Cloud Engineer: Google Associate Flashcards
7 cards from real Cloud Engineer practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Cloud Engineer: Google Associate flashcards as text
You need to allow only internal VM instances in a VPC to communicate with a Cloud SQL instance without exposing it to the public internet. What should you configure?
Answer: Use Private Service Connect or Private IP for Cloud SQL
Private IP (or Private Service Connect) keeps Cloud SQL traffic within the VPC, avoiding public internet exposure.
Which GCP storage class is most cost-effective for data accessed less than once a year, such as disaster recovery archives?
Answer: Archive
Archive storage has the lowest storage cost but highest retrieval cost, making it ideal for data accessed less than once a year.
A team wants to enforce that all GCP resources in a project have a specific label 'env=production'. Which tool enforces this at resource creation time?
Answer: Organization Policy constraints
Organization Policy Service can enforce resource label requirements using constraints like `constraints/compute.restrictCloudSQLInstances` or custom OPA policies.
You are deploying a stateless HTTP microservice on GCP that needs to scale from zero and handle unpredictable traffic spikes. Which service is the best fit?
Answer: Cloud Run
Cloud Run is fully managed, scales to zero, and handles sudden traffic spikes automatically for stateless containers.
A Cloud Storage bucket needs to retain objects for exactly 7 years for compliance and prevent any deletion during that period. What feature should you enable?
Answer: Bucket Lock with a Retention Policy
Bucket Lock enforces a retention policy so objects cannot be deleted or modified before the retention period expires, satisfying compliance requirements.
You want to give a Compute Engine instance access to Cloud Storage without storing credentials on the VM. What is the recommended approach?
Answer: Attach a service account to the VM instance
Attaching a service account to the VM lets the instance obtain short-lived credentials automatically via the metadata server, eliminating stored key files.
Which Cloud Load Balancing type supports WebSocket connections and can distribute traffic across regions using anycast IP?
Answer: Global External HTTP(S) Load Balancer
The Global External HTTP(S) Load Balancer uses anycast IPs, supports WebSockets, and can route traffic to backends in multiple regions.