Free Google Associate-Cloud-Engineer Exam Questions

Question 1

You are building a product on top of Google Kubernetes Engine (GKE). You have a single GKE cluster. For each of your customers, a Pod is running in that cluster, and your customers can run arbitrary code inside their Pod. You want to maximize the isolation between your customers’ Pods. What should you do?

A : Use Binary Authorization and whitelist only the container images used by your customers’ Pods.

B : Use the Container Analysis API to detect vulnerabilities in the containers used by your customers’ Pods.

C : Create a GKE node pool with a sandbox type configured to gvisor. Add the parameter runtimeClassName: gvisor to the specification of your customers’ Pods.

D : Use the cos_containerd image for your GKE nodes. Add a nodeSelector with the value cloud.google. com/gke-os-distribution: cos_containerd to the specification of your customers’ Pods.

Answer: C

Question 2

You are given a project with a single virtual private cloud (VPC) and a single subnetwork in the us-central1 region. There is a Compute Engine instance hosting an application in thissubnetwork. You need to deploy a new instance in the same project in the europe-west1 region. This new instance needs access to the application. You want to follow Google-recommended practices. What should you do?

A : 1. Create a subnetwork in the same VPC, in europe-west1.2. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint.

B : 1. Create a VPC and a subnetwork in europe-west1.2. Expose the application with an internal load balancer.3. Create the new instance in the new subnetwork and use the load balancer's address as the endpoint.

C : 1. Create a subnetwork in the same VPC, in europe-west1.2. Use Cloud VPN to connect the two subnetworks.3. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint.

D : 1. Create a VPC and a subnetwork in europe-west1.2. Peer the 2 VPCs.3. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint.

Answer: C

Question 3

You want to find out when users were added to Cloud Spanner Identity Access Management (IAM) roles on your Google Cloud Platform (GCP) project. What should you do in the GCP Console?

A : en the Cloud Spanner console to review configurations.

B : en the IAM & admin console to review IAM policies for Cloud Spanner roles.

C : to the Stackdriver Monitoring console and review information for Cloud Spanner.

D : to the Stackdriver Logging console, review admin activity logs, and filter them for Cloud Spanner IAM roles.

Answer: B

Question 4

(You are managing an application deployed on Cloud Run. The development team has released a new version of the application. You want to deploy and redirect traffic to this new version of the application. To ensure traffic to the new version of the application is served with no startup time, you want to ensure that there are two idle instances available for incoming traffic before adjusting the traffic flow. You also want to minimize administrative overhead. What should you do?)

A : Ensure the checkbox "Serve this revision immediately" is unchecked when deploying the new revision. Before changing the traffic rules, use a traffic simulation tool to send load to the new revision.

B : Configure service autoscaling and set the minimum number of instances to 2.

C : Configure revision autoscaling for the new revision and set the minimum number of instances to 2.

D : Configure revision autoscaling for the existing revision and set the minimum number of instances to 2.

Answer: C

Question 5

(You have an application running inside a Compute Engine instance. You want to provide the application with secure access to a BigQuery dataset. You must ensure that credentials are only valid for a short period of time, and your application will only have access to the intended BigQuery dataset. You want to follow Google-recommended practices and minimize your operational costs. What should you do?)

A : Attach a custom service account to the instance, and grant the service account the BigQuery Data Viewer IAM role on the project.

B : Attach a new service account to the instance every hour, and grant the service account the BigQuery Data Viewer IAM role on the dataset.

C : Attach a custom service account to the instance, and grant the service account the BigQuery Data Viewer IAM role on the dataset.

D : Attach a new service account to the instance every hour, and grant the service account the BigQuery Data Viewer IAM role on the project.

Answer: C