GCP Google Cloud Platform (GCP) Skills 4 — Questions and Answers
Question 1: Which GCP managed service is purpose-built for running Apache Spark and Hadoop workloads?
- Dataflow
- Dataproc (Correct answer)
- Datastream
- Data Fusion
Correct answer: Dataproc
Cloud Dataproc is a managed service for running Apache Spark, Hadoop, Hive, and Pig workloads with fast cluster creation and per-second billing.
Question 2: What is the function of Cloud Armor in GCP?
- Encrypts data at rest across all GCP storage services
- Provides DDoS protection and WAF rules for external HTTP(S) load balancers (Correct answer)
- Manages SSL certificates for Cloud Run services
- Scans container images for known vulnerabilities
Correct answer: Provides DDoS protection and WAF rules for external HTTP(S) load balancers
Cloud Armor is GCP's managed DDoS mitigation and Web Application Firewall service that integrates with the external HTTP(S) load balancer.
Question 3: A team wants to enforce that all GCP projects in their organization must have a specific label. Which tool enforces this policy?
- Cloud IAM conditions
- Organization Policy Service (Correct answer)
- Resource Manager Tags
- Security Command Center
Correct answer: Organization Policy Service
The Organization Policy Service lets you set constraints across your entire GCP resource hierarchy, including requiring specific labels on projects.
Question 4: What is 'VPC Service Controls' used for in GCP?
- Setting firewall rules for inbound traffic to GCP VMs
- Creating a security perimeter around GCP services to prevent data exfiltration (Correct answer)
- Managing IP address allocation for VPC subnets
- Restricting which regions users can deploy resources in
Correct answer: Creating a security perimeter around GCP services to prevent data exfiltration
VPC Service Controls creates a logical perimeter around supported GCP services (e.g., BigQuery, Cloud Storage), blocking access from outside the perimeter even for authorized users.
Question 5: Which Compute Engine feature ensures a VM restarts on a different host if the underlying hardware fails?
- Sole-tenant nodes
- Live migration
- Automatic restart (Correct answer)
- Managed instance groups
Correct answer: Automatic restart
The 'automatic restart' setting causes Compute Engine to restart a VM on another host if the VM terminates due to hardware or system failures.
Question 6: In Cloud Functions (2nd gen), what is the maximum allowed memory per function instance?
- 512 MB
- 2 GB
- 8 GB
- 16 GB (Correct answer)
Correct answer: 16 GB
Cloud Functions 2nd gen supports up to 16 GB of memory per instance, a significant increase over 1st gen's 8 GB limit.
Question 7: What does 'customer-managed encryption keys' (CMEK) allow in GCP?
- GCP automatically rotates encryption keys on a 90-day schedule
- Customers control their own encryption keys stored in Cloud KMS instead of Google-managed keys (Correct answer)
- All data is encrypted client-side before being sent to GCP
- Encryption is disabled for services that need raw performance
Correct answer: Customers control their own encryption keys stored in Cloud KMS instead of Google-managed keys
CMEK lets you provision and manage your own encryption keys in Cloud KMS, giving you control over key rotation, access, and revocation for GCP services.
GCP Google Cloud Platform (GCP) Skills 4
Which GCP managed service is purpose-built for running Apache Spark and Hadoop workloads?