Google Cloud Associate Cloud Engineer Exam MCQ With Answers GCP ACE 16

Associate Cloud Engineer

Google Cloud

Associate Cloud Engineers deploy applications, monitor operations, and manage enterprise solutions. They use Google Cloud Console and the command-line interface to perform common platform-based tasks to maintain one or more deployed solutions that leverage Google-managed or self-managed services on Google Cloud.

The Associate Cloud Engineer exam assesses your ability to:

Set up a cloud solution environment
Plan and configure a cloud solution
Deploy and implement a cloud solution
Ensure successful operation of a cloud solution
Configure access and security

About this certification exam

Length: 2 hours
Registration fee: $125 (plus tax where applicable)
Languages: English, Japanese, Spanish, Portuguese
Exam format: 50-60 multiple choice and multiple select questions

GOOGLE CLOUD ASSOCIATE CLOUD ENGINEER MCQ

1. You need to host an application on a Compute Engine instance in a project shared with other teams. You want to prevent the other teams from accidentally causing downtime on application. Which feature should you use?

Use a Shielded VM.
Use a Preemptible VM.
Use a sole-tenant node.
Enable deletion protection on the instance.

Answer: Enable deletion protection on the instance.

2. Your organization needs to grant users access to query datasets in BigQuery but prevent them from accidentally deleting the datasets. You want a solution that follows Google-recommended practices. What should you do?

Add users to roles/bigquery user role only, instead of roles/bigquery dataOwner.
Add users to roles/bigquery dataEditor role only, instead of roles/bigquery dataOwner.
Create a custom role by removing delete permissions, and add users to that role only.
Create a custom role by removing delete permissions. Add users to the group, and then add the group to the custom role.

Answer: Create a custom role by removing delete permissions. Add users to the group, and then add the group to the custom role.

3. You have a developer laptop with the Cloud SDK installed on Ubuntu. The Cloud SDK was installed from the Google Cloud Ubuntu package repository. You want to test your application locally on your laptop with Cloud Datastore. What should you do?

Export Cloud Datastore data using gcloud datastore export.
Create a Cloud Datastore index using gcloud datastore indexes create.
Install the google-cloud-sdk-datastore-emulator component using the apt get install command.
Install the cloud-datastore-emulator component using the gcloud components install command.

Answer: Install the google-cloud-sdk-datastore-emulator component using the apt get install command.

4. Your company set up a complex organizational structure on Google Cloud. The structure includes hundreds of folders and projects. Only a few team members should be able to view the hierarchical structure. You need to assign minimum permissions to these team members, and you want to follow Google-recommended practices. What should you do?

Add the users to roles/browser role.
Add the users to roles/iam.roleViewer role.
Add the users to a group, and add this group to roles/browser.
Add the users to a group, and add this group to roles/iam.roleViewer role.

Answer: Add the users to a group, and add this group to roles/browser.

5. Your company has a single sign-on (SSO) identity provider that supports Security Assertion Markup Language (SAML) integration with service providers. Your company has users in Cloud Identity. You would like users to authenticate using your companyג€TMs SSO provider. What should you do?

In Cloud Identity, set up SSO with Google as an identity provider to access custom SAML apps.
In Cloud Identity, set up SSO with a third-party identity provider with Google as a service provider.
Obtain OAuth 2.0 credentials, configure the user consent screen, and set up OAuth 2.0 for Mobile & Desktop Apps.
Obtain OAuth 2.0 credentials, configure the user consent screen, and set up OAuth 2.0 for Web Server Applications.

Answer: In Cloud Identity, set up SSO with a third-party identity provider with Google as a service provider.

6. Your organization has a dedicated person who creates and manages all service accounts for Google Cloud projects. You need to assign this person the minimum role for projects. What should you do?

Add the user to roles/iam.roleAdmin role.
Add the user to roles/iam.securityAdmin role.
Add the user to roles/iam.serviceAccountUser role.
Add the user to roles/iam.serviceAccountAdmin role.

Answer: Add the user to roles/iam.serviceAccountAdmin role.

7. You are building an archival solution for your data warehouse and have selected Cloud Storage to archive your data. Your users need to be able to access this archived data once a quarter for some regulatory requirements. You want to select a cost-efficient option. Which storage option should you use?

Cold Storage
Nearline Storage
Regional Storage
Multi-Regional Storage

Answer: Cold Storage

8. A team of data scientists infrequently needs to use a Google Kubernetes Engine (GKE) cluster that you manage. They require GPUs for some long-running, non- restartable jobs. You want to minimize cost. What should you do?

Enable node auto-provisioning on the GKE cluster.
Create a VerticalPodAutscaler for those workloads.
Create a node pool with preemptible VMs and GPUs attached to those VMs.
Create a node pool of instances with GPUs, and enable autoscaling on this node pool with a minimum size of 1.

Answer: Create a node pool of instances with GPUs, and enable autoscaling on this node pool with a minimum size of 1.

9. Your organization has user identities in Active Directory. Your organization wants to use Active Directory as their source of truth for identities. Your organization wants to have full control over the Google accounts used by employees for all Google services, including your Google Cloud Platform (GCP) organization. What should you do?

Use Google Cloud Directory Sync (GCDS) to synchronize users into Cloud Identity.
Use the cloud Identity APIs and write a script to synchronize users to Cloud Identity.
Export users from Active Directory as a CSV and import them to Cloud Identity via the Admin Console.
Ask each employee to create a Google account using self signup. Require that each employee use their company email address and password.

Answer: Use Google Cloud Directory Sync (GCDS) to synchronize users into Cloud Identity.

10. You have successfully created a development environment in a project for an application. This application uses Compute Engine and Cloud SQL. Now you need to create a production environment for this application. The security team has forbidden the existence of network routes between these 2 environments and has asked you to follow Google recommended practices. What should you do?

Create a new project, enable the Compute Engine and Cloud SQL APIs in that project, and replicate the setup you have created in the development environment.
Create a new production subnet in the existing VPC and a new production Cloud SQL instance in your existing project, and deploy your application using those resources.
Create a new project, modify your existing VPC to be a Shared VPC, share that VPC with your new project, and replicate the setup you have in the development environment in that new project in the Shared VPC.
Ask the security team to grant you the Project Editor role in an existing production project used by another division of your company. Once they grant you that role, replicate the setup you have in the development environment in that project.

Answer: Create a new project, enable the Compute Engine and Cloud SQL APIs in that project, and replicate the setup you have created in the development environment.

11. Your management has asked an external auditor to review all the resources in a specific project. The security team has enabled the Organization Policy called Domain Restricted Sharing on the organization node by specifying only your Cloud Identity domain. You want the auditor to only be able to view, but not modify, the resources in that project. What should you do?

Ask the auditor for their Google account, and give them the Viewer role on the project.
Ask the auditor for their Google account, and give them the Security Reviewer role on the project.
Create a temporary account for the auditor in Cloud Identity, and give that account the Viewer role on the project.
Create a temporary account for the auditor in Cloud Identity, and give that account the Security Reviewer role on the project.

Answer: Create a temporary account for the auditor in Cloud Identity, and give that account the Viewer role on the project.

12. You have a workload running on Compute Engine that is critical to your business. You want to ensure that the data on the boot disk of this workload is backed up regularly. You need to be able to restore a backup as quickly as possible in case of disaster. You also want older backups to be cleaned automatically to save on cost. You want to follow Google-recommended practices. What should you do?

Create a Cloud Function to create an instance template.
Create a snapshot schedule for the disk using the desired interval.
Create a cron job to create a new disk from the disk using gcloud.
Create a Cloud Task to create an image and export it to Cloud Storage.

Answer: Create a snapshot schedule for the disk using the desired interval.

13. You need to assign a Cloud Identity and Access Management (Cloud IAM) role to an external auditor. The auditor needs to have permissions to review your Google Cloud Platform (GCP) Audit Logs and also to review your Data Access logs. What should you do?

Assign the auditor the IAM role roles/logging.privateLogViewer. Perform the export of logs to Cloud Storage.
Assign the auditor the IAM role roles/logging.privateLogViewer. Direct the auditor to also review the logs for changes to Cloud IAM policy.
Assign the auditorג€TMs IAM user to a custom role that has logging.privateLogEntries.list permission. Perform the export of logs to Cloud Storage.
Assign the auditorג€TMs IAM user to a custom role that has logging.privateLogEntries.list permission. Direct the auditor to also review the logs for changes to Cloud IAM policy.

Answer: Assign the auditor the IAM role roles/logging.privateLogViewer. Direct the auditor to also review the logs for changes to Cloud IAM policy.

14. You are managing several Google Cloud Platform (GCP) projects and need access to all logs for the past 60 days. You want to be able to explore and quickly analyze the log contents. You

want to follow Google-recommended practices to obtain the combined logs for all projects. What should you do?

Navigate to Stackdriver Logging and select resource.labels.project_id="*"
Create a Stackdriver Logging Export with a Sink destination to a BigQuery dataset. Configure the table expiration to 60 days.
Create a Stackdriver Logging Export with a Sink destination to Cloud Storage. Create a lifecycle rule to delete objects after 60 days.
Configure a Cloud Scheduler job to read from Stackdriver and store the logs in BigQuery. Configure the table expiration to 60 days.

Answer: Create a Stackdriver Logging Export with a Sink destination to a BigQuery dataset. Configure the table expiration to 60 days.

15. You need to reduce GCP service costs for a division of your company using the fewest possible steps. You need to turn off all configured services in an existing GCP project. What should you do?

Verify that you are assigned the Project Owners IAM role for this project. 2. Locate the project in the GCP console, click Shut down and then enter the project ID.
Verify that you are assigned the Project Owners IAM role for this project. 2. Switch to the project in the GCP console, locate the resources and delete them.
Verify that you are assigned the Organizational Administrator IAM role for this project. 2. Locate the project in the GCP console, enter the project ID and then click Shut down.
Verify that you are assigned the Organizational Administrators IAM role for this project. 2. Switch to the project in the GCP console, locate the resources and delete them.

Answer: Verify that you are assigned the Project Owners IAM role for this project. 2. Locate the project in the GCP console, click Shut down and then enter the project ID.

16. You are configuring service accounts for an application that spans multiple projects. Virtual machines (VMs) running in the web-applications project need access to BigQuery datasets in crmdatabases-proj. You want to follow Google-recommended practices to give access to the service account in the web-applications project. What should you do?

Give ג€project ownerג€ for web-applications appropriate roles to crm-databases-proj.
Give ג€project ownerג€ role to crm-databases-proj and the web-applications project.
Give ג€project ownerג€ role to crm-databases-proj and bigquery.dataViewer role to web-applications.
Give bigquery.dataViewer role to crm-databases-proj and appropriate roles to web-application.

Answer: Give bigquery.dataViewer role to crm-databases-proj and appropriate roles to web application.

17. An employee was terminated, but their access to Google Cloud Platform (GCP) was not removed until 2 weeks later. You need to find out this employee accessed any sensitive customer information after their termination. What should you do?

View System Event Logs in Stackdriver. Search for the user email as the principal.
View System Event Logs in Stackdriver. Search for the service account associated with the user.
View Data Access audit logs in Stackdriver. Search for the user’s email as the principal.
View the Admin Activity log in Stackdriver. Search for the service account associated with the user.

Answer: View Data Access audit logs in Stackdriver. Search for the user’s email as the principal.

18. You need to create a custom IAM role for use with a GCP service. All permissions in the role must be suitable for production use. You also want to clearly share with your organization the status of the custom role. This will be the first version of the custom role. What should you do?

Use permissions in your role that use the ג€˜supported ג€ TMsupport level for role permissions. Set the role stage to ALPHA while testing the role permissions.
Use permissions in your role that use the ג€˜supportedג€ TMsupport level for role permissions. Set the role stage to BETA while testing the role permissions.
Use permissions in your role that use the ג€˜testingג€ TMsupport level for role permissions. Set the role stage to ALPHA while testing the role permissions.
Use permissions in your role that use the ג€˜testingג€ TMsupport level for role permissions. Set the role stage to BETA while testing the role permissions.

Answer: Use permissions in your role that use the ג€˜supported ג€ TMsupport level for rol permissions. Set the role stage to ALPHA while testing the role permissions.

19. Your company has a large quantity of unstructured data in different file formats. You want to perform ETL transformations on the data. You need to make the data accessible on Google Cloud so it can be processed by a Dataflow job. What should you do?

Upload the data to BigQuery using the bq command line tool.
Upload the data to Cloud Storage using the gsutil command line tool.
Upload the data into Cloud SQL using the import function in the console.
Upload the data into Cloud Spanner using the import function in the console.

Answer: Upload the data to Cloud Storage using the gsutil command line tool.

20. You need to manage multiple Google Cloud projects in the fewest steps possible. You want to configure the Google Cloud SDK command line interface (CLI) so that you can easily manage multiple projects. What should you do?

Create a configuration for each project you need to manage. 2. Activate the appropriate configuration when you work with each of your assigned Google Cloud projects.
Create a configuration for each project you need to manage. 2. Use gcloud init to update the configuration values when you need to work with a non-default project
Use the default configuration for one project you need to manage. 2. Activate the appropriate configuration when you work with each of your assigned Google Cloud projects.
Use the default configuration for one project you need to manage. 2. Use gcloud init to update the configuration values when you need to work with a non-default project.

Answer: Create a configuration for each project you need to manage. 2. Activate the appropriate configuration when you work with each of your assigned Google Cloud projects.

21. Your managed instance group raised an alert stating that new instance creation has failed to create new instances. You need to maintain the number of running instances specified by the template to be able to process expected application traffic. What should you do?

Create an instance template that contains valid syntax which will be used by the instance group. Delete any persistent disks with the same name as instance names.
Create an instance template that contains valid syntax that will be used by the instance group. Verify that the instance name and persistent disk name values are not the same in the template.
Verify that the instance template being used by the instance group contains valid syntax. Delete any persistent disks with the same name as instance names. Set the disks.autoDelete property to true in the instance template.
Delete the current instance template and replace it with a new instance template. Verify that the instance name and persistent disk name values are not the same in the template. Set the disks.autoDelete property to true in the instance template.

Answer: Create an instance template that contains valid syntax which will be used by the instance group. Delete any persistent disks with the same name as instance names.

22. Your company is moving from an on-premises environment to Google Cloud. You have multiple development teams that use Cassandra environments as backend databases. They all need a development environment that is isolated from other Cassandra instances. You want to move to Google Cloud quickly and with minimal support effort. What should you do?

Build an instruction guide to install Cassandra on Google Cloud. 2. Make the instruction guide accessible to your developers.
Advise your developers to go to Cloud Marketplace. 2. Ask the developers to launch a Cassandra image for their development work.
Build a Cassandra Compute Engine instance and take a snapshot of it. 2. Use the snapshot to create instances for your developers.
Build a Cassandra Compute Engine instance and take a snapshot of it. 2. Upload the snapshot to Cloud Storage and make it accessible to your developers. 3. Build instructions to create a Compute Engine instance from the snapshot so that developers can do it themselves.

Answer: Advise your developers to go to Cloud Marketplace. 2. Ask the developers to launch Cassandra image for their development work.

23. You have a Compute Engine instance hosting a production application. You want to receive an email if the instance consumes more than 90% of its CPU resources for more than 15 minutes. You want to use Google services. What should you do?

1.Create a consumer Gmail account. 2. Write a script that monitors the CPU usage. 3. When the CPU usage exceeds the threshold, have that script send an email using the Gmail account and smtp.gmail.com on port 25 as SMTP server.
1.Create a Stackdriver Workspace, and associate your Google Cloud Platform (GCP) project with it. 2. Create an Alerting Policy in Stackdriver that uses the threshold as a trigger condition. 3. Configure your email address in the notification channel.
1.Create a Stackdriver Workspace, and associate your GCP project with it. 2. Write a script that monitors the CPU usage and sends it as a custom metric to Stackdriver. 3. Create an uptime check for the instance in Stackdriver.
1.In Stackdriver Logging, create a logs-based metric to extract the CPU usage by using this regular expression: CPU Usage: ([0-9] {1,3})% 2. In Stackdriver Monitoring, create an Alerting Policy based on this metric. 3. Configure your email address in the notification channel.

Answer: 1.Create a Stackdriver Workspace, and associate your Google Cloud Platform (GCP) project with it. 2. Create an Alerting Policy in Stackdriver that uses the threshold as a trigger condition. 3. Configure your email address in the notification channel.

24. You have an application that uses Cloud Spanner as a backend database. The application has a very predictable traffic pattern. You want to automatically scale up or down the number of Spanner nodes depending on traffic. What should you do?

Create a cron job that runs on a scheduled basis to review Cloud Monitoring metrics, and then resize the Spanner instance accordingly.
Create a Cloud Monitoring alerting policy to send an alert to oncall SRE emails when Cloud Spanner CPU exceeds the threshold. SREs would scale resources up or down accordingly.
Create a Cloud Monitoring alerting policy to send an alert to Google Cloud Support email when Cloud Spanner CPU exceeds your threshold. Google support would scale resources up or down accordingly.
Create a Cloud Monitoring alerting policy to send an alert to webhook when Cloud Spanner CPU is over or under your threshold. Create a Cloud Function that listens to HTTP and resizes Spanner resources accordingly.

Answer: Create a Cloud Monitoring alerting policy to send an alert to webhook when Cloud Spanner CPU is over or under your threshold. Create a Cloud Function that listens to HTTP and resizes Spanner resources accordingly.

25. Your company publishes large files on an Apache web server that runs on a Compute Engine instance. The Apache web server is not the only application running in the project. You want to receive an email when the egress network costs for the server exceed 100 dollars for the current month as measured by Google Cloud. What should you do?

Set up a budget alert on the project with an amount of 100 dollars, a threshold of 100%, and notification type of ג€email.ג€
Set up a budget alert on the billing account with an amount of 100 dollars, a threshold of 100%, and notification type of ג€email.ג€
Export the billing data to BigQuery. Create a Cloud Function that uses BigQuery to sum the egress network costs of the exported billing data for the Apache web server for the current month and sends an email if it is over 100 dollars. Schedule the Cloud Function using Cloud Scheduler to run hourly.
Use the Cloud Logging Agent to export the Apache web server logs to Cloud Logging. Create a Cloud Function that uses BigQuery to parse the HTTP response log data in Cloud Logging for the current month and sends an email if the size of all HTTP responses, multiplied by current Google Cloud egress prices, totals over 100 dollars. Schedule the Cloud Function using Cloud Scheduler to run hourly.

Answer: Export the billing data to BigQuery. Create a Cloud Function that uses BigQuery to sum the egress network costs of the exported billing data for the Apache web server for the current month and sends an email if it is over 100 dollars. Schedule the Cloud Function using Cloud Scheduler to run hourly.