2023 Updates For the Latest Associate-Cloud-Engineer Free Exam Study Guide!
Best Associate-Cloud-Engineer Exam Preparation Material with New Dumps Questions
How can you get ready for Associate Cloud Engineer Certification Exam
There is a study guide for Associate Cloud Engineer Certification Exam
Here is our instant guide if you don't have time to read all the page
This exam is well recognized as Associate Cloud Engineer, like all examinations, Google has some freedom to examine a variety of topics. This means that most of the contents of Associate Cloud Engineer are necessary as they perform random tests on the many available topics. Also keep in mind that experience conditions often exist because they observed the average person and what is needed. You can always go further to succeed with the Associate Cloud Engineer, but it can take some extra effort. The exam objectives are strange for each exam and are usually provided by the certification provider. These normally indicate to the candidate which subjects are relevant, what he should know and why the exam tries to cover these subjects. It is necessary to find them out for your precise exam. This can be found on almost all provider websites and reports a lot like studies. Staying focused on studying can be difficult, but take it in mind that the best jobs in the world are only several tests away. Regardless of whether you enter cybersecurity or do a basic level technical job, certification is a clear, learning and rewarding path for careers that pay a LOT of money. They offer a better balance between professional and private life and can get in touch with some of the leaders in the business world. The Google Associate Cloud Engineer certification exam is of paramount importance both in professional life and in the Google certification process. With Google certification, you can easily get a good job in the market and move towards success. Specialists who have successfully finished the Google Associate Cloud Engineer exam preparation are the absolute favorites in the industry. You will pass the Google Associate Cloud Engineer certification exam and have career chances. In this advanced age, getting an excellent Google certification exam has become more necessary for Google specialists. If we examine the world of IT credentials, we will find many certified exams, but the truth is that Google Associate Cloud Engineer certification is above all the credentials available in the IT profession. The Google certification is one of the best ways to increase value in the IT world. You want to know why? The Associate Cloud Engineer exam module was recently presented by Google and has attracted the attention of many Google ACE professionals and aspiring people who wish to increase their credibility in the market.
NEW QUESTION 54
You built an application on your development laptop that uses Google Cloud services. Your application uses Application Default Credentials for authentication and works fine on your development laptop. You want to migrate this application to a Compute Engine virtual machine (VM) and set up authentication using Google-recommended practices and minimal changes.
What should you do?
- A. Create a service account with appropriate access for Google services, and configure the application to use this account.
- B. Assign appropriate access for Google services to the service account used by the Compute Engine VM.
- C. Store credentials for your user account with appropriate access for Google services in a config file, and deploy this config file with your application.
- D. Store credentials for service accounts with appropriate access for Google services in a config file, and deploy this config file with your application.
Answer: A
Explanation:
https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances
NEW QUESTION 55
You need to configure IAM access audit logging in BigQuery for external auditors. You want to follow Google-recommended practices. What should you do?
- A. Add the auditors group to two new custom IAM roles.
- B. Add the auditor user accounts to the `logging.viewer' and `bigQuery.dataViewer' predefined IAM roles.
- C. Add the auditor user accounts to two new custom IAM roles.
- D. Add the auditors group to the `logging.viewer' and `bigQuery.dataViewer' predefined IAM roles.
Answer: D
Explanation:
As per google best practices it is recommended to use predefined roles and create groups to control access to multiple users with same responsibility
https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#groups-and- service-accounts .
NEW QUESTION 56
You are configuring service accounts for an application that spans multiple projects. Virtual machines (VMs) running in the web-applications project need access to BigQuery datasets in crm-databases-proj. You want to follow Google-recommended practices to give access to the service account in the web- applications project. What should you do?
- A. Give "project owner" role to crm-databases-proj and bigquery.dataViewer role to web- applications.
- B. Give bigquery.dataViewer role to crm-databases-proj and appropriate roles to web-applications.
- C. Give "project owner" role to crm-databases-proj and the web-applications project.
- D. Give "project owner" for web-applications appropriate roles to crm-databases- proj
Answer: B
Explanation:
You just need read access for DB at the project.
NEW QUESTION 57
Your management has asked an external auditor to review all the resources in a specific project.
The security team has enabled the Organization Policy called Domain Restricted Sharing on the organization node by specifying only your Cloud Identity domain. You want the auditor to only be able to view, but not modify, the resources in that project. What should you do?
- A. Ask the auditor for their Google account, and give them the Viewer role on the project.
- B. Create a temporary account for the auditor in Cloud Identity, and give that account the Viewer role on the project.
- C. Ask the auditor for their Google account, and give them the Security Reviewer role on the project.
- D. Create a temporary account for the auditor in Cloud Identity, and give that account the Security Reviewer role on the project.
Answer: B
Explanation:
roles/viewer Read access to all resources. Get and list access for all resources.
Using primitive roles
The following table lists the primitive roles that you can grant to access a project, the description of what the role does, and the permissions bundled within that role. Avoid using primitive roles except when absolutely necessary. These roles are very powerful, and include a large number of permissions across all Google Cloud services. For more details on when you should use primitive roles, see the Identity and Access Management FAQ.
IAM predefined roles are much more granular, and allow you to carefully manage the set of permissions that your users have access to. See Understanding Roles for a list of roles that can be granted at the project level. Creating custom roles can further increase the control you have over user permissions.
https://cloud.google.com/resource-manager/docs/access-control-proj#using_primitive_roles
NEW QUESTION 58
Your team maintains the infrastructure for your organization. The current infrastructure requires changes. You need to share your proposed changes with the rest of the team. You want to follow Google's recommended best practices. What should you do?
- A. Use Deployment Manager templates to describe the proposed changes and store them in a Cloud Storage bucket.
- B. Use Deployment Manager templates to describe the proposed changes and store them in Cloud Source Repositories.
- C. Apply the change in a development environment, run gcloud compute instances list, and then save the output in a shared Storage bucket.
- D. Apply the change in a development environment, run gcloud compute instances list, and then save the output in Cloud Source Repositories.
Answer: B
Explanation:
Deployment Manager Template can be written in either Jinja or Python, this is Infrastructure as Code (IaC) we are talking about here, same as AWS Cloudformation, or Terraform. Therefore, they should be stored on a git repository such as Google Cloud Source Repositories.
NEW QUESTION 59
For analysis purposes, you need to send all the logs from all of your Compute Engine instances to a BigQuery dataset called platform-logs. You have already installed the Stackdriver Logging agent on all the instances. You want to minimize cost. What should you do?
- A. 1. In Stackdriver Logging, create a filter to view only Compute Engine logs.2. Click Create Export.3. Choose BigQuery as Sink Service, and the platform-logs dataset as Sink Destination.
- B. 1. Create a Cloud Function that has the BigQuery User role on the platform-logs dataset.2. Configure this Cloud Function to create a BigQuery Job that executes this query:INSERT INTO dataset.platform-logs (timestamp, log)SELECT timestamp, log FROM compute.logsWHERE timestamp > DATE_SUB(CURRENT_DATE(), INTERVAL 1 DAY)3. Use Cloud Scheduler to trigger this Cloud Function once a day.
- C. 1. Give the BigQuery Data Editor role on the platform-logs dataset to the service accounts used by your instances.2. Update your instances' metadata to add the following value: logs-destination: bq://platform-logs.
- D. 1. In Stackdriver Logging, create a logs export with a Cloud Pub/Sub topic called logs as a sink.2. Create a Cloud Function that is triggered by messages in the logs topic.3. Configure that Cloud Function to drop logs that are not from Compute Engine and to insert Compute Engine logs in the platform-logs dataset.
Answer: A
NEW QUESTION 60
An application requires block storage for file updates. The data is 500 GB and must continuously sustain 100 MiB/s of aggregate read/write operations.
Which storage option is appropriate for this application?
- A. Amazon Glacier
- B. Amazon EBS
- C. Amazon EFS
- D. Amazon S3
Answer: B
NEW QUESTION 61
You are building an application that stores relational data from users. Users across the globe will use this application. Your CTO is concerned about the scaling requirements because the size of the user base is unknown. You need to implement a database solution that can scale with your user growth with minimum configuration changes. Which storage solution should you use?
- A. Cloud Firestore
- B. Cloud Spanner
- C. Cloud Datastore
- D. Cloud SQL
Answer: B
NEW QUESTION 62
You need to grant access for three users so that they can view and edit table data on a Cloud Spanner instance. What should you do?
- A. Run gcloud iam roles describe roles/spanner.viewer - -project my-project.
Add the users to the role. - B. Run gcloud iam roles describe roles/spanner.databaseUser.
Add the users to the role. - C. Run gcloud iam roles describe roles/spanner.databaseUser.
Add the users to a new group. Add the group to the role. - D. Run gcloud iam roles describe roles/spanner.viewer - -project my-project.
Add the users to a new group. Add the group to the role.
Answer: C
NEW QUESTION 63
You are given a project with a single virtual private cloud (VPC) and a single subnetwork in the us-central1 region. There is a Compute Engine instance hosting an application in this subnetwork. You need to deploy a new instance in the same project in the europe-west1 region. This new instance needs access to the application. You want to follow Google-recommended practices. What should you do?
- A. 1. Create a subnetwork in the same VPC, in europe-west1.2. Use Cloud VPN to connect the two subnetworks.3. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint.
- B. 1. Create a VPC and a subnetwork in europe-west1.2. Peer the 2 VPCs.3. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint.
- C. 1. Create a VPC and a subnetwork in europe-west1.2. Expose the application with an internal load balancer.3. Create the new instance in the new subnetwork and use the load balancer's address as the endpoint.
- D. 1. Create a subnetwork in the same VPC, in europe-west1.2. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint.
Answer: D
NEW QUESTION 64
You need to assign a Cloud Identity and Access Management (Cloud IAM) role to an external auditor. The auditor needs to have permissions to review your Google Cloud Platform (GCP) Audit Logs and also to review your Data Access logs. What should you do?
- A. Assign the auditor the IAM role roles/logging.privateLogViewer.
Perform the export of logs to Cloud Storage. - B. Assign the auditor the IAM role roles/logging.privateLogViewer.
Direct the auditor to also review the logs for changes to Cloud IAM policy. - C. Assign the auditor's IAM user to a custom role that has logging.privateLogEntries.list permission.
Perform the export of logs to Cloud Storage. - D. Assign the auditor's IAM user to a custom role that has logging.privateLogEntries.list permission.
Direct the auditor to also review the logs for changes to Cloud IAM policy.
Answer: B
Explanation:
Google Cloud provides Cloud Audit Logs, which is an integral part of Cloud Logging. It consists of two log streams for each project: Admin Activity and Data Access.
Admin Activity logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. Admin Activity logs are always enabled. There is no charge for your Admin Activity audit logs.
Data Access logs record API calls that create, modify, or read user-provided data. Data Access audit logs are disabled by default because they can be large.
logging.viewer: The logging.viewer role gives the security admin team the ability to view the Admin Activity logs.
logging.privateLogViewer : The logging.privateLogViewer role gives the ability to view the Data Access logs.
NEW QUESTION 65
You are creating a Kubernetes Engine cluster to deploy multiple pods inside the cluster. All container logs must be stored in BigQuery for later analysis. You want to follow Google- recommended practices. Which two approaches can you take?
- A. Develop a custom add-on that uses Cloud Logging API and BigQuery API. Deploy the add-on to your Kubernetes Engine cluster.
- B. Turn on Stackdriver Logging during the Kubernetes Engine cluster creation.
- C. Use the Stackdriver Logging export feature to create a sink to BigQuery. Specify a filter expression to export log records related to your Kubernetes Engine cluster only.
- D. Use the Stackdriver Logging export feature to create a sink to Cloud Storage. Create a Cloud Dataflow job that imports log files from Cloud Storage to BigQuery.
- E. Turn on Stackdriver Monitoring during the Kubernetes Engine cluster creation.
Answer: B,C
Explanation:
A Is correct because creating a cluster with Stackdriver Logging option will enable all the container logs to be stored in Stackdriver Logging.
B Is not correct because creating a cluster with Stackdriver Monitoring option will enable monitoring metrics to be gathered, but it has nothing to do with logging.
C is not correct, because even if you can develop a Kubernetes addon that will send logs to BigQuery, this is not a Google-recommended practice.
D is incorrect because this is not a Google recommended practice.
E Is correct because Stackdriver Logging support exporting logs to BigQuery by creating sinks (see links below).
https://cloud.google.com/kubernetes-engine/docs/how-to/logging
https://cloud.google.com/logging/docs/export/configure_export_v2
https://kubernetes.io/docs/reference/labels-annotations-taints/
NEW QUESTION 66
You have a simple web application that you're trying to deploy in a secure and inexpensive way. The application is running inside a Docker container on port 8080. Once the application is initially deployed, the developers are going to take ownership of future deployments.
What is the best option for running the application?
- A. Use an App Engine Flexible Environment.
- B. Use an App Engine Standard Environment.
- C. Use Kubernetes Engine.
- D. Use an on-premises Kubernetes cluster.
Answer: A
NEW QUESTION 67
Your company has a large quantity of unstructured data in different file formats. You want to perform ETL transformations on the data. You need to make the data accessible on Google Cloud so it can be processed by a Dataflow job. What should you do?
- A. Upload the data to BigQuery using the bq command line tool.
- B. Upload the data to Cloud Storage using the gsutil command line tool.
- C. Upload the data into Cloud SQL using the import function in the console.
- D. Upload the data into Cloud Spanner using the import function in the console.
Answer: A
Explanation:
Reference:
https://cloud.google.com/solutions/performing-etl-from-relational-database-into-bigquery
NEW QUESTION 68
You have experimented with Google Cloud using your own credit card and expensed the costs to your company. Your company wants to streamline the billing process and charge the costs of your projects to their monthly invoice. What should you do?
- A. Set up BigQuery billing export and grant your financial department IAM access to query the data.
- B. Change the billing account of your projects to the billing account of your company.
- C. Grant the financial team the IAM role of ג€Billing Account Userג€ on the billing account linked to your credit card.
- D. Create a ticket with Google Billing Support to ask them to send the invoice to your company.
Answer: B
NEW QUESTION 69
You need to grant access for three users so that they can view and edit table data on a Cloud Spanner instance. What should you do?
- A. Run gcloud iam roles describe roles/spanner.viewer - -project my-project.
Add the users to the role. - B. Run gcloud iam roles describe roles/spanner.databaseUser.
Add the users to the role. - C. Run gcloud iam roles describe roles/spanner.databaseUser.
Add the users to a new group. Add the group to the role. - D. Run gcloud iam roles describe roles/spanner.viewer - -project my-project.
Add the users to a new group. Add the group to the role.
Answer: C
Explanation:
As recommended practice, for 3 users creating a group and assigning role to that is the correct method.
https://cloud.google.com/spanner/docs/iam#spanner.databaseUser
NEW QUESTION 70
Your team maintains the infrastructure for your organization. The current infrastructure requires changes. You need to share your proposed changes with the rest of the team. You want to follow Google's recommended best practices. What should you do?
- A. Apply the changes in a development environment, run gcloud compute instances list, and then save the output in Cloud Source Repositories.
- B. Apply the changes in a development environment, run gcloud compute instances list, and then save the output in a shared Storage bucket.
- C. Use Deployment Manager templates to describe the proposed changes and store them in a Cloud Storage bucket.
- D. Use Deployment Manager templates to describe the proposed changes and store them in Cloud Source Repositories.
Answer: D
NEW QUESTION 71
You need to create a custom IAM role for use with a GCP service. All permissions in the role must be suitable for production use. You also want to clearly share with your organization the status of the custom role. This will be the first version of the custom role. What should you do?
- A. Use permissions in your role that use the 'supported' support level for role permissions. Set the role stage to ALPHA while testing the role permissions.
- B. Use permissions in your role that use the 'testing' support level for role permissions. Set the role stage to BETA while testing the role permissions.
- C. Use permissions in your role that use the 'supported' support level for role permissions. Set the role stage to BETA while testing the role permissions.
- D. Use permissions in your role that use the 'testing' support level for role permissions. Set the role stage to ALPHA while testing the role permissions.
Answer: D
NEW QUESTION 72
You need to add a group of new users to Cloud Identity. Some of the users already have existing Google accounts. You want to follow one of Google's recommended practices and avoid conflicting accounts. What should you do?
- A. Tell the user to remove all personal email from the existing account
- B. Invite the user to use an email alias to resolve the conflict
- C. Tell the user that they must delete their existing account
- D. Invite the user to transfer their existing account
Answer: B
NEW QUESTION 73
You have a large 5-TB AVRO file stored in a Cloud Storage bucket. Your analysts are proficient only in SQL and need access to the data stored in this file. You want to find a cost-effective way to complete their request as soon as possible. What should you do?
- A. Create a Hadoop cluster and copy the AVRO file to NDFS by compressing it. Load the file in a hive table and provide access to your analysts so that they can run SQL queries.
- B. Load data in Cloud Datastore and run a SQL query against it.
- C. Create external tables in BigQuery that point to Cloud Storage buckets and run a SQL query on these external tables to complete your request.
- D. Create a BigQuery table and load data in BigQuery. Run a SQL query on this table and drop this table after you complete your request.
Answer: C
Explanation:
An external data source (also known as a federated data source) is a data source that you can query directly even though the data is not stored in BigQuery. Instead of loading or streaming the data, you create a table that references the external data source.
https://cloud.google.com/bigquery/external-data-sources
NEW QUESTION 74
Your company uses a large number of Google Cloud services centralized in a single project. All teams have specific projects for testing and development. The DevOps team needs access to all of the production services in order to perform their job. You want to prevent Google Cloud product changes from broadening their permissions in the future. You want to follow Google- recommended practices. What should you do?
- A. Create a custom role that combines the required permissions.
Grant the DevOps team the custom role on the production project. - B. Grant all members of the DevOps team the role of Project Editor on the production project.
- C. Grant all members of the DevOps team the role of Project Editor on the organization level.
- D. Create a custom role that combines the required permissions.
Grant the DevOps team the custom role on the organization level.
Answer: A
Explanation:
Understanding IAM custom roles
Key Point: Custom roles enable you to enforce the principle of least privilege, ensuring that the user and service accounts in your organization have only the permissions essential to performing their intended functions.
Basic concepts
Custom roles are user-defined, and allow you to bundle one or more supported permissions to meet your specific needs. Custom roles are not maintained by Google; when new permissions, features, or services are added to Google Cloud, your custom roles will not be updated automatically.
When you create a custom role, you must choose an organization or project to create it in. You can then grant the custom role on the organization or project, as well as any resources within that organization or project.
https://cloud.google.com/iam/docs/understanding-custom-roles#basic_concepts
NEW QUESTION 75
You want to add a new auditor to a Google Cloud Platform project. The auditor should be allowed to read, but not modify, all project items.
How should you configure the auditor's permissions?
- A. Select the built-in IAM service Viewer role. Add the user's account to this role.
- B. Create a custom role with view-only service permissions. Add the user's account to the custom role.
- C. Create a custom role with view-only project permissions. Add the user's account to the custom role.
- D. Select the built-in IAM project Viewer role. Add the user's account to this role.
Answer: D
Explanation:
roles/Viewer role provides access to all resources under the projects but do not alter the state of these resources.
https://cloud.google.com/resource-manager/docs/access-control-proj
NEW QUESTION 76
You need to set up permissions for a set of Compute Engine instances to enable them to write data into a particular Cloud Storage bucket. You want to follow Google-recommended practices. What should you do?
- A. Create a service account and add it to the IAM role 'storage.objectCreator' for that bucket.
- B. Create a service account and add it to the IAM role 'storage.objectAdmin' for that bucket.
- C. Create a service account with an access scope. Use the access scope
'https://www.googleapis.com/auth/cloud-platform'. - D. Create a service account with an access scope. Use the access scope
'https://www.googleapis.com/auth/devstorage.write_only'.
Answer: C
NEW QUESTION 77
You are hosting an application on bare-metal servers in your own data center. The application needs access to Cloud Storage. However, security policies prevent the servers hosting the application from having public IP addresses or access to the internet. You want to follow Google-recommended practices to provide the application with access to Cloud Storage. What should you do?
- A. 1. Using Cloud VPN or Interconnect, create a tunnel to a VPC in GCP.2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel.3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com.
- B. 1. Use Migrate for Compute Engine (formerly known as Velostrata) to migrate those servers to Compute Engine.2. Create an internal load balancer (ILB) that uses storage.googleapis.com as backend.3. Configure your new instances to use this ILB as proxy.
- C. 1. Use nslookup to get the IP address for storage.googleapis.com.2. Negotiate with the security team to be able to give a public IP address to the servers.3. Only allow egress traffic from those servers to the IP addresses for storage.googleapis.com.
- D. 1. Using Cloud VPN, create a VPN tunnel to a Virtual Private Cloud (VPC) in Google Cloud Platform (GCP).2. In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance.3. Configure your servers to use that instance as a proxy to access Cloud Storage.
Answer: A
NEW QUESTION 78
You need to create a new billing account and then link it with an existing Google Cloud Platform project.
What should you do?
- A. Verify that you are Project Billing Manager for the GCP project.
Update the existing project to link it to the existing billing account. - B. Verify that you are Billing Administrator for the billing account.
Update the existing project to link it to the existing billing account. - C. Verify that you are Billing Administrator for the billing account.
Create a new project and link the new project to the existing billing account. - D. Verify that you are Project Billing Manager for the GCP project.
Create a new billing account and link the new billing account to the existing project.
Answer: D
Explanation:
Project Billing Manager is required to manage the GCP project billing settings. We assume you can create a new billing account because you are an organization billing admin or because you are not part of an organization.
NEW QUESTION 79
......
Below are the topics of Associate Cloud Engineer Exam
Candidates must know the exam topics before they start of preparation. Because it will really help them in hitting the core. Our Associate Cloud Engineer exam dumps will include the following topics:
- Configuring access and security
- Planning and configuring a cloud solution
- Setting up a cloud solution environment
- Deploying and implementing a cloud solution
- Ensuring successful operation of a cloud solution
Free Associate-Cloud-Engineer Exam Files Verified & Correct Answers Downloaded Instantly: https://www.testbraindump.com/Associate-Cloud-Engineer-exam-prep.html
Fast Exam Updates Associate-Cloud-Engineer dumps with PDF Test Engine Practice: https://drive.google.com/open?id=1KKojWN2o0WlxWRUoj82A0gBo5raiMESY
