Cloud Engineer Associate Cloud Engineer v1.0 3 — Questions and Answers
Question 1: You are designing a solution requiring global HTTP(S) load balancing with SSL termination and Cloud CDN. Which load balancer type should you use?
- External Application Load Balancer (Global) (Correct answer)
- Internal TCP/UDP Load Balancer
- Network Load Balancer
- Regional External Application Load Balancer
Correct answer: External Application Load Balancer (Global)
The External Application Load Balancer in global mode supports HTTPS, SSL termination, and integrates with Cloud CDN at Google's edge.
Question 2: A BigQuery dataset is being queried by analysts in a different project. How should you grant them query access without exposing sensitive columns?
- Use column-level security with policy tags and grant roles/datacatalog.categoryFineGrainedReader on allowed columns
- Export the dataset to Cloud Storage and share the bucket
- Share the entire dataset with roles/bigquery.dataViewer and document restricted columns
- Create a view without sensitive columns and grant access to the view (Correct answer)
Correct answer: Create a view without sensitive columns and grant access to the view
An authorized view exposes only the columns you choose, providing fine-grained access control without sharing the underlying table.
Question 3: Your application writes logs to stdout inside a container running on GKE. Where do the logs appear by default?
- Cloud Logging (Logs Explorer) (Correct answer)
- Cloud Storage bucket named after the cluster
- BigQuery dataset
- Pub/Sub topic
Correct answer: Cloud Logging (Logs Explorer)
GKE automatically captures stdout/stderr from containers and routes them to Cloud Logging via the built-in logging agent.
Question 4: Which Terraform command shows you what changes will be applied without actually making them?
- terraform plan (Correct answer)
- terraform validate
- terraform apply --dry-run
- terraform show
Correct answer: terraform plan
terraform plan generates an execution plan displaying what actions Terraform will take without modifying any infrastructure.
Question 5: You need to migrate a 10 TB on-premises MySQL database to Cloud SQL with minimal downtime. Which approach is most appropriate?
- Use Database Migration Service with continuous replication then cut over (Correct answer)
- Take a mysqldump backup and restore it directly to Cloud SQL
- Export to Cloud Storage and import via Cloud SQL import
- Replicate using a third-party ETL tool
Correct answer: Use Database Migration Service with continuous replication then cut over
Database Migration Service supports continuous replication, allowing the on-premises database to stay live until you choose to cut over.
Question 6: A Cloud Storage bucket has Uniform Bucket-Level Access enabled. What does this mean?
- ACLs on individual objects are disabled; only IAM policies control access (Correct answer)
- All objects in the bucket are publicly readable
- Bucket-level encryption is enforced for all objects
- Object versioning is automatically enabled
Correct answer: ACLs on individual objects are disabled; only IAM policies control access
Uniform Bucket-Level Access disables object-level ACLs and enforces IAM-only access control across the entire bucket.
Question 7: You need a managed message queue that guarantees at-least-once delivery and supports multiple independent subscribers. Which service fits best?
- Cloud Pub/Sub (Correct answer)
- Cloud Tasks
- Cloud Dataflow
- Memorystore
Correct answer: Cloud Pub/Sub
Cloud Pub/Sub provides at-least-once delivery with fan-out to multiple subscriptions, each receiving all messages independently.
Cloud Engineer Associate Cloud Engineer v1.0 3
You are designing a solution requiring global HTTP(S) load balancing with SSL termination and Cloud CDN.
Which load balancer type should you use?