Google Associate Cloud Engineer practice questions

1. Question 1 of 25

   Your organization needs to grant users access to query datasets in BigQuery but prevent them from accidentally deleting the datasets. You want a solution that follows Google-recommended practices. What should you do?

   • AAdd users to roles/bigquery user role only, instead of roles/bigquery dataOwner.
   • BAdd users to roles/bigquery dataEditor role only, instead of roles/bigquery dataOwner.
   • CCreate a custom role by removing delete permissions, and add users to that role only.
   • DCreate a custom role by removing delete permissions. Add users to the group, and then add the group to the custom role.

   Show answer

   Correct answer: D

   How others answered

   • D52%
   • A43%

   Only 52% agreed on this answer — treat it as contested rather than settled.

   Explanation

   I believe the key part is the "following Google Best Practices" phrase. A - Works, but doesn't follow GCP best practices B - Doesn't work as the role grants permission to delete datasets C - Works, but is more complicated than A and doesn't follow Google best practices D - Correct, more complicated than A, but it follows Google Best Practices.

   Adapted from community discussion by someoneinthecloud · 2020-07-18 · 74 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

   1. S

      someoneinthecloud

      2020-07-18

      74 upvotes

      I believe the key part is the "following Google Best Practices" phrase. A - Works, but doesn't follow GCP best practices B - Doesn't work as the role grants permission to delete datasets C - Works, but is more complicated than A and doesn't follow Google best practices D - Correct, more complicated than A, but it follows Google Best Practices.

   2. E

      ESP_SAP

      2020-08-19

      57 upvotes

      Correct Answer is (D): The proper answer regarding to bigquery roles is the listed in the options, the proper rol that resolve this requirement is: roles/bigquery.dataViewer https://cloud.google.com/bigquery/docs/access-control#custom_roles on the other hand, the question explicitly is asking to use the GCP best practices on IAM : GCP Best Practices explain clearly these rules: Policy management ❑ Set organization-level IAM policies to grant access to all projects in your organization. ❑ Grant roles to a Google group instead of individual users when possible. It is easier to add members to and remove members from a Google group instead of updating an IAM policy to add or remove users. ❑ If you need to grant multiple roles to allow a particular task, create a Google group, grant the roles to that group, and then add users to that group. https://cloud.google.com/iam/docs/using-iam-securely#policy_management

   3. K

      kyo

      2021-07-24

      13 upvotes

      I don't think A works properly. roles/bigquery.user has bigquery.datasets.create. And the documentation states: > Additional, allows the creation of new datasets within the project; the creator is granted the BigQuery Data Owner role (roles/bigquery.dataOwner) on these new datasets. If bigquery.user creates a new dataset, it's likely that bigquery.user will get permission to delete that dataset. This means that bigquery.user may have permission to delete data. https://cloud.google.com/bigquery/docs/access-control

   4. M

      miniso8153

      2020-06-06

      14 upvotes

      A https://cloud.google.com/bigquery/docs/access-control#bigquery

2. Question 2 of 25

   You have a developer laptop with the Cloud SDK installed on Ubuntu. The Cloud SDK was installed from the Google Cloud Ubuntu package repository. You want to test your application locally on your laptop with Cloud Datastore. What should you do?

   • AExport Cloud Datastore data using gcloud datastore export.
   • BCreate a Cloud Datastore index using gcloud datastore indexes create.
   • CInstall the google-cloud-sdk-datastore-emulator component using the apt get install command.
   • DInstall the cloud-datastore-emulator component using the gcloud components install command.

   Show answer

   Correct answer: C

   How others answered

   • C51%
   • D49%

   Only 51% agreed on this answer — treat it as contested rather than settled.

   Explanation

   I agree with this comment. The answer is C. If you installed the SDK from the Ubuntu repo and try to do the following: $ gcloud components install cloud-datastore-emulator You will receive this message: ERROR: (gcloud.components.install) You cannot perform this action because the Cloud SDK component manager is disabled for this installation. You can run the following command to achieve the same result for this installation: sudo apt-get install google-cloud-sdk-datastore-emulator

   Adapted from community discussion by XRiddlerX · 2020-07-30 · 55 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

   1. X

      XRiddlerX

      2020-07-30

      55 upvotes

      I agree with this comment. The answer is C. If you installed the SDK from the Ubuntu repo and try to do the following: $ gcloud components install cloud-datastore-emulator You will receive this message: ERROR: (gcloud.components.install) You cannot perform this action because the Cloud SDK component manager is disabled for this installation. You can run the following command to achieve the same result for this installation: sudo apt-get install google-cloud-sdk-datastore-emulator

   2. S

      someoneinthecloud

      2020-07-18

      51 upvotes

      I believe answer is C https://cloud.google.com/sdk/docs/downloads-apt-get The question is not about the datastore command itself but from where we should run the update command on the Ubuntu to install the component.

   3. M

      myuniquename

      2021-09-22

      36 upvotes

      absolutely insane if that question comes up during the associate exam, who on earth would know that off the top of their heads?

   4. E

      Eshkrkrkr

      2020-11-10

      26 upvotes

      Wrong! The answer is C! When you install SDK using apt Cloud SDK Component Manager is disabled and you need to install extra packages again using apt. https://cloud.google.com/sdk/docs/components#managing_cloud_sdk_components Note: These instructions will not work if you have installed Cloud SDK using a package manager such as APT or yum because Cloud SDK Component Manager is disabled when using that method of installation.

3. Question 3 of 25

   Your company has a single sign-on (SSO) identity provider that supports Security Assertion Markup Language (SAML) integration with service providers. Your company has users in Cloud Identity. You would like users to authenticate using your company's SSO provider. What should you do?

   • AIn Cloud Identity, set up SSO with Google as an identity provider to access custom SAML apps.
   • BIn Cloud Identity, set up SSO with a third-party identity provider with Google as a service provider.
   • CObtain OAuth 2.0 credentials, configure the user consent screen, and set up OAuth 2.0 for Mobile & Desktop Apps.
   • DObtain OAuth 2.0 credentials, configure the user consent screen, and set up OAuth 2.0 for Web Server Applications.

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   B - This is the only possible option. You configure applications (service providers) to accept SAML assertions from the company’s existing identity provider and users in Cloud Identity can sign in to various applications through the third-party single sign-on (SSO) identity provider. It is important to note that user authentication occurs in the third-party IdP so the absence of a Gmail login is not an issue for signing in. Ref: https://cloud.google.com/identity/solutions/enable-sso If you have a third-party IdP, you can still configure SSO for third-party apps in the Cloud Identity catalog. User authentication occurs in the third-party IdP, and Cloud Identity manages the cloud apps. To use Cloud Identity for SSO, your users need Cloud Identity accounts. They sign in through your third-party IdP or using a password on their Cloud Identity accounts.

   Adapted from community discussion by sudav · 2022-08-19 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • support.google.com documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • support.google.com documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

   1. P

      PhilipAWS

      2021-12-24

      31 upvotes

      Only option B make sense to me as per - https://support.google.com/cloudidentity/answer/6262987?hl=en&ref_topic=7558767

   2. S

      sudav

      2022-08-19

      5 upvotes

      B - This is the only possible option. You configure applications (service providers) to accept SAML assertions from the company’s existing identity provider and users in Cloud Identity can sign in to various applications through the third-party single sign-on (SSO) identity provider. It is important to note that user authentication occurs in the third-party IdP so the absence of a Gmail login is not an issue for signing in. Ref: https://cloud.google.com/identity/solutions/enable-sso If you have a third-party IdP, you can still configure SSO for third-party apps in the Cloud Identity catalog. User authentication occurs in the third-party IdP, and Cloud Identity manages the cloud apps. To use Cloud Identity for SSO, your users need Cloud Identity accounts. They sign in through your third-party IdP or using a password on their Cloud Identity accounts.

   3. E

      ESP_SAP

      2021-08-20

      6 upvotes

      Correct Answer is (A): Set up SSO with Google as your Identity provider With single sign-on (SSO), your users can access many applications without having to enter their username and password for each application. Here’s how to set up SSO if you use Google to authenticate your users. https://support.google.com/cloudidentity/topic/7558768?hl=en&ref_topic=7558174

   4. E

      Eshkrkrkr

      2021-11-10

      5 upvotes

      I think its B: https://support.google.com/cloudidentity/answer/6262987?hl=en&ref_topic=7558767 Google offers a SAML-based single sign-on (SSO) service that provides partner companies with full control over the authorization and authentication of hosted user accounts that can access web-based applications like Gmail or Google Calendar. Using the SAML model, Google acts as the service provider and provides services such as Gmail and Start Pages.

4. Question 4 of 25

   A team of data scientists infrequently needs to use a Google Kubernetes Engine (GKE) cluster that you manage. They require GPUs for some long-running, non- restartable jobs. You want to minimize cost. What should you do?

   • AEnable node auto-provisioning on the GKE cluster.
   • BCreate a VerticalPodAutscaler for those workloads.
   • CCreate a node pool with preemptible VMs and GPUs attached to those VMs.
   • DCreate a node pool of instances with GPUs, and enable autoscaling on this node pool with a minimum size of 1.

   Show answer

   Correct answer: A

   How others answered

   • A57%
   • D39%

   Only 57% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Incorrect options are B. VerticalPodAutscaler scales PODS based on the app you deploy. For handle infrequently GPU access, you need infrequently GPU nodes VerticalAutscaler Pod deployed on a non GPU node it useless, [We cant have the node always have GPU for infrequent requests] C. Preemptible VMs cant last long D. For infrequent access, you don't want to have a permanent homogenous cluster. The correct option is "A" auto-provisioning = Attaches and deletes node pools to cluster based on the requirements. Hence creating a GPU node pool, and auto-scaling would be better https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning

   Adapted from community discussion by [Removed] · 2021-04-10 · 25 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

   1. P

      Polok

      2020-06-06

      72 upvotes

      If you need something for long-running, non- restartable jobs you dont use preemptible VMs Think answer is D.

   2. [

      [Removed]

      2021-04-10

      25 upvotes

      Incorrect options are B. VerticalPodAutscaler scales PODS based on the app you deploy. For handle infrequently GPU access, you need infrequently GPU nodes VerticalAutscaler Pod deployed on a non GPU node it useless, [We cant have the node always have GPU for infrequent requests] C. Preemptible VMs cant last long D. For infrequent access, you don't want to have a permanent homogenous cluster. The correct option is "A" auto-provisioning = Attaches and deletes node pools to cluster based on the requirements. Hence creating a GPU node pool, and auto-scaling would be better https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning

   3. K

      kimharsh

      2021-11-22

      12 upvotes

      A is not correct because you can't add a GPU node to an existing GKE cluster Limitations Before using GPUs on GKE, keep in mind the following limitations: You cannot add GPUs to existing node pools. GPU nodes cannot be live migrated during maintenance events. GPUs are only supported with general-purpose N1 machine types. GPUs are not supported in Windows Server node pools REF: https://cloud.google.com/kubernetes-engine/docs/how-to/gpus#limitations So the answer should be D

   4. W

      wjtb

      2022-05-31

      10 upvotes

      https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning Node auto-provisioning creates node pools based on the following information: CPU, memory and ephemeral storage resource requests. GPU requests Pending Pods' node affinities and label selectors. Pending Pods' node taints and tolerations.

5. Question 5 of 25

   You need a dynamic way of provisioning VMs on Compute Engine. The exact specifications will be in a dedicated configuration file. You want to follow Google's recommended practices. Which method should you use?

   • ADeployment Manager
   • BCloud Composer
   • CManaged Instance Group
   • DUnmanaged Instance Group

   Show answer

   Correct answer: A

   How others answered

   • A92%

   Explanation

   The correct answer is Option A - Deployment Manager. Deployment Manager is a configuration management tool that allows you to define and deploy a set of resources, including Compute Engine VMs, in a declarative manner. You can use it to specify the exact specifications of your VMs in a configuration file, and Deployment Manager will create and manage those VMs for you. Deployment Manager is recommended by Google as a way to automate and manage the deployment of resources on the Google Cloud Platform. https://cloud.google.com/deployment-manager/docs/

   Adapted from community discussion by Buruguduystunstugudunstuy · 2022-12-29 · 22 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

   1. B

      Buruguduystunstugudunstuy

      2022-12-29

      Selected A22 upvotes

      The correct answer is Option A - Deployment Manager. Deployment Manager is a configuration management tool that allows you to define and deploy a set of resources, including Compute Engine VMs, in a declarative manner. You can use it to specify the exact specifications of your VMs in a configuration file, and Deployment Manager will create and manage those VMs for you. Deployment Manager is recommended by Google as a way to automate and manage the deployment of resources on the Google Cloud Platform. https://cloud.google.com/deployment-manager/docs/

   2. S

      shreymath9999

      2023-10-25

      9 upvotes

      The question says - "Dynamic way of provision VMs on Compute Engine" which both the Managed Instance group and the Deployment Manager does, but for different purposes. So here the answer can be more of Deployment Manager as it covers the scope of question, while the Managed Instance group can also dynamically provision VMs based on configuration file but only for auto-healing or horizontal scaling purposes, the answer could have been C if the question was asked as "Dynamic way of provision VMs on Compute Engine for horizontal scaling/auto healing"

   3. S

      sakdip66

      2023-04-08

      5 upvotes

      Managed Instance Group (option C) and Unmanaged Instance Group (option D) are Compute Engine features that allow you to group related VM instances and manage them as a single entity. However, they do not provide a dynamic way of provisioning VMs based on a configuration file like Deployment Manager does.

   4. O

      orious

      2022-06-30

      Selected A4 upvotes

      A is correct. Managed Instance Groups don't support Configuration file in order to provision VM instances.

6. Question 6 of 25

   Your management has asked an external auditor to review all the resources in a specific project. The security team has enabled the Organization Policy called Domain Restricted Sharing on the organization node by specifying only your Cloud Identity domain. You want the auditor to only be able to view, but not modify, the resources in that project. What should you do?

   • AAsk the auditor for their Google account, and give them the Viewer role on the project.
   • BAsk the auditor for their Google account, and give them the Security Reviewer role on the project.
   • CCreate a temporary account for the auditor in Cloud Identity, and give that account the Viewer role on the project.
   • DCreate a temporary account for the auditor in Cloud Identity, and give that account the Security Reviewer role on the project.

   Show answer

   Correct answer: C

   How others answered

   • C77%

   Explanation

   Correct Answer is (C): roles/viewer Read access to all resources. Get and list access for all resources. Using primitive roles The following table lists the primitive roles that you can grant to access a project, the description of what the role does, and the permissions bundled within that role. Avoid using primitive roles except when absolutely necessary. These roles are very powerful, and include a large number of permissions across all Google Cloud services. For more details on when you should use primitive roles, see the Identity and Access Management FAQ. IAM predefined roles are much more granular, and allow you to carefully manage the set of permissions that your users have access to. See Understanding Roles for a list of roles that can be granted at the project level. Creating custom roles can further increase the control you have over user permissions. https://cloud.google.com/resource-manager/docs/access-control-proj#using_primitive_roles

   Adapted from community discussion by ESP_SAP · 2020-08-20 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

   1. D

      dan80

      2020-06-08

      52 upvotes

      C - https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors

   2. E

      ESP_SAP

      2020-08-20

      21 upvotes

      Correct Answer is (C): roles/viewer Read access to all resources. Get and list access for all resources. Using primitive roles The following table lists the primitive roles that you can grant to access a project, the description of what the role does, and the permissions bundled within that role. Avoid using primitive roles except when absolutely necessary. These roles are very powerful, and include a large number of permissions across all Google Cloud services. For more details on when you should use primitive roles, see the Identity and Access Management FAQ. IAM predefined roles are much more granular, and allow you to carefully manage the set of permissions that your users have access to. See Understanding Roles for a list of roles that can be granted at the project level. Creating custom roles can further increase the control you have over user permissions. https://cloud.google.com/resource-manager/docs/access-control-proj#using_primitive_roles

   3. H

      happyBoo

      2021-06-11

      6 upvotes

      roles/iam.securityReviewer will give access to view IAM roles in addition, which is not required.

   4. A

      ayj

      2020-11-17

      4 upvotes

      Security Reviewer: Provides permissions to list all resources and IAM policies on them. Viewer: Permissions for read-only actions that do not affect state, such as viewing (but not modifying) existing resources or data. Think C makes sense then

7. Question 7 of 25

   You need to assign a Cloud Identity and Access Management (Cloud IAM) role to an external auditor. The auditor needs to have permissions to review your Google Cloud Platform (GCP) Audit Logs and also to review your Data Access logs. What should you do?

   • AAssign the auditor the IAM role roles/logging.privateLogViewer. Perform the export of logs to Cloud Storage.
   • BAssign the auditor the IAM role roles/logging.privateLogViewer. Direct the auditor to also review the logs for changes to Cloud IAM policy.
   • CAssign the auditor's IAM user to a custom role that has logging.privateLogEntries.list permission. Perform the export of logs to Cloud Storage.
   • DAssign the auditor's IAM user to a custom role that has logging.privateLogEntries.list permission. Direct the auditor to also review the logs for changes to Cloud IAM policy.

   Show answer

   Correct answer: B

   How others answered

   • B90%

   Explanation

   Correct Answer is (B): Background Google Cloud provides Cloud Audit Logs, which is an integral part of Cloud Logging. It consists of two log streams for each project: Admin Activity and Data Access. Admin Activity logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. Admin Activity logs are always enabled. There is no charge for your Admin Activity audit logs. Data Access logs record API calls that create, modify, or read user-provided data. Data Access audit logs are disabled by default because they can be large. logging.viewer: The logging.viewer role gives the security admin team the ability to view the Admin Activity logs. logging.privateLogViewer : The logging.privateLogViewer role gives the ability to view the Data Access logs.

   Adapted from community discussion by ESP_SAP · 2021-02-24 · 67 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

   1. E

      ESP_SAP

      2021-02-24

      67 upvotes

      Correct Answer is (B): Background Google Cloud provides Cloud Audit Logs, which is an integral part of Cloud Logging. It consists of two log streams for each project: Admin Activity and Data Access. Admin Activity logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. Admin Activity logs are always enabled. There is no charge for your Admin Activity audit logs. Data Access logs record API calls that create, modify, or read user-provided data. Data Access audit logs are disabled by default because they can be large. logging.viewer: The logging.viewer role gives the security admin team the ability to view the Admin Activity logs. logging.privateLogViewer : The logging.privateLogViewer role gives the ability to view the Data Access logs.

   2. E

      ESP_SAP

      2021-02-24

      25 upvotes

      Correct Answer is (B): (Continuation). Scenario: External auditors In this scenario, audit logs for an organization are aggregated and exported to a central sink location. A third-party auditor is granted access several times a year to review the organization's audit logs. The auditor is not authorized to view PII data in the Admin Activity logs. During normal access, the auditors' Google group is only granted access to view the historic logs stored in BigQuery. If any anomalies are discovered, the group is granted permission to view the actual Cloud Logging Admin Activity logs via the dashboard's elevated access mode. At the end of each audit period, the group's access is then revoked. Data is redacted using Cloud DLP before being made accessible for viewing via the dashboard application.

   3. E

      ESP_SAP

      2021-02-24

      22 upvotes

      Correct Answer is (B): (Continuation). The table below explains IAM logging roles that an Organization Administrator can grant to the service account used by the dashboard, as well as the resource level at which the role is granted: logging.viewer Organization Dashboard service account The logging.viewer role permits the service account to read the Admin Activity logs in Cloud Logging. bigquery.dataViewer BigQuery dataset Dashboard service account The bigquery.dataViewer role permits the service account used by the dashboard application to read the exported Admin Activity logs.

   4. E

      Eshkrkrkr

      2021-05-11

      8 upvotes

      Yes, B is correct because: 1) Question doesn't ask us to export and store logs for any long period of time. 2) Custom role with only logging.privateLogEntries.list permission won't let the auditor to access Log Exporer at all (https://cloud.google.com/logging/docs/access-control#console_permissions - Minimal read-only access: logging.logEntries.list)

8. Question 8 of 25

   You are managing several Google Cloud Platform (GCP) projects and need access to all logs for the past 60 days. You want to be able to explore and quickly analyze the log contents. You want to follow Google-recommended practices to obtain the combined logs for all projects. What should you do?

   • ANavigate to Stackdriver Logging and select resource.labels.project_id="*"
   • BCreate a Stackdriver Logging Export with a Sink destination to a BigQuery dataset. Configure the table expiration to 60 days.
   • CCreate a Stackdriver Logging Export with a Sink destination to Cloud Storage. Create a lifecycle rule to delete objects after 60 days.
   • DConfigure a Cloud Scheduler job to read from Stackdriver and store the logs in BigQuery. Configure the table expiration to 60 days.

   Show answer

   Correct answer: B

   How others answered

   • B100%

   Explanation

   I believe B is the answer. All that matters in this scenario is the logs for the past 60 days. We can use BigQuery to analyze contents so C is incorrect. We need to configure a BQ as the sink for the logs export so we can query and analyze log data in the future. Therefore D is incorrect. https://cloud.google.com/logging/docs/audit/best-practices#export-best-practices Since we only care about the logs within 60 days, we can set the expiration time to 60 to retain only the logs within that time frame. Once data is beyond 60 days old, it wouldn't be included in future analyzations. https://cloud.google.com/bigquery/docs/managing-tables#updating_a_tables_expiration_time

   Adapted from community discussion by dttncl · 2022-04-12 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

   1. [

      [Removed]

      2021-03-12

      11 upvotes

      The question is to view log past 60 days. B, c, D talks about deleting an object or truncation of table data

   2. D

      dttncl

      2022-04-12

      6 upvotes

      I believe B is the answer. All that matters in this scenario is the logs for the past 60 days. We can use BigQuery to analyze contents so C is incorrect. We need to configure a BQ as the sink for the logs export so we can query and analyze log data in the future. Therefore D is incorrect. https://cloud.google.com/logging/docs/audit/best-practices#export-best-practices Since we only care about the logs within 60 days, we can set the expiration time to 60 to retain only the logs within that time frame. Once data is beyond 60 days old, it wouldn't be included in future analyzations. https://cloud.google.com/bigquery/docs/managing-tables#updating_a_tables_expiration_time

   3. T

      tifo16

      2021-10-18

      6 upvotes

      Firstly i though that A was correct but when considering "default" retention period which is 30 days, i go for B. https://cloud.google.com/blog/products/it-ops/best-practices-for-working-with-google-cloud-audit-logging Log entries are held in Stackdriver Logging for a limited time known as the retention period. After that, the entries are deleted. To keep log entries longer, you need to export them outside of Stackdriver Logging by configuring log sinks.

   4. S

      scanner2

      2024-03-07

      Selected B2 upvotes

      Provides storage of log entries in BigQuery datasets. You can use big data analysis capabilities on the stored logs. Logging sinks stream logging data into BigQuery in small batches, which lets you query data without running a load job. You can set a default table expiration time at the dataset level, or you can set a table's expiration time when the table is created. A table's expiration time is often referred to as "time to live" or TTL. When a table expires, it is deleted along with all of the data it contains. https://cloud.google.com/logging/docs/export/configure_export_v2#overview https://cloud.google.com/bigquery/docs/managing-tables#updating_a_tables_expiration_time

9. Question 9 of 25

   You need to reduce GCP service costs for a division of your company using the fewest possible steps. You need to turn off all configured services in an existing GCP project. What should you do?

   • A1. Verify that you are assigned the Project Owners IAM role for this project. 2. Locate the project in the GCP console, click Shut down and then enter the project ID.
   • B1. Verify that you are assigned the Project Owners IAM role for this project. 2. Switch to the project in the GCP console, locate the resources and delete them.
   • C1. Verify that you are assigned the Organizational Administrator IAM role for this project. 2. Locate the project in the GCP console, enter the project ID and then click Shut down.
   • D1. Verify that you are assigned the Organizational Administrators IAM role for this project. 2. Switch to the project in the GCP console, locate the resources and delete them.

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   I have to go with A as the correct answer according to support.google.com URL: https://support.google.com/googleapi/answer/6251787?hl=en# What stands out at me is the paragraph "Shutting down a project stops all billing and traffic serving, shuts down any Google Cloud Platform App Engine applications, and terminates all Compute Engine instances. All project data associated with Google Cloud and Google APIs services becomes inaccessible."

   Adapted from community discussion by XRiddlerX · 2021-07-29 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Google Cloud documentation
   • Google Cloud documentation
   • support.google.com documentation
   • Google Cloud documentation
   • Google Cloud documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

   1. S

      ShakthiGCP

      2022-03-09

      7 upvotes

      orgpolicy.policy.get resourcemanager.folders.get resourcemanager.folders.getIamPolicy resourcemanager.folders.list resourcemanager.folders.setIamPolicy resourcemanager.organizations.get resourcemanager.organizations.getIamPolicy resourcemanager.organizations.setIamPolicy resourcemanager.projects.get resourcemanager.projects.getIamPolicy resourcemanager.projects.list resourcemanager.projects.setIamPolicy organization admin doesnt have a delete project permission to that role. Ans: A.

   2. X

      XRiddlerX

      2021-07-29

      6 upvotes

      I have to go with A as the correct answer according to support.google.com URL: https://support.google.com/googleapi/answer/6251787?hl=en# What stands out at me is the paragraph "Shutting down a project stops all billing and traffic serving, shuts down any Google Cloud Platform App Engine applications, and terminates all Compute Engine instances. All project data associated with Google Cloud and Google APIs services becomes inaccessible."

   3. L

      Liongeek

      2021-12-29

      6 upvotes

      Just for the record, despite the role the user should have to excecute the shut down, when you are about to do it, you FIRST click Shut down and then enter the ID, you can try it. Only ans that fits is A.

   4. S

      sudav

      2022-08-19

      4 upvotes

      A - The primitive Project Owner role provides permissionst to delete project https://cloud.google.com/iam/docs/understanding-roles#primitive_roles You can shut down projects using the Cloud Console. When you shut down a project, this immediately happens: All billing and traffic serving stops, You lose access to the project, The owners of the project will be notified and can stop the deletion within 30 days, The project will be scheduled to be deleted after 30 days. However, some resources may be deleted much earlier.

10. Question 10 of 25

    You need to manage multiple Google Cloud projects in the fewest steps possible. You want to configure the Google Cloud SDK command line interface (CLI) so that you can easily manage multiple projects. What should you do?

    • A1. Create a configuration for each project you need to manage. 2. Activate the appropriate configuration when you work with each of your assigned Google Cloud projects.
    • B1. Create a configuration for each project you need to manage. 2. Use gcloud init to update the configuration values when you need to work with a non-default project
    • C1. Use the default configuration for one project you need to manage. 2. Activate the appropriate configuration when you work with each of your assigned Google Cloud projects.
    • D1. Use the default configuration for one project you need to manage. 2. Use gcloud init to update the configuration values when you need to work with a non-default project.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    A Cloud SDK comes with a default configuration. To create multiple configurations, use gcloud config configurations create, and gcloud config configurations activate to switch between them. https://cloud.google.com/sdk/gcloud/reference/config/set

    Adapted from community discussion by SSunny · 2022-03-12 · 34 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. S

       SSunny

       2022-03-12

       34 upvotes

       A Cloud SDK comes with a default configuration. To create multiple configurations, use gcloud config configurations create, and gcloud config configurations activate to switch between them. https://cloud.google.com/sdk/gcloud/reference/config/set

    2. X

       xaqanik

       2024-02-08

       Selected A7 upvotes

       Google Cloud SDK allows you to create multiple configurations for different projects, and you can easily switch between these configurations as needed. To manage multiple projects efficiently, you can create a separate configuration for each project and activate the appropriate configuration when you work with each assigned project. The gcloud config configurations create and gcloud config configurations activate commands allow you to create and activate different configurations. By using different configurations, you can ensure that your CLI commands are always executed in the correct context and against the correct project, without the need to manually change the configuration each time you switch projects.

    3. G

       GCP_Student1

       2022-03-11

       8 upvotes

       A. 1. Create a configuration for each project you need to manage. 2. Activate the appropriate configuration when you work with each of your assigned Google Cloud projects.

    4. S

       scanner2

       2024-09-08

       Selected A2 upvotes

       The gcloud config command group lets you set, view and unset properties used by Google Cloud CLI. A configuration is a set of properties that govern the behavior of gcloud and other Google Cloud CLI tools. The initial default configuration is set when gcloud init is run. You can create additional named configurations using gcloud init or gcloud config configurations create. To switch between configurations, use gcloud config configurations activate. https://cloud.google.com/sdk/gcloud/reference/config https://cloud.google.com/sdk/gcloud/reference/config/configurations/activate

11. Question 11 of 25

    Your managed instance group raised an alert stating that new instance creation has failed to create new instances. You need to maintain the number of running instances specified by the template to be able to process expected application traffic. What should you do?

    • ACreate an instance template that contains valid syntax which will be used by the instance group. Delete any persistent disks with the same name as instance names.
    • BCreate an instance template that contains valid syntax that will be used by the instance group. Verify that the instance name and persistent disk name values are not the same in the template.
    • CVerify that the instance template being used by the instance group contains valid syntax. Delete any persistent disks with the same name as instance names. Set the disks.autoDelete property to true in the instance template.
    • DDelete the current instance template and replace it with a new instance template. Verify that the instance name and persistent disk name values are not the same in the template. Set the disks.autoDelete property to true in the instance template.

    Show answer

    Correct answer: A

    How others answered

    • A65%
    • C35%

    Only 65% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Really tricky question. Ideal scenario would be 1. create new template, while creating ensure that in the new template disks.autoDelete=true, 3. delete existing persistent disks, 4. make rolling update ... In order to switch to new template we need "Rolling update". Unfortunately, it is not mentioned. With current options C - not correct, we cannot update existing template D - not correct, we cannot delete existing template when it is in use (just checked in GCP) (We need rolling update) B - will not solve our problem without Rolling update A - This is the only option (I know that it can be temporary) that will work without Rolling update according to https://cloud.google.com/compute/docs/troubleshooting/troubleshooting-migs

    Adapted from community discussion by TAvenger · 2021-02-21 · 61 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. T

       TAvenger

       2021-02-21

       61 upvotes

       Really tricky question. Ideal scenario would be 1. create new template, while creating ensure that in the new template disks.autoDelete=true, 3. delete existing persistent disks, 4. make rolling update ... In order to switch to new template we need "Rolling update". Unfortunately, it is not mentioned. With current options C - not correct, we cannot update existing template D - not correct, we cannot delete existing template when it is in use (just checked in GCP) (We need rolling update) B - will not solve our problem without Rolling update A - This is the only option (I know that it can be temporary) that will work without Rolling update according to https://cloud.google.com/compute/docs/troubleshooting/troubleshooting-migs

    2. E

       ESP_SAP

       2020-08-21

       44 upvotes

       Correct Answer is (C): Your instance template has set the disks.autoDelete option to false for boot persistent disks so that when a VM has been deleted (for example, because of autohealing), the persistent disk was not deleted. When the managed instance group attempted to recreate the VM with the same name, it ran into the same issue where a persistent disk already exists with the same name. Delete the existing persistent disk to resolve the immediate problem and update the instance template to set the disks.autoDelete to true if you would like boot persistent disks to be deleted alongside the instance https://cloud.google.com/compute/docs/instance-groups/creating-groups-of-managed-instances#troubleshooting

    3. J

       JackGlemins

       2021-02-28

       12 upvotes

       https://cloud.google.com/compute/docs/instance-templates#how_to_update_instance_templates

    4. R

       rungcpnow

       2020-10-09

       5 upvotes

       Answer is D.. you cannot modify the instance template . Ans c is close but only problem is you cannot modify instance template. Only way is you can modify instance template when creating a VM. Instance templates are designed to create instances with identical configurations. So you cannot update an existing instance template or change an instance template after you create it. If an instance template goes out of date, or you need to make changes to the configuration, create a new instance template. You can create a template based on an existing instance template, or based on an existing instance. You can also override instance template fields when creating a VM instance from an instance template. https://cloud.google.com/compute/docs/instances/create-vm-from-instance-template#creating_a_vm_instance_from_an_instance_template_with_overrides

12. Question 12 of 25

    You have an application that receives SSL-encrypted TCP traffic on port 443. Clients for this application are located all over the world. You want to minimize latency for the clients. Which load balancing option should you use?

    • AHTTPS Load Balancer
    • BNetwork Load Balancer
    • CSSL Proxy Load Balancer
    • DInternal TCP/UDP Load Balancer. Add a firewall rule allowing ingress traffic from 0.0.0.0/0 on the target instances.

    Show answer

    Correct answer: C

    How others answered

    • C69%
    • A31%

    Only 69% agreed on this answer — treat it as contested rather than settled.

    Explanation

    SSL Proxy Load Balancing support for the following ports: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995, 1883, 3389, 5222, 5432, 5671, 5672, 5900, 5901, 6379, 8085, 8099, 9092, 9200, and 9300. When you use Google- managed SSL certificates with SSL Proxy Load Balancing, the frontend port for traffic must be 443 to enable the Google-managed SSL certificates to be provisioned and renewed.

    Adapted from community discussion by Bituz · 2020-07-26 · 32 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. B

       Bituz

       2020-07-26

       32 upvotes

       SSL Proxy Load Balancing support for the following ports: 25, 43, 110, 143, 195, 443, 465, 587, 700, 993, 995, 1883, 3389, 5222, 5432, 5671, 5672, 5900, 5901, 6379, 8085, 8099, 9092, 9200, and 9300. When you use Google- managed SSL certificates with SSL Proxy Load Balancing, the frontend port for traffic must be 443 to enable the Google-managed SSL certificates to be provisioned and renewed.

    2. G

       GCP_Student1

       2021-02-13

       8 upvotes

       The answer is C You have an application that receives SSL-encrypted TCP traffic on port 443. Clients for this application are located all over the world. You want to minimize latency for the clients. Which load balancing option should you use? SSL Proxy Load Balancing is a reverse proxy load balancer that distributes SSL traffic coming from the internet to virtual machine (VM) instances in your Google Cloud VPC network. When using SSL Proxy Load Balancing for your SSL traffic, user SSL (TLS) connections are terminated at the load balancing layer, and then proxied to the closest available backend instances by using either SSL (recommended) or TCP. For the types of backends that are supported, see Backends. With the Premium Tier, SSL Proxy Load Balancing can be configured as a global load balancing service. With Standard Tier, the SSL proxy load balancer handles load balancing regionally. SSL Proxy Load Balancing is intended for non-HTTP(S) traffic. For HTTP(S) traffic, we recommend that you use HTTP(S) Load Balancing https://cloud.google.com/load-balancing/docs/ssl

    3. J

       Jelly_Wang

       2023-05-01

       Selected C9 upvotes

       Go for C. We are taking exam so read the question smart. For HTTPS traffic use HTTPS load balancer. For non-HTTP traffic, use SSL Proxy Load Balancer. (https://cloud.google.com/load-balancing/docs/ssl). Network Load Balancer (Extenral TCP/UDP network load balancer) for regional pass through traffic (https://cloud.google.com/load-balancing/docs/network). Here it mentioned SSL-encrypted TCP traffic all over the world, go for SSL proxy load balancer. Read the keyword "SSL-encrypted TCP" and "all over the world". Keep it simple, don't over complicated yourself

    4. F

       fishnoodlesoup

       2021-12-19

       9 upvotes

       For me "A" is the correct answer. We need a Global LB for 443, which is HTTPS. SSL Proxy Load Balancing is intended for non-HTTP(S) traffic. For HTTP(S) traffic, we recommend that you use HTTP(S) Load Balancing. Source: https://cloud.google.com/load-balancing/docs/ssl

13. Question 13 of 25

    You need to create a copy of a custom Compute Engine virtual machine (VM) to facilitate an expected increase in application traffic due to a business acquisition. What should you do?

    • ACreate a Compute Engine snapshot of your base VM. Create your images from that snapshot.
    • BCreate a Compute Engine snapshot of your base VM. Create your instances from that snapshot.
    • CCreate a custom Compute Engine image from a snapshot. Create your images from that image.
    • DCreate a custom Compute Engine image from a snapshot. Create your instances from that image.

    Show answer

    Correct answer: D

    How others answered

    • D63%
    • B38%

    Only 63% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Correct Answer is (D): Preparing your instance for an image You can create an image from a disk even while it is attached to a running VM instance. However, your image will be more reliable if you put the instance in a state that is easier for the image to capture. Use one of the following processes to prepare your boot disk for the image: Stop the instance so that it can shut down and stop writing any data to the persistent disk. If you can't stop your instance before you create the image, minimize the amount of writes to the disk and sync your file system. Pause apps or operating system processes that write data to that persistent disk. Run an app flush to disk if necessary. For example, MySQL has a FLUSH statement. Other apps might have similar processes. Stop your apps from writing to your persistent disk. Run sudo sync. After you prepare the instance, create the image. https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#prepare_instance_for_image

    Adapted from community discussion by ESP_SAP · 2020-08-21 · 38 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. E

       ESP_SAP

       2020-08-21

       38 upvotes

       Correct Answer is (D): Preparing your instance for an image You can create an image from a disk even while it is attached to a running VM instance. However, your image will be more reliable if you put the instance in a state that is easier for the image to capture. Use one of the following processes to prepare your boot disk for the image: Stop the instance so that it can shut down and stop writing any data to the persistent disk. If you can't stop your instance before you create the image, minimize the amount of writes to the disk and sync your file system. Pause apps or operating system processes that write data to that persistent disk. Run an app flush to disk if necessary. For example, MySQL has a FLUSH statement. Other apps might have similar processes. Stop your apps from writing to your persistent disk. Run sudo sync. After you prepare the instance, create the image. https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#prepare_instance_for_image

    2. P

       pca2b

       2021-03-28

       15 upvotes

       B: we just need to make 'a copy' of the VM, B works well for that. not D: Had the question mentioned more copies, we would need to go the way of images...templates etc. D will work but not needed here.

    3. N

       Nazz1977

       2022-12-07

       Selected D7 upvotes

       I have test it. It is D It is not B because if you make a snapshot and replicate it ,the new machines will have the same SSID, imagine if machine are in a domain, all the clones machines are viewing from domain controlles are the same. It doesn't work.

    4. N

       nooneknows

       2023-04-14

       Selected D2 upvotes

       Option A is not recommended because snapshots are not directly usable as images for creating new instances. While snapshots are useful for backup and disaster recovery, they are not optimized for creating new VMs. Option B is also not recommended because snapshots are not directly usable as instances. While it is possible to create new disks from snapshots, additional configuration steps would be required to create a new instance from a disk. Option C is a valid option, but it requires additional steps to create an image from a snapshot before creating new images from that image. Option D is the best option because it involves creating a custom Compute Engine image directly from the snapshot, which can be used to create new instances with minimal additional configuration. This approach is faster and simpler than creating images from images. Therefore, the correct answer is option D: Create a custom Compute Engine image from a snapshot. Create your instances from that image.

14. Question 14 of 25

    You have deployed an application on a single Compute Engine instance. The application writes logs to disk. Users start reporting errors with the application. You want to diagnose the problem. What should you do?

    • ANavigate to Cloud Logging and view the application logs.
    • BConnect to the instance's serial console and read the application logs.
    • CConfigure a Health Check on the instance and set a Low Healthy Threshold value.
    • DInstall and configure the Cloud Logging Agent and view the logs from Cloud Logging.

    Show answer

    Correct answer: D

    How others answered

    • D53%
    • B43%

    Only 53% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Correct Answer is (D): In its default configuration, the Logging agent streams logs from common third-party applications and system software to Logging; review the list of default logs. You can configure the agent to stream additional logs; go to Configuring the Logging agent for details on agent configuration and operation. It is a best practice to run the Logging agent on all your VM instances. The agent runs under both Linux and Windows. To install the Logging agent, go to Installing the agent. https://cloud.google.com/logging/docs/agent

    Adapted from community discussion by ESP_SAP · 2020-08-22 · 18 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. H

       hiteshrup

       2020-09-10

       28 upvotes

       Answer: D App logs can't be visible to Cloud Logging until we install Cloud Logging Agent on GCE

    2. E

       ESP_SAP

       2020-08-22

       18 upvotes

       Correct Answer is (D): In its default configuration, the Logging agent streams logs from common third-party applications and system software to Logging; review the list of default logs. You can configure the agent to stream additional logs; go to Configuring the Logging agent for details on agent configuration and operation. It is a best practice to run the Logging agent on all your VM instances. The agent runs under both Linux and Windows. To install the Logging agent, go to Installing the agent. https://cloud.google.com/logging/docs/agent

    3. F

       francisco_guerra

       2020-08-12

       14 upvotes

       The answer is D because you need to install first the agent to see the logs on the logging

    4. E

       ESP_SAP

       2020-08-24

       11 upvotes

       CORRECTION. Correct Answer is (A): Activity logging is enabled by default for all Compute Engine projects. You can see your project's activity logs through the Logs Viewer in the Google Cloud Console: In the Cloud Console, go to the Logging page. Go to the Logging page When in the Logs Viewer, select and filter your resource type from the first drop-down list. From the All logs drop-down list, select compute.googleapis.com/activity_log to see Compute Engine activity logs. https://cloud.google.com/compute/docs/logging/activity-logs#viewing_logs Besides: Activity logs are provided as part of the Cloud Logging service. For more information about Logging in general, read the Cloud Logging documentation. https://cloud.google.com/compute/docs/logging/activity-logs

15. Question 15 of 25

    You built an application on your development laptop that uses Google Cloud services. Your application uses Application Default Credentials for authentication and works fine on your development laptop. You want to migrate this application to a Compute Engine virtual machine (VM) and set up authentication using Google- recommended practices and minimal changes. What should you do?

    • AAssign appropriate access for Google services to the service account used by the Compute Engine VM.
    • BCreate a service account with appropriate access for Google services, and configure the application to use this account.
    • CStore credentials for service accounts with appropriate access for Google services in a config file, and deploy this config file with your application.
    • DStore credentials for your user account with appropriate access for Google services in a config file, and deploy this config file with your application.

    Show answer

    Correct answer: A

    How others answered

    • A54%
    • B46%

    Only 54% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Correct Answer is (B): Best practices In general, Google recommends that each instance that needs to call a Google API should run as a service account with the minimum permissions necessary for that instance to do its job. In practice, this means you should configure service accounts for your instances with the following process: Create a new service account rather than using the Compute Engine default service account. Grant IAM roles to that service account for only the resources that it needs. Configure the instance to run as that service account. Grant the instance the https://www.googleapis.com/auth/cloud-platform scope to allow full access to all Google Cloud APIs, so that the IAM permissions of the instance are completely determined by the IAM roles of the service account. Avoid granting more access than necessary and regularly check your service account permissions to make sure they are up-to-date. https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#best_practices

    Adapted from community discussion by ESP_SAP · 2020-08-22 · 55 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. E

       ESP_SAP

       2020-08-22

       55 upvotes

       Correct Answer is (B): Best practices In general, Google recommends that each instance that needs to call a Google API should run as a service account with the minimum permissions necessary for that instance to do its job. In practice, this means you should configure service accounts for your instances with the following process: Create a new service account rather than using the Compute Engine default service account. Grant IAM roles to that service account for only the resources that it needs. Configure the instance to run as that service account. Grant the instance the https://www.googleapis.com/auth/cloud-platform scope to allow full access to all Google Cloud APIs, so that the IAM permissions of the instance are completely determined by the IAM roles of the service account. Avoid granting more access than necessary and regularly check your service account permissions to make sure they are up-to-date. https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#best_practices

    2. C

       cRobert

       2020-12-20

       20 upvotes

       From your quote: Configure the "instance" to run as that service account. From answer B: and configure the "application" to use this account. You don't add service accounts to applications, ans A

    3. F

       filco72

       2020-08-11

       20 upvotes

       I would choose: A. Assign appropriate access for Google services to the service account used by the Compute Engine VM. as there is no need to create a new service account.

    4. P

       PiperMe

       2024-02-27

       5 upvotes

       I'd strongly lean towards Option B (Create a service account with appropriate access for Google services and configure the application to use this account) as the most likely correct answer. Google's exams emphasize secure design principles. The principle of least privilege is a core tenet, and custom service accounts embody this. Option B aligns precisely with the best practice for production environments and demonstrates a clear understanding of IAM concepts. While Option A could be acceptable with careful permission adjustments, exams often favor the solution most demonstrably secure and aligned with recommended practice out of the box. I believe option A might be a trap. Default service accounts can have varying levels of access. The exam might purposely use this ambiguity to test your knowledge of security principles. Focusing on the step of creating a custom service account signals your understanding of the correct IAM workflow.

16. Question 16 of 25

    You have downloaded and installed the gcloud command line interface (CLI) and have authenticated with your Google Account. Most of your Compute Engine instances in your project run in the europe-west1-d zone. You want to avoid having to specify this zone with each CLI command when managing these instances. What should you do?

    • ASet the europe-west1-d zone as the default zone using the gcloud config subcommand.
    • BIn the Settings page for Compute Engine under Default location, set the zone to europeג€"west1-d.
    • CIn the CLI installation directory, create a file called default.conf containing zone=europeג€"west1ג€"d.
    • DCreate a Metadata entry on the Compute Engine page with key compute/zone and value europeג€"west1ג€"d.

    Show answer

    Correct answer: A

    How others answered

    • A87%

    Explanation

    Correct Answer is (A): Change your default zone and region in the metadata server Note: This only applies to the default configuration. You can change the default zone and region in your metadata server by making a request to the metadata server. For example: gcloud compute project-info add-metadata \ --metadata google-compute-default-region=europe-west1,google-compute-default-zone=europe-west1-b The gcloud command-line tool only picks up on new default zone and region changes after you rerun the gcloud init command. After updating your default metadata, run gcloud init to reinitialize your default configuration. https://cloud.google.com/compute/docs/gcloud-compute#change_your_default_zone_and_region_in_the_metadata_server

    Adapted from community discussion by ESP_SAP · 2021-02-22 · 29 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. E

       ESP_SAP

       2021-02-22

       29 upvotes

       Correct Answer is (A): Change your default zone and region in the metadata server Note: This only applies to the default configuration. You can change the default zone and region in your metadata server by making a request to the metadata server. For example: gcloud compute project-info add-metadata \ --metadata google-compute-default-region=europe-west1,google-compute-default-zone=europe-west1-b The gcloud command-line tool only picks up on new default zone and region changes after you rerun the gcloud init command. After updating your default metadata, run gcloud init to reinitialize your default configuration. https://cloud.google.com/compute/docs/gcloud-compute#change_your_default_zone_and_region_in_the_metadata_server

    2. F

       filco72

       2021-02-11

       7 upvotes

       I would choose: A. Set the europe-west1-d zone as the default zone using the gcloud config subcommand. as this is the correct way to set default

    3. E

       Examan1

       2021-09-01

       4 upvotes

       Using gcloud config you can set the zone in your active configuration only. This setting does not apply to other gcloud configurations and does not become the default for the project. Ref: https://cloud.google.com/sdk/gcloud/reference/config/set So I believe correct answer is B as per https://cloud.google.com/compute/docs/regions-zones/changing-default-zone-region#console In the Cloud Console, go to the Settings page. From the Zone drop-down menu, select a default zone.

    4. J

       JH86

       2021-12-14

       2 upvotes

       The answer SHOULD BE B. i have looked at this questions multiple times and has initially selected A due to the high upvote and the google doc links provided. A - you can perform a gcloud command to set a default zone but the catch is here - the answer has indicated gcloud config instead of GCLOUD COMPUTE. the command that allows you to set default region and zone is GCLOUD COMPUTE. https://cloud.google.com/compute/docs/gcloud-compute B - the google doc provides 2 methods to changing default region/zone. One is using the gcloud command (gcloud compute) OR using the console method, by changing the settings in the cloud console. https://cloud.google.com/compute/docs/regions-zones/changing-default-zone-region#console

17. Question 17 of 25

    Your team maintains the infrastructure for your organization. The current infrastructure requires changes. You need to share your proposed changes with the rest of the team. You want to follow Google's recommended best practices. What should you do?

    • AUse Deployment Manager templates to describe the proposed changes and store them in a Cloud Storage bucket.
    • BUse Deployment Manager templates to describe the proposed changes and store them in Cloud Source Repositories.
    • CApply the changes in a development environment, run gcloud compute instances list, and then save the output in a shared Storage bucket.
    • DApply the changes in a development environment, run gcloud compute instances list, and then save the output in Cloud Source Repositories.

    Show answer

    Correct answer: B

    How others answered

    • B60%
    • A40%

    Only 60% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Correct Answer is (A): Connecting to Cloud Storage buckets Cloud Storage is a flexible, scalable, and durable storage option for your virtual machine instances. You can read and write files to Cloud Storage buckets from almost anywhere, so you can use buckets as common storage between your instances, App Engine, your on-premises systems, and other cloud services. https://cloud.google.com/compute/docs/disks/gcs-buckets Why not (B)? Caution Cloud Source Repositories are intended to store only the source code for your app and not user or personal data. Don't store any Core App Engine Customer Data (as defined in your License Agreement) in Cloud Source Repositories. https://cloud.google.com/source-repositories/docs/features

    Adapted from community discussion by ESP_SAP · 2020-08-22 · 33 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. E

       ESP_SAP

       2020-08-22

       33 upvotes

       Correct Answer is (A): Connecting to Cloud Storage buckets Cloud Storage is a flexible, scalable, and durable storage option for your virtual machine instances. You can read and write files to Cloud Storage buckets from almost anywhere, so you can use buckets as common storage between your instances, App Engine, your on-premises systems, and other cloud services. https://cloud.google.com/compute/docs/disks/gcs-buckets Why not (B)? Caution Cloud Source Repositories are intended to store only the source code for your app and not user or personal data. Don't store any Core App Engine Customer Data (as defined in your License Agreement) in Cloud Source Repositories. https://cloud.google.com/source-repositories/docs/features

    2. S

       SSPC

       2020-08-13

       31 upvotes

       B is correct. https://cloud.google.com/source-repositories/docs/features

    3. E

       ESP_SAP

       2022-09-11

       26 upvotes

       Correction. 2 years later. Correct Answer is (B): Using Recommendations for Infrastructure as Code: This tutorial uses Hashicorp Terraform as the IaC tool, however the architectural patterns and components used in the described automation pipeline can be leveraged even if you are using a different IaC management tool such as Deployment Manager. Cloud Build Purpose: Google Cloud Build automates the deployment of infrastructure based on the changes made to the IaC manifests per policy intelligence recommendations. Access control: The Cloud Build service account must have the right set of permissions to interact with resources in your test project. See the documentation for configuring a Cloud Build service account. GitHub Purpose: The IaC repository uses GitHub for source control. The IaC repository in GitHub is integrated with Cloud Build. When commits are made to the master branch, a Cloud Build job is triggered to run a set of preconfigured tasks. https://cloud.google.com/recommender/docs/tutorial-iac#overview

    4. S

       stepkurniawan

       2020-08-26

       13 upvotes

       you store the sensitive data NOT in the instance template, that is the current best practice. But you need version control like GIT or Google's GIT (Cloud Source Repo) to backup your code somehow and able to roll back if needed.

18. Question 18 of 25

    You have an application that uses Cloud Spanner as a database backend to keep current state information about users. Cloud Bigtable logs all events triggered by users. You export Cloud Spanner data to Cloud Storage during daily backups. One of your analysts asks you to join data from Cloud Spanner and Cloud Bigtable for specific users. You want to complete this ad hoc request as efficiently as possible. What should you do?

    • ACreate a dataflow job that copies data from Cloud Bigtable and Cloud Storage for specific users.
    • BCreate a dataflow job that copies data from Cloud Bigtable and Cloud Spanner for specific users.
    • CCreate a Cloud Dataproc cluster that runs a Spark job to extract data from Cloud Bigtable and Cloud Storage for specific users.
    • DCreate two separate BigQuery external tables on Cloud Storage and Cloud Bigtable. Use the BigQuery console to join these tables through user fields, and apply appropriate filters.

    Show answer

    Correct answer: D

    How others answered

    • D67%
    • B33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Correct Answer is (D): Introduction to external data sources This page provides an overview of querying data stored outside of BigQuery. https://cloud.google.com/bigquery/external-data-sources

    Adapted from community discussion by ESP_SAP · 2020-08-22 · 29 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. A

       AmitKM

       2020-08-20

       38 upvotes

       I think it should be D. https://cloud.google.com/bigquery/external-data-sources

    2. E

       ESP_SAP

       2020-08-22

       29 upvotes

       Correct Answer is (D): Introduction to external data sources This page provides an overview of querying data stored outside of BigQuery. https://cloud.google.com/bigquery/external-data-sources

    3. R

       ryzior

       2022-03-07

       6 upvotes

       update: BigQuery supports the following external data sources: Bigtable Cloud Spanner Cloud SQL Cloud Storage Drive

    4. E

       ESP_SAP

       2020-08-22

       6 upvotes

       BigQuery offers support for querying data directly from: Bigtable Cloud Storage Google Drive Cloud SQL (beta)

19. Question 19 of 25

    Your company has embraced a hybrid cloud strategy where some of the applications are deployed on Google Cloud. A Virtual Private Network (VPN) tunnel connects your Virtual Private Cloud (VPC) in Google Cloud with your company's on-premises network. Multiple applications in Google Cloud need to connect to an on-premises database server, and you want to avoid having to change the IP configuration in all of your applications when the IP of the database changes. What should you do?

    • AConfigure Cloud NAT for all subnets of your VPC to be used when egressing from the VM instances.
    • BCreate a private zone on Cloud DNS, and configure the applications with the DNS name.
    • CConfigure the IP of the database as custom metadata for each instance, and query the metadata server.
    • DQuery the Compute Engine internal DNS from the applications to retrieve the IP of the database.

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    B, Forwarding zones Cloud DNS forwarding zones let you configure target name servers for specific private zones. Using a forwarding zone is one way to implement outbound DNS forwarding from your VPC network. A Cloud DNS forwarding zone is a special type of Cloud DNS private zone. Instead of creating records within the zone, you specify a set of forwarding targets. Each forwarding target is an IP address of a DNS server, located in your VPC network, or in an on-premises network connected to your VPC network by Cloud VPN or Cloud Interconnect. A does not apply, that is to provide internet access to resources C, does not apply D, I don't get it so B

    Adapted from community discussion by kopper2019 · 2022-04-17 · 34 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. K

       kopper2019

       2022-04-17

       34 upvotes

       B, Forwarding zones Cloud DNS forwarding zones let you configure target name servers for specific private zones. Using a forwarding zone is one way to implement outbound DNS forwarding from your VPC network. A Cloud DNS forwarding zone is a special type of Cloud DNS private zone. Instead of creating records within the zone, you specify a set of forwarding targets. Each forwarding target is an IP address of a DNS server, located in your VPC network, or in an on-premises network connected to your VPC network by Cloud VPN or Cloud Interconnect. A does not apply, that is to provide internet access to resources C, does not apply D, I don't get it so B

    2. P

       pondai

       2022-03-26

       9 upvotes

       https://cloud.google.com/dns/docs/best-practices#best_practices_for_dns_forwarding_zones_and_server_policies Cloud DNS offers DNS forwarding zones and DNS server policies to allow lookups of DNS names between your on-premises and Google Cloud environment. You have multiple options for configuring DNS forwarding. The following section lists best practices for hybrid DNS setup. These best practices are illustrated in the Reference architectures for hybrid DNS. So I think B is correct

    3. T

       TAvenger

       2022-03-15

       6 upvotes

       I've rechecked google documentation, https://cloud.google.com/nat/docs/overview NAT lets Google Cloud virtual machine (VM) instances without external IP addresses and private Google Kubernetes Engine (GKE) clusters send outbound packets to the internet and receive any corresponding established inbound response packets. There is nothing about hybrid connections or VPNs etc... In our case it is clearly mentioned that we have hybrid, VPN, VPC ... and the only thing we need is not to be dependent on IP change. From google documentation private zone on Cloud DNS ("B") will help us to solve this issue https://cloud.google.com/dns/docs/best-practices

    4. S

       scanner2

       2024-09-06

       Selected B3 upvotes

       DNS is a hierarchical distributed database that lets you store IP addresses and other data and look them up by name. Cloud DNS lets you publish your zones and records in DNS without the burden of managing your own DNS servers and software. Cloud DNS offers both public zones and private managed DNS zones. A public zone is visible to the public internet, while a private zone is visible only from one or more Virtual Private Cloud (VPC) networks that you specify. https://cloud.google.com/dns/docs/overview

20. Question 20 of 25

    You have developed a containerized web application that will serve internal colleagues during business hours. You want to ensure that no costs are incurred outside of the hours the application is used. You have just created a new Google Cloud project and want to deploy the application. What should you do?

    • ADeploy the container on Cloud Run for Anthos, and set the minimum number of instances to zero.
    • BDeploy the container on Cloud Run (fully managed), and set the minimum number of instances to zero.
    • CDeploy the container on App Engine flexible environment with autoscaling, and set the value min_instances to zero in the app.yaml.
    • DDeploy the container on App Engine flexible environment with manual scaling, and set the value instances to zero in the app.yaml.

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    I think that is B the correct answer, because Cloud Run can scale to 0: https://cloud.google.com/run/docs/about-instance-autoscaling And App Engine Flexible can't scale to 0, the minimum instance number is 1: https://cloud.google.com/appengine/docs/the-appengine-environments#comparing_high-level_features

    Adapted from community discussion by crysk · 2021-03-11 · 39 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. C

       crysk

       2021-03-11

       39 upvotes

       I think that is B the correct answer, because Cloud Run can scale to 0: https://cloud.google.com/run/docs/about-instance-autoscaling And App Engine Flexible can't scale to 0, the minimum instance number is 1: https://cloud.google.com/appengine/docs/the-appengine-environments#comparing_high-level_features

    2. P

       pca2b

       2021-03-28

       16 upvotes

       B: not A because Anthos is an add-on to GKE clusters, 'new project' means we dont have a GKE cluster to work with https://cloud.google.com/kuberun/docs/architecture-overview#components_in_the_default_installation

    3. N

       N_A

       2023-05-10

       Selected B4 upvotes

       C. and D. are wrong answers as only the App Engine standard environment scales down to zero. Answer A. will incur extra cost as Cloud Run for Anthos runs on Kubernetes, so need to have a k8s cluster available. B. Is correct, as "Cloud Run automatically scales up or down from zero to N depending on traffic, leveraging container image streaming for a fast startup time." from https://cloud.google.com/run

    4. J

       JelloMan

       2022-05-11

       Selected B4 upvotes

       along with the reason that most have stated (only Cloud Run can scale down to 0 instances) another reason is that Cloud Run is pay-per-use. App-engine flexible is paid based on usage of vCPU, memory, and persistent disks, so you will be racking up cost quickly just because your VM's are created (regardless if they're running or not)

21. Question 21 of 25

    Your company developed a mobile game that is deployed on Google Cloud. Gamers are connecting to the game with their personal phones over the Internet. The game sends UDP packets to update the servers about the gamers' actions while they are playing in multiplayer mode. Your game backend can scale over multiple virtual machines (VMs), and you want to expose the VMs over a single IP address. What should you do?

    • AConfigure an SSL Proxy load balancer in front of the application servers.
    • BConfigure an Internal UDP load balancer in front of the application servers.
    • CConfigure an External HTTP(s) load balancer in front of the application servers.
    • DConfigure an External Network load balancer in front of the application servers.

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Answer is D, cell phones are sending UDP packets and the only that can receive that type of traffic is a External Network TCP/UDP https://cloud.google.com/load-balancing/docs/network

    Adapted from community discussion by kopper2019 · 2021-10-17 · 32 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. K

       kopper2019

       2021-10-17

       32 upvotes

       Answer is D, cell phones are sending UDP packets and the only that can receive that type of traffic is a External Network TCP/UDP https://cloud.google.com/load-balancing/docs/network

    2. J

       JH86

       2021-12-11

       14 upvotes

       Answer is D. there are so many confusion here, from B,C or D. For myself im eliminating all options except B,D due to the traffic type. which leaves me with B or D. Then next the traffic source either external or internal which in this case is an external traffic from the internet, therefore my final answer is D. https://cloud.google.com/load-balancing/docs/choosing-load-balancer

    3. T

       TAvenger

       2021-09-15

       6 upvotes

       Read some theory! Or try to google! Here is the link https://cloud.google.com/load-balancing/docs/choosing-load-balancer UDP traffic is possible with 2 options: - External Network TCP/UDP Load balancing - Internal TCP/UDP Load balancing For LoadBalancer to be available outside of GCP we will need External Network TCP/UDP LoadBalancer. "D" is correct answer!

    4. C

       Cynthia2023

       2024-07-01

       Selected D4 upvotes

       1. UDP Traffic Support: • An external Network Load Balancer in Google Cloud supports both TCP and UDP traffic. Since your game uses UDP packets for multiplayer interactions, the Network Load Balancer is appropriate for handling this type of traffic. 2. Single IP for Multiple VMs: • Network Load Balancers allow you to use a single, anycast IP address that can distribute incoming traffic across multiple VMs in your backend. This aligns with your requirement to expose the backend servers through a single IP address.

22. Question 22 of 25

    Your auditor wants to view your organization's use of data in Google Cloud. The auditor is most interested in auditing who accessed data in Cloud Storage buckets. You need to help the auditor access the data they need. What should you do?

    • ATurn on Data Access Logs for the buckets they want to audit, and then build a query in the log viewer that filters on Cloud Storage.
    • BAssign the appropriate permissions, and then create a Data Studio report on Admin Activity Audit Logs.
    • CAssign the appropriate permissions, and then use Cloud Monitoring to review metrics.
    • DUse the export logs API to provide the Admin Activity Audit Logs in the format they want.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    It should be A. Data access log are not enabled by default due to the fact that it incurs costs. So you need to enable it first. And then you can filter it in the log viewer

    Adapted from community discussion by iri_gcp · 2021-03-14 · 41 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. I

       iri_gcp

       2021-03-14

       41 upvotes

       It should be A. Data access log are not enabled by default due to the fact that it incurs costs. So you need to enable it first. And then you can filter it in the log viewer

    2. G

       GCP_Student1

       2021-03-14

       11 upvotes

       A. Turn on Data Access Logs for the buckets they want to audit, and then build a query in the log viewer that filters on Cloud Storage.

    3. J

       Jman007

       2022-06-21

       Selected A6 upvotes

       question says auditor is most interested in who accessED data in Cloud Storage. im not sure how auditoring is done for those who answered A but this means they want the logs for past users who accessed the data from a sepecified time. Turning on the feature now is kind of too late. poorly written question and answers. No point in an auditor coming in and giving the company all the exact questions they are going to ask and come back and ask them in a few months time. A seems like the better choices though

    4. E

       ericyev

       2021-12-07

       4 upvotes

       I choose D. reason is here: Cloud Audit Logs generates the following audit logs for operations in Cloud Storage: Admin Activity logs: Entries for operations that modify the configuration or metadata of a project, bucket, or object. Data Access logs: Entries for operations that modify objects or read a project, bucket, or object. There are several sub-types of data access logs: ADMIN_READ: Entries for operations that read the configuration or metadata of a project, bucket, or object. DATA_READ: Entries for operations that read an object. DATA_WRITE: Entries for operations that create or modify an object.

23. Question 23 of 25

    You are working with a Cloud SQL MySQL database at your company. You need to retain a month-end copy of the database for three years for audit purposes. What should you do?

    • ASet up an export job for the first of the month. Write the export file to an Archive class Cloud Storage bucket.
    • BSave the automatic first-of-the-month backup for three years. Store the backup file in an Archive class Cloud Storage bucket.
    • CSet up an on-demand backup for the first of the month. Write the backup to an Archive class Cloud Storage bucket.
    • DConvert the automatic first-of-the-month backup to an export file. Write the export file to a Coldline class Cloud Storage bucket.

    Show answer

    Correct answer: A

    How others answered

    • A100%

    Explanation

    https://cloud.google.com/sql/docs/mysql/backup-recovery/backups not B: Automatic backups are made EVERY SINGLE DAY. You can set only the number of backups up to 365. Also you cannot choose your Archival storage as destination not C: You cannot setup "on-demand" backup. User would have to make backups manually every month. Also you cannot choose your Archival storage as destination not D: You cannot conver backup to export file. Also Coldline class is less cost-effective than Archival class. The only option left is "A" You can set up your job with any date/time schedule. You can export file to any storage with any storage class.

    Adapted from community discussion by TAvenger · 2021-09-14 · 53 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. T

       TAvenger

       2021-09-14

       53 upvotes

       https://cloud.google.com/sql/docs/mysql/backup-recovery/backups not B: Automatic backups are made EVERY SINGLE DAY. You can set only the number of backups up to 365. Also you cannot choose your Archival storage as destination not C: You cannot setup "on-demand" backup. User would have to make backups manually every month. Also you cannot choose your Archival storage as destination not D: You cannot conver backup to export file. Also Coldline class is less cost-effective than Archival class. The only option left is "A" You can set up your job with any date/time schedule. You can export file to any storage with any storage class.

    2. J

       JieHeng

       2021-12-27

       16 upvotes

       First need to understand backup vs export, two different concepts. - https://cloud.google.com/sql/docs/mysql/backup-recovery/backups A – yes, you can export data from Cloud SQL to Cloud Storage- https://cloud.google.com/sql/docs/mysql/import-export/exporting#cloud-sql Not B, C, D – be it automatic or on-demand backup, according to the doc “No, you can't export a backup. You can only export instance data.”

    3. P

       patashish

       2023-01-13

       4 upvotes

       Correct Ans - C On demand backup You can create a backup at any time (Here we need backup a month-end copy of the database for three years). You can create on-demand backups for any instance, whether the instance has automatic backups enabled or not. Reason : 1) you can't export a backup. You can only export instance data so export option A is out from answer. Backups encompass the entire database. Exports can select specific contents. As per question You need to retain a month-end copy of the database not specific contents. 2) Automated backups are taken daily, within a 4-hour backup window. Up to seven most recent backups are retained, by default. *Cost** to store all backups .. 3) Option D not applicable **Coldline class** *Cost*

    4. D

       djgodzilla

       2021-12-14

       6 upvotes

       from the same link : Can I export a backup? No, you can't export a backup. You can only export instance data. See Exporting data from Cloud SQL to a dump in Cloud storage.

24. Question 24 of 25

    You need to configure optimal data storage for files stored in Cloud Storage for minimal cost. The files are used in a mission-critical analytics pipeline that is used continually. The users are in Boston, MA (United States). What should you do?

    • AConfigure regional storage for the region closest to the users. Configure a Nearline storage class.
    • BConfigure regional storage for the region closest to the users. Configure a Standard storage class.
    • CConfigure dual-regional storage for the dual region closest to the users. Configure a Nearline storage class.
    • DConfigure dual-regional storage for the dual region closest to the users. Configure a Standard storage class.

    Show answer

    Correct answer: B

    How others answered

    • B59%
    • D41%

    Only 59% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Continuous access to data means Standard since all of the other options are for infrequently accessed storage (Nearline, Coldline, Archive). Since no other regions are mentioned, single region is best in this case

    Adapted from community discussion by JelloMan · 2022-05-02 · 24 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. J

       JelloMan

       2022-05-02

       Selected B24 upvotes

       Continuous access to data means Standard since all of the other options are for infrequently accessed storage (Nearline, Coldline, Archive). Since no other regions are mentioned, single region is best in this case

    2. J

       Jelly_Wang

       2023-05-12

       Selected B5 upvotes

       Answer is B. If you go with D, you must be a newbie trying to pass the exam and then hopefully get some practice with your next employer. Regional storage doesn't mean no automated failover and failback. It does have automated failover and failback on zonal failure, which is more than enough to cover a single city (Boston). Plus, I work for a provincial government who do business in a single province. We use regional storage. Man if you work for a company that run business in a single city and you go with multi regional storage, finger cross for yourself.

    3. T

       thanab

       2023-11-03

       Selected B3 upvotes

       The correct answer is B. Configure regional storage for the region closest to the users. Configure a Standard storage class. The files are used in a mission-critical analytics pipeline that is used continually. This means that the files need to be available quickly and reliably. Regional storage is the best option for this because it ensures that the files are stored in the same region as the users. This will minimize latency and ensure that the files are available quickly. The Standard storage class is the best option for this because it provides a good balance between cost and performance. Nearline storage is a lower-cost option, but it is also slower. Standard storage is a good option for files that are used frequently, but not constantly. The other options are not as good for this scenario. Dual-regional storage is more expensive than regional storage, and it does not provide any performance benefits. Coldline storage is the lowest-cost option, but it is also the slowest.

    4. A

       Aninina

       2022-10-30

       6 upvotes

       Dual region is expensive than multi-region. (Also mentioned in the documentation: https://cloud.google.com/storage/docs/locations) When we set objects to be multi-regional, we get to decide/shuffle the data around at will to meet our storage needs. When you take that control away from us, it reduces the flexibility of our systems, making it more expensive to operate.

25. Question 25 of 25

    Your organization has three existing Google Cloud projects. You need to bill the Marketing department for only their Google Cloud services for a new initiative within their group. What should you do?

    • A1. Verify that you are assigned the Billing Administrator IAM role for your organization's Google Cloud Project for the Marketing department. 2. Link the new project to a Marketing Billing Account.
    • B1. Verify that you are assigned the Billing Administrator IAM role for your organization's Google Cloud account. 2. Create a new Google Cloud Project for the Marketing department. 3. Set the default key-value project labels to department:marketing for all services in this project.
    • C1. Verify that you are assigned the Organization Administrator IAM role for your organization's Google Cloud account. 2. Create a new Google Cloud Project for the Marketing department. 3. Link the new project to a Marketing Billing Account.
    • D1. Verify that you are assigned the Organization Administrator IAM role for your organization's Google Cloud account. 2. Create a new Google Cloud Project for the Marketing department. 3. Set the default key-value project labels to department:marketing for all services in this project.

    Show answer

    Correct answer: A

    How others answered

    • A54%
    • C29%
    • B17%

    Only 54% agreed on this answer — treat it as contested rather than settled.

    Explanation

    I understand that the question implies the creation of a new project, however neither of the roles listed have that functionality. If you chose B you are choosing an answer that has a direct contradiction because the Billing Account Admin does not have the permissions to create a new project. Thus, I think it is better to assume the new initiative/project is already created or being created by someone else and your job is simply to link the project to the account which you do have the appropriate permissions to perform. A is my choice.

    Adapted from community discussion by gcpreviewer · 2022-09-27 · 21 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by ACE or CertExamHQ.

    1. G

       gcpreviewer

       2022-09-27

       Selected A21 upvotes

       I understand that the question implies the creation of a new project, however neither of the roles listed have that functionality. If you chose B you are choosing an answer that has a direct contradiction because the Billing Account Admin does not have the permissions to create a new project. Thus, I think it is better to assume the new initiative/project is already created or being created by someone else and your job is simply to link the project to the account which you do have the appropriate permissions to perform. A is my choice.

    2. S

       sukouto

       2024-02-01

       5 upvotes

       Worth noting that an Organization Administrator doesn't have permissions to deal with billing, so I think C/D are no good: https://cloud.google.com/iam/docs/understanding-roles#resourcemanager.organizationAdmin

    3. A

       arj4c3

       2022-09-24

       Selected A1 upvote

       Option A seems the only valid answer as Billing Admin can link a new project to a billing acc B & D assumes you have the resourcemanager.projects.create permission to create a new project. According to https://cloud.google.com/resource-manager/docs/creating-managing-labels#permissions resourcemanager.projects.update permission is needed to edit the labels neither Billing Adminstrator nor Organization Adminstrator has resourcemanager.projects.update permission to edit the labels they only can see the labels of a project as both have only resourcemanager.projects.get permission so Options B & D are both wrong C is wrong because neither does Organizational admin have resourcemanager.projects.create permission to create a project nor does it have permission to link a project to a billing account - > https://cloud.google.com/iam/docs/understanding-roles#resourcemanager.organizationAdmin so my final answer is A

    4. N

       Nazz1977

       2023-01-27

       Selected A4 upvotes

       "Your organization has three existing Google Cloud projects". Don´t need to create anything.... I go to A

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ACE practice, question 1 of 25