Cloud Engineer Cloud Engineer: Google Associate 5 — Questions and Answers
Question 1: You need to route traffic between two VPC networks in different GCP projects without traversing the public internet. What is the recommended solution?
- Configure a Cloud VPN between the two VPCs
- Set up VPC Network Peering between the two networks (Correct answer)
- Use an external load balancer as a proxy between VPCs
- Create a shared VPC and move all resources into it
Correct answer: Set up VPC Network Peering between the two networks
VPC Network Peering connects two VPC networks privately so traffic flows through Google's internal network without public internet exposure.
Question 2: A Dataflow pipeline reading from Cloud Storage is running slowly. The job graph shows one stage with significantly more work than others. What is the likely cause?
- Insufficient IAM permissions for the Dataflow worker
- Data skew causing a hot key in one worker bundle (Correct answer)
- The Cloud Storage bucket is in a different region than the Dataflow job
- The pipeline uses the wrong runner (DirectRunner instead of DataflowRunner)
Correct answer: Data skew causing a hot key in one worker bundle
Data skew causes one worker to receive a disproportionate share of data, creating a bottleneck visible as an unbalanced stage in the job graph.
Question 3: Which Cloud Logging export destination allows you to run SQL queries on log data for long-term analysis?
- Cloud Storage bucket (JSON files)
- BigQuery dataset (Correct answer)
- Pub/Sub topic
- Cloud Monitoring metrics
Correct answer: BigQuery dataset
Exporting logs to BigQuery via a log sink enables SQL-based analysis on structured log data for historical trends and compliance.
Question 4: You are setting up a Cloud Armor security policy. Which rule action blocks requests that match a condition?
- allow
- deny(403) (Correct answer)
- redirect
- throttle
Correct answer: deny(403)
The deny(403) action in Cloud Armor returns an HTTP 403 Forbidden response to requests matching the security policy rule.
Question 5: A Cloud SQL for PostgreSQL instance is running out of storage. What feature can automatically increase storage capacity without downtime?
- Read replicas
- Automatic storage increase (Correct answer)
- High availability failover
- Point-in-time recovery
Correct answer: Automatic storage increase
Cloud SQL's automatic storage increase feature detects when free space is low and automatically adds storage without requiring manual intervention or downtime.
Question 6: You need to deploy infrastructure across multiple GCP environments (dev, staging, prod) using code that can be version-controlled and peer-reviewed. Which tool is most aligned with this requirement?
- gcloud CLI scripts
- Cloud Console GUI
- Terraform with Google Cloud provider (Correct answer)
- Cloud Deployment Manager (YAML templates)
Correct answer: Terraform with Google Cloud provider
Terraform is the industry-standard IaC tool with a mature Google Cloud provider, enabling version-controlled, reviewable, and repeatable infrastructure deployments.
Question 7: A project has exceeded its Compute Engine quota for CPU cores in a region. Which action can you take to resolve this without changing regions?
- Delete and recreate the project
- Submit a quota increase request via the Cloud Console or API (Correct answer)
- Switch to a different billing account
- Enable the Compute Engine API again
Correct answer: Submit a quota increase request via the Cloud Console or API
GCP quotas can be increased by submitting a quota increase request in the Cloud Console under IAM & Admin > Quotas, subject to Google approval.
Cloud Engineer Cloud Engineer: Google Associate 5
You need to route traffic between two VPC networks in different GCP projects without traversing the public internet.
What is the recommended solution?