ACE practice questions 161–170

1. Question 161 · 325 in bank

   You need to migrate invoice documents stored on-premises to Cloud Storage. The documents have the following storage requirements: • Documents must be kept for five years. • Up to five revisions of the same invoice document must be stored, to allow for corrections. • Documents older than 365 days should be moved to lower cost storage tiers. You want to follow Google-recommended practices to minimize your operational and development costs. What should you do?

   • AEnable retention policies on the bucket, and use Cloud Scheduler to invoke a Cloud Function to move or delete your documents based on their metadata.
   • BEnable retention policies on the bucket, use lifecycle rules to change the storage classes of the objects, set the number of versions, and delete old files.
   • CEnable object versioning on the bucket, and use Cloud Scheduler to invoke a Cloud Functions instance to move or delete your documents based on their metadata.
   • DEnable object versioning on the bucket, use lifecycle conditions to change the storage class of the objects, set the number of versions, and delete old files.

   Show answer

   Answer: D

   Explanation

   - Object Versioning: Enabling object versioning on the Cloud Storage bucket allows you to store up to five revisions of the same invoice document. This satisfies the requirement for keeping multiple versions of each document for corrections. - Lifecycle Conditions: Google Cloud Storage allows you to define lifecycle conditions for objects within a bucket. These conditions can automatically change the storage class of objects when they meet certain criteria, such as age. After 365 days, you can automatically move documents to lower-cost storage classes like Nearline, Coldline, or Archive, which reduces storage costs while still retaining the data. - Version Management and Deletion: The lifecycle rules can also be configured to manage the number of object versions retained and to delete old versions or objects, ensuring compliance with the five-year retention requirement.

   Source: Adapted from community discussion — Cynthia2023

   References

   • Google Cloud documentation

   Next question

2. Question 162 · 325 in bank

   You installed the Google Cloud CLI on your workstation and set the proxy configuration. However, you are worried that your proxy credentials will be recorded in the gcloud CLI logs. You want to prevent your proxy credential from being logged. What should you do?

   • AConfigure username and password by using gcloud config set proxy/username and gcloud config set proxy/password commands.
   • BEncode username and password in sha256 encoding, and save in to a text file. Use filename as a value in the gcloud config set core/custom_ca_certs_file command.
   • CProvide values for CLOUDSDK_PROXY_USERNAME and CLOUDSDK_PROXY_PASSWORD in the gcloud CLI tool configuration file.
   • DSet the CLOUDSDK_PROXY_USERNAME and CLOUDSDK_PROXY_PASSWORD properties by using environment variables in your command line tool.

   Show answer

   Answer: D

   Explanation

   Answer is D. See Google Docs: https://cloud.google.com/sdk/docs/proxy-settings Alternatively, to avoid having the proxy credentials recorded in any logs (such as shell history or gcloud CLI logs) or in the gcloud CLI configuration file, you can set the properties using environment variables. export CLOUDSDK_PROXY_USERNAME [USERNAME] export CLOUDSDK_PROXY_PASSWORD [PASSWORD]

   Source: Adapted from community discussion — ChemaKSado

   References

   • Google Cloud documentation

   Next question

3. Question 163 · 325 in bank

   Your company developed an application to deploy on Google Kubernetes Engine. Certain parts of the application are not fault-tolerant and are allowed to have downtime. Other parts of the application are critical and must always be available. You need to configure a Google Kubernetes Engine cluster while optimizing for cost. What should you do?

   • ACreate a cluster with a single node-pool by using standard VMs. Label he fault-tolerant Deployments as spot_true.
   • BCreate a cluster with a single node-pool by using Spot VMs. Label the critical Deployments as spot_false.
   • CCreate a cluster with both a Spot VM node pool and a node pool by using standard VMs. Deploy the critical deployments on the Spot VM node pool and the fault-tolerant deployments on the node pool by using standard VMs.
   • DCreate a cluster with both a Spot VM node pool and a nods pool by using standard VMs. Deploy the critical deployments on the node pool by using standard VMs and the fault-tolerant deployments on the Spot VM node pool.

   Show answer

   Answer: D

   Explanation

   Spot VM Node Pool for Fault-Tolerant Parts: Spot VMs in GKE are cost-effective but can be preempted (terminated) by Google Cloud with little notice if their resources are needed elsewhere. They are suitable for workloads that can handle interruptions, like the fault-tolerant parts of your application. Standard VM Node Pool for Critical Parts: Standard VMs offer more reliability and are not subject to preemption like Spot VMs. Using a standard VM node pool for the critical parts of your application ensures they remain available and are not disrupted by potential preemptions.

   Source: Adapted from community discussion — Cynthia2023

   Next question

4. Question 164 · 325 in bank

   You need to deploy an application in Google Cloud using serverless technology. You want to test a new version of the application with a small percentage of production traffic. What should you do?

   • ADeploy the application to Cloud Run. Use gradual rollouts for traffic splitting.
   • BDeploy the application to Google Kubernetes Engine. Use Anthos Service Mash for traffic splitting.
   • CDeploy the application to Cloud Functions. Specify the version number in the functions name.
   • DDeploy the application to App Engine. For each new version, create a new service.

   Show answer

   Answer: A

   Explanation

   I would go for A. Here is why: Core requirements: 1. Serverless technology 2. Gradual deployment A: Cloud Run is serverless and supports gradual deployments with the help of tags and gcloud run services update-traffic. B: GKE is not considered serverless. Anthos Service Mash does support gradual deployments. C: Cloud Functions is serverless but specifying the version number in the functions name doesn't help to achieve gradual deployments. Instead using revisions or tags in combination with gcloud run services update-traffic is required. D: App Engine is serverless. For gradual deployments, you should create a new version of your service and then use gcloud app services set-traffic to split your traffic. Don't create a new service for each new version.

   Source: Adapted from community discussion — carpa_jo

   Next question

5. Question 165 · 325 in bank

   Your company's security vulnerability management policy wants a member of the security team to have visibility into vulnerabilities and other OS metadata for a specific Compute Engine instance. This Compute Engine instance hosts a critical application in your Google Cloud project. You need to implement your company's security vulnerability management policy. What should you do?

   • A• Ensure that the Ops Agent is installed on the Compute Engine instance. • Create a custom metric in the Cloud Monitoring dashboard. • Provide the security team member with access to this dashboard.
   • B• Ensure that the Ops Agent is installed on the Compute Engine instance. • Provide the security team member roles/osconfig.inventoryViewer permission.
   • C• Ensure that the OS Config agent is installed on the Compute Engine instance. • Provide the security team member roles/osconfig.vulnerabilityReportViewer permission.
   • D• Ensure that the OS Config agent is installed on the Compute Engine instance. • Create a log sink to BigQuery dataset. • Provide the security team member with access to this dataset.

   Show answer

   Answer: C

   Explanation

   Ops Agent: The Ops Agent is primarily used for collecting system and application metrics, as well as logs in Google Cloud. It is adept at monitoring the performance and health of applications and virtual machines but does not specialize in vulnerability assessment or OS-level inventory management. OS Config Agent: This agent is specifically designed for OS configuration, inventory management, and vulnerability reporting in Google Cloud. It can gather and report on system-level inventory information (like installed packages) and OS vulnerabilities.

   Source: Adapted from community discussion — Cynthia2023

   Next question

6. Question 166 · 325 in bank

   You want to enable your development team to deploy new features to an existing Cloud Run service in production. To minimize the risk associated with a new revision, you want to reduce the number of customers who might be affected by an outage without introducing any development or operational costs to your customers. You want to follow Google-recommended practices for managing revisions to a service. What should you do?

   • AAsk your customers to retry access to your service with exponential backoff to mitigate any potential problems after the new revision is deployed.
   • BGradually roll out the new revision and split customer traffic between the revisions to allow rollback in case a problem occurs.
   • CSend all customer traffic to the new revision, and roll back to a previous revision if you witness any problems in production.
   • DDeploy your application to a second Cloud Run service, and ask your customers to use the second Cloud Run service.

   Show answer

   Answer: B

   Explanation

   I would go with B. Here is why: Requirements: 1. Reduce the number of customers who might be affected by an outage (caused by a new version release) 2. Don't introduce any development or operational costs to the customers. (3. Follow Google-recommended practices) A: Might require the customer to setup exponential backoff on their end -> Requirement 2 not met. B: Fulfills all requirements. C: Does not meet requirement 1, as switching 100% traffic at once to the new version would affect all of the customers, if there would be any issue in this version. D: Does not meet requirements 1, 2 and 3, as an issue would affect all customers (once they have switched to the new service), switching to the second cloud run service causes dev/ops costs on the customer side and it doesn't follow Google-recommended practices, as a new version of an existing service should not be released as a new service.

   Source: Adapted from community discussion — carpa_jo

   Next question

7. Question 167 · 325 in bank

   You have deployed an application on a Compute Engine instance. An external consultant needs to access the Linux-based instance. The consultant is connected to your corporate network through a VPN connection, but the consultant has no Google account. What should you do?

   • AInstruct the external consultant to use the gcloud compute ssh command line tool by using Identity-Aware Proxy to access the instance.
   • BInstruct the external consultant to use the gcloud compute ssh command line tool by using the public IP address of the instance to access it.
   • CInstruct the external consultant to generate an SSH key pair, and request the public key from the consultant. Add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key.
   • DInstruct the external consultant to generate an SSH key pair, and request the private key from the consultant. Add the private key to the instance yourself, and have the consultant access the instance through SSH with their public key.

   Show answer

   Answer: C

   Explanation

   The correct answer is **C**. To allow an external consultant to access a Linux-based Compute Engine instance, you should: - Instruct the external consultant to generate an **SSH key pair**. This will result in a public key and a private key. - Request the **public key** from the consultant. The public key can be shared without compromising security. - Add the public key to the instance yourself. This will allow the consultant to authenticate with the Compute Engine instance. - Have the consultant access the instance through SSH with their **private key**. The private key should be kept secret and not shared. The other options (A, B, and D) are not correct because they either require the consultant to have a Google account, expose the instance to the public internet, or involve sharing the private key, which is a security risk.

   Source: Adapted from community discussion — JB28

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

8. Question 168 · 325 in bank

   After a recent security incident, your startup company wants better insight into what is happening in the Google Cloud environment. You need to monitor unexpected firewall changes and instance creation. Your company prefers simple solutions. What should you do?

   • ACreate a log sink to forward Cloud Audit Logs filtered for firewalls and compute instances to Cloud Storage. Use BigQuery to periodically analyze log events in the storage bucket.
   • BUse Cloud Logging filters to create log-based metrics for firewall and instance actions. Monitor the changes and set up reasonable alerts.
   • CInstall Kibana on a compute instance. Create a log sink to forward Cloud Audit Logs filtered for firewalls and compute instances to Pub/Sub. Target the Pub/Sub topic to push messages to the Kibana instance. Analyze the logs on Kibana in real time.
   • DTurn on Google Cloud firewall rules logging, and set up alerts for any insert, update, or delete events.

   Show answer

   Answer: B

   Explanation

   Per ChatGPT, Option B provides a simple and effective solution using native Google Cloud services (Cloud Logging and log-based metrics) to monitor unexpected firewall changes and instance creation, while also allowing for the setup of reasonable alerts to ensure timely response to any security incidents.

   Source: Adapted from community discussion — KelvinToo

   Next question

9. Question 169 · 325 in bank

   You are configuring service accounts for an application that spans multiple projects. Virtual machines (VMs) running in the web-applications project need access to BigQuery datasets in the crm-databases project. You want to follow Google-recommended practices to grant access to the service account in the web-applications project. What should you do?

   • AGrant "project owner" for web-applications appropriate roles to crm-databases.
   • BGrant "project owner" role to crm-databases and the web-applications project.
   • CGrant "project owner" role to crm-databases and roles/bigquery.dataViewer role to web-applications.
   • DGrant roles/bigquery.dataViewer role to crm-databases and appropriate roles to web-applications.

   Show answer

   Answer: D

   Explanation

   You're managing the service accounts, why would you grant any role to 'web-applications' project owner? The most appropiate should be D, because you are granting a wrong role to the service accounts in 'crm-databases' project, but then the option says that appropiate roles will be granted to service accounts in 'web-applications' project.

   Source: Adapted from community discussion — LautaroBarone

   Next question

10. Question 170 · 325 in bank

    Your Dataproc cluster runs in a single Virtual Private Cloud (VPC) network in a single subnetwork with range 172.16.20.128/25. There are no private IP addresses available in the subnetwork. You want to add new VMs to communicate with your cluster using the minimum number of steps. What should you do?

    • AModify the existing subnet range to 172.16.20.0/24.
    • BCreate a new Secondary IP Range in the VPC and configure the VMs to use that range.
    • CCreate a new VPC network for the VMs. Enable VPC Peering between the VMs'VPC network and the Dataproc cluster VPC network.
    • DCreate a new VPC network for the VMs with a subnet of 172.32.0.0/16. Enable VPC network Peering between the Dataproc VPC network and the VMs VPC network. Configure a custom Route exchange.

    Show answer

    Answer: A

    Explanation

    A. Same as question 129. Option A involves modifying the subnet range of the existing VPC network to increase the number of available IP addresses. By changing the subnet range to 172.16.20.0/24, you will have a larger IP address range to allocate to new VMs, allowing them to communicate with the Dataproc cluster. To expand the IP range of a Compute Engine subnetwork, you can use: gcloud compute networks subnets expand-ip-range NAME

    Source: Adapted from community discussion — apb98

    References

    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ACE practice, question 161. 325 questions available.