Cloud Engineer Cloud Engineer: Google Associate 4 — Questions and Answers
Question 1: A Cloud Run service needs to access a secret stored in Secret Manager at runtime. Which approach follows Google's security best practices?
- Mount the secret as an environment variable or volume using Secret Manager integration (Correct answer)
- Download the secret during the container build and bake it into the image
- Store the secret in a Cloud Storage bucket and download it at startup
- Pass the secret as a build argument in the Dockerfile
Correct answer: Mount the secret as an environment variable or volume using Secret Manager integration
Cloud Run's native Secret Manager integration mounts secrets as environment variables or volumes, keeping them out of the container image.
Question 2: You are designing a multi-region Cloud Spanner database to minimize latency for users in the US and Europe. Which instance configuration should you choose?
- A single-region configuration in us-central1
- A multi-region configuration that spans US and European regions (Correct answer)
- Separate Spanner instances per region with application-level replication
- A regional instance in europe-west1 only
Correct answer: A multi-region configuration that spans US and European regions
A multi-region Spanner configuration automatically replicates data across US and European regions, providing low latency for both user populations.
Question 3: Which command correctly authenticates the gcloud CLI using Application Default Credentials for local development?
- gcloud auth login
- gcloud auth application-default login (Correct answer)
- gcloud config set account
- gcloud iam service-accounts keys create
Correct answer: gcloud auth application-default login
gcloud auth application-default login stores credentials that client libraries use automatically for ADC-based authentication in local development.
Question 4: You want to prevent VM instances in a project from having external IP addresses. Which Organization Policy constraint enforces this?
- constraints/compute.vmExternalIpAccess (Correct answer)
- constraints/compute.restrictCloudSQLInstances
- constraints/iam.disableServiceAccountKeyCreation
- constraints/compute.skipDefaultNetworkCreation
Correct answer: constraints/compute.vmExternalIpAccess
The constraints/compute.vmExternalIpAccess policy restricts or denies the assignment of external IP addresses to Compute Engine VMs.
Question 5: A Pub/Sub subscription has a large backlog of unprocessed messages. What happens to messages that are not acknowledged within the subscription's acknowledgement deadline?
- They are permanently deleted from the topic
- They are redelivered to the subscriber (Correct answer)
- They are moved to a dead-letter topic automatically
- They are stored in Cloud Storage for later retrieval
Correct answer: They are redelivered to the subscriber
If a message is not acknowledged within the deadline, Pub/Sub redelivers it to ensure at-least-once delivery semantics.
Question 6: You need a fully managed data warehouse on GCP to run analytical SQL queries on petabyte-scale datasets. Which service should you use?
- Cloud SQL
- BigQuery (Correct answer)
- Cloud Bigtable
- Datastore
Correct answer: BigQuery
BigQuery is Google's serverless, fully managed data warehouse designed for fast analytical SQL queries on petabyte-scale datasets.
Question 7: A GKE workload needs to call a Google Cloud API. What is the recommended way to grant the workload access without using a service account key file?
- Mount a service account JSON key as a Kubernetes Secret
- Use Workload Identity to link a Kubernetes service account to a Google service account (Correct answer)
- Set GOOGLE_APPLICATION_CREDENTIALS to a path inside the container
- Use node-level service account permissions for all pods on the node
Correct answer: Use Workload Identity to link a Kubernetes service account to a Google service account
Workload Identity binds a Kubernetes service account to a Google service account, allowing pods to obtain short-lived credentials without key files.
Cloud Engineer Cloud Engineer: Google Associate 4
A Cloud Run service needs to access a secret stored in Secret Manager at runtime.
Which approach follows Google's security best practices?