🔍

ACE — questions

Page 13 of 17 · 334 total questions.

ACE Question 241

Single page →
Topic 1 · Question 241

You used the gcloud container clusters command to create two Google Cloud Kubernetes (GKE) clusters: prod-cluster and dev-cluster. • prod-cluster is a standard cluster. • dev-cluster is an auto-pilot cluster. When you run the kubectl get nodes command, you only see the nodes from prod-cluster. Which commands should you run to check the node status for dev-cluster?

  • Agcloud container clusters get-credentials dev-clusterkubectl get nodes (correct answer)
  • Bgcloud container clusters update -generate-password dev-cluster kubectl get nodes
  • Ckubectl config set-context dev-clusterkubectl cluster-info
  • Dkubectl config set-credentials dev-clusterkubectl cluster-info
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: gcloud container clusters get-credentials dev-clusterkubectl get nodes.

ACE Question 242

Single page →
Topic 1 · Question 242

You recently discovered that your developers are using many service account keys during their development process. While you work on a long term improvement, you need to quickly implement a process to enforce short-lived service account credentials in your company. You have the following requirements: • All service accounts that require a key should be created in a centralized project called pj-sa. • Service account keys should only be valid for one day. You need a Google-recommended solution that minimizes cost. What should you do?

  • AImplement a Cloud Run job to rotate all service account keys periodically in pj-sa. Enforce an org policy to deny service account key creation with an exception to pj-sa.
  • BImplement a Kubernetes CronJob to rotate all service account keys periodically. Disable attachment of service accounts to resources in all projects with an exception to pj-sa.
  • CEnforce an org policy constraint allowing the lifetime of service account keys to be 24 hours. Enforce an org policy constraint denying service account key creation with an exception on pj-sa. (correct answer)
  • DEnforce a DENY org policy constraint over the lifetime of service account keys for 24 hours. Disable attachment of service accounts to resources in all projects with an exception to pj-sa.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Enforce an org policy constraint allowing the lifetime of service account keys to be 24 hours. Enforce an org policy constraint denying service account key creation with an exception on pj-sa.

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely.

ACE Question 243

Single page →
Topic 1 · Question 243

Your company is running a three-tier web application on virtual machines that use a MySQL database. You need to create an estimated total cost of cloud infrastructure to run this application on Google Cloud instances and Cloud SQL. What should you do?

  • ACreate a Google spreadsheet with multiple Google Cloud resource combinations. On a separate sheet, import the current Google Cloud prices and use these prices for the calculations within formulas.
  • BUse the Google Cloud Pricing Calculator and select the Cloud Operations template to define your web application with as much detail as possible.
  • CImplement a similar architecture on Google Cloud, and run a reasonable load test on a smaller scale. Check the billing information, and calculate the estimated costs based on the real load your system usually handles.
  • DUse the Google Cloud Pricing Calculator to determine the cost of every Google Cloud resource you expect to use. Use similar size instances for the web server, and use your current on-premises machines as a comparison for Cloud SQL. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use the Google Cloud Pricing Calculator to determine the cost of every Google Cloud resource you expect to use. Use similar size instances for the web server, and use your current on-premises machines as a comparison...

Explanation

Cloud SQL is a managed relational database (MySQL/PostgreSQL/SQL Server) that handles patching, backups, and failover.

ACE Question 244

Single page →
Topic 1 · Question 244

You have a Bigtable instance that consists of three nodes that store personally identifiable information (PII) data. You need to log all read or write operations, including any metadata or configuration reads of this database table, in your company’s Security Information and Event Management (SIEM) system. What should you do?

  • A• Navigate to Cloud Monitoring in the Google Cloud console, and create a custom monitoring job for the Bigtable instance to track all changes.• Create an alert by using webhook endpoints, with the SIEM endpoint as a receiver.
  • B• Navigate to the Audit Logs page in the Google Cloud console, and enable Admin Write logs for the Bigtable instance.• Create a Cloud Functions instance to export logs from Cloud Logging to your SIEM.
  • C• Navigate to the Audit Logs page in the Google Cloud console, and enable Data Read, Data Write and Admin Read logs for the Bigtable instance.• Create a Pub/Sub topic as a Cloud Logging sink destination, and add your SIEM as a subscriber to the topic. (correct answer)
  • D• Install the Ops Agent on the Bigtable instance during configuration.• Create a service account with read permissions for the Bigtable instance.• Create a custom Dataflow job with this service account to export logs to the company’s SIEM system.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: • Navigate to the Audit Logs page in the Google Cloud console, and enable Data Read, Data Write and Admin Read logs for the Bigtable instance.• Create a Pub/Sub topic as a Cloud Logging sink destination, and add your...

Explanation

Cloud Bigtable is a managed, low-latency NoSQL wide-column store for very high-throughput workloads. Pub/Sub is a serverless, global messaging service that decouples services and ingests high-volume event streams. Cloud Logging centralizes, stores, and analyzes logs across services.

ACE Question 245

Single page →
Topic 1 · Question 245

You want to set up a Google Kubernetes Engine cluster. Verifiable node identity and integrity are required for the cluster, and nodes cannot be accessed from the internet. You want to reduce the operational cost of managing your cluster, and you want to follow Google-recommended practices. What should you do?

  • ADeploy a private autopilot cluster. (correct answer)
  • BDeploy a public autopilot cluster.
  • CDeploy a standard public cluster and enable shielded nodes.
  • DDeploy a standard private cluster and enable shielded nodes.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Deploy a private autopilot cluster.

ACE Question 246

Single page →
Topic 1 · Question 246

Your company wants to migrate their on-premises workloads to Google Cloud. The current on-premises workloads consist of: • A Flask web application • A backend API • A scheduled long-running background job for ETL and reporting You need to keep operational costs low. You want to follow Google-recommended practices to migrate these workloads to serverless solutions on Google Cloud. What should you do?

  • AMigrate the web application to App Engine and the backend API to Cloud Run. Use Cloud Tasks to run your background job on Compute Engine.
  • BMigrate the web application to App Engine and the backend API to Cloud Run. Use Cloud Tasks to run your background job on Cloud Run. (correct answer)
  • CRun the web application on a Cloud Storage bucket and the backend API on Cloud Run. Use Cloud Tasks to run your background job on Cloud Run.
  • DRun the web application on a Cloud Storage bucket and the backend API on Cloud Run. Use Cloud Tasks to run your background job on Compute Engine.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Migrate the web application to App Engine and the backend API to Cloud Run. Use Cloud Tasks to run your background job on Cloud Run.

Explanation

Cloud Run runs stateless containers serverlessly and scales to zero, minimizing operational overhead. App Engine is a fully managed platform that runs and autoscales web apps with little operational effort.

ACE Question 247

Single page →
Topic 1 · Question 247

Your company is moving its continuous integration and delivery (CI/CD) pipeline to Compute Engine instances. The pipeline will manage the entire cloud infrastructure through code. How can you ensure that the pipeline has appropriate permissions while your system is following security best practices?

  • A• Attach a single service account to the compute instances.• Add minimal rights to the service account.• Allow the service account to impersonate a Cloud Identity user with elevated permissions to create, update, or delete resources.
  • B• Add a step for human approval to the CI/CD pipeline before the execution of the infrastructure provisioning.• Use the human approvals IAM account for the provisioning.
  • C• Attach a single service account to the compute instances.• Add all required Identity and Access Management (IAM) permissions to this service account to create, update, or delete resources.
  • D• Create multiple service accounts, one for each pipeline with the appropriate minimal Identity and Access Management (IAM) permissions.• Use a secret manager service to store the key files of the service accounts.• Allow the CI/CD pipeline to request the appropriate secrets during the execution of the pipeline. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: • Create multiple service accounts, one for each pipeline with the appropriate minimal Identity and Access Management (IAM) permissions.• Use a secret manager service to store the key files of the service accounts.• A...

Explanation

A service account provides an identity for workloads to access Google Cloud APIs securely. Cloud IAM grants fine-grained, least-privilege access to Google Cloud resources. Secret Manager stores and controls access to secrets such as API keys and credentials.

ACE Question 248

Single page →
Topic 1 · Question 248

Your application stores files on Cloud Storage by using the Standard Storage class. The application only requires access to files created in the last 30 days. You want to automatically save costs on files that are no longer accessed by the application. What should you do?

  • ACreate an object lifecycle on the storage bucket to change the storage class to Archive Storage for objects with an age over 30 days. (correct answer)
  • BCreate a cron job in Cloud Scheduler to call a Cloud Functions instance every day to delete files older than 30 days.
  • CCreate a retention policy on the storage bucket of 30 days, and lock the bucket by using a retention policy lock.
  • DEnable object versioning on the storage bucket and add lifecycle rules to expire non-current versions after 30 days.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an object lifecycle on the storage bucket to change the storage class to Archive Storage for objects with an age over 30 days.

ACE Question 249

Single page →
Topic 1 · Question 249

Your manager asks you to deploy a workload to a Kubernetes cluster. You are not sure of the workload's resource requirements or how the requirements might vary depending on usage patterns, external dependencies, or other factors. You need a solution that makes cost-effective recommendations regarding CPU and memory requirements, and allows the workload to function consistently in any situation. You want to follow Google-recommended practices. What should you do?

  • AConfigure the Horizontal Pod Autoscaler for availability, and configure the cluster autoscaler for suggestions.
  • BConfigure the Horizontal Pod Autoscaler for availability, and configure the Vertical Pod Autoscaler recommendations for suggestions. (correct answer)
  • CConfigure the Vertical Pod Autoscaler recommendations for availability, and configure the Cluster autoscaler for suggestions.
  • DConfigure the Vertical Pod Autoscaler recommendations for availability, and configure the Horizontal Pod Autoscaler for suggestions.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Configure the Horizontal Pod Autoscaler for availability, and configure the Vertical Pod Autoscaler recommendations for suggestions. This option delivers the requirement at the lowest cost.

ACE Question 250

Single page →
Topic 1 · Question 250

You need to migrate invoice documents stored on-premises to Cloud Storage. The documents have the following storage requirements: • Documents must be kept for five years. • Up to five revisions of the same invoice document must be stored, to allow for corrections. • Documents older than 365 days should be moved to lower cost storage tiers. You want to follow Google-recommended practices to minimize your operational and development costs. What should you do?

  • AEnable retention policies on the bucket, and use Cloud Scheduler to invoke a Cloud Function to move or delete your documents based on their metadata.
  • BEnable retention policies on the bucket, use lifecycle rules to change the storage classes of the objects, set the number of versions, and delete old files.
  • CEnable object versioning on the bucket, and use Cloud Scheduler to invoke a Cloud Functions instance to move or delete your documents based on their metadata.
  • DEnable object versioning on the bucket, use lifecycle conditions to change the storage class of the objects, set the number of versions, and delete old files. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Enable object versioning on the bucket, use lifecycle conditions to change the storage class of the objects, set the number of versions, and delete old files.

ACE Question 251

Single page →
Topic 1 · Question 251

You installed the Google Cloud CLI on your workstation and set the proxy configuration. However, you are worried that your proxy credentials will be recorded in the gcloud CLI logs. You want to prevent your proxy credential from being logged. What should you do?

  • AConfigure username and password by using gcloud config set proxy/username and gcloud config set proxy/password commands.
  • BEncode username and password in sha256 encoding, and save in to a text file. Use filename as a value in the gcloud config set core/custom_ca_certs_file command.
  • CProvide values for CLOUDSDK_PROXY_USERNAME and CLOUDSDK_PROXY_PASSWORD in the gcloud CLI tool configuration file.
  • DSet the CLOUDSDK_PROXY_USERNAME and CLOUDSDK_PROXY_PASSWORD properties by using environment variables in your command line tool. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Set the CLOUDSDK_PROXY_USERNAME and CLOUDSDK_PROXY_PASSWORD properties by using environment variables in your command line tool.

ACE Question 252

Single page →
Topic 1 · Question 252

Your company developed an application to deploy on Google Kubernetes Engine. Certain parts of the application are not fault-tolerant and are allowed to have downtime. Other parts of the application are critical and must always be available. You need to configure a Google Kubernetes Engine cluster while optimizing for cost. What should you do?

  • ACreate a cluster with a single node-pool by using standard VMs. Label he fault-tolerant Deployments as spot_true.
  • BCreate a cluster with a single node-pool by using Spot VMs. Label the critical Deployments as spot_false.
  • CCreate a cluster with both a Spot VM node pool and a node pool by using standard VMs. Deploy the critical deployments on the Spot VM node pool and the fault-tolerant deployments on the node pool by using standard VMs.
  • DCreate a cluster with both a Spot VM node pool and a nods pool by using standard VMs. Deploy the critical deployments on the node pool by using standard VMs and the fault-tolerant deployments on the Spot VM node pool. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create a cluster with both a Spot VM node pool and a nods pool by using standard VMs. Deploy the critical deployments on the node pool by using standard VMs and the fault-tolerant deployments on the Spot VM node pool.

Explanation

Spot VMs use spare capacity at a large discount for fault-tolerant, interruptible workloads. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

ACE Question 253

Single page →
Topic 1 · Question 253

You need to deploy an application in Google Cloud using serverless technology. You want to test a new version of the application with a small percentage of production traffic. What should you do?

  • ADeploy the application to Cloud Run. Use gradual rollouts for traffic splitting. (correct answer)
  • BDeploy the application to Google Kubernetes Engine. Use Anthos Service Mash for traffic splitting.
  • CDeploy the application to Cloud Functions. Specify the version number in the functions name.
  • DDeploy the application to App Engine. For each new version, create a new service.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Deploy the application to Cloud Run. Use gradual rollouts for traffic splitting.

Explanation

Cloud Run runs stateless containers serverlessly and scales to zero, minimizing operational overhead.

ACE Question 254

Single page →
Topic 1 · Question 254

Your company's security vulnerability management policy wants a member of the security team to have visibility into vulnerabilities and other OS metadata for a specific Compute Engine instance. This Compute Engine instance hosts a critical application in your Google Cloud project. You need to implement your company's security vulnerability management policy. What should you do?

  • A• Ensure that the Ops Agent is installed on the Compute Engine instance.• Create a custom metric in the Cloud Monitoring dashboard.• Provide the security team member with access to this dashboard.
  • B• Ensure that the Ops Agent is installed on the Compute Engine instance.• Provide the security team member roles/osconfig.inventoryViewer permission.
  • C• Ensure that the OS Config agent is installed on the Compute Engine instance.• Provide the security team member roles/osconfig.vulnerabilityReportViewer permission. (correct answer)
  • D• Ensure that the OS Config agent is installed on the Compute Engine instance.• Create a log sink to BigQuery dataset.• Provide the security team member with access to this dataset.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: • Ensure that the OS Config agent is installed on the Compute Engine instance.• Provide the security team member roles/osconfig.vulnerabilityReportViewer permission.

Explanation

Compute Engine provides configurable virtual machines when you need full control of the OS.

ACE Question 255

Single page →
Topic 1 · Question 255

You want to enable your development team to deploy new features to an existing Cloud Run service in production. To minimize the risk associated with a new revision, you want to reduce the number of customers who might be affected by an outage without introducing any development or operational costs to your customers. You want to follow Google-recommended practices for managing revisions to a service. What should you do?

  • AAsk your customers to retry access to your service with exponential backoff to mitigate any potential problems after the new revision is deployed.
  • BGradually roll out the new revision and split customer traffic between the revisions to allow rollback in case a problem occurs. (correct answer)
  • CSend all customer traffic to the new revision, and roll back to a previous revision if you witness any problems in production.
  • DDeploy your application to a second Cloud Run service, and ask your customers to use the second Cloud Run service.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Gradually roll out the new revision and split customer traffic between the revisions to allow rollback in case a problem occurs.

ACE Question 256

Single page →
Topic 1 · Question 256

You have deployed an application on a Compute Engine instance. An external consultant needs to access the Linux-based instance. The consultant is connected to your corporate network through a VPN connection, but the consultant has no Google account. What should you do?

  • AInstruct the external consultant to use the gcloud compute ssh command line tool by using Identity-Aware Proxy to access the instance.
  • BInstruct the external consultant to use the gcloud compute ssh command line tool by using the public IP address of the instance to access it.
  • CInstruct the external consultant to generate an SSH key pair, and request the public key from the consultant. Add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key. (correct answer)
  • DInstruct the external consultant to generate an SSH key pair, and request the private key from the consultant. Add the private key to the instance yourself, and have the consultant access the instance through SSH with their public key.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Instruct the external consultant to generate an SSH key pair, and request the public key from the consultant. Add the public key to the instance yourself, and have the consultant access the instance through SSH with t...

ACE Question 257

Single page →
Topic 1 · Question 257

After a recent security incident, your startup company wants better insight into what is happening in the Google Cloud environment. You need to monitor unexpected firewall changes and instance creation. Your company prefers simple solutions. What should you do?

  • ACreate a log sink to forward Cloud Audit Logs filtered for firewalls and compute instances to Cloud Storage. Use BigQuery to periodically analyze log events in the storage bucket.
  • BUse Cloud Logging filters to create log-based metrics for firewall and instance actions. Monitor the changes and set up reasonable alerts. (correct answer)
  • CInstall Kibana on a compute instance. Create a log sink to forward Cloud Audit Logs filtered for firewalls and compute instances to Pub/Sub. Target the Pub/Sub topic to push messages to the Kibana instance. Analyze the logs on Kibana in real time.
  • DTurn on Google Cloud firewall rules logging, and set up alerts for any insert, update, or delete events.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use Cloud Logging filters to create log-based metrics for firewall and instance actions. Monitor the changes and set up reasonable alerts.

Explanation

Cloud Logging centralizes, stores, and analyzes logs across services.

ACE Question 258

Single page →
Topic 1 · Question 258

You are configuring service accounts for an application that spans multiple projects. Virtual machines (VMs) running in the web-applications project need access to BigQuery datasets in the crm-databases project. You want to follow Google-recommended practices to grant access to the service account in the web-applications project. What should you do?

  • AGrant "project owner" for web-applications appropriate roles to crm-databases.
  • BGrant "project owner" role to crm-databases and the web-applications project.
  • CGrant "project owner" role to crm-databases and roles/bigquery.dataViewer role to web-applications.
  • DGrant roles/bigquery.dataViewer role to crm-databases and appropriate roles to web-applications. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Grant roles/bigquery.dataViewer role to crm-databases and appropriate roles to web-applications.

Explanation

BigQuery is a serverless, petabyte-scale data warehouse for fast SQL analytics with no infrastructure to manage.

ACE Question 259

Single page →
Topic 1 · Question 259

Your Dataproc cluster runs in a single Virtual Private Cloud (VPC) network in a single subnetwork with range 172.16.20.128/25. There are no private IP addresses available in the subnetwork. You want to add new VMs to communicate with your cluster using the minimum number of steps. What should you do?

  • AModify the existing subnet range to 172.16.20.0/24. (correct answer)
  • BCreate a new Secondary IP Range in the VPC and configure the VMs to use that range.
  • CCreate a new VPC network for the VMs. Enable VPC Peering between the VMs'VPC network and the Dataproc cluster VPC network.
  • DCreate a new VPC network for the VMs with a subnet of 172.32.0.0/16. Enable VPC network Peering between the Dataproc VPC network and the VMs VPC network. Configure a custom Route exchange.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Modify the existing subnet range to 172.16.20.0/24.

ACE Question 260

Single page →
Topic 1 · Question 260

You are building a backend service for an ecommerce platform that will persist transaction data from mobile and web clients. After the platform is launched, you expect a large volume of global transactions. Your business team wants to run SQL queries to analyze the data. You need to build a highly available and scalable data store for the platform. What should you do?

  • ACreate a multi-region Cloud Spanner instance with an optimized schema. (correct answer)
  • BCreate a multi-region Firestore database with aggregation query enabled.
  • CCreate a multi-region Cloud SQL for PostgreSQL database with optimized indexes.
  • DCreate a multi-region BigQuery dataset with optimized tables.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create a multi-region Cloud Spanner instance with an optimized schema.

Explanation

Cloud Spanner is a horizontally scalable, strongly consistent relational database with global reach. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

Showing questions 241–260 of 334 · Page 13 of 17