ACE practice questions 231–240

1. Question 231 · 325 in bank

   You have a web application deployed as a managed instance group. You have a new version of the application to gradually deploy. Your web application is currently receiving live web traffic. You want to ensure that the available capacity does not decrease during the deployment. What should you do?

   • APerform a rolling-action start-update with maxSurge set to 0 and maxUnavailable set to 1.
   • BPerform a rolling-action start-update with maxSurge set to 1 and maxUnavailable set to 0.
   • CCreate a new managed instance group with an updated instance template. Add the group to the backend service for the load balancer. When all instances in the new managed instance group are healthy, delete the old managed instance group.
   • DCreate a new instance template with the new application version. Update the existing managed instance group with the new instance template. Delete the instances in the managed instance group to allow the managed instance group to recreate the instance using the new instance template.

   Show answer

   Answer: B

   Explanation

   Correct option is B. We need to ensure the global capacity remains intact, for that reason we need to establish maxUnavailable to 0. On the other hand, we need to ensure new instances can be created. We do that by establishing the maxSurge to 1. Option C is more expensive and more difficult to set up and option D won't meet requirements since it won't keep global capacity intact.

   Source: Adapted from community discussion — CarlS

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 232 · 325 in bank

   You are the organization and billing administrator for your company. The engineering team has the Project Creator role on the organization. You do not want the engineering team to be able to link projects to the billing account. Only the finance team should be able to link a project to a billing account, but they should not be able to make any other changes to projects. What should you do?

   • AAssign the finance team only the Billing Account User role on the billing account.
   • BAssign the engineering team only the Billing Account User role on the billing account.
   • CAssign the finance team the Billing Account User role on the billing account and the Project Billing Manager role on the organization.
   • DAssign the engineering team the Billing Account User role on the billing account and the Project Billing Manager role on the organization.

   Show answer

   Answer: C

   Explanation

   Option A is correct, as we don't want the engineering team to link projects to billing account and want only the Finance team. Billing Account User role will help to link projects to the billing account...

   Source: Adapted from community discussion — Bharathy

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 233 · 325 in bank

   Your company uses Cloud Storage to store application backup files for disaster recovery purposes. You want to follow Google's recommended practices. Which storage option should you use?

   • AMulti-Regional Storage
   • BRegional Storage
   • CNearline Storage
   • DColdline Storage

   Show answer

   Answer: D

   Explanation

   Best Answer is " Archive Storage " https://cloud.google.com/storage/docs/storage-classes But as per the given option next best solution is " Coldline Storage"

   Source: Adapted from community discussion — poogcp

   References

   • Google Cloud documentation

   Next question

4. Question 234 · 325 in bank

   You have an application running in Google Kubernetes Engine (GKE) with cluster autoscaling enabled. The application exposes a TCP endpoint. There are several replicas of this application. You have a Compute Engine instance in the same region, but in another Virtual Private Cloud (VPC), called gce-network, that has no overlapping IP ranges with the first VPC. This instance needs to connect to the application on GKE. You want to minimize effort. What should you do?

   • A1. In GKE, create a Service of type LoadBalancer that uses the application's Pods as backend. 2. Set the service's externalTrafficPolicy to Cluster. 3. Configure the Compute Engine instance to use the address of the load balancer that has been created.
   • B1. In GKE, create a Service of type NodePort that uses the application's Pods as backend. 2. Create a Compute Engine instance called proxy with 2 network interfaces, one in each VPC. 3. Use iptables on this instance to forward traffic from gce-network to the GKE nodes. 4. Configure the Compute Engine instance to use the address of proxy in gce-network as endpoint.
   • C1. In GKE, create a Service of type LoadBalancer that uses the application's Pods as backend. 2. Add an annotation to this service: cloud.google.com/load-balancer-type: Internal 3. Peer the two VPCs together. 4. Configure the Compute Engine instance to use the address of the load balancer that has been created.
   • D1. In GKE, create a Service of type LoadBalancer that uses the application's Pods as backend. 2. Add a Cloud Armor Security Policy to the load balancer that whitelists the internal IPs of the MIG's instances. 3. Configure the Compute Engine instance to use the address of the load balancer that has been created.

   Show answer

   Answer: C

   Explanation

   I believe it's A. It's never mentioned in the question that traffic cannot go through the Internet but it's mentioned that effort should be minimized. A requires a lot less effort than C to accomplish the same (no VPC peering, per example).

   Source: Adapted from community discussion — someoneinthecloud

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 235 · 325 in bank

   Your organization is a financial company that needs to store audit log files for 3 years. Your organization has hundreds of Google Cloud projects. You need to implement a cost-effective approach for log file retention. What should you do?

   • ACreate an export to the sink that saves logs from Cloud Audit to BigQuery.
   • BCreate an export to the sink that saves logs from Cloud Audit to a Coldline Storage bucket.
   • CWrite a custom script that uses logging API to copy the logs from Stackdriver logs to BigQuery.
   • DExport these logs to Cloud Pub/Sub and write a Cloud Dataflow pipeline to store logs to Cloud SQL.

   Show answer

   Answer: B

   Explanation

   if it is all about cost, B is the best. However, speaking of "audit" you probably need to access the data once in a while, which Coldline storage might not be ideal for this case I guess? I would go for A in the exam though.

   Source: Adapted from community discussion — Gini

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 236 · 325 in bank

   You want to run a single caching HTTP reverse proxy on GCP for a latency-sensitive website. This specific reverse proxy consumes almost no CPU. You want to have a 30-GB in-memory cache, and need an additional 2 GB of memory for the rest of the processes. You want to minimize cost. How should you run this reverse proxy?

   • ACreate a Cloud Memorystore for Redis instance with 32-GB capacity.
   • BRun it on Compute Engine, and choose a custom instance type with 6 vCPUs and 32 GB of memory.
   • CPackage it in a container image, and run it on Kubernetes Engine, using n1-standard-32 instances as nodes.
   • DRun it on Compute Engine, choose the instance type n1-standard-1, and add an SSD persistent disk of 32 GB.

   Show answer

   Answer: A

   Explanation

   Go to cloud console and create instance select Memorystore with Basic tier, select us-central1 and us-central1-a, and capacity 32GB, the cost estimate is $0.023/GB/hr select VM instance with custom machine type with 6 vCPUs and 32 GB memory, the same region and zone as Memorystore setting, the cost estimate is $0.239/hr Option B will definitely cost more as it adds on CPU usage cost even it uses little in this scenario, but still charge you. So answer is A from real practice example.

   Source: Adapted from community discussion — jzh

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 237 · 325 in bank

   You are hosting an application on bare-metal servers in your own data center. The application needs access to Cloud Storage. However, security policies prevent the servers hosting the application from having public IP addresses or access to the internet. You want to follow Google-recommended practices to provide the application with access to Cloud Storage. What should you do?

   • A1. Use nslookup to get the IP address for storage.googleapis.com. 2. Negotiate with the security team to be able to give a public IP address to the servers. 3. Only allow egress traffic from those servers to the IP addresses for storage.googleapis.com.
   • B1. Using Cloud VPN, create a VPN tunnel to a Virtual Private Cloud (VPC) in Google Cloud. 2. In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance. 3. Configure your servers to use that instance as a proxy to access Cloud Storage.
   • C1. Use Migrate for Compute Engine (formerly known as Velostrata) to migrate those servers to Compute Engine. 2. Create an internal load balancer (ILB) that uses storage.googleapis.com as backend. 3. Configure your new instances to use this ILB as proxy.
   • D1. Using Cloud VPN or Interconnect, create a tunnel to a VPC in Google Cloud. 2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel. 3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com.

   Show answer

   Answer: D

   Explanation

   What messy answers! I chose D and here is my reasoning per answer. A. It's bad practice to use nslookup to try find a permanent IP address because IPs can change. That's what DNS is for! Also, the security team aren't going to budge... this is just a silly answer. B. We're getting warmer. Any time a question mentions on-prem and cloud, Google wants you to think about Cloud VPN. This solution might even work, but installing Squid? This is a messy solution to a more simple problem. C. Talk about using a sledge hammer to swat a mosquito. I think this could work, but migrating servers to cloud to solve a simple networking problem? D. Once more Google's favorite Cloud VPN is in the answer. I'm not sure about the networking component of this question.

   Source: Adapted from community discussion — obeythefist

   References

   • Google Cloud documentation

   Next question

8. Question 238 · 325 in bank

   You want to deploy an application on Cloud Run that processes messages from a Cloud Pub/Sub topic. You want to follow Google-recommended practices. What should you do?

   • A1. Create a Cloud Function that uses a Cloud Pub/Sub trigger on that topic. 2. Call your application on Cloud Run from the Cloud Function for every message.
   • B1. Grant the Pub/Sub Subscriber role to the service account used by Cloud Run. 2. Create a Cloud Pub/Sub subscription for that topic. 3. Make your application pull messages from that subscription.
   • C1. Create a service account. 2. Give the Cloud Run Invoker role to that service account for your Cloud Run application. 3. Create a Cloud Pub/Sub subscription that uses that service account and uses your Cloud Run application as the push endpoint.
   • D1. Deploy your application on Cloud Run on GKE with the connectivity set to Internal. 2. Create a Cloud Pub/Sub subscription for that topic. 3. In the same Google Kubernetes Engine cluster as your application, deploy a container that takes the messages and sends them to your application.

   Show answer

   Answer: C

   Explanation

   why c ? explained>> You can use Pub/Sub to push messages to the endpoint of your Cloud Run service, where the messages are subsequently delivered to containers as HTTP requests. You cannot use Pub/Sub pull subscriptions because Cloud Run only allocates CPU during the processing of a request.

   Source: Adapted from community discussion — Bhagirathi

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 239 · 325 in bank

   You need to deploy an application, which is packaged in a container image, in a new project. The application exposes an HTTP endpoint and receives very few requests per day. You want to minimize costs. What should you do?

   • ADeploy the container on Cloud Run.
   • BDeploy the container on Cloud Run on GKE.
   • CDeploy the container on App Engine Flexible.
   • DDeploy the container on GKE with cluster autoscaling and horizontal pod autoscaling enabled.

   Show answer

   Answer: A

   Explanation

   Listen to this guy. Google says "Cloud Run abstracts away all infrastructure management by automatically scaling up and down from zero almost instantaneously—depending on traffic. Cloud Run only charges you for the exact resources you use."

   Source: Adapted from community discussion — spudleymcdudley

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 240 · 325 in bank

    Your company has an existing GCP organization with hundreds of projects and a billing account. Your company recently acquired another company that also has hundreds of projects and its own billing account. You would like to consolidate all GCP costs of both GCP organizations onto a single invoice. You would like to consolidate all costs as of tomorrow. What should you do?

    • ALink the acquired company's projects to your company's billing account.
    • BConfigure the acquired company's billing account and your company's billing account to export the billing data into the same BigQuery dataset.
    • CMigrate the acquired company's projects into your company's GCP organization. Link the migrated projects to your company's billing account.
    • DCreate a new GCP organization and a new billing account. Migrate the acquired company's projects and your company's projects into the new GCP organization and link the projects to the new billing account.

    Show answer

    Answer: A

    Explanation

    To me, A looks correct. projects are linked to another organization as well in the acquired company so migrating would need google cloud support. we can not do ourselves. however, we can link other company projects to an existing billing account to generate total cost. https://medium.com/google-cloud/google-cloud-platform-cross-org-billing-41c5db8fefa6

    Source: Adapted from community discussion — GunjGupta

    References

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ACE practice, question 231. 325 questions available.