PCA practice questions 81–90

1. Question 81 · 335 in bank

   Your company has a Google Workspace account and Google Cloud Organization. Some developers in the company have created Google Cloud projects outside of the Google Cloud Organization. You want to create an Organization structure that allows developers to create projects, but prevents them from modifying production projects. You want to manage policies for all projects centrally and be able to set more restrictive policies for production projects. You want to minimize disruption to users and developers when business needs change in the future. You want to follow Google-recommended practices. Now should you design the Organization structure?

   • A1. Create a second Google Workspace account and Organization. 2. Grant all developers the Project Creator IAM role on the new Organization. 3. Move the developer projects into the new Organization. 4. Set the policies for all projects on both Organizations. 5. Additionally, set the production policies on the original Organization.
   • B1. Create a folder under the Organization resource named ג€Production.ג€ 2. Grant all developers the Project Creator IAM role on the new Organization. 3. Move the developer projects into the new Organization. 4. Set the policies for all projects on the Organization. 5. Additionally, set the production policies on the ג€Productionג€ folder.
   • C1. Create folders under the Organization resource named ג€Developmentג€ and ג€Production.ג€ 2. Grant all developers the Project Creator IAM role on the ג€Developmentג€ folder. 3. Move the developer projects into the ג€Developmentג€ folder. 4. Set the policies for all projects on the Organization. 5. Additionally, set the production policies on the ג€Productionג€ folder.
   • D1. Designate the Organization for production projects only. 2. Ensure that developers do not have the Project Creator IAM role on the Organization. 3. Create development projects outside of the Organization using the developer Google Workspace accounts. 4. Set the policies for all projects on the Organization. 5. Additionally, set the production policies on the individual production projects.

   Show answer

   Answer: C

   Explanation

   I would recommend option C, creating two folders under the Organization resource named "Development" and "Production" and placing developer and production projects in the respective folders. This approach would allow you to centrally manage policies for all projects, while also being able to set more restrictive policies for production projects. It would also allow you to easily move projects between the Development and Production folders as business needs change, without disrupting users or developers. Option D, designating the Organization for production projects only, would not allow developers to create projects within the Organization and could lead to confusion around project ownership and management. It would also make it more difficult to move projects between development and production environments.

   Source: Adapted from community discussion — omermahgoub

   References

   • Google Cloud documentation

   Next question

2. Question 82 · 335 in bank

   Your company has an application running on Compute Engine that allows users to play their favorite music. There are a fixed number of instances. Files are stored in Cloud Storage, and data is streamed directly to users. Users are reporting that they sometimes need to attempt to play popular songs multiple times before they are successful. You need to improve the performance of the application. What should you do?

   • A1. Mount the Cloud Storage bucket using gcsfuse on all backend Compute Engine instances. 2. Serve music files directly from the backend Compute Engine instance.
   • B1. Create a Cloud Filestore NFS volume and attach it to the backend Compute Engine instances. 2. Download popular songs in Cloud Filestore. 3. Serve music files directly from the backend Compute Engine instance.
   • C1. Copy popular songs into CloudSQL as a blob. 2. Update application code to retrieve data from CloudSQL when Cloud Storage is overloaded.
   • D1. Create a managed instance group with Compute Engine instances. 2. Create a global load balancer and configure it with two backends: ג—‹ Managed instance group ג—‹ Cloud Storage bucket 3. Enable Cloud CDN on the bucket backend.

   Show answer

   Answer: D

   Explanation

   The correct answer is: D. Create a managed instance group with Compute Engine instances. Create a global load balancer and configure it with two backends: Managed instance group, Cloud Storage bucket. Enable Cloud CDN on the bucket backend. This solution will improve the performance of the application by: Automatically scaling the number of Compute Engine instances to meet demand. Distributing traffic across multiple instances to reduce load on each instance. Caching popular songs in memory to reduce the number of times that they need to be loaded from Cloud Storage. Using a global load balancer to distribute traffic evenly across all regions. Using Cloud CDN to deliver files to users from a location that is closer to them. This solution is the most efficient and cost-effective way to improve the performance of the application.

   Source: Adapted from community discussion — CGS22

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

3. Question 83 · 335 in bank

   The operations team in your company wants to save Cloud VPN log events for one year. You need to configure the cloud infrastructure to save the logs. What should you do?

   • ASet up a filter in Cloud Logging and a Cloud Storage bucket as an export target for the logs you want to save.
   • BEnable the Compute Engine API, and then enable logging on the firewall rules that match the traffic you want to save.
   • CSet up a Cloud Logging Dashboard titled Cloud VPN Logs, and then add a chart that queries for the VPN metrics over a one-year time period.
   • DSet up a filter in Cloud Logging and a topic in Pub/Sub to publish the logs.

   Show answer

   Answer: A

   Explanation

   A Is correct. Set up a filter in Cloud Logging and a Cloud Storage bucket as an export target for the logs you want to save. Filter in Cloud Loggin for specific content, and Cloud Storage for storage.

   Source: Adapted from community discussion — edilramos

   References

   • Google Cloud documentation

   Next question

4. Question 84 · 335 in bank

   You are working with a data warehousing team that performs data analysis. The team needs to process data from external partners, but the data contains personally identifiable information (PII). You need to process and store the data without storing any of the PIIE data. What should you do?

   • ACreate a Dataflow pipeline to retrieve the data from the external sources. As part of the pipeline, use the Cloud Data Loss Prevention (Cloud DLP) API to remove any PII data. Store the result in BigQuery.
   • BCreate a Dataflow pipeline to retrieve the data from the external sources. As part of the pipeline, store all non-PII data in BigQuery and store all PII data in a Cloud Storage bucket that has a retention policy set.
   • CAsk the external partners to upload all data on Cloud Storage. Configure Bucket Lock for the bucket. Create a Dataflow pipeline to read the data from the bucket. As part of the pipeline, use the Cloud Data Loss Prevention (Cloud DLP) API to remove any PII data. Store the result in BigQuery.
   • DAsk the external partners to import all data in your BigQuery dataset. Create a dataflow pipeline to copy the data into a new table. As part of the Dataflow bucket, skip all data in columns that have PII data

   Show answer

   Answer: A

   Explanation

   The correct answer is A. Option C seems to be an option, but there are two non-conformities there. In addition to storing personal data in the GCS, it is being improperly retained.

   Source: Adapted from community discussion — edilramos

   Next question

5. Question 85 · 335 in bank

   You want to allow your operations team to store logs from all the production projects in your Organization, without including logs from other projects. All of the production projects are contained in a folder. You want to ensure that all logs for existing and new production projects are captured automatically. What should you do?

   • ACreate an aggregated export on the Production folder. Set the log sink to be a Cloud Storage bucket in an operations project.
   • BCreate an aggregated export on the Organization resource. Set the log sink to be a Cloud Storage bucket in an operations project.
   • CCreate log exports in the production projects. Set the log sinks to be a Cloud Storage bucket in an operations project.
   • DCreate log exports in the production projects. Set the log sinks to be BigQuery datasets in the production projects, and grant IAM access to the operations team to run queries on the datasets.

   Show answer

   Answer: A

   Explanation

   The correct answer is: A. Create an aggregated export on the Production folder. Set the log sink to be a Cloud Storage bucket in an operations project. This solution will allow the operations team to store logs from all the production projects in your Organization, without including logs from other projects. All of the production projects are contained in a folder, so you can create an aggregated export on the Production folder. You can then set the log sink to be a Cloud Storage bucket in an operations project. This will allow the operations team to store all of the logs from the production projects in one place.

   Source: Adapted from community discussion — CGS22

   References

   • Google Cloud documentation

   Next question

6. Question 86 · 335 in bank

   Your company has an application that is running on multiple instances of Compute Engine. It generates 1 TB per day of logs. For compliance reasons, the logs need to be kept for at least two years. The logs need to be available for active query for 30 days. After that, they just need to be retained for audit purposes. You want to implement a storage solution that is compliant, minimizes costs, and follows Google-recommended practices. What should you do?

   • A1. Install a Cloud Logging agent on all instances. 2. Create a sink to export logs into a regional Cloud Storage bucket. 3. Create an Object Lifecycle rule to move files into a Coldline Cloud Storage bucket after one month. 4. Configure a retention policy at the bucket level using bucket lock.
   • B1. Write a daily cron job, running on all instances, that uploads logs into a Cloud Storage bucket. 2. Create a sink to export logs into a regional Cloud Storage bucket. 3. Create an Object Lifecycle rule to move files into a Coldline Cloud Storage bucket after one month.
   • C1. Install a Cloud Logging agent on all instances. 2. Create a sink to export logs into a partitioned BigQuery table. 3. Set a time_partitioning_expiration of 30 days.
   • D1. Create a daily cron job, running on all instances, that uploads logs into a partitioned BigQuery table. 2. Set a time_partitioning_expiration of 30 days.

   Show answer

   Answer: A

   Explanation

   The answer is A. The practice for managing logs generated on Compute Engine on Google Cloud is to install the Cloud Logging agent and send them to Cloud Logging. The sent logs will be aggregated into a Cloud Logging sink and exported to Cloud Storage. The reason for using Cloud Storage as the destination for the logs is that the requirement in question requires setting up a lifecycle based on the storage period. In this case, the log will be used for active queries for 30 days after it is saved, but after that, it needs to be stored for a longer period of time for auditing purposes. If the data is to be used for active queries, we can use BigQuery's Cloud Storage data query feature and move the data past 30 days to Coldline to build a cost-optimal solution. Therefore, the correct answer is as follows 1. Install the Cloud Logging agent on all instances. Create a sync that exports the logs to the region's Cloud Storage bucket. 3. Create an Object Lifecycle rule to move the files to the Coldline Cloud Storage bucket after one month. 4. 4. set up a bucket-level retention policy using bucket locking."

   Source: Adapted from community discussion — gggsrs

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

7. Question 87 · 335 in bank

   Your company has just recently activated Cloud Identity to manage users. The Google Cloud Organization has been configured as well. The security team needs to secure projects that will be part of the Organization. They want to prohibit IAM users outside the domain from gaining permissions from now on. What should they do?

   • AConfigure an organization policy to restrict identities by domain.
   • BConfigure an organization policy to block creation of service accounts.
   • CConfigure Cloud Scheduler to trigger a Cloud Function every hour that removes all users that don't belong to the Cloud Identity domain from all projects.
   • DCreate a technical user (e.g., crawler@yourdomain.com), and give it the project owner role at root organization level. Write a bash script that: ג€¢ Lists all the IAM rules of all projects within the organization. ג€¢ Deletes all users that do not belong to the company domain. Create a Compute Engine instance in a project within the Organization and configure gcloud to be executed with technical user credentials. Configure a cron job that executes the bash script every hour.

   Show answer

   Answer: A

   Explanation

   The correct answer is: A. Configure an organization policy to restrict identities by domain. This solution will allow the security team to secure projects that will be part of the Organization by prohibiting IAM users outside the domain from gaining permissions. The other options are not as efficient or effective. Option B would not be efficient, as it would block the creation of all service accounts, which are necessary for some applications. Option C would not be effective, as it would not prevent IAM users from gaining permissions, as it would only remove users that do not belong to the Cloud Identity domain from all projects. Option D would not be efficient, as it would require a Compute Engine instance to be created and a cron job to be configured, which would add complexity and cost to the solution.

   Source: Adapted from community discussion — CGS22

   References

   • Google Cloud documentation

   Next question

8. Question 88 · 335 in bank

   Your company has an application running on Google Cloud that is collecting data from thousands of physical devices that are globally distributed. Data is published to Pub/Sub and streamed in real time into an SSD Cloud Bigtable cluster via a Dataflow pipeline. The operations team informs you that your Cloud Bigtable cluster has a hotspot, and queries are taking longer than expected. You need to resolve the problem and prevent it from happening in the future. What should you do?

   • AAdvise your clients to use HBase APIs instead of NodeJS APIs.
   • BDelete records older than 30 days.
   • CReview your RowKey strategy and ensure that keys are evenly spread across the alphabet.
   • DDouble the number of nodes you currently have.

   Show answer

   Answer: C

   Explanation

   C. Review your RowKey strategy and ensure that keys are evenly spread across the alphabet. The RowKey is used to sort data within a Cloud Bigtable cluster. If the keys are not evenly spread across the alphabet, it can result in a hotspot and slow down queries. To prevent this from happening in the future, you should review your RowKey strategy and ensure that keys are evenly spread across the alphabet. This will help to distribute the data evenly across the cluster and improve query performance. Other potential solutions to consider include adding more nodes to the cluster or optimizing your query patterns. However, deleting records older than 30 days or advising clients to use HBase APIs instead of NodeJS APIs would not address the issue of a hotspot in the cluster.

   Source: Adapted from community discussion — omermahgoub

   References

   • Google Cloud documentation
   • Google Cloud documentation

   Next question

9. Question 89 · 335 in bank

   Your company has a Google Cloud project that uses BigQuery for data warehousing. There are some tables that contain personally identifiable information (PII). Only the compliance team may access the PII. The other information in the tables must be available to the data science team. You want to minimize cost and the time it takes to assign appropriate access to the tables. What should you do?

   • A1. From the dataset where you have the source data, create views of tables that you want to share, excluding PII. 2. Assign an appropriate project-level IAM role to the members of the data science team. 3. Assign access controls to the dataset that contains the view.
   • B1. From the dataset where you have the source data, create materialized views of tables that you want to share, excluding PII. 2. Assign an appropriate project-level IAM role to the members of the data science team. 3. Assign access controls to the dataset that contains the view.
   • C1. Create a dataset for the data science team. 2. Create views of tables that you want to share, excluding PII. 3. Assign an appropriate project-level IAM role to the members of the data science team. 4. Assign access controls to the dataset that contains the view. 5. Authorize the view to access the source dataset.
   • D1. Create a dataset for the data science team. 2. Create materialized views of tables that you want to share, excluding PII. 3. Assign an appropriate project-level IAM role to the members of the data science team. 4. Assign access controls to the dataset that contains the view. 5. Authorize the view to access the source dataset.

   Show answer

   Answer: C

   Explanation

   It's definitely C. https://cloud.google.com/bigquery/docs/share-access-views Materialized views are only relevant for speeding up access to data; not for controlling access. Option A would not work because the following link says "Users need the bigquery.tables.getData permission on all tables and views that their query references. In addition, when querying a view users need this permission on all underlying tables and views. However, if you are using authorized views or authorized datasets, you don't need to give users access to the underlying source data." https://cloud.google.com/bigquery/docs/table-access-controls#required_permission_to_query_tables_and_views

   Source: Adapted from community discussion — cloudmon

   References

   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation
   • Google Cloud documentation

   Next question

10. Question 90 · 335 in bank

    Your company is forecasting a sharp increase in the number and size of Apache Spark and Hadoop jobs being run on your local datacenter. You want to utilize the cloud to help you scale this upcoming demand with the least amount of operations work and code change. Which product should you use?

    • AGoogle Cloud Dataflow
    • BGoogle Cloud Dataproc
    • CGoogle Compute Engine
    • DGoogle Kubernetes Engine

    Show answer

    Answer: B

    Explanation

    Dataproc is a managed Spark and Hadoop service that lets you take advantage of open source data tools for batch processing, querying, streaming, and machine learning. Dataproc automation helps you create clusters quickly, manage them easily, and save money by turning clusters off when you don't need them. With less time and money spent on administration, you can focus on your jobs and your data. https://cloud.google.com/dataproc/docs/concepts/overview#:~:text=Dataproc%20is%20a%20managed%20Spark,%2C%20streaming%2C%20and%20machine%20learning.&text=With%20less%20time%20and%20money,your%20jobs%20and%20your%20data.

    Source: Adapted from community discussion — VinayakBudapanahalli

    References

    • Google Cloud documentation
    • Google Cloud documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

PCA practice, question 81. 335 questions available.