Associate-Cloud-Engineer Premium Exam Engine - Download Free PDF Questions
Instant Download Associate-Cloud-Engineer Free Updated Test Dumps
NEW QUESTION # 109
You want to configure 10 Compute Engine instances for availability when maintenance occurs.
Your requirements state that these instances should attempt to automatically restart if they crash.
Also, the instances should be highly available including during system maintenance. What should you do?
- A. Create an instance template for the instances.
Set the `Automatic Restart' to on. Set the `On-host maintenance' to Migrate VM instance.
Add the instance template to an intsance group. - B. Create an instance group for the instances.
Set the `Autohealing' health check to healthy (HTTP). - C. Create an instance group for the instance.
Verify that the `Advanced creation options' setting for `do not retry machine creation' is set to off. - D. Create an instance template for the instances.
`Automatic Restart' to off. Set `On-host maintenance' to Terminate VM instances.
Add the instance template to an instance group.
Answer: D
NEW QUESTION # 110
A company has a popular multi-player mobile game hosted in its on-premises datacenter. The current infrastructure can no longer keep up with demand and the company is considering a move to the cloud.
Which solution should a Solutions Architect recommend as the MOST scalable and cost-effective solution to meet these needs?
- A. Amazon EC2 and Amazon Elastic Transcoder
- B. AWS Lambda and Amazon API Gateway
- C. Amazon S3 and Amazon CloudFront
- D. Amazon EC2 and an Application Load Balancer
Answer: B
NEW QUESTION # 111
A colleague handed over a Google Cloud Platform project for you to maintain. As part of a security checkup, you want to review who has been granted the Project Owner role. What should you do?
- A. Enable Audit Logs on the IAM & admin page for all resources, and validate the results.
- B. In the console, validate which SSH keys have been stored as project-wide keys.
- C. Use the command gcloud projects get-iam-policy to view the current role assignments.
- D. Navigate to Identity-Aware Proxy and check the permissions for these resources.
Answer: B
Explanation:
Explanation/Reference: https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys
NEW QUESTION # 112
You have a batch workload that runs every night and uses a large number of virtual machines (VMs). It is fault- tolerant and can tolerate some of the VMs being terminated. The current cost of VMs is too high. What should you do?
- A. Run a test using simulated maintenance events. If the test is successful, use N1 Standard VMs when running future jobs.
- B. Run a test using a managed instance group. If the test is successful, use N1 Standard VMs in the managed instance group when running future jobs.
- C. Run a test using N1 standard VMs instead of N2. If the test is successful, use N1 Standard VMs when running future jobs.
- D. Run a test using simulated maintenance events. If the test is successful, use preemptible N1 Standard VMs when running future jobs.
Answer: A
Explanation:
Reference:
https://cloud.google.com/compute/vm-instance-pricing
NEW QUESTION # 113
You need to configure IAM access audit logging in BigQuery for external auditors. You want to follow Google-recommended practices. What should you do?
- A. Add the auditor user accounts to the 'logging.viewer' and 'bigQuery.dataViewer' predefined IAM roles.
- B. Add the auditors group to the 'logging.viewer' and 'bigQuery.dataViewer' predefined IAM roles.
- C. Add the auditor user accounts to two new custom IAM roles.
- D. Add the auditors group to two new custom IAM roles.
Answer: A
NEW QUESTION # 114
You are the project owner of a GCP project and want to delegate control to colleagues to manage buckets and files in Cloud Storage. You want to follow Google-recommended practices. Which IAM roles should you grant your colleagues?
- A. Project Editor
- B. Storage Object Admin
- C. Storage Admin
- D. Storage Object Creator
Answer: C
Explanation:
Explanation
Storage Admin (roles/storage.admin) Grants full control of buckets and objects.
When applied to an individual bucket, control applies only to the specified bucket and objects within the bucket.
firebase.projects.get
resourcemanager.projects.get
resourcemanager.projects.list
storage.buckets.*
storage.objects.*
https://cloud.google.com/storage/docs/access-control/iam-roles
This role grants full control of buckets and objects. When applied to an individual bucket, control applies only to the specified bucket and objects within the bucket.
Ref: https://cloud.google.com/iam/docs/understanding-roles#storage-roles
NEW QUESTION # 115
Several employees at your company have been creating projects with Cloud Platform and paying for it with their personal credit cards, which the company reimburses. The company wants to centralize all these projects under a single, new billing account. What should you do?
- A. Create a ticket with Google Support and wait for their call to share your credit card details over the phone.
- B. In the Google Platform Console, go to the Resource Manage and move all projects to the root Organizarion.
- C. In the Google Cloud Platform Console, create a new billing account and set up a payment method.
- D. Contact [email protected] with your bank account details and request a corporate billing account for your company.
Answer: C
Explanation:
Explanation/Reference: https://www.whizlabs.com/blog/google-cloud-interview-questions/
NEW QUESTION # 116
You are running a data warehouse on BigQuery. A partner company is offering a recommendation engine based on the data in your data warehouse. The partner company is also running their application on Google Cloud. They manage the resources in their own project, but they need access to the BigQuery dataset in your project. You want to provide the partner company with access to the dataset What should you do?
- A. Ask the partner to create a Service Account in their project, and grant their Service Account access to the BigQuery dataset in your project
- B. Ask the partner to create a Service Account in their project, and have them give the Service Account access to BigQuery in their project
- C. Create a Service Account in your own project, and ask the partner to grant this Service Account access to BigQuery in their project
- D. Create a Service Account in your own project, and grant this Service Account access to BigGuery in your project
Answer: A
Explanation:
Explanation
https://gtseres.medium.com/using-service-accounts-across-projects-in-gcp-cf9473fef8f0#:~:text=Go%20to%20th
NEW QUESTION # 117
You are hosting an application on bare-metal servers in your own data center. The application needs access to Cloud Storage. However, security policies prevent the servers hosting the application from having public IP addresses or access to the internet. You want to follow Google-recommended practices to provide the application with access to Cloud Storage. What should you do?
- A. 1. Using Cloud VPN or Interconnect, create a tunnel to a VPC in GCP.2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel.3. In your on-premises network, configure your DNS server to resolve
*.googleapis.com as a CNAME to restricted.googleapis.com. - B. 1. Use Migrate for Compute Engine (formerly known as Velostrata) to migrate those servers to Compute Engine.2. Create an internal load balancer (ILB) that uses storage.googleapis.com as backend.3.
Configure your new instances to use this ILB as proxy. - C. 1. Use nslookup to get the IP address for storage.googleapis.com.2. Negotiate with the security team to be able to give a public IP address to the servers.3. Only allow egress traffic from those servers to the IP addresses for storage.googleapis.com.
- D. 1. Using Cloud VPN, create a VPN tunnel to a Virtual Private Cloud (VPC) in Google Cloud Platform (GCP).2. In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance.3. Configure your servers to use that instance as a proxy to access Cloud Storage.
Answer: A
Explanation:
Explanation
Our requirement is to follow Google recommended practices to achieve the end result. Configuring Private Google Access for On-Premises Hosts is best achieved by VPN/Interconnect + Advertise Routes + Use restricted Google IP Range.
Using Cloud VPN or Interconnect, create a tunnel to a VPC in GCP
Using Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel.
In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com is the right answer right, and it is what Google recommends.
Ref: https://cloud.google.com/vpc/docs/configure-private-google-access-hybrid You must configure routes so that Google API traffic is forwarded through your Cloud VPN or Cloud Interconnect connection, firewall rules on your on-premises firewall to allow the outgoing traffic, and DNS so that traffic to Google APIs resolves to the IP range youve added to your routes.
You can use Cloud Router Custom Route Advertisement to announce the Restricted Google APIs IP addresses through Cloud Router to your on-premises network. The Restricted Google APIs IP range is
199.36.153.4/30. While this is technically a public IP range, Google does not announce it publicly. This IP range is only accessible to hosts that can reach your Google Cloud projects through internal IP ranges, such as through a Cloud VPN or Cloud Interconnect connection. Without having a public IP address or access to the internet, the only way you could connect to cloud storage is if you have an internal route to it.
So Negotiate with the security team to be able to give public IP addresses to the servers is not right.
Following Google recommended practices is synonymous with using Googles services (Not quite, but it is at least for the exam !!).
So In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance is not right.
Migrating the VM to Compute Engine is a bit drastic when Google says it is perfectly fine to have Hybrid Connectivity architectures https://cloud.google.com/hybrid-connectivity.
So,
Use Migrate for Compute Engine (formerly known as Velostrata) to migrate these servers to Compute Engine is not right.
NEW QUESTION # 118
Your company runs one batch process in an on-premises server that takes around 30 hours to complete. The task runs monthly, can be performed offline, and must be restarted if interrupted.
You want to migrate this workload to the cloud while minimizing cost. What should you do?
- A. Migrate the workload to a Compute Engine VM.
Start and stop the instance as needed. - B. Migrate the workload to a Compute Engine Preemptible VM.
- C. Create an Instance Template with Preemptible VMs On.
Create a Managed Instance Group from the template and adjust Target CPU Utilization.
Migrate the workload. - D. Migrate the workload to a Google Kubernetes Engine cluster with Preemptible nodes.
Answer: A
Explanation:
Install the workload in a compute engine VM, start and stop the instance as needed, because as per the question the VM runs for 30 hours, process can be performed offline and should not be interrupted, if interrupted we need to restart the batch process again. Preemptible VMs are cheaper, but they will not be available beyond 24hrs, and if the process gets interrupted the preemptible VM will restart.
NEW QUESTION # 119
You have an application that receives SSL-encrypted TCP traffic on port 443. Clients for this application are located all over the world. You want to minimize latency for the clients. Which load balancing option should you use?
- A. SSL Proxy Load Balancer
- B. Internal TCP/UDP Load Balancer. Add a firewall rule allowing ingress traffic from 0.0.0.0/0 on the target instances.
- C. Network Load Balancer
- D. HTTPS Load Balancer
Answer: A
Explanation:
Reference:
https://cloud.google.com/load-balancing/docs/ssl
NEW QUESTION # 120
You are creating a Kubernetes Engine cluster to deploy multiple pods inside the cluster. All container logs must be stored in BigQuery for later analysis. You want to follow Google- recommended practices. Which two approaches can you take?
- A. Develop a custom add-on that uses Cloud Logging API and BigQuery API. Deploy the add-on to your Kubernetes Engine cluster.
- B. Use the Stackdriver Logging export feature to create a sink to Cloud Storage. Create a Cloud Dataflow job that imports log files from Cloud Storage to BigQuery.
- C. Turn on Stackdriver Monitoring during the Kubernetes Engine cluster creation.
- D. Turn on Stackdriver Logging during the Kubernetes Engine cluster creation.
- E. Use the Stackdriver Logging export feature to create a sink to BigQuery. Specify a filter expression to export log records related to your Kubernetes Engine cluster only.
Answer: D,E
Explanation:
A Is correct because creating a cluster with Stackdriver Logging option will enable all the container logs to be stored in Stackdriver Logging.
B Is not correct because creating a cluster with Stackdriver Monitoring option will enable monitoring metrics to be gathered, but it has nothing to do with logging.
C is not correct, because even if you can develop a Kubernetes addon that will send logs to BigQuery, this is not a Google-recommended practice.
D is incorrect because this is not a Google recommended practice.
E Is correct because Stackdriver Logging support exporting logs to BigQuery by creating sinks (see links below).
https://cloud.google.com/kubernetes-engine/docs/how-to/logging
https://cloud.google.com/logging/docs/export/configure_export_v2
https://kubernetes.io/docs/reference/labels-annotations-taints/
NEW QUESTION # 121
You built an application on your development laptop that uses Google Cloud services. Your application uses Application Default Credentials for authentication and works fine on your development laptop. You want to migrate this application to a Compute Engine virtual machine (VM) and set up authentication using Google- recommended practices and minimal changes. What should you do?
- A. Store credentials for your user account with appropriate access for Google services in a config file, and deploy this config file with your application.
- B. Create a service account with appropriate access for Google services, and configure the application to use this account.
- C. Assign appropriate access for Google services to the service account used by the Compute Engine VM.
- D. Store credentials for service accounts with appropriate access for Google services in a config file, and deploy this config file with your application.
Answer: B
Explanation:
In general, Google recommends that each instance that needs to call a Google API should run as a service account with the minimum permissions necessary for that instance to do its job. In practice, this means you should configure service accounts for your instances with the following process: Create a new service account rather than using the Compute Engine default service account. Grant IAM roles to that service account for only the resources that it needs. Configure the instance to run as that service account. Grant the instance the https://www.googleapis.com/auth/cloud-platform scope to allow full access to all Google Cloud APIs, so that the IAM permissions of the instance are completely determined by the IAM roles of the service account. Avoid granting more access than necessary and regularly check your service account permissions to make sure they are up-to-date. https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances#best_practices
NEW QUESTION # 122
Your development team needs a new Jenkins server for their project. You need to deploy the server using the fewest steps possible. What should you do?
- A. Download and deploy the Jenkins Java WAR to App Engine Standard.
- B. Create a new Compute Engine instance and install Jenkins through the command line interface.
- C. Use GCP Marketplace to launch the Jenkins solution.
- D. Create a Kubernetes cluster on Compute Engine and create a deployment with the Jenkins Docker image.
Answer: C
Explanation:
Explanation/Reference: https://cloud.google.com/solutions/using-jenkins-for-distributed-builds-on-compute-engine
NEW QUESTION # 123
Your company implemented BigQuery as an enterprise data warehouse. Users from multiple business units run queries on this data warehouse. However, you notice that query costs for BigQuery are very high, and you need to control costs. Which two methods should you use? (Choose two.)
- A. Create separate copies of your BigQuery data warehouse for each business unit.
- B. Apply a user- or project-level custom query quota for BigQuery data warehouse.
- C. Split your BigQuery data warehouse into multiple data warehouses for each business unit.
- D. Split the users from business units to multiple projects.
- E. Change your BigQuery query model from on-demand to flat rate. Apply the appropriate number of slots to each Project.
Answer: B,E
NEW QUESTION # 124
You need to assign a Cloud Identity and Access Management (Cloud IAM) role to an external auditor. The auditor needs to have permissions to review your Google Cloud Platform (GCP) Audit Logs and also to review your Data Access logs. What should you do?
- A. Assign the auditor's IAM user to a custom role that has logging.privateLogEntries.list permission. Direct the auditor to also review the logs for changes to Cloud IAM policy.
- B. Assign the auditor the IAM role roles/logging.privateLogViewer. Direct the auditor to also review the logs for changes to Cloud IAM policy.
- C. Assign the auditor the IAM role roles/logging.privateLogViewer. Perform the export of logs to Cloud Storage.
- D. Assign the auditor's IAM user to a custom role that has logging.privateLogEntries.list permission. Perform the export of logs to Cloud Storage.
Answer: D
NEW QUESTION # 125
You deployed an App Engine application using gcloud app deploy, but it did not deploy to the intended project. You want to find out why this happened and where the application deployed. What should you do?
- A. Check the web-application.xml file for your application and check project settings.
- B. Check the app.yaml file for your application and check project settings.
- C. Go to Deployment Manager and review settings for deployment of applications.
- D. Go to Cloud Shell and run gcloud config list to review the Google Cloud configuration used for deployment.
Answer: B
NEW QUESTION # 126
You need to track and verity modifications to a set of Google Compute Engine instances in your Google Cloud project. In particular, you want to verify OS system patching events on your virtual machines (VMs). What should you do?
- A. Review the Compute Engine activity logs Select and review the Admin Event logs
- B. Review the Compute Engine activity logs Select and review the System Event logs
- C. Install the Cloud Logging Agent In Cloud Logging, review the Compute Engine operation logs
- D. Install the Cloud Logging Agent In Cloud Logging review the Compute Engine syslog logs
Answer: A
NEW QUESTION # 127
You created several resources in multiple Google Cloud projects. All projects are linked to different billing accounts. To better estimate future charges, you want to have a single visual representation of all costs incurred. You want to include new cost data as soon as possible. What should you do?
- A. Visit the Cost Table page to get a CSV export and visualize it using Data Studio.
- B. Use the Reports view in the Cloud Billing Console to view the desired cost information.
- C. Configure Billing Data Export to BigQuery and visualize the data in Data Studio.
- D. Fill all resources in the Pricing Calculator to get an estimate of the monthly cost.
Answer: C
Explanation:
https://cloud.google.com/billing/docs/how-to/export-data-bigquery "Cloud Billing export to BigQuery enables you to export detailed Google Cloud billing data (such as usage, cost estimates, and pricing data) automatically throughout the day to a BigQuery dataset that you specify."
NEW QUESTION # 128
You have downloaded and installed the gcloud command line interface (CLI) and have authenticated with your Google Account. Most of your Compute Engine instances in your project run in the europe-west1-d zone. You want to avoid having to specify this zone with each CLI command when managing these instances. What should you do?
- A. Create a Metadata entry on the Compute Engine page with key compute/zone and value europe-west1-d.
- B. Set the europe-west1-d zone as the default zone using the gcloud config subcommand.
- C. In the CLI installation directory, create a file called default.conf containing zone=europe-west1-d.
- D. In the Settings page for Compute Engine under Default location, set the zone to europe-west1-d.
Answer: C
NEW QUESTION # 129
Your management has asked an external auditor to review all the resources in a specific project.
The security team has enabled the Organization Policy called Domain Restricted Sharing on the organization node by specifying only your Cloud Identity domain. You want the auditor to only be able to view, but not modify, the resources in that project. What should you do?
- A. Create a temporary account for the auditor in Cloud Identity, and give that account the Security Reviewer role on the project.
- B. Ask the auditor for their Google account, and give them the Viewer role on the project.
- C. Ask the auditor for their Google account, and give them the Security Reviewer role on the project.
- D. Create a temporary account for the auditor in Cloud Identity, and give that account the Viewer role on the project.
Answer: D
Explanation:
https://cloud.google.com/iam/docs/roles-audit-logging#scenario_external_auditors
NEW QUESTION # 130
A colleague handed over a Google Cloud Platform project for you to maintain. As part of a security checkup, you want to review who has been granted the Project Owner role. What should you do?
- A. Enable Audit Logs on the IAM & admin page for all resources, and validate the results.
- B. In the console, validate which SSH keys have been stored as project-wide keys.
- C. Navigate to Identity-Aware Proxy and check the permissions for these resources.
- D. Use the command gcloud projects get-iam-policy to view the current role assignments.
Answer: D
Explanation:
Explanation
A simple approach would be to use the command flags available when listing all the IAM policy for a given project. For instance, the following command: `gcloud projects get-iam-policy $PROJECT_ID
--flatten="bindings[].members" --format="table(bindings.members)" --filter="bindings.role:roles/owner"` outputs all the users and service accounts associated with the role 'roles/owner' in the project in question.
https://groups.google.com/g/google-cloud-dev/c/Z6sZs7TvygQ?pli=1
NEW QUESTION # 131
......
Free Associate-Cloud-Engineer Exam Braindumps Google Pratice Exam: https://www.testbraindump.com/Associate-Cloud-Engineer-exam-prep.html
Valid Associate-Cloud-Engineer FREE EXAM DUMPS QUESTIONS & ANSWERS: https://drive.google.com/open?id=1feyYV38gMg_G-lnAhpm09XwZfDZHbrEp
