ACE practice questions 181–190

1. Question 181 · 325 in bank

   You are deploying an application on Google Cloud that requires a relational database for storage. To satisfy your company’s security policies, your application must connect to your database through an encrypted and authenticated connection that requires minimal management and integrates with Identity and Access Management (IAM). What should you do?

   • ADeploy a Cloud SQL database with the SSL mode set to encrypted only, configure SSL/TLS client certificates, and configure a database user and password.
   • BDeploy a Cloud SQL database with the SSL mode set to encrypted only, configure SSL/TLS client certificates, and configure IAM database authentication.
   • CDeploy a Cloud SQL database and configure IAM database authentication. Access the database through the Cloud SQL Auth Proxy.
   • DDeploy a Cloud SQL database and configure a database user and password. Access the database through the Cloud SQL Auth Proxy.

   Show answer

   Answer: C

   Explanation

   Cloud SQL Auth Proxy: This proxy ensures secure connections to your Cloud SQL database by automatically handling encryption (SSL/TLS) and IAM-based authentication. It simplifies the management of secure connections without needing to manage SSL/TLS certificates manually. IAM Database Authentication: This allows you to use IAM credentials to authenticate to the database, providing a unified and secure authentication mechanism that integrates seamlessly with Google Cloud IAM.

   Source: Adapted from community discussion — BuenaCloudDE

   Next question

2. Question 182 · 325 in bank

   You have sensitive data stored in three Cloud Storage buckets and have enabled data access logging. You want to verify activities for a particular user for these buckets, using the fewest possible steps. You need to verify the addition of metadata labels and which files have been viewed from those buckets. What should you do?

   • AUsing the GCP Console, filter the Activity log to view the information.
   • BUsing the GCP Console, filter the Stackdriver log to view the information.
   • CView the bucket in the Storage section of the GCP Console.
   • DCreate a trace in Stackdriver to view the information.

   Show answer

   Answer: B

   Explanation

   A is correct. As mentioned in the question, data access logging is enabled. I tried to download a file from a bucket and was able to view this information in Activity tab in console

   Source: Adapted from community discussion — iamgcp

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 183 · 325 in bank

   You have two Google Cloud projects: project-a with VPC vpc-a (10.0.0.0/16) and project-b with VPC vpc-b (10.8.0.0/16). Your frontend application resides in vpc-a and the backend API services are deployed in vpc-b. You need to efficiently and cost-effectively enable communication between these Google Cloud projects. You also want to follow Google-recommended practices. What should you do?

   • ACreate an OpenVPN connection between vpc-a and vpc-b.
   • BCreate VPC Network Peering between vpc-a and vpc-b.
   • CConfigure a Cloud Router in vpc-a and another Cloud Router in vpc-b.
   • DConfigure a Cloud Interconnect connection between vpc-a and vpc-b.

   Show answer

   Answer: B

   Explanation

   Why other options are not as suitable: A. OpenVPN connection: OpenVPN requires setting up and managing a VPN gateway, adding complexity and potential overhead. C. Cloud Routers: While Cloud Routers are powerful tools for managing dynamic routing, they are unnecessary for simple communication between two VPCs. D. Cloud Interconnect: Cloud Interconnect is a high-speed, dedicated connection for hybrid cloud environments. It's overkill for connecting two VPCs within GCP and would be much more expensive than VPC Network Peering.

   Source: Adapted from community discussion — RuchiMishra

   References

   • Google Cloud documentation

   Next question

4. Question 184 · 325 in bank

   Your company is running a critical workload on a single Compute Engine VM instance. Your company's disaster recovery policies require you to back up the entire instance’s disk data every day. The backups must be retained for 7 days. You must configure a backup solution that complies with your company’s security policies and requires minimal setup and configuration. What should you do?

   • AConfigure the instance to use persistent disk asynchronous replication.
   • BConfigure daily scheduled persistent disk snapshots with a retention period of 7 days.
   • CConfigure Cloud Scheduler to trigger a Cloud Function each day that creates a new machine image and deletes machine images that are older than 7 days.
   • DConfigure a bash script using gsutil to run daily through a cron job. Copy the disk’s files to a Cloud Storage bucket with archive storage class and an object lifecycle rule to delete the objects after 7 days.

   Show answer

   Answer: B

   Explanation

   Compute Engine snapshots provide a fast and efficient way to back up the entire disk of a VM instance, including the operating system, applications, and data. They are incremental backups, meaning they only store the changes made since the last snapshot, which helps save storage costs.

   Source: Adapted from community discussion — RuchiMishra

   Next question

5. Question 185 · 325 in bank

   Your company requires that Google Cloud products are created with a specific configuration to comply with your company’s security policies. You need to implement a mechanism that will allow software engineers at your company to deploy and update Google Cloud products in a preconfigured and approved manner. What should you do?

   • ACreate Java packages that utilize the Google Cloud Client Libraries for Java to configure Google Cloud products. Store and share the packages in a source code repository.
   • BCreate bash scripts that utilize the Google Cloud CLI to configure Google Cloud products. Store and share the bash scripts in a source code repository.
   • CUse the Google Cloud APIs by using curl to configure Google Cloud products. Store and share the curl commands in a source code repository.
   • DCreate Terraform modules that utilize the Google Cloud Terraform Provider to configure Google Cloud products. Store and share the modules in a source code repository.

   Show answer

   Answer: D

   Explanation

   Here's why this is the most suitable solution: Infrastructure as Code (IaC): Terraform is an IaC tool that allows you to define and provision infrastructure resources using declarative configuration files. This approach ensures consistency in resource configuration across different deployments, making it easier to enforce security policies and compliance requirements. Modularity: Terraform modules promote reusability and maintainability. You can create modules for specific GCP products or configurations and share them within your organization. This reduces duplication of effort and ensures that all deployments adhere to the same standards.

   Source: Adapted from community discussion — RuchiMishra

   References

   • Google Cloud documentation

   Next question

6. Question 186 · 325 in bank

   You are a Google Cloud organization administrator. You need to configure organization policies and log sinks on Google Cloud projects that cannot be removed by project users to comply with your company's security policies. The security policies are different for each company department. Each company department has a user with the Project Owner role assigned to their projects. What should you do?

   • AUse a standard naming convention for projects that includes the department name. Configure organization policies on the organization and log sinks on the projects.
   • BUse a standard naming convention for projects that includes the department name. Configure both organization policies and log sinks on the projects.
   • COrganize projects under folders for each department. Configure both organization policies and log sinks on the folders.
   • DOrganize projects under folders for each department. Configure organization policies on the organization and log sinks on the folders.

   Show answer

   Answer: C

   Explanation

   As per question, the security policies are different for each company department. Hence, organizing each department in folders, Organizational Policies on Folders, and Log Sinks on Folders will work. Project owners cannot modify or remove organization policies applied at the folder or organization level.

   Source: Adapted from community discussion — RuchiMishra

   Next question

7. Question 187 · 325 in bank

   You are deploying a web application using Compute Engine. You created a managed instance group (MIG) to host the application. You want to follow Google-recommended practices to implement a secure and highly available solution. What should you do?

   • AUse SSL proxy load balancing for the MIG and an A record in your DNS private zone with the load balancer's IP address.
   • BUse SSL proxy load balancing for the MIG and a CNAME record in your DNS public zone with the load balancer’s IP address.
   • CUse HTTP(S) load balancing for the MIG and a CNAME record in your DNS private zone with the load balancer’s IP address.
   • DUse HTTP(S) load balancing for the MIG and an A record in your DNS public zone with the load balancer’s IP address.

   Show answer

   Answer: D

   Explanation

   Compliance question was already two times before. And I stay with HTTP(S) load balancer because it recommend practices in Associate Cloud Engineer Path. HTTP(S) Load Balancing: This is a globally distributed, managed service for HTTP and HTTPS traffic that provides high availability, automatic scaling, and support for SSL termination. It ensures your web application is secure and can handle varying traffic loads efficiently. A Record in DNS Public Zone: An A record maps your domain name to the IP address of the load balancer, making your application accessible to users over the internet. Using a public DNS zone ensures that your application is reachable globally.

   Source: Adapted from community discussion — BuenaCloudDE

   Next question

8. Question 188 · 325 in bank

   You have several hundred microservice applications running in a Google Kubernetes Engine (GKE) cluster. Each microservice is a deployment with resource limits configured for each container in the deployment. You've observed that the resource limits for memory and CPU are not appropriately set for many of the microservices. You want to ensure that each microservice has right sized limits for memory and CPU. What should you do?

   • AConfigure a Vertical Pod Autoscaler for each microservice.
   • BModify the cluster's node pool machine type and choose a machine type with more memory and CPU.
   • CConfigure a Horizontal Pod Autoscaler for each microservice.
   • DConfigure GKE cluster autoscaling.

   Show answer

   Answer: A

   Explanation

   Here's why a Vertical Pod Autoscaler (VPA) is the most suitable solution for this scenario: Right-Sizing Resources: VPA is designed to automatically adjust the resource requests and limits (CPU and memory) for pods based on their actual usage. This ensures that pods have enough resources to run efficiently without being over-provisioned, which can lead to wasted resources and higher costs. Automated Optimization: VPA continuously monitors the resource usage of your pods and recommends optimal settings. You can choose to apply these recommendations automatically or manually, giving you flexibility and control over the process. Microservice-Specific Tuning: By configuring a VPA for each microservice, you can fine-tune the resource allocation for each individual service based on its specific needs and usage patterns. This is more efficient than making blanket changes to the entire cluster or node pool.

   Source: Adapted from community discussion — RuchiMishra

   Next question

9. Question 189 · 325 in bank

   Select 2

   Your company uses BigQuery to store and analyze data. Upon submitting your query in BigQuery, the query fails with a quotaExceeded error. You need to diagnose the issue causing the error. What should you do? (Choose two.)

   • AUse BigQuery BI Engine to analyze the issue.
   • BUse the INFORMATION_SCHEMA views to analyze the underlying issue.
   • CConfigure Cloud Trace to analyze the issue.
   • DSearch errors in Cloud Audit Logs to analyze the issue.
   • EView errors in Cloud Monitoring to analyze the issue.

   Show answer

   Answer: BD

   Explanation

   B & D. Here's why these two methods are crucial for diagnosing quotaExceeded errors in BigQuery: B. INFORMATION_SCHEMA Views: BigQuery's INFORMATION_SCHEMA provides metadata about datasets, tables, and jobs. Relevant views like JOBS_BY_PROJECT and JOBS_BY_USER can help you analyze recent queries, their resource consumption (bytes processed, slots used), and any errors encountered. This can reveal which queries are exceeding quotas and what type of quota (e.g., query size, daily limit) is being exceeded. D. Cloud Audit Logs: Audit logs record all API calls and administrative actions within your GCP projects. By searching for quotaExceeded errors in the audit logs, you can see the exact error messages, timestamps, and potentially the queries that triggered the error. This helps pinpoint the specific resources and actions causing the issue.

   Source: Adapted from community discussion — RuchiMishra

   References

   • Google Cloud documentation

   Next question

10. Question 190 · 325 in bank

    Your team has developed a stateless application which requires it to be run directly on virtual machines. The application is expected to receive a fluctuating amount of traffic and needs to scale automatically. You need to deploy the application. What should you do?

    • ADeploy the application on a managed instance group and configure autoscaling.
    • BDeploy the application on a Kubernetes Engine cluster and configure node pool autoscaling.
    • CDeploy the application on Cloud Functions and configure the maximum number instances.
    • DDeploy the application on Cloud Run and configure autoscaling.

    Show answer

    Answer: A

    Explanation

    Here's why A is the most suitable solution: Managed Instance Groups (MIGs): MIGs are designed to manage groups of identical VMs, making them ideal for running stateless applications. They provide features like auto-scaling, auto-healing, and load balancing, which are crucial for handling fluctuating traffic. Autoscaling: You can configure autoscaling policies to automatically add or remove VM instances based on metrics like CPU utilization, HTTP load balancing traffic, or Stackdriver Monitoring metrics. This ensures that your application can scale up to handle peak traffic and scale down during periods of low demand.

    Source: Adapted from community discussion — RuchiMishra

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ACE practice, question 181. 325 questions available.