ACE : Associate Cloud Engineer Associate Cloud Engineer : Part 09
-
You are performing a monthly security check of your Google Cloud environment and want to know who has access to view data stored in your Google Cloud Project. What should you do?
- Enable Audit Logs for all APIs that are related to data storage.
- Review the IAM permissions for any role that allows for data access.
- Review the Identity-Aware Proxy settings for each resource.
- Create a Data Loss Prevention job.
Explanation:
Reference:
https://cloud.google.com/compute/docs/access
-
Your company has embraced a hybrid cloud strategy where some of the applications are deployed on Google Cloud. A Virtual Private Network (VPN) tunnel connects your Virtual Private Cloud (VPC) in Google Cloud with your company’s on-premises network. Multiple applications in Google Cloud need to connect to an on-premises database server, and you want to avoid having to change the IP configuration in all of your applications when the IP of the database changes. What should you do?
- Configure Cloud NAT for all subnets of your VPC to be used when egressing from the VM instances.
- Create a private zone on Cloud DNS, and configure the applications with the DNS name.
- Configure the IP of the database as custom metadata for each instance, and query the metadata server.
- Query the Compute Engine internal DNS from the applications to retrieve the IP of the database.
-
You have developed a containerized web application that will serve internal colleagues during business hours. You want to ensure that no costs are incurred outside of the hours the application is used. You have just created a new Google Cloud project and want to deploy the application. What should you do?
- Deploy the container on Cloud Run for Anthos, and set the minimum number of instances to zero.
- Deploy the container on Cloud Run (fully managed), and set the minimum number of instances to zero.
- Deploy the container on App Engine flexible environment with autoscaling, and set the value
min_instances
to zero in the app.yaml. - Deploy the container on App Engine flexible environment with manual scaling, and set the value
instances
to zero in the app.yaml.
-
You have experimented with Google Cloud using your own credit card and expensed the costs to your company. Your company wants to streamline the billing process and charge the costs of your projects to their monthly invoice. What should you do?
- Grant the financial team the IAM role of “Billing Account User” on the billing account linked to your credit card.
- Set up BigQuery billing export and grant your financial department IAM access to query the data.
- Create a ticket with Google Billing Support to ask them to send the invoice to your company.
- Change the billing account of your projects to the billing account of your company.
-
You are running a data warehouse on BigQuery. A partner company is offering a recommendation engine based on the data in your data warehouse. The partner company is also running their application on Google Cloud. They manage the resources in their own project, but they need access to the BigQuery dataset in your project. You want to provide the partner company with access to the dataset. What should you do?
- Create a Service Account in your own project, and grant this Service Account access to BigQuery in your project.
- Create a Service Account in your own project, and ask the partner to grant this Service Account access to BigQuery in their project.
- Ask the partner to create a Service Account in their project, and have them give the Service Account access to BigQuery in their project.
- Ask the partner to create a Service Account in their project, and grant their Service Account access to the BigQuery dataset in your project.
-
Your web application has been running successfully on Cloud Run for Anthos. You want to evaluate an updated version of the application with a specific percentage of your production users (canary deployment). What should you do?
- Create a new service with the new version of the application. Split traffic between this version and the version that is currently running.
- Create a new revision with the new version of the application. Split traffic between this version and the version that is currently running.
- Create a new service with the new version of the application. Add HTTP Load Balancer in front of both services.
- Create a new revision with the new version of the application. Add HTTP Load Balancer in front of both revisions.
-
Your company developed a mobile game that is deployed on Google Cloud. Gamers are connecting to the game with their personal phones over the Internet. The game sends UDP packets to update the servers about the gamers’ actions while they are playing in multiplayer mode. Your game backend can scale over multiple virtual machines (VMs), and you want to expose the VMs over a single IP address. What should you do?
- Configure an SSL Proxy load balancer in front of the application servers.
- Configure an Internal UDP load balancer in front of the application servers.
- Configure an External HTTP(s) load balancer in front of the application servers.
- Configure an External Network load balancer in front of the application servers.
Explanation:Reference:https://cloud.google.com/solutions/connecting-securely -
You are working for a hospital that stores its medical images in an on-premises data room. The hospital wants to use Cloud Storage for archival storage of these images. The hospital wants an automated process to upload any new medical images to Cloud Storage. You need to design and implement a solution. What should you do?
- Create a Pub/Sub topic, and enable a Cloud Storage trigger for the Pub/Sub topic. Create an application that sends all medical images to the Pub/Sub topic.
- Deploy a Dataflow job from the batch template, “Datastore to Cloud Storage.” Schedule the batch job on the desired interval.
- Create a script that uses the
gsutil
command line interface to synchronize the on-premises storage with Cloud Storage. Schedule the script as a cron job. - In the Cloud Console, go to Cloud Storage. Upload the relevant images to the appropriate bucket.
-
Your auditor wants to view your organization’s use of data in Google Cloud. The auditor is most interested in auditing who accessed data in Cloud Storage buckets. You need to help the auditor access the data they need. What should you do?
- Turn on Data Access Logs for the buckets they want to audit, and then build a query in the log viewer that filters on Cloud Storage.
- Assign the appropriate permissions, and then create a Data Studio report on Admin Activity Audit Logs.
- Assign the appropriate permissions, and the use Cloud Monitoring to review metrics.
- Use the export logs API to provide the Admin Activity Audit Logs in the format they want.
Explanation:Reference:https://cloud.google.com/storage/docs/audit-logging -
You received a JSON file that contained a private key of a Service Account in order to get access to several resources in a Google Cloud project. You downloaded and installed the Cloud SDK and want to use this private key for authentication and authorization when performing gcloud commands. What should you do?
- Use the command
gcloud auth login
and point it to the private key. - Use the command
gcloud auth activate-service-account
and point it to the private key. - Place the private key file in the installation directory of the Cloud SDK and rename it to “credentials.json”.
- Place the private key file in your home directory and rename it to “GOOGLE_APPLICATION_CREDENTIALS”.
Explanation:Reference:https://cloud.google.com/sdk/docs/authorizing - Use the command
-
You are working with a Cloud SQL MySQL database at your company. You need to retain a month-end copy of the database for three years for audit purposes. What should you do?
- Set up an export job for the first of the month. Write the export file to an Archive class Cloud Storage bucket.
- Save the automatic first-of-the-month backup for three years. Store the backup file in an Archive class Cloud Storage bucket.
- Set up an on-demand backup for the first of the month. Write the backup to an Archive class Cloud Storage bucket.
- Convert the automatic first-of-the-month backup to an export file. Write the export file to a Coldline class Cloud Storage bucket.
-
You are monitoring an application and receive user feedback that a specific error is spiking. You notice that the error is caused by a Service Account having insufficient permissions. You are able to solve the problem but want to be notified if the problem recurs. What should you do?
- In the Log Viewer, filter the logs on severity ‘Error’ and the name of the Service Account.
- Create a sink to BigQuery to export all the logs. Create a Data Studio dashboard on the exported logs.
- Create a custom log-based metric for the specific error to be used in an Alerting Policy.
- Grant Project Owner access to the Service Account.
Explanation:Reference:https://cloud.google.com/logging/docs/view/advanced-queries -
You are developing a financial trading application that will be used globally. Data is stored and queried using a relational structure, and clients from all over the world should get the exact identical state of the data. The application will be deployed in multiple regions to provide the lowest latency to end users. You need to select a storage option for the application data while minimizing latency. What should you do?
- Use Cloud Bigtable for data storage.
- Use Cloud SQL for data storage.
- Use Cloud Spanner for data storage.
- Use Firestore for data storage.
Explanation:Reference:https://cloud.google.com/solutions/best-practices-compute-engine-region-selection -
You are about to deploy a new Enterprise Resource Planning (ERP) system on Google Cloud. The application holds the full database in-memory for fast data access, and you need to configure the most appropriate resources on Google Cloud for this application. What should you do?
- Provision preemptible Compute Engine instances.
- Provision Compute Engine instances with GPUs attached.
- Provision Compute Engine instances with local SSDs attached.
- Provision Compute Engine instances with M1 machine type.
Explanation:Reference:https://cloud.google.com/compute/docs/disks/local-ssd -
You have developed an application that consists of multiple microservices, with each microservice packaged in its own Docker container image. You want to deploy the entire application on Google Kubernetes Engine so that each microservice can be scaled individually. What should you do?
- Create and deploy a Custom Resource Definition per microservice.
- Create and deploy a Docker Compose File.
- Create and deploy a Job per microservice.
- Create and deploy a Deployment per microservice.
-
You will have several applications running on different Compute Engine instances in the same project. You want to specify at a more granular level the service account each instance uses when calling Google Cloud APIs. What should you do?
- When creating the instances, specify a Service Account for each instance.
- When creating the instances, assign the name of each Service Account as instance metadata.
- After starting the instances, use
gcloud compute instances update
to specify a Service Account for each instance. - After starting the instances, use
gcloud compute instances update
to assign the name of the relevant Service Account as instance metadata.
-
You are creating an application that will run on Google Kubernetes Engine. You have identified MongoDB as the most suitable database system for your application and want to deploy a managed MongoDB environment that provides a support SLA. What should you do?
- Create a Cloud Bigtable cluster, and use the HBase API.
- Deploy MongoDB Atlas from the Google Cloud Marketplace.
- Download a MongoDB installation package, and run it on Compute Engine instances.
- Download a MongoDB installation package, and run it on a Managed Instance Group.
-
You are managing a project for the Business Intelligence (BI) department in your company. A data pipeline ingests data into BigQuery via streaming. You want the users in the BI department to be able to run the custom SQL queries against the latest data in BigQuery. What should you do?
- Create a Data Studio dashboard that uses the related BigQuery tables as a source and give the BI team view access to the Data Studio dashboard.
- Create a Service Account for the BI team and distribute a new private key to each member of the BI team.
- Use Cloud Scheduler to schedule a batch Dataflow job to copy the data from BigQuery to the BI team’s internal data warehouse.
- Assign the IAM role of BigQuery User to a Google Group that contains the members of the BI team.
-
Your company is moving its entire workload to Compute Engine. Some servers should be accessible through the Internet, and other servers should only be accessible over the internal network. All servers need to be able to talk to each other over specific ports and protocols. The current on-premises network relies on a demilitarized zone (DMZ) for the public servers and a Local Area Network (LAN) for the private servers. You need to design the networking infrastructure on Google Cloud to match these requirements. What should you do?
- 1. Create a single VPC with a subnet for the DMZ and a subnet for the LAN.
2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public ingress traffic for the DMZ. - 1. Create a single VPC with a subnet for the DMZ and a subnet for the LAN.
2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public egress traffic for the DMZ. - 1. Create a VPC with a subnet for the DMZ and another VPC with a subnet for the LAN.
2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public ingress traffic for the DMZ. - 1. Create a VPC with a subnet for the DMZ and another VPC with a subnet for the LAN.
2. Set up firewall rules to open up relevant traffic between the DMZ and the LAN subnets, and another firewall rule to allow public egress traffic for the DMZ.
- 1. Create a single VPC with a subnet for the DMZ and a subnet for the LAN.
-
You have just created a new project which will be used to deploy a globally distributed application. You will use Cloud Spanner for data storage. You want to create a Cloud Spanner instance. You want to perform the first step in preparation of creating the instance. What should you do?
- Enable the Cloud Spanner API.
- Configure your Cloud Spanner instance to be multi-regional.
- Create a new VPC network with subnetworks in all desired regions.
- Grant yourself the IAM role of Cloud Spanner Admin.
Explanation:Reference:https://cloud.google.com/spanner/docs/instances
Subscribe
0 Comments
Newest