Free Associate Cloud Engineer v1.0 Questions and Answers — Questions and Answers
Question 1: The audit log files for your company must be kept for three years because it is a financial institution. There are several Google Cloud projects in your company. It would help if you practiced a cost-efficient log file retention strategy. What ought you to do?
- Make a Cloud Audit export to the sink that stores logs to a Coldline Storage bucket
- Create a sink export that stores Cloud Audit logs to BigQuery (Correct answer)
- Write a Cloud Dataflow pipeline to store the logs in Cloud SQL and export these logs to Cloud Pub/Sub
- Create a custom script that copies the logs from the Stackdriver logs to BigQuery using the logging API
Correct answer: Create a sink export that stores Cloud Audit logs to BigQuery
For long-term, cost-efficient retention of audit logs (three years in this case), exporting them to BigQuery via a sink export is the recommended strategy. BigQuery offers highly scalable, cost-effective storage and powerful querying capabilities, making it ideal for compliance and auditing needs over large datasets. Unlike Cloud Storage, BigQuery is optimized for analytical queries, which is beneficial for auditors needing to analyze historical log data.
Question 2: For a latency-sensitive website, you wish to use GCP to run a single HTTP reverse proxy with caching. The CPU use for this specific reverse proxy is minimal. A 30-GB in-memory cache is desired, and an extra 2 GB of memory is required for the remaining processes. Cost savings are what you seek. How should this reverse proxy be used?
- Run it on Compute Engine, and choose a custom instance type with 6 vCPUs and 32 GB of memory (Correct answer)
- Create a Cloud Memorystore for Redis instance with 32-GB capacity
- Run it on Compute Engine, choose the instance type n1-standard-1, and add an SSD persistent disk of 32 GB
- Package it in a container image, and run it on Kubernetes Engine, using n1-standard-32 instances as nodes
Correct answer: Run it on Compute Engine, and choose a custom instance type with 6 vCPUs and 32 GB of memory
The application requires a 30 GB in-memory cache plus 2 GB for other processes, totaling 32 GB of memory, with minimal CPU usage. Running it on Compute Engine with a custom instance type allows for precise resource allocation, providing exactly 32 GB of memory and a minimal number of vCPUs (e.g., 6 vCPUs to ensure sufficient processing power for the proxy). This approach optimizes for cost savings by matching resources closely to the application's specific needs, avoiding the over-provisioning of predefined instance types.
Question 3: In your own data center, bare-metal servers are hosting an application. Cloud storage must be accessible to the application. Security regulations, however, forbid the servers hosting the application from having available IP addresses or internet access. It would help if you stuck to Google's advice to grant the application access to cloud storage. What ought you to do?
- 1. Use nslookup to get the IP address for storage.googleapis.com <br> 2. Negotiate with the security team to allow the servers to have a public IP address. <br> 3. Only permit egress traffic from those servers to storage.googleapis.com's IP addresses
- 1. Using Cloud VPN, create a VPN tunnel to a Virtual Private Cloud (VPC) in Google Cloud <br> 2. In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance <br> 3. Configure your servers to use that instance as a proxy to access Cloud Storage
- 1. Using Cloud VPN or Interconnect, create a tunnel to a VPC in Google Cloud <br> 2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel <br> 3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com
- 1. Use Migrate for Compute Engine (formerly known as Velostrata) to migrate those servers to Compute Engine <br> 2. Create an internal load balancer (ILB) that uses storage.googleapis.com as a backend <br> 3. Configure your new instances to use this ILB as a proxy (Correct answer)
Correct answer: 1. Use Migrate for Compute Engine (formerly known as Velostrata) to migrate those servers to Compute Engine <br> 2. Create an internal load balancer (ILB) that uses storage.googleapis.com as a backend <br> 3. Configure your new instances to use this ILB as a proxy
This strategy involves first migrating the on-site bare-metal servers to Compute Engine instances in Google Cloud using Migrate for Compute Engine. This places the application within the GCP network, closer to Cloud Storage. To maintain the security requirement of no direct internet access for the application instances, an Internal Load Balancer (ILB) can be set up to front a proxy service. The application instances are then configured to route their Cloud Storage requests through this internal proxy, allowing them to access the service without needing public IP addresses or direct internet egress.
Question 4: You wish to set up a Cloud Run application that handles Cloud Pub/Sub topic message processing. You want to adhere to Google's suggestions. What ought you to do?
- 1. Grant the Pub/Sub Subscriber role to the service account used by Cloud Run <br> 2. Create a Cloud Pub/Sub subscription for that topic <br> 3. Make your application pull messages from that subscription
- 1. Create a Cloud Function that uses a Cloud Pub/Sub trigger on that topic <br> 2. Call your application on Cloud Run from the Cloud Function for every message
- 1. Deploy your application on Cloud Run on GKE with the connectivity set to Internal <br> 2. Create a Cloud Pub/Sub subscription for that topic <br> 3. In the same Google Kubernetes Engine cluster as your application, deploy a container that takes the messages and sends them to your application (Correct answer)
- 1. Create a service account <br> 2. Give the Cloud Run Invoker role to that service account for your Cloud Run application <br> 3. Create a Cloud Pub/Sub subscription that uses that service account and uses your Cloud Run application as the push endpoint
Correct answer: 1. Deploy your application on Cloud Run on GKE with the connectivity set to Internal <br> 2. Create a Cloud Pub/Sub subscription for that topic <br> 3. In the same Google Kubernetes Engine cluster as your application, deploy a container that takes the messages and sends them to your application
To process Cloud Pub/Sub messages with a Cloud Run application on GKE while adhering to internal connectivity, deploy the Cloud Run application with connectivity set to Internal. Create a standard Cloud Pub/Sub subscription for the topic. Then, within the same GKE cluster, deploy a separate container that acts as a message puller, fetching messages from the Pub/Sub subscription and forwarding them internally to your Cloud Run application. This ensures secure, private message handling within the cluster.
Question 5: A container image-packaged program has to be deployed in a new project. Not many requests are made daily to the application, which exposes an HTTP endpoint. You want to reduce spending. What ought you to do?
- Deploy the container on Cloud Run on GKE (Correct answer)
- Deploy the container on Cloud Run
- Deploy the container on GKE with cluster autoscaling and horizontal pod autoscaling enabled
- Deploy the container on App Engine Flexible
Correct answer: Deploy the container on Cloud Run on GKE
For a containerized application with low daily request volume, deploying it on Cloud Run on GKE is a highly cost-effective solution. Cloud Run on GKE allows the application to scale down to zero instances when idle, meaning you only pay for resources when requests are actively being processed. This minimizes infrastructure costs compared to maintaining a full GKE cluster with constantly running nodes or using App Engine Flexible for such low-traffic scenarios.
Question 6: Your business already has a GCP organization with a billing account and numerous projects. Your business acquired a company with hundreds of projects and its billing account. You want to combine the GCP expenses of the two GCP entities into one invoice. You want to connect all costs starting tomorrow. What ought you to do?
- Set up your billing account and the acquired company's billing account so that billing information is exported into a single BigQuery dataset
- Link the acquired company's projects to your company's billing account
- Create a new GCP organization and a new billing account. Migrate the acquired company's projects and your company's projects into the new GCP organization and link the projects to the new billing account (Correct answer)
- Project migration into your firm's GCP organization from the acquired company. Connect the migrated projects to the billing account for your business
Correct answer: Create a new GCP organization and a new billing account. Migrate the acquired company's projects and your company's projects into the new GCP organization and link the projects to the new billing account
To consolidate GCP expenses from two separate organizations and billing accounts into a single invoice, a new, unified GCP organization and billing account must be established. All projects from both the original company and the acquired company should then be migrated under this new organization and linked to the new billing account. This ensures all future costs are tracked and billed together from the specified start date, providing a single point of financial management.
Question 7: You used Cloud Spanner to build a Google Cloud application. While monitoring the environment, your support staff shouldn't have access to table data. You want to adhere to Google's best practices, so you need an efficient way to grant the right rights to your support team. What ought you to do?
- Add the support team group to the roles/spanner.databaseUser role (Correct answer)
- Add the support team group to the roles/monitoring.viewer role
- Add the support team group to the roles/stackdriver.accounts.viewer role
- Add the support team group to the roles/spanner.databaseReader role
Correct answer: Add the support team group to the roles/spanner.databaseUser role
The `roles/spanner.databaseUser` role grants permissions to read and write data within a Cloud Spanner database, which is typically sufficient for support staff to troubleshoot and monitor application data. Crucially, this role does not grant permissions to manage the database schema or instances, preventing unintended modifications to the database structure. This adheres to the principle of least privilege, providing necessary access without exposing sensitive administrative capabilities.
Free Associate Cloud Engineer v1.0 Questions and Answers
The audit log files for your company must be kept for three years because it is a financial institution.
There are several Google Cloud projects in your company.
It would help if you practiced a cost-efficient log file retention strategy.
What ought you to do?