Cloud Engineer Cloud Engineer: Essential Google Infrastructure 3 — Questions and Answers
Question 1: A Cloud Engineer wants to store application configuration secrets such as database passwords securely in GCP. Which service is best suited for this?
- Cloud Storage with encryption
- Secret Manager (Correct answer)
- Cloud KMS
- Firestore
Correct answer: Secret Manager
Secret Manager is GCP's dedicated service for storing, accessing, and auditing secrets like API keys and passwords with version control.
Question 2: Which Cloud Storage storage class is most cost-effective for data that is accessed less than once per year, such as long-term archival backups?
- Standard
- Nearline
- Coldline
- Archive (Correct answer)
Correct answer: Archive
Archive storage class has the lowest storage cost but highest retrieval cost, making it ideal for data accessed less than once per year.
Question 3: What is the primary advantage of using a Managed Instance Group (MIG) with autoscaling in Compute Engine?
- It provides dedicated physical hardware for instances
- It automatically adjusts the number of VMs based on load metrics (Correct answer)
- It enables live migration between zones
- It groups instances for shared billing purposes
Correct answer: It automatically adjusts the number of VMs based on load metrics
Autoscaling MIGs automatically add or remove VM instances based on CPU utilization, load balancing capacity, or custom metrics.
Question 4: In GCP's resource hierarchy, at which level do Organization Policies apply when set at the organization node?
- Only the organization node itself
- Only projects directly under the organization
- The organization node and all descendant folders and projects (Correct answer)
- Only resources without folder assignments
Correct answer: The organization node and all descendant folders and projects
Organization Policies set at the organization node cascade down the hierarchy to all folders, projects, and resources unless overridden at lower levels.
Question 5: Which GCP service enables real-time stream analytics by ingesting and processing large volumes of event data from IoT devices or application logs?
- BigQuery
- Pub/Sub (Correct answer)
- Dataflow
- Cloud Composer
Correct answer: Pub/Sub
Pub/Sub is GCP's asynchronous messaging service that ingests high-throughput event streams and decouples producers from consumers.
Question 6: A Cloud Engineer needs to configure DNS for a GCP application so that internal VMs resolve hostnames without exposing DNS to the public internet. Which service should they use?
- Cloud DNS public zone
- Cloud DNS private zone (Correct answer)
- Cloud Endpoints
- Identity-Aware Proxy
Correct answer: Cloud DNS private zone
Cloud DNS private zones provide DNS resolution only to resources within the specified VPC networks, keeping records internal.
Question 7: What is the function of a GCP Service Account when used by a Compute Engine instance?
- It provides a static IP address for the instance
- It acts as the identity the instance uses to authenticate with GCP APIs (Correct answer)
- It encrypts all traffic leaving the instance
- It defines the machine type and resource limits for the instance
Correct answer: It acts as the identity the instance uses to authenticate with GCP APIs
A service account assigned to a Compute Engine instance serves as the instance's identity, determining which GCP APIs and resources it can access.
Cloud Engineer Cloud Engineer: Essential Google Infrastructure 3
A Cloud Engineer wants to store application configuration secrets such as database passwords securely in GCP.
Which service is best suited for this?