Free Google Associate-Cloud-Engineer Exam Questions

Question 1

Your company is moving its continuous integration and delivery (CI/CD) pipeline to Compute Engine instances. The pipeline will manage the entire cloud infrastructure through code. How can you ensure that the pipeline has appropriate permissions while your system is following security best practices?

A : • Add a step for human approval to the CI/CD pipeline before the execution of the infrastructureprovisioning.• Use the human approvals IAM account for the provisioning.

B : • Attach a single service account to the compute instances.• Add minimal rights to the service account.• Allow the service account to impersonate a Cloud Identity user with elevated permissions to create, update, or delete resources.

C : • Attach a single service account to the compute instances.• Add all required Identity and Access Management (IAM) permissions to this service account to create, update, or delete resources

D : • Create multiple service accounts, one for each pipeline with the appropriate minimal Identity andAccess Management (IAM) permissions.• Use a secret manager service to store the key files of the service accounts.• Allow the CI/CD pipeline to request the appropriate secrets during the execution of the pipeline.

Answer: B

Question 2

(You have an application running inside a Compute Engine instance. You want to provide the application with secure access to a BigQuery dataset. You must ensure that credentials are only valid for a short period of time, and your application will only have access to the intended BigQuery dataset. You want to follow Google-recommended practices and minimize your operational costs. What should you do?)

A : Attach a custom service account to the instance, and grant the service account the BigQuery Data Viewer IAM role on the project.

B : Attach a new service account to the instance every hour, and grant the service account the BigQuery Data Viewer IAM role on the dataset.

C : Attach a custom service account to the instance, and grant the service account the BigQuery Data Viewer IAM role on the dataset.

D : Attach a new service account to the instance every hour, and grant the service account the BigQuery Data Viewer IAM role on the project.

Answer: C

Question 3

You have several hundred microservice applications running in a Google Kubernetes Engine (GKE) cluster. Each microservice is a deployment with resource limits configured for each container in the deployment. You've observed that the resource limits for memory and CPU are not appropriately set for many of the microservices. You want to ensure that each microservice has right sized limits for memory and CPU. What should you do?

A : Modify the cluster's node pool machine type and choose a machine type with more memory and CPU.

B : Configure a Horizontal Pod Autoscaler for each microservice.

C : Configure GKE cluster autoscaling.

D : Configure a Vertical Pod Autoscaler for each microservice.

Answer: C

Question 4

You are deploying a large multi-tiered application with more than 1,000 IP addresses in a Google Cloudproject that needs to be securely isolated. The application includes the:web tier with frontend servers for public trafficapplication tier with servers running core application logic that only need access from the web tier anddatabase tier with database servers that only need access from the application tierYou want to minimizecost, complexity, and administrative overhead in the network architecture. What should you do?database tier with database servers that only need access from the application tierYou want to minimizecost, complexity, and administrative overhead in the network architecture. What should you do?

A : Create a /24 Shared VPC with separate subnets for each tier. Use firewall rules that reference network tags to control traffic.

B : Create one custom mode /16 VPC with three subnets. Place each tier in its own subnet and use firewallrules that reference IP subnets to control traffic.

C : Deploy each tier into a separate custom mode VPC. Use VPC Network Peering to securely connecteach Custom mode VPC. Manage firewall rules individually in each VPC.

D : Deploy each tier in a /24 VPC by using network tags to identify instances. Implement firewall rules forfine-grained network segmentation.

Answer: B

Question 5

You want to find out when users were added to Cloud Spanner Identity Access Management (IAM) roles on your Google Cloud Platform (GCP) project. What should you do in the GCP Console?

A : en the Cloud Spanner console to review configurations.

B : en the IAM & admin console to review IAM policies for Cloud Spanner roles.

C : to the Stackdriver Monitoring console and review information for Cloud Spanner.

D : to the Stackdriver Logging console, review admin activity logs, and filter them for Cloud Spanner IAM roles.

Answer: B