ACE practice questions 301–310

1. Question 301 · 325 in bank

   You are deploying an application to Google Kubernetes Engine (GKE) that needs to call an external third-party API. You need to provide the external API vendor with a list of IP addresses for their firewall to allow traffic from your application. You want to follow Google-recommended practices and avoid any risk of interrupting traffic to the API due to IP address changes. What should you do?

   • AConfigure your GKE cluster with one node, and set the node to have a static external IP address. Ensure that the GKE cluster autoscaler is off. Send the external IP address of the node to the vendor to be added to the allowlist.
   • BConfigure your GKE cluster with private nodes. Configure a Cloud NAT instance with static IP addresses. Provide these IP addresses to the vendor to be added to the allowlist.
   • CConfigure your GKE cluster with private nodes. Configure a Cloud NAT instance with dynamic IP addresses. Provide these IP addresses to the vendor to be added to the allowlist.
   • DConfigure your GKE cluster with public nodes. Write a Cloud Function that pulls the public IP addresses of each node in the cluster, Trigger the function to run every day with Cloud Scheduler. Send the list to the vendor by email every day.

   Show answer

   Answer: B

   Next question

2. Question 302 · 325 in bank

   You are planning to migrate your on-premises VMs to Google Cloud. You need to set up a landing zone in Google Cloud before migrating the VMs. You must ensure that all VM in your production environment can communicate with each other through private IP addresses. You need to allow all VMs in your Google Cloud organization to accept connections on specific TCP ports. You want to follow Google-recommended practices, and you need to minimize your operational costs. What should you do?

   • ACreate individual VPCs per Google Cloud project. Peer all he VPC together. Apply organization policies on the organization level.
   • BCreate individual VPCs for each Google Cloud project. Peer ail ne VPCs together. Apply hierarchical firewall policies on the organization level.
   • CCreate a host VPC project with each production project as its service project. Apply organization policies on the organization level.
   • DCreate a host VPC project with each production project as its service project. Apply hierarchical firewall policies on the organization level.

   Show answer

   Answer: D

   Next question

3. Question 303 · 325 in bank

   You assist different engineering teams in deploying their infrastructure on Google Cloud. Your company has defined certain practices required for all workloads. You need to provide the engineering teams with a solution that enables teams to deploy their infrastructure independently without having to know all implementation details of the company’s required practices. What should you do?

   • AConfigure organization policies to enforce your company's required practices. Ask the teams to provision their infrastructure by using the Google Cloud console.
   • BCreate a service account per team, and grant the service account the Project Editor role. Ask the teams to provision their infrastructure through the Google Cloud CLI (gcloud CL), while impersonating their dedicated service account.
   • CWrite Terraform modules for each component that are compliant with the company's required practices, and ask teams to implement their infrastructure through these modules.
   • DProvide training for all engineering teams you work with to understand the company’s required practices. Allow the engineering teams to provision the infrastructure to best meet their needs.

   Show answer

   Answer: C

   Next question

4. Question 304 · 325 in bank

   You ate managing an application deployed on Cloud Run. The development team has released a new version of the application. You want to deploy and redirect traffic to this new version of the application. To ensure traffic to the new version of the application is served with no startup time, you want to ensure that there are two idle instances available for incoming traffic before adjusting the traffic flow. You also want to minimize administrative overhead. What should you do?

   • AEnsure the checkbox “Serve this revision immediately” is unchecked when deploying the new revision. Before changing the traffic rules, use a traffic simulation tool to send load to the new revision.
   • BConfigure service autoscaling and set the minimum number of instances to 2.
   • CConfigure revision autoscaling for the new revision and set the minimum number of instances to 2.
   • DConfigure revision autoscaling for the existing revision and set the minimum number of instances to 2.

   Show answer

   Answer: C

   Next question

5. Question 305 · 325 in bank

   Your digital media company stores a large number of video files on-premises. Each video file ranges from 100 MB to 100 GB. You are currently storing 150 TB of video data in your on-premises network, with no room for expansion. You need to migrate all infrequently accessed video files older than one year to Cloud Storage to ensure that on-premises storage remains available for new files. You must also minimize costs and control bandwidth usage. What should you do?

   • AUse Storage Transfer Service to move the data from the selected on-premises file storage systems to a Cloud Storage bucket.
   • BUse Transfer Appliance to request an appliance. Load the data locally, and ship the appliance back to Google for ingestion into Cloud Storage.
   • CSet up a Cloud Interconnect connection between the on-premises network and Google Cloud. Establish a private endpoint for Filestore access. Transfer the data from the existing Network File System (NFS) to Filestore.
   • DCreate a Cloud Storage bucket. Establish an Identity and Access Management (IAM) role with write permissions to the bucket. Use the gsutil tool to directly copy files over the network to Cloud Storage.

   Show answer

   Answer: A

   Next question

6. Question 306 · 325 in bank

   You are implementing a company-wide standard to control SSH access for your Google Cloud projects. You want to simplify SSH access management to your Compute Engine instances while maintaining audit compliance and eliminating as many manual steps as possible. What should you do?

   • AConfigure a service account to add SSH keys for all VMs.
   • BConfigure metadata SSH keys to manage sudo access to instances.
   • CEnable OS Login by using an organization policy for each Google Cloud project.
   • DEnable OS Login with two-factor authentication for the domain.

   Show answer

   Answer: C

   Next question

7. Question 307 · 325 in bank

   Select 2

   You need to create and manage service accounts for your workloads running on Google Cloud. You want to follow Google-recommended practices. What should you do? (Choose two.)

   • ACreate as few service accounts as possible.
   • BDelete any unused service accounts immediately.
   • CCreate single-purpose service accounts.
   • DManage service accounts as resources.
   • EUse random names for the service accounts.

   Show answer

   Answer: CD

   Next question

8. Question 308 · 325 in bank

   Your company wants to migrate your data from an on-premises relational database to Google Cloud. Your current database can no longer scale with respect to the growth of your users, and you expect the number of users to rapidly grow. You need to choose a relational database that allows you to globally scale while minimizing your management and administration efforts. You also want to follow Google-recommended practices. What should you do?

   • AUse Cloud SQL.
   • BUse Spanner.
   • CUse Firestore.
   • DUse BigQuery.

   Show answer

   Answer: B

   Next question

9. Question 309 · 325 in bank

   You are the Google Cloud systems administrator for your organization. User A reports that they received an error when attempting to access the Cloud SQL database in their Google Cloud project, while User B can access the database. You need to troubleshoot the issue for User A, while following Google-recommended practices. What should you do first?

   • AConfirm that network firewall rules are not blocking traffic for User A.
   • BVerify that User A has the Identity and Access Management (IAM) Project Owner role assigned.
   • CReview recent configuration changes that may have caused unintended modifications to permissions.
   • DReview the error message that User A received.

   Show answer

   Answer: D

   Next question

10. Question 310 · 325 in bank

    You are writing a shell script that includes a few gcloud CLI commands to access some Google Cloud resources. You want to test the script in your local development environment with a service account in the most secure way. What should you do?

    • AGenerate an ID token for the service account. Use the token with the gcloud CLI commands.
    • BEnable service account impersonation, and use the gcloud config set command to use it by default.
    • CDownload the service account key file and save it in a secure location. Set the GOOGLE_APPLICATION_CREDENTIALS environment variable to the key file.
    • DDownload the service account key file, and use it to generate an access token. Use the token with the gcloud CLI commands.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ACE practice, question 301. 325 questions available.