to BigQuery, and use Looker Studio to visualize the data.

  ---

  Explanation

  Cloud Billing export to BigQuery allows you to perform detailed, granular analysis of your cost data by writing custom SQL queries. Looker Studio (formerly Data Studio) enables flexible, customizable dashboards, letting you visualize cost data in multiple ways (e.g., by project, service, labels). This combination is the Google-recommended solution for in-depth cost reporting and visualization.

• Question 39:

  Your team has created 4 projects, one for each distinct application. You have a single budget for all of these projects. What is the best way to pay for all of these projects?

  A. Create a Billing Account for each project.
  B. Use an invoiced account, which will pay for all projects inside a Google Cloud account.
  C. Use a single Billing Account linked to all 4 projects.
  D. Use a single Billing Account linked to the Google Cloud account.
  C. Use a single Billing Account linked to all 4 projects.

  ---

  Explanation

• Question 40:

  You have an application that runs on Compute Engine VM instances in a custom Virtual Private Cloud (VPC). Your company's security policies only allow the use to internal IP addresses on VM instances and do not let VM instances connect to the internet. You need to ensure that the application can access a file hosted in a Cloud Storage bucket within your project. What should you do?

  A. Enable Private Service Access on the Cloud Storage Bucket.
  B. Add slorage.googleapis.com to the list of restricted services in a VPC Service Controls perimeter and add your project to the list to protected projects.
  C. Enable Private Google Access on the subnet within the custom VPC.
  D. Deploy a Cloud NAT instance and route the traffic to the dedicated IP address of the Cloud Storage bucket.
  C. Enable Private Google Access on the subnet within the custom VPC.

  ---

  Explanation

  Private Google Access lets you connect VM instances to GCP services without external IP addresses and only internal. A is wrong because even though Private Services Access lets you also access GCP and other services through internal IPs, it also allows the VMs to have external IPs. https://cloud.google.com/vpc/docs/private-google-access