ACE practice questions 271–280

1. Question 271 · 325 in bank

   You create a Deployment with 2 replicas in a Google Kubernetes Engine cluster that has a single preemptible node pool. After a few minutes, you use kubectl to examine the status of your Pod and observe that one of them is still in Pending status:

   

   What is the most likely cause?

   • AThe pending Pod's resource requests are too large to fit on a single node of the cluster.
   • BToo many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod.
   • CThe node pool is configured with a service account that does not have permission to pull the container image used by the pending Pod.
   • DThe pending Pod was originally scheduled on a node that has been preempted between the creation of the Deployment and your verification of the Pods' status. It is currently being rescheduled on a new node.

   Show answer

   Answer: B

   Explanation

   Correct Answer is (B): Reasons for a Pod Status Pending: Troubleshooting Reason #1: Not enough CPU Troubleshooting Reason #2: Not enough memory Troubleshooting Reason #3: Not enough CPU and memory https://managedkube.com/kubernetes/k8sbot/troubleshooting/pending/pod/2019/02/22/pending-pod.html

   Source: Adapted from community discussion — ESP_SAP

   References

   • Kubernetes documentation
   • Kubernetes documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

2. Question 272 · 325 in bank

   You want to find out when users were added to Cloud Spanner Identity Access Management (IAM) roles on your Google Cloud Platform (GCP) project. What should you do in the GCP Console?

   • AOpen the Cloud Spanner console to review configurations.
   • BOpen the IAM & admin console to review IAM policies for Cloud Spanner roles.
   • CGo to the Stackdriver Monitoring console and review information for Cloud Spanner.
   • DGo to the Stackdriver Logging console, review admin activity logs, and filter them for Cloud Spanner IAM roles.

   Show answer

   Answer: D

   Explanation

   Correct Answer is (D): Stackdriver logging allows filtering of logs based on resource (i.e. Cloud Spanner) then sub category of granting access will provide info as to when a role was granted to the user It says when in the question when users were added to Cloud Spanner Identity Access Management (IAM) roles on your Google Cloud Platform (GCP) project

   Source: Adapted from community discussion — ESP_SAP

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 273 · 325 in bank

   Select 2

   Your company implemented BigQuery as an enterprise data warehouse. Users from multiple business units run queries on this data warehouse. However, you notice that query costs for BigQuery are very high, and you need to control costs. Which two methods should you use? (Choose two.)

   • ASplit the users from business units to multiple projects.
   • BApply a user- or project-level custom query quota for BigQuery data warehouse.
   • CCreate separate copies of your BigQuery data warehouse for each business unit.
   • DSplit your BigQuery data warehouse into multiple data warehouses for each business unit.
   • EChange your BigQuery query model from on-demand to flat rate. Apply the appropriate number of slots to each Project.

   Show answer

   Answer: BE

   Explanation

   B & E Refer below link - first of all you can define quotas on project or user level and 2nd one is you can change from on demand to flat rate model and define the parameters based on your requirement --- https://cloud.google.com/bigquery/docs/custom-quotas https://cloud.google.com/bigquery/pricing#flat_rate_pricing

   Source: Adapted from community discussion — Jignesh_Gamdha

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

4. Question 274 · 325 in bank

   You are building a product on top of Google Kubernetes Engine (GKE). You have a single GKE cluster. For each of your customers, a Pod is running in that cluster, and your customers can run arbitrary code inside their Pod. You want to maximize the isolation between your customers' Pods. What should you do?

   • AUse Binary Authorization and whitelist only the container images used by your customers' Pods.
   • BUse the Container Analysis API to detect vulnerabilities in the containers used by your customers' Pods.
   • CCreate a GKE node pool with a sandbox type configured to gvisor. Add the parameter runtimeClassName: gvisor to the specification of your customers' Pods.
   • DUse the cos_containerd image for your GKE nodes. Add a nodeSelector with the value cloud.google.com/gke-os-distribution: cos_containerd to the specification of your customers' Pods.

   Show answer

   Answer: C

   Explanation

   Let me be honest, I did not have any clue to answer this question. However, I spotted the keyword, 'isolation', from the question and a keyword, 'sandbox' from the answers and guessed the answer which turned out to be correct. So, yes it is C!

   Source: Adapted from community discussion — akshaychavan7

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

5. Question 275 · 325 in bank

   Your customer has implemented a solution that uses Cloud Spanner and notices some read latency-related performance issues on one table. This table is accessed only by their users using a primary key. The table schema is shown below.

   

   You want to resolve the issue. What should you do?

   • ARemove the profile_picture field from the table.
   • BAdd a secondary index on the person_id column.
   • CChange the primary key to not have monotonically increasing values.
   • DCreate a secondary index using the following Data Definition Language (DDL):

   Show answer

   Answer: C

   Explanation

   • Hotspotting Issue: Cloud Spanner, like many distributed databases, can experience issues with what is known as "hotspotting." This happens when a large portion of read or write operations are concentrated on a specific part of the database. In this case, the sequential nature of the person_id as a primary key can lead to hotspotting because new records are continually added at the "end" of the key space, creating a hot node which can cause performance bottlenecks. • Monotonically Increasing Values: Monotonically increasing values as primary keys can exacerbate the hotspotting effect because each new entry is placed after the last, creating a write hotspot on the last node that handles the upper bound of the key range. Over time, this can lead to unbalanced read/write loads across the nodes.

   Source: Adapted from community discussion — Cynthia2023

   References

   • Google Cloud documentation

   Next question

6. Question 276 · 325 in bank

   Your finance team wants to view the billing report for your projects. You want to make sure that the finance team does not get additional permissions to the project. What should you do?

   • AAdd the group for the finance team to roles/billing user role.
   • BAdd the group for the finance team to roles/billing admin role.
   • CAdd the group for the finance team to roles/billing viewer role.
   • DAdd the group for the finance team to roles/billing project/Manager role.

   Show answer

   Answer: C

   Explanation

   c "Billing Account Viewer access would usually be granted to finance teams, it provides access to spend information, but does not confer the right to link or unlink projects or otherwise manage the properties of the billing account." https://cloud.google.com/billing/docs/how-to/billing-access

   Source: Adapted from community discussion — miniso8153

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 277 · 325 in bank

   Your organization is migrating to Google Cloud. You want only users with company-issued Google accounts to access your Google Cloud environment. You must ensure that users of the same department can only access resources within their own department. You want to minimize operational costs while following Google-recommended practices. What should you do?

   • AAssign users to the relevant Google Groups, and provide access to cloud resources through Identity and Access Management (IAM) roles. Periodically identify and remove non-company issued Google accounts.
   • BAssign users to the relevant Google Groups, and provide access to cloud resources through Identity and Access Management (IAM) roles. Use organization policies to block non-company issued emails.
   • CCreate a folder for each department in Resource Manager. Grant the users of each department the Folder Admin role on the folder of their department.
   • DCreate a folder for each department in Resource Manager. Grant all company users the Folder Admin role on the organization level.

   Show answer

   Answer: B

   Next question

8. Question 278 · 325 in bank

   You are deploying an application to Cloud Run. Your application requires the use of an API that runs on Google Kubernetes Engine (GKE). You need to ensure that your Cloud Run service can privately reach the API on GKE, and you want to follow Google-recommended practices. What should you do?

   • ADeploy an ingress resource on the GKE cluster to expose the API to the internet. Use Cloud Armor to filter for IP addresses that can connect to the API. On the Cloud Run service, configure the application to fetch its public IP address and update the Cloud Armor policy on startup to allow this IP address to call the API on ports 80 and 443.
   • BCreate an ingress firewall rule on the VPC to allow connections from 0.0.0.0/0 on ports 80 and 443.
   • CCreate an egress firewall rule on the VPC to allow connections to 0.0.0.0/ on ports 80 and 443.
   • DDeploy an internal Application Load Balancer to expose the API on GKE to the VPC. Configure Cloud DNS with the IP address of the internal Application Load Balancer. Deploy a Serverless VPC Access connector to allow the Cloud Run service to call the API through the FQDN on Cloud DNS.

   Show answer

   Answer: D

   Next question

9. Question 279 · 325 in bank

   Your company uses a multi-cloud strategy that includes Google Cloud. You want to centralize application logs in a third-party software-as-a-service (SaaS) tool from all environments. You need to integrate logs originating from Cloud Logging, and you want to ensure the export occurs with the least amount of delay possible. What should you do?

   • ACreate a Cloud Logging sink and configure BigQuery as the destination. Configure the SaaS tool to query BigQuery to retrieve the logs.
   • BCreate a Cloud Logging sink and configure Pub/Sub as the destination. Configure the SaaS tool to subscribe to the Pub/Sub topic to retrieve the logs.
   • CCreate a Cloud Logging sink and configure Cloud Storage as the destination. Configure the SaaS tool to read the Cloud Storage bucket to retrieve the logs.
   • DUse a Cloud Scheduler cron job to trigger a Cloud Function that queries Cloud Logging and sends the logs to the SaaS tool.

   Show answer

   Answer: B

   Next question

10. Question 280 · 325 in bank

    You are planning to migrate a database and a backend application to a Standard Google Kubernetes Engine (GKE) cluster. You need to prevent data loss and make sure there are enough nodes available for your backend application based on the demands of your workloads. You want to follow Google-recommended practices and minimize the amount of manual work required. What should you do?

    • ARun your database as a StatefulSet. Configure cluster autoscaling to handle changes in the demands of your workloads.
    • BRun your database as a single Pod. Run the resize command when you notice changes in the demands of your workloads.
    • CRun your database as a DaemonSet. Run the resize command when you notice changes in the demands of your workloads.
    • DRun your database as a Deployment. Configure cluster autoscaling to handle changes in the demands of your workloads.

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ACE practice, question 271. 325 questions available.