ACE practice questions 151–160

1. Question 151 · 325 in bank

   You used the gcloud container clusters command to create two Google Cloud Kubernetes (GKE) clusters: prod-cluster and dev-cluster. • prod-cluster is a standard cluster. • dev-cluster is an auto-pilot cluster. When you run the kubectl get nodes command, you only see the nodes from prod-cluster. Which commands should you run to check the node status for dev-cluster?

   • Agcloud container clusters get-credentials dev-cluster kubectl get nodes
   • Bgcloud container clusters update -generate-password dev-cluster kubectl get nodes
   • Ckubectl config set-context dev-cluster kubectl cluster-info
   • Dkubectl config set-credentials dev-cluster kubectl cluster-info

   Show answer

   Answer: A

   Explanation

   gcloud container clusters get-credentials updates a kubeconfig file with appropriate credentials and endpoint information to point kubectl at a specific cluster in Google Kubernetes Engine

   Source: Adapted from community discussion — pritampanda1988

   References

   • Google Cloud documentation

   Next question

2. Question 152 · 325 in bank

   You recently discovered that your developers are using many service account keys during their development process. While you work on a long term improvement, you need to quickly implement a process to enforce short-lived service account credentials in your company. You have the following requirements: • All service accounts that require a key should be created in a centralized project called pj-sa. • Service account keys should only be valid for one day. You need a Google-recommended solution that minimizes cost. What should you do?

   • AImplement a Cloud Run job to rotate all service account keys periodically in pj-sa. Enforce an org policy to deny service account key creation with an exception to pj-sa.
   • BImplement a Kubernetes CronJob to rotate all service account keys periodically. Disable attachment of service accounts to resources in all projects with an exception to pj-sa.
   • CEnforce an org policy constraint allowing the lifetime of service account keys to be 24 hours. Enforce an org policy constraint denying service account key creation with an exception on pj-sa.
   • DEnforce a DENY org policy constraint over the lifetime of service account keys for 24 hours. Disable attachment of service accounts to resources in all projects with an exception to pj-sa.

   Show answer

   Answer: C

   Explanation

   You can use an org policy to enforce a 24-hour lifetime for service account keys. You can use an org policy to deny service account key creation, with an exception for the pj-sa project. This is a Google-recommended solution and it is relatively inexpensive.

   Source: Adapted from community discussion — qannik

   References

   • Google Cloud documentation

   Next question

3. Question 153 · 325 in bank

   Your company is running a three-tier web application on virtual machines that use a MySQL database. You need to create an estimated total cost of cloud infrastructure to run this application on Google Cloud instances and Cloud SQL. What should you do?

   • ACreate a Google spreadsheet with multiple Google Cloud resource combinations. On a separate sheet, import the current Google Cloud prices and use these prices for the calculations within formulas.
   • BUse the Google Cloud Pricing Calculator and select the Cloud Operations template to define your web application with as much detail as possible.
   • CImplement a similar architecture on Google Cloud, and run a reasonable load test on a smaller scale. Check the billing information, and calculate the estimated costs based on the real load your system usually handles.
   • DUse the Google Cloud Pricing Calculator to determine the cost of every Google Cloud resource you expect to use. Use similar size instances for the web server, and use your current on-premises machines as a comparison for Cloud SQL.

   Show answer

   Answer: D

   Explanation

   Google Cloud Pricing Calculator, is the recommended approach for creating an estimated total cost of cloud infrastructure. By selecting the relevant Google Cloud resources (such as instances for web servers and Cloud SQL for the database), and specifying similar sizes and configurations, you can obtain a more accurate estimation of the costs.

   Source: Adapted from community discussion — qannik

   Next question

4. Question 154 · 325 in bank

   You have a Bigtable instance that consists of three nodes that store personally identifiable information (PII) data. You need to log all read or write operations, including any metadata or configuration reads of this database table, in your company’s Security Information and Event Management (SIEM) system. What should you do?

   • A• Navigate to Cloud Monitoring in the Google Cloud console, and create a custom monitoring job for the Bigtable instance to track all changes. • Create an alert by using webhook endpoints, with the SIEM endpoint as a receiver.
   • B• Navigate to the Audit Logs page in the Google Cloud console, and enable Admin Write logs for the Bigtable instance. • Create a Cloud Functions instance to export logs from Cloud Logging to your SIEM.
   • C• Navigate to the Audit Logs page in the Google Cloud console, and enable Data Read, Data Write and Admin Read logs for the Bigtable instance. • Create a Pub/Sub topic as a Cloud Logging sink destination, and add your SIEM as a subscriber to the topic.
   • D• Install the Ops Agent on the Bigtable instance during configuration. • Create a service account with read permissions for the Bigtable instance. • Create a custom Dataflow job with this service account to export logs to the company’s SIEM system.

   Show answer

   Answer: C

   Explanation

   Option C is the most appropriate choice for capturing audit and data access logs from a Bigtable instance and sending them to your SIEM system. 1) Enabling Data Read, Data Write, and Admin Read logs for the Bigtable instance ensures that you capture the relevant operations, including read and write operations, as well as administrative reads, in the audit logs. 2) Creating a Pub/Sub topic as a Cloud Logging sink destination allows you to export the logs from Cloud Logging to Pub/Sub. This is a common approach for sending logs to external systems, including SIEMs. 3) Adding your SIEM as a subscriber to the Pub/Sub topic ensures that the logs are forwarded to your SIEM system, allowing you to monitor and analyze them for security and compliance purposes. NB:A Cloud Logging sink destination is a configuration that specifies where logs collected by Google Cloud's Cloud Logging service should be sent or exported. It allows you to control the destination of logs generated by various Google Cloud services, such as Compute Engine, Cloud Storage, BigQuery, and more.

   Source: Adapted from community discussion — taylz876

   References

   • Google Cloud documentation

   Next question

5. Question 155 · 325 in bank

   You want to set up a Google Kubernetes Engine cluster. Verifiable node identity and integrity are required for the cluster, and nodes cannot be accessed from the internet. You want to reduce the operational cost of managing your cluster, and you want to follow Google-recommended practices. What should you do?

   • ADeploy a private autopilot cluster.
   • BDeploy a public autopilot cluster.
   • CDeploy a standard public cluster and enable shielded nodes.
   • DDeploy a standard private cluster and enable shielded nodes.

   Show answer

   Answer: A

   Explanation

   In a private cluster, nodes only have internal IP addresses, which means that nodes and Pods are isolated from the internet by default. https://cloud.google.com/kubernetes-engine/docs/how-to/private-clusters Shielded GKE Nodes provide strong, verifiable node identity and integrity to increase the security of Google Kubernetes Engine (GKE) nodes. Note: For GKE Autopilot clusters, the Shielded GKE Nodes feature is enabled by default and cannot be overridden. https://cloud.google.com/kubernetes-engine/docs/how-to/shielded-gke-nodes

   Source: Adapted from community discussion — scanner2

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 156 · 325 in bank

   Your company wants to migrate their on-premises workloads to Google Cloud. The current on-premises workloads consist of: • A Flask web application • A backend API • A scheduled long-running background job for ETL and reporting You need to keep operational costs low. You want to follow Google-recommended practices to migrate these workloads to serverless solutions on Google Cloud. What should you do?

   • AMigrate the web application to App Engine and the backend API to Cloud Run. Use Cloud Tasks to run your background job on Compute Engine.
   • BMigrate the web application to App Engine and the backend API to Cloud Run. Use Cloud Tasks to run your background job on Cloud Run.
   • CRun the web application on a Cloud Storage bucket and the backend API on Cloud Run. Use Cloud Tasks to run your background job on Cloud Run.
   • DRun the web application on a Cloud Storage bucket and the backend API on Cloud Run. Use Cloud Tasks to run your background job on Compute Engine.

   Show answer

   Answer: B

   Explanation

   it's asking for a serverless solution so A and D are automatically out due to the inclusion of Compute Engine (server-based solution). you would use App engine to run a web app, not cloud storage. That's why it's B

   Source: Adapted from community discussion — interesting_owl

   References

   • Google Cloud documentation

   Next question

7. Question 157 · 325 in bank

   Your company is moving its continuous integration and delivery (CI/CD) pipeline to Compute Engine instances. The pipeline will manage the entire cloud infrastructure through code. How can you ensure that the pipeline has appropriate permissions while your system is following security best practices?

   • A• Attach a single service account to the compute instances. • Add minimal rights to the service account. • Allow the service account to impersonate a Cloud Identity user with elevated permissions to create, update, or delete resources.
   • B• Add a step for human approval to the CI/CD pipeline before the execution of the infrastructure provisioning. • Use the human approvals IAM account for the provisioning.
   • C• Attach a single service account to the compute instances. • Add all required Identity and Access Management (IAM) permissions to this service account to create, update, or delete resources.
   • D• Create multiple service accounts, one for each pipeline with the appropriate minimal Identity and Access Management (IAM) permissions. • Use a secret manager service to store the key files of the service accounts. • Allow the CI/CD pipeline to request the appropriate secrets during the execution of the pipeline.

   Show answer

   Answer: D

   Explanation

   Principle of Least Privilege: Creating separate service accounts for different aspects of your CI/CD pipeline allows you to adhere to the principle of least privilege. This means each service account is granted only the permissions necessary for its specific role in the pipeline. Security and Organization: Using multiple service accounts makes it easier to manage permissions, track activities, and audit usage for specific tasks or components of your CI/CD process. Secret Management: Storing the service account key files in a secret manager service (like Google Cloud Secret Manager) enhances security. This approach securely manages and accesses these keys, reducing the risk of unauthorized access or exposure. Dynamic Access: Allowing the CI/CD pipeline to request the appropriate secrets during execution ensures that credentials are provided only when needed and aren't unnecessarily exposed or stored in less secure environments.

   Source: Adapted from community discussion — Cynthia2023

   Next question

8. Question 158 · 325 in bank

   Your application stores files on Cloud Storage by using the Standard Storage class. The application only requires access to files created in the last 30 days. You want to automatically save costs on files that are no longer accessed by the application. What should you do?

   • ACreate an object lifecycle on the storage bucket to change the storage class to Archive Storage for objects with an age over 30 days.
   • BCreate a cron job in Cloud Scheduler to call a Cloud Functions instance every day to delete files older than 30 days.
   • CCreate a retention policy on the storage bucket of 30 days, and lock the bucket by using a retention policy lock.
   • DEnable object versioning on the storage bucket and add lifecycle rules to expire non-current versions after 30 days.

   Show answer

   Answer: A

   Explanation

   Cloud Storage lifecycle management, you can automatically transition objects between storage classes based on certain conditions, such as age. Since your application only requires access to files created in the last 30 days, you can set a lifecycle rule to move files that are older than 30 days to Archive Storage, which offers the lowest storage costs but is designed for infrequent access.

   Source: Adapted from community discussion — master9

   Next question

9. Question 159 · 325 in bank

   Your manager asks you to deploy a workload to a Kubernetes cluster. You are not sure of the workload's resource requirements or how the requirements might vary depending on usage patterns, external dependencies, or other factors. You need a solution that makes cost-effective recommendations regarding CPU and memory requirements, and allows the workload to function consistently in any situation. You want to follow Google-recommended practices. What should you do?

   • AConfigure the Horizontal Pod Autoscaler for availability, and configure the cluster autoscaler for suggestions.
   • BConfigure the Horizontal Pod Autoscaler for availability, and configure the Vertical Pod Autoscaler recommendations for suggestions.
   • CConfigure the Vertical Pod Autoscaler recommendations for availability, and configure the Cluster autoscaler for suggestions.
   • DConfigure the Vertical Pod Autoscaler recommendations for availability, and configure the Horizontal Pod Autoscaler for suggestions.

   Show answer

   Answer: B

   Explanation

   Horizontal Pod Autoscaler (HPA): It automatically scales the number of pods in a deployment, replica set, or stateful set based on observed CPU utilization (or, with custom metrics support, on some other application-provided metrics). This helps maintain availability by ensuring that your application has the necessary number of pods to handle the workload. Vertical Pod Autoscaler (VPA): It automatically adjusts the CPU and memory reservations for your pods to help "right size" your applications. This is particularly useful when you're unsure of the resource requirements. VPA makes recommendations for the appropriate CPU and memory settings based on usage patterns, which can be very effective for cost optimization. This combination ensures that your workload is both horizontally scalable (to handle changes in demand) and vertically optimized (to use resources efficiently), following Google-recommended practices for Kubernetes workloads.

   Source: Adapted from community discussion — Urbanvzla

   Next question

10. Question 160 · 325 in bank

    You need to configure IAM access audit logging in BigQuery for external auditors. You want to follow Google-recommended practices. What should you do?

    • AAdd the auditors group to the 'logging.viewer' and 'bigQuery.dataViewer' predefined IAM roles.
    • BAdd the auditors group to two new custom IAM roles.
    • CAdd the auditor user accounts to the 'logging.viewer' and 'bigQuery.dataViewer' predefined IAM roles.
    • DAdd the auditor user accounts to two new custom IAM roles.

    Show answer

    Answer: A

    Explanation

    Correct is A. As per google best practices it is recommended to use predefined roles and create groups to control access to multiple users with same responsibility

    Source: Adapted from community discussion — coldpar

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ACE practice, question 151. 325 questions available.