ACE practice questions 241–250

1. Question 241 · 325 in bank

   You built an application on Google Cloud that uses Cloud Spanner. Your support team needs to monitor the environment but should not have access to table data. You need a streamlined solution to grant the correct permissions to your support team, and you want to follow Google-recommended practices. What should you do?

   • AAdd the support team group to the roles/monitoring.viewer role
   • BAdd the support team group to the roles/spanner.databaseUser role.
   • CAdd the support team group to the roles/spanner.databaseReader role.
   • DAdd the support team group to the roles/stackdriver.accounts.viewer role.

   Show answer

   Answer: A

   Explanation

   A, right, correct answer. B and C are incorrect because allow to read data. D also incorrect: Not for monitoring. roles/stackdriver.accounts.viewer Stackdriver Accounts Viewer: Read-only access to get and list information about Stackdriver account structure (resourcemanager.projects.get, resourcemanager.projects.list and stackdriver.projects.get)

   Source: Adapted from community discussion — WindDriver

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 242 · 325 in bank

   For analysis purposes, you need to send all the logs from all of your Compute Engine instances to a BigQuery dataset called platform-logs. You have already installed the Cloud Logging agent on all the instances. You want to minimize cost. What should you do?

   • A1. Give the BigQuery Data Editor role on the platform-logs dataset to the service accounts used by your instances. 2. Update your instances' metadata to add the following value: logs-destination: bq://platform-logs.
   • B1. In Cloud Logging, create a logs export with a Cloud Pub/Sub topic called logs as a sink. 2. Create a Cloud Function that is triggered by messages in the logs topic. 3. Configure that Cloud Function to drop logs that are not from Compute Engine and to insert Compute Engine logs in the platform-logs dataset.
   • C1. In Cloud Logging, create a filter to view only Compute Engine logs. 2. Click Create Export. 3. Choose BigQuery as Sink Service, and the platform-logs dataset as Sink Destination.
   • D1. Create a Cloud Function that has the BigQuery User role on the platform-logs dataset. 2. Configure this Cloud Function to create a BigQuery Job that executes this query: INSERT INTO dataset.platform-logs (timestamp, log) SELECT timestamp, log FROM compute.logs WHERE timestamp > DATE_SUB(CURRENT_DATE(), INTERVAL 1 DAY) 3. Use Cloud Scheduler to trigger this Cloud Function once a day.

   Show answer

   Answer: C

   Explanation

   The most cost-effective and recommended solution to send logs from Compute Engine instances to BigQuery is to use the Cloud Logging agent with a sink that streams the logs to BigQuery. Answer C is the most appropriate solution. In Cloud Logging, create a filter to view only Compute Engine logs. Click Create Export. Choose BigQuery as Sink Service, and the platform-logs dataset as Sink Destination. This will allow all Compute Engine instance logs to be exported to BigQuery with minimal complexity and cost.

   Source: Adapted from community discussion — Buruguduystunstugudunstuy

   References

   • Google Cloud documentation

   Next question

3. Question 243 · 325 in bank

   You are using Deployment Manager to create a Google Kubernetes Engine cluster. Using the same Deployment Manager deployment, you also want to create a DaemonSet in the kube-system namespace of the cluster. You want a solution that uses the fewest possible services. What should you do?

   • AAdd the cluster's API as a new Type Provider in Deployment Manager, and use the new type to create the DaemonSet.
   • BUse the Deployment Manager Runtime Configurator to create a new Config resource that contains the DaemonSet definition.
   • CWith Deployment Manager, create a Compute Engine instance with a startup script that uses kubectl to create the DaemonSet.
   • DIn the cluster's definition in Deployment Manager, add a metadata that has kube-system as key and the DaemonSet manifest as value.

   Show answer

   Answer: A

   Explanation

   Correct Answer is (A): Adding an API as a type provider This page describes how to add an API to Google Cloud Deployment Manager as a type provider. To learn more about types and type providers, read the Types overview documentation. A type provider exposes all of the resources of a third-party API to Deployment Manager as base types that you can use in your configurations. These types must be directly served by a RESTful API that supports Create, Read, Update, and Delete (CRUD). If you want to use an API that is not automatically provided by Google with Deployment Manager, you must add the API as a type provider. https://cloud.google.com/deployment-manager/docs/configuration/type-providers/creating-type-provider

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Kubernetes documentation

   Next question

4. Question 244 · 325 in bank

   Several employees at your company have been creating projects with Cloud Platform and paying for it with their personal credit cards, which the company reimburses. The company wants to centralize all these projects under a single, new billing account. What should you do?

   • AContact cloud-billing@google.com with your bank account details and request a corporate billing account for your company.
   • BCreate a ticket with Google Support and wait for their call to share your credit card details over the phone.
   • CIn the Google Platform Console, go to the Resource Manage and move all projects to the root Organizarion.
   • DIn the Google Cloud Platform Console, create a new billing account and set up a payment method.

   Show answer

   Answer: D

   Explanation

   C is incomplete. Moving projects under an organisation doesn't change their linked billing project. https://cloud.google.com/resource-manager/docs/migrating-projects-billing ---- Note: The link between projects and billing accounts is preserved, irrespective of the hierarchy. When you move your existing projects into the organization they will continue to work and be billed as they used to before the migration, even if the corresponding billing account has not been migrated yet. ---- D is incomplete as well, after setting the billing account in the organisation you need to link the projects to the new billing account.

   Source: Adapted from community discussion — samcat84

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 245 · 325 in bank

   You are building an application that will run in your data center. The application will use Google Cloud Platform (GCP) services like AutoML. You created a service account that has appropriate access to AutoML. You need to enable authentication to the APIs from your on-premises environment. What should you do?

   • AUse service account credentials in your on-premises application.
   • BUse gcloud to create a key file for the service account that has appropriate permissions.
   • CSet up direct interconnect between your data center and Google Cloud Platform to enable authentication for your on-premises applications.
   • DGo to the IAM & admin console, grant a user account permissions similar to the service account permissions, and use this user account for authentication from your data center.

   Show answer

   Answer: B

   Explanation

   Correct answer should be (B): To use a service account outside of Google Cloud, such as on other platforms or on-premises, you must first establish the identity of the service account. Public/private key pairs provide a secure way of accomplishing this goal. https://cloud.google.com/iam/docs/creating-managing-service-account-keys

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

6. Question 246 · 325 in bank

   You are using Container Registry to centrally store your company's container images in a separate project. In another project, you want to create a Google Kubernetes Engine (GKE) cluster. You want to ensure that Kubernetes can download images from Container Registry. What should you do?

   • AIn the project where the images are stored, grant the Storage Object Viewer IAM role to the service account used by the Kubernetes nodes.
   • BWhen you create the GKE cluster, choose the Allow full access to all Cloud APIs option under 'Access scopes'.
   • CCreate a service account, and give it access to Cloud Storage. Create a P12 key for this service account and use it as an imagePullSecrets in Kubernetes.
   • DConfigure the ACLs on each image in Cloud Storage to give read-only access to the default Compute Engine service account.

   Show answer

   Answer: A

   Explanation

   Correct Answer (A): IAM permissions IAM permissions determine who can access resources. All users, service accounts, and other identities that interact with Container Registry must have the appropriate Cloud Storage permissions. By default, Google Cloud use default service accounts to interact with resources within the same project. For example, the Cloud Build service account can both push and pull images when Container Registry is in the same project. You must configure or modify permissions yourself if: You are using a service account in one project to access Container Registry in a different project You are using a default service account with read-only access to storage, but you want to both pull and push images You are using a custom service account to interact with Container Registry https://cloud.google.com/container-registry/docs/access-control

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Kubernetes documentation
   • Google Cloud documentation

   Next question

7. Question 247 · 325 in bank

   You deployed a new application inside your Google Kubernetes Engine cluster using the YAML file specified below.

   

   You check the status of the deployed pods and notice that one of them is still in PENDING status:

   

   You want to find out why the pod is stuck in pending status. What should you do?

   • AReview details of the myapp-service Service object and check for error messages.
   • BReview details of the myapp-deployment Deployment object and check for error messages.
   • CReview details of myapp-deployment-58ddbbb995-lp86m Pod and check for warning messages.
   • DView logs of the container in myapp-deployment-58ddbbb995-lp86m pod and check for warning messages.

   Show answer

   Answer: C

   Explanation

   Answer is C - You can't view logs of a pod that isn't deployed, so D is incorrect. C allows you to check the pod deployment messages and look for errors

   Source: Adapted from community discussion — someoneinthecloud

   References

   • Kubernetes documentation
   • Google Cloud documentation
   • Kubernetes documentation

   Next question

8. Question 248 · 325 in bank

   You are setting up a Windows VM on Compute Engine and want to make sure you can log in to the VM via RDP. What should you do?

   • AAfter the VM has been created, use your Google Account credentials to log in into the VM.
   • BAfter the VM has been created, use gcloud compute reset-windows-password to retrieve the login credentials for the VM.
   • CWhen creating the VM, add metadata to the instance using 'windows-password' as the key and a password as the value.
   • DAfter the VM has been created, download the JSON private key for the default Compute Engine service account. Use the credentials in the JSON file to log in to the VM.

   Show answer

   Answer: B

   Explanation

   Correct Answer is B. B. After the VM has been created, use gcloud compute reset-windows-password to retrieve the login credentials for the VM. https://cloud.google.com/sdk/gcloud/reference/beta/compute/reset-windows-password

   Source: Adapted from community discussion — John_Iam

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 249 · 325 in bank

   You want to configure an SSH connection to a single Compute Engine instance for users in the dev1 group. This instance is the only resource in this particular Google Cloud Platform project that the dev1 users should be able to connect to. What should you do?

   • ASet metadata to enable-oslogin=true for the instance. Grant the dev1 group the compute.osLogin role. Direct them to use the Cloud Shell to ssh to that instance.
   • BSet metadata to enable-oslogin=true for the instance. Set the service account to no service account for that instance. Direct them to use the Cloud Shell to ssh to that instance.
   • CEnable block project wide keys for the instance. Generate an SSH key for each user in the dev1 group. Distribute the keys to dev1 users and direct them to use their third-party tools to connect.
   • DEnable block project wide keys for the instance. Generate an SSH key and associate the key with that instance. Distribute the key to dev1 users and direct them to use their third-party tools to connect.

   Show answer

   Answer: A

   Explanation

   Pure from logic thinking: A can't be right. If the group get access to that instance with enable-oslogin=true, then they could have access to every instance that has enable-oslogin=true. Or do I miss something?

   Source: Adapted from community discussion — student002

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 250 · 325 in bank

    You need to produce a list of the enabled Google Cloud Platform APIs for a GCP project using the gcloud command line in the Cloud Shell. The project name is my-project. What should you do?

    • ARun gcloud projects list to get the project ID, and then run gcloud services list --project <project ID>.
    • BRun gcloud init to set the current project to my-project, and then run gcloud services list --available.
    • CRun gcloud info to view the account value, and then run gcloud services list --account <Account>.
    • DRun gcloud projects describe <project ID> to verify the project value, and then run gcloud services list --available.

    Show answer

    Answer: A

    Explanation

    A is the correct answer, log to gcloud and run the commands, doesnt make sense to run cloud init and gcloud services list --available gives you the full services that are available.

    Source: Adapted from community discussion — dan80

    References

    • Google Cloud documentation
    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ACE practice, question 241. 325 questions available.