Google Google Certifications ASSOCIATE-CLOUD-ENGINEER Questions & Answers

• Question 1:

  The sales team has a project named Sales Data Digest that has the ID acme-data-digest You need to set up similar Google Cloud resources for the marketing team but their resources must be organized independently of the sales team. What should you do?

  A. Grant the Project Editor role to the Marketing learn for acme data digest

  B. Create a Project Lien on acme-data digest and then grant the Project Editor role to the Marketing team

  C. Create another protect with the ID acme-marketing-data-digest for the Marketing team and deploy the resources there

  D. Create a new protect named Meeting Data Digest and use the ID acme-data-digest Grant the Project Editor role to the Marketing team.

  Correct Answer: C

• Question 2:

  After a recent security incident, your startup company wants better insight into what is happening in the Google Cloud environment. You need to monitor unexpected firewall changes and instance creation. Your company prefers simple solutions. What should you do?

  A. Use Cloud Logging filters to create log-based metrics for firewall and instance actions. Monitor the changes and set up reasonable alerts.

  B. Install Kibana on a compute Instance. Create a log sink to forward Cloud Audit Logs filtered for firewalls and compute instances to Pub/Sub. Target the Pub/Sub topic to push messages to the Kibana instance. Analyze the logs on Kibana in real time.

  C. Turn on Google Cloud firewall rules logging, and set up alerts for any insert, update, or delete events.

  D. Create a log sink to forward Cloud Audit Logs filtered for firewalls and compute instances to Cloud Storage. Use BigQuery to periodically analyze log events in the storage bucket.

  Correct Answer: A

  Explanation: This answer is the simplest and most effective way to monitor unexpected firewall changes and instance creation in Google Cloud. Cloud Logging filters allow you to specify the criteria for the log entries that you want to view or export. You can use the Logging query language to write filters based on the LogEntry fields, such as resource.type, severity, or protoPayload.methodName. For example, you can filter for firewall-related events by using the following query: resource.type="gce_subnetwork"

  logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Ffirewall" You can filter for instance- related events by using the following query: resource.type="gce_instance" logName="projects/PROJECT_ID/logs/compute.googleapis.com%2Factivity_log" You can create log- based metrics from these filters to measure the rate or count of log entries that match the filter. Log-based metrics can be used to create charts and dashboards in Cloud Monitoring, or to set up alerts based on the metric values. For example, you can create an alert policy that triggers when the log-based metric for firewall changes exceeds a certain threshold in a given time interval. This way, you can get notified of any unexpected or malicious changes to your firewall rules. Option B is incorrect because it is unnecessarily complex and costly. Installing Kibana on a compute instance requires additional configuration and maintenance. Creating a log sink to forward Cloud Audit Logs to Pub/Sub also incurs additional charges for the Pub/Sub service. Analyzing the logs on Kibana in real time may not be feasible or efficient, as it requires constant monitoring and manual intervention. Option C is incorrect because Google Cloud firewall rules logging is a different feature from Cloud Audit Logs. Firewall rules logging allows you to audit, verify, and analyze the effects of your firewall rules by creating connection records for each rule that applies to traffic. However, firewall rules logging does not log the insert, update, or delete events for the firewall rules themselves. Those events are logged by Cloud Audit Logs, which record the administrative activities in your Google Cloud project. Option D is incorrect because it is not a real-time solution. Creating a log sink to forward Cloud Audit Logs to Cloud Storage requires additional storage space and charges. Using BigQuery to periodically analyze log events in the storage bucket also incurs additional costs for the BigQuery service. Moreover, this option does not provide any alerting mechanism to notify you of any unexpected or malicious changes to your firewall rules or instances.

• Question 3:

  The sales team has a project named Sales Data Digest that has the ID acme-data-digest. You need to set up similar Google Cloud resources for the marketing team but their resources must be organized independently of the sales team. What should you do?

  A. Grant the Project Editor role to the Marketing team for acme-data-digest.

  B. Create a Project Lien on acme-data-digest and then grant the Project Editor role to the Marketing team.

  C. Create another project with the ID acme-marketing-data-digest for the Marketing team and deploy the resources there.

  D. Create a new project named Marketing Data Digest and use the ID acme-data-digest. Grant the Project Editor role to the Marketing team.

  Correct Answer: C

  Answer should be C because the resources for the marketing team should be independent from the Sales team. Resources are tied and separated by projects.

• Question 4:

  You have deployed multiple Linux instances on Compute Engine. You plan on adding more instances in the coming weeks. You want to be able to access all of these instances through your SSH client over the internet without having to configure specific access on the existing and new instances. You do not want the Compute Engine instances to have a public IP. What should you do?

  A. Configure Cloud Identity-Aware Proxy for HTTPS resources.

  B. Configure Cloud Identity-Aware Proxy for SSH and TCP resources

  C. Create an SSH keypair and store the public key as a project-wide SSH Key.

  D. Create an SSH keypair and store the private key as a project-wide SSH Key.

  Correct Answer: B

  https://cloud.google.com/iap/docs/using-tcp-forwarding

• Question 5:

  You have created an application that is packaged into a Docker image. You want to deploy the Docker image as a workload on Google Kubernetes Engine. What should you do?

  A. Upload the image to Cloud Storage and create a Kubernetes Service referencing the image.

  B. Upload the image to Cloud Storage and create a Kubernetes Deployment referencing the image.

  C. Upload the image to Container Registry and create a Kubernetes Service referencing the image.

  D. Upload the image to Container Registry and create a Kubernetes Deployment referencing the image.

  Correct Answer: D

  Reference: https://cloud.google.com/kubernetes-engine/docs/tutorials/hello-app

• Question 6:

  You are assigned to maintain a Google Kubernetes Engine (GKE) cluster named `dev' that was deployed on Google Cloud. You want to manage the GKE configuration using the command line interface (CLI). You have just downloaded and installed the Cloud SDK. You want to ensure that future CLI commands by default address this specific cluster What should you do?

  A. Use the command gcloud config set container/cluster dev.

  B. Use the command gcloud container clusters update dev.

  C. Create a file called gke.default in the ~/.gcloud folder that contains the cluster name.

  D. Create a file called defaults.json in the ~/.gcloud folder that contains the cluster name.

  Correct Answer: A

  To set a default cluster for gcloud commands, run the following command: gcloud config set container/cluster CLUSTER_NAME https://cloud.google.com/kubernetes- engine/docs/how-to/managing-clusters?hl=en https://cloud.google.com/kubernetes-engine/docs/how-to/cluster-access-for-kubectl#gcloud-config

• Question 7:

  You need to add a group of new users to Cloud Identity. Some of the users already have existing Google accounts. You want to follow one of Google's recommended practices and avoid conflicting accounts. What should you do?

  A. Invite the user to transfer their existing account.

  B. Invite the user to use an email alias to resolve the conflict.

  C. Tell the user that they must delete their existing account.

  D. Tell the user to remove all personal email from the existing account.

  Correct Answer: A

  Reference: https://support.google.com/cloudidentity/answer/7332836?hl=en

• Question 8:

  You need to manage a Cloud Spanner instance for best query performance. Your instance in production runs in a single Google Cloud region. You need to improve performance in the shortest amount of time. You want to follow Google best practices for service configuration. What should you do?

  A. Create an alert in Cloud Monitoring to alert when the percentage of high priority CPU utilization reaches 45%. If you exceed this threshold, add nodes to your instance.

  B. Create an alert in Cloud Monitoring to alert when the percentage of high priority CPU utilization reaches 45%. Use database query statistics to identify queries that result in high CPU usage, and then rewrite those queries to optimize their resource usage.

  C. Create an alert in Cloud Monitoring to alert when the percentage of high priority CPU utilization reaches 65%. If you exceed this threshold, add nodes to your instance.

  D. Create an alert in Cloud Monitoring to alert when the percentage of high priority CPU utilization reaches 65%. Use database query statistics to identify queries that result in high CPU usage, and then rewrite those queries to optimize their resource usage.

  Correct Answer: C

  Reference: https://cloud.google.com/spanner/docs/instances

• Question 9:

  Your company has an internal application for managing transactional orders. The application is used exclusively by employees in a single physical location. The application requires strong consistency, fast queries, and ACID guarantees for multi-table transactional updates. The first version of the application is implemented in PostgreSQL, and you want to display it to the cloud with minimal code changes. Which database is most appropriate for this application?

  A. BigQuery

  B. Cloud SQL

  C. Cloud Spanner

  D. Cloud Datastore

  Correct Answer: B

  Cloud SQL is the most appropriate choice for deploying the application with the required characteristics while minimizing code changes and maintaining strong consistency, fast queries, and ACID guarantees for multi-table transactional updates. Reference: https://cloud.google.com/spanner/docs/transactions

• Question 10:

  You are developing a new web application that will be deployed on Google Cloud Platform. As part of your release cycle, you want to test updates to your application on a small portion of real user traffic. The majority of the users should still be directed towards a stable version of your application. What should you do?

  A. Deploy the application on App Engine. For each update, create a new version of the same service. Configure traffic splitting to send a small percentage of traffic to the new version.

  B. Deploy the application on App Engine. For each update, create a new service. Configure traffic splitting to send a small percentage of traffic to the new service.

  C. Deploy the application on Kubernetes Engine. For a new release, update the deployment to use the new version.

  D. Deploy the application on Kubernetes Engine. For a new release, create a new deployment for the now version. Update the service to use the new deployment.

  Correct Answer: A

  A is correct answer,

  Keyword, Version, traffic splitting, App Engine supports traffic splitting for versions before releasing.