Cloud Engineer Cloud Engineer: Essential Google Infrastructure 5 — Questions and Answers
Question 1: A Cloud Engineer needs to give a third-party vendor temporary access to a GCP Storage bucket without creating a GCP account for them. What is the recommended approach?
- Share the project owner's service account key
- Generate a Signed URL with an expiration time (Correct answer)
- Make the bucket publicly accessible
- Create a temporary IAM user with viewer role
Correct answer: Generate a Signed URL with an expiration time
Signed URLs grant time-limited access to a specific GCS object without requiring the recipient to have a GCP account.
Question 2: Which Compute Engine feature allows you to create a consistent snapshot of a persistent disk even while the disk is in use?
- Live Migration
- Disk Cloning
- Persistent Disk Snapshot (Correct answer)
- Instance Template
Correct answer: Persistent Disk Snapshot
Persistent Disk Snapshots in GCP are application-consistent, incremental backups that can be taken while the disk is attached and in use.
Question 3: What is the role of Workload Identity Federation in GCP?
- It maps Kubernetes service accounts to GCP service accounts without key files (Correct answer)
- It federates user identities from on-premises Active Directory to Cloud Identity
- It enables cross-project service account impersonation
- It provisions short-lived tokens for Cloud Functions only
Correct answer: It maps Kubernetes service accounts to GCP service accounts without key files
Workload Identity Federation (for GKE specifically Workload Identity) lets Kubernetes workloads authenticate to GCP APIs as a service account without needing exported key files.
Question 4: A Cloud Engineer configures a Cloud Armor security policy on an HTTP(S) Load Balancer. What can Cloud Armor protect against?
- Data exfiltration through Cloud Storage
- DDoS attacks and OWASP Top 10 web application threats (Correct answer)
- Unauthorized SSH access to Compute Engine instances
- Misconfigured IAM policies on GCP resources
Correct answer: DDoS attacks and OWASP Top 10 web application threats
Cloud Armor provides DDoS protection and WAF capabilities with pre-configured rules for OWASP Top 10 threats at the load balancer edge.
Question 5: In BigQuery, what is a partitioned table and what is its primary benefit?
- A table split across multiple GCP regions for redundancy
- A table divided into segments based on a column value to reduce query cost and improve performance (Correct answer)
- A table with row-level security applied per partition
- A table that streams data into separate shards automatically
Correct answer: A table divided into segments based on a column value to reduce query cost and improve performance
Partitioned tables divide data by a column (e.g., date) so queries that filter on that column scan only relevant partitions, reducing cost and latency.
Question 6: Which GCP tool enables infrastructure provisioning using declarative configuration files, supporting version control and repeatable deployments?
- Cloud Shell
- Cloud Deployment Manager (Correct answer)
- Cloud Build
- Cloud Scheduler
Correct answer: Cloud Deployment Manager
Cloud Deployment Manager allows you to define GCP infrastructure in YAML or Python templates and manages the lifecycle of those resources declaratively.
Question 7: What is the purpose of a VPC Service Control perimeter in Google Cloud?
- To restrict outbound internet access from VMs
- To define a security boundary around GCP services that prevents data exfiltration (Correct answer)
- To isolate billing between projects within a VPC
- To enforce encryption at rest for all services within a project
Correct answer: To define a security boundary around GCP services that prevents data exfiltration
VPC Service Controls create a security perimeter around GCP API services to mitigate data exfiltration risks, even if IAM is misconfigured.
Cloud Engineer Cloud Engineer: Essential Google Infrastructure 5
A Cloud Engineer needs to give a third-party vendor temporary access to a GCP Storage bucket without creating a GCP account for them.
What is the recommended approach?