Go to Associate-Cloud-Engineer Questions - Try Associate-Cloud-Engineer dumps pdf [Q135-Q157]

Go to Associate-Cloud-Engineer Questions - Try Associate-Cloud-Engineer dumps pdf

Dumps Practice Exam Questions Study Guide for the Associate-Cloud-Engineer Exam

Google Associate-Cloud-Engineer Certification Exam is an excellent way for professionals to demonstrate their skills and knowledge in deploying and managing applications on the GCP. Google Associate Cloud Engineer Exam certification provides individuals with the opportunity to enhance their cloud computing career and open up new opportunities for themselves in this field.

 

NEW QUESTION # 135
Your data team is working on some new machine learning models. They're generating several files per day that they want to store in a regional bucket. They mostly focus on the files from the last week. However, they want to keep all the files just to base safe. With the fewest steps possible, what's the best way to lower the storage costs?

• A. Create a lifecycle policy to switch the objects older than a week to nearline storage.
• B. Create a Cloud Function triggered when objects are added to a bucket. Look at the date on all the files and move it to nearline storage if it's older than a week.
• C. Create a Cloud Function triggered when objects are added to a bucket. Look at the date on all the files and move it to coldline storage if it's older than a week.
• D. Create a lifecycle policy to switch the objects older than a week to coldline storage.

Answer: A

NEW QUESTION # 136
You have a Cloud Storage bucket that needs to host static web assets. How do you make the bucket public?

• A. Set allUsers to have the Storage Object Viewer role.
• B. Check the "make public" box in the UI.
• C. Trick question. Don't ever make a bucket public.
• D. gsutil make-public gs://bucket-name

Answer: A

NEW QUESTION # 137
Your company uses a large number of Google Cloud services centralized in a single project. All teams have specific projects for testing and development. The DevOps team needs access to all of the production services in order to perform their job. You want to prevent Google Cloud product changes from broadening their permissions in the future. You want to follow Google- recommended practices. What should you do?

• A. Grant all members of the DevOps team the role of Project Editor on the production project.
• B. Create a custom role that combines the required permissions.
  Grant the DevOps team the custom role on the production project.
• C. Create a custom role that combines the required permissions.
  Grant the DevOps team the custom role on the organization level.
• D. Grant all members of the DevOps team the role of Project Editor on the organization level.

Answer: D

NEW QUESTION # 138
Your organization is a financial company that needs to store audit log files for 3 years. Your organization has hundreds of Google Cloud projects. You need to implement a cost-effective approach for log file retention.
What should you do?

• A. Export these logs to Cloud Pub/Sub and write a Cloud Dataflow pipeline to store logs to Cloud SQL.
• B. Write a custom script that uses logging API to copy the logs from Stackdriver logs to BigQuery.
• C. Create an export to the sink that saves logs from Cloud Audit to a Coldline Storage bucket.
• D. Create an export to the sink that saves logs from Cloud Audit to BigQuery.

Answer: C

Explanation:
Coldline Storage is the perfect service to store audit logs from all the projects and is very cost-efficient as well.
Coldline Storage is a very low-cost, highly durable storage service for storing infrequently accessed data.

NEW QUESTION # 139
Your company set up a complex organizational structure on Google Could Platform. The structure includes hundreds of folders and projects. Only a few team members should be able to view the hierarchical structure. You need to assign minimum permissions to these team members and you want to follow Google-recommended practices. What should you do?

• A. Add the users to roles/browser role.
• B. Add the users to a group, and add this group to roles/iam.roleViewer role.
• C. Add the users to roles/iam.roleViewer role.
• D. Add the users to a group, and add this group to roles/browser role.

Answer: D

Explanation:
Google recommend groups and roles/browser provides Read access to browse the hierarchy for a project, including the folder, organization, and Cloud IAM policy. This role doesn't include permission to view resources in the project.
https://cloud.google.com/iam/docs/understanding-roles

NEW QUESTION # 140
You are managing several Google Cloud Platform (GCP) projects and need access to all logs for the past 60 days. You want to be able to explore and quickly analyze the log contents. You want to follow Google- recommended practices to obtain the combined logs for all projects. What should you do?

• A. Create a Stackdriver Logging Export with a Sink destination to Cloud Storage. Create a lifecycle rule to delete objects after 60 days.
• B. Navigate to Stackdriver Logging and select resource.labels.project_id="*"
• C. Configure a Cloud Scheduler job to read from Stackdriver and store the logs in BigQuery. Configure the table expiration to 60 days.
• D. Create a Stackdriver Logging Export with a Sink destination to a BigQuery dataset. Configure the table expiration to 60 days.

Answer: D

NEW QUESTION # 141
You are managing several Google Cloud Platform (GCP) projects and need access to all logs for the past 60 days. You want to be able to explore and quickly analyze the log contents. You want to follow Google- recommended practices to obtain the combined logs for all projects. What should you do?

• A. Create a Stackdriver Logging Export with a Sink destination to Cloud Storage. Create a lifecycle rule to delete objects after 60 days.
• B. Navigate to Stackdriver Logging and select resource.labels.project_id="*"
• C. Configure a Cloud Scheduler job to read from Stackdriver and store the logs in BigQuery. Configure the table expiration to 60 days.
• D. Create a Stackdriver Logging Export with a Sink destination to a BigQuery dataset. Configure the table expiration to 60 days.

Answer: D

Explanation:
Explanation
Navigate to Stackdriver Logging and select resource.labels.project_id=*. is not right.
Log entries are held in Stackdriver Logging for a limited time known as the retention period which is 30 days (default configuration). After that, the entries are deleted. To keep log entries longer, you need to export them outside of Stackdriver Logging by configuring log sinks.
Ref: https://cloud.google.com/blog/products/gcp/best-practices-for-working-with-google-cloud-audit-logging Configure a Cloud Scheduler job to read from Stackdriver and store the logs in BigQuery. Configure the table expiration to 60 days. is not right.
While this works, it makes no sense to use Cloud Scheduler job to read from Stackdriver and store the logs in BigQuery when Google provides a feature (export sinks) that does exactly the same thing and works out of the box.Ref: https://cloud.google.com/logging/docs/export/configure_export_v2 Create a Stackdriver Logging Export with a Sink destination to Cloud Storage. Create a lifecycle rule to delete objects after 60 days. is not right.
You can export logs by creating one or more sinks that include a logs query and an export destination.
Supported destinations for exported log entries are Cloud Storage, BigQuery, and Pub/Sub.Ref: https://cloud.google.com/logging/docs/export/configure_export_v2 Sinks are limited to exporting log entries from the exact resource in which the sink was created: a Google Cloud project, organization, folder, or billing account. If it makes it easier to exporting from all projects of an organication, you can create an aggregated sink that can export log entries from all the projects, folders, and billing accounts of a Google Cloud organization.Ref: https://cloud.google.com/logging/docs/export/aggregated_sinks Either way, we now have the data in Cloud Storage, but querying logs information from Cloud Storage is harder than Querying information from BigQuery dataset. For this reason, we should prefer Big Query over Cloud Storage.
Create a Stackdriver Logging Export with a Sink destination to a BigQuery dataset. Configure the table expiration to 60 days. is the right answer.
You can export logs by creating one or more sinks that include a logs query and an export destination.
Supported destinations for exported log entries are Cloud Storage, BigQuery, and Pub/Sub.Ref: https://cloud.google.com/logging/docs/export/configure_export_v2 Sinks are limited to exporting log entries from the exact resource in which the sink was created: a Google Cloud project, organization, folder, or billing account. If it makes it easier to exporting from all projects of an organication, you can create an aggregated sink that can export log entries from all the projects, folders, and billing accounts of a Google Cloud organization.Ref: https://cloud.google.com/logging/docs/export/aggregated_sinks Either way, we now have the data in a BigQuery Dataset. Querying information from a Big Query dataset is easier and quicker than analyzing contents in Cloud Storage bucket. As our requirement is to Quickly analyze the log contents, we should prefer Big Query over Cloud Storage.
Also, You can control storage costs and optimize storage usage by setting the default table expiration for newly created tables in a dataset. If you set the property when the dataset is created, any table created in the dataset is deleted after the expiration period. If you set the property after the dataset is created, only new tables are deleted after the expiration period.For example, if you set the default table expiration to 7 days, older data is automatically deleted after 1 week.Ref: https://cloud.google.com/bigquery/docs/best-practices-storage

NEW QUESTION # 142
You have a Dockerfile that you need to deploy on Kubernetes Engine. What should you do?

• A. Create a docker image from the Dockerfile and upload it to Container Registry.
  Create a Deployment YAML file to point to that image.
  Use kubectl to create the deployment with that file.
• B. Use kubectl app deploy <dockerfilename>.
• C. Use gcloud app deploy <dockerfilename>.
• D. Create a docker image from the Dockerfile and upload it to Cloud Storage.
  Create a Deployment YAML file to point to that image.
  Use kubectl to create the deployment with that file.

Answer: A

Explanation:
Create the image prior to deployment:
https://cloud.google.com/kubernetes-engine/docs/tutorials/hello-app
You cant deploy a docker file

NEW QUESTION # 143
An employee was terminated, but their access to Google Cloud Platform (GCP) was not removed until 2 weeks later. You need to find out this employee accessed any sensitive customer information after their termination. What should you do?

• A. View System Event Logs in Stackdriver. Search for the service account associated with the user.
• B. View System Event Logs in Stackdriver. Search for the user's email as the principal.
• C. View Data Access audit logs in Stackdriver. Search for the user's email as the principal.
• D. View the Admin Activity log in Stackdriver. Search for the service account associated with the user.

Answer: C

Explanation:
We are trying to find out if any sensitive data was accessed. Data access logs are the only logs that show this.
https://cloud.google.com/logging/docs/audit#data-access

NEW QUESTION # 144
You're running an n-tier application on Compute Engine with an Apache web server serving up web requests. You want to consolidate all of your logging into Stackdriver. What's the best approach to get the Apache logs into Stackdriver?

• A. Enable Stackdriver monitoring when creating the instance.
• B. Install the Stackdriver monitoring and logging agents on the instance.
• C. Stackdriver logs application data from all instances by default.
• D. Create a log sink and export it to Stackdriver.

Answer: B

NEW QUESTION # 145
A colleague handed over a Google Cloud Platform project for you to maintain. As part of a security checkup, you want to review who has been granted the Project Owner role. What should you do?

• A. Navigate to Identity-Aware Proxy and check the permissions for these resources.
• B. In the console, validate which SSH keys have been stored as project-wide keys.
• C. Enable Audit Logs on the IAM & admin page for all resources, and validate the results.
• D. Use the command gcloud projects get-iam-policy to view the current role assignments.

Answer: D

Explanation:
A simple approach would be to use the command flags available when listing all the IAM policy for a given project. For instance, the following command: `gcloud projects get-iam-policy $PROJECT_ID --flatten="bindings[].members" --format="table(bindings.members)" --filter="bindings.role:roles/owner"` outputs all the users and service accounts associated with the role 'roles/owner' in the project in question. https://groups.google.com/g/google-cloud-dev/c/Z6sZs7TvygQ?pli=1

NEW QUESTION # 146
You have production and test workloads that you want to deploy on Compute Engine. Production VMs need to be in a different subnet than the test VMs. All the VMs must be able to reach each other over Internal IP without creating additional routes. You need to set up VPC and the 2 subnets. Which configuration meets these requirements?

• A. Create 2 custom VPCs, each with a single subnet. Create each subnet in the same region and with the same CIDR range.
• B. Create a single custom VPC with 2 subnets. Create each subnet in the same region and with the same CIDR range.
• C. Create 2 custom VPCs, each with a single subnet. Create each subnet in a different region and with a different CIDR range.
• D. Create a single custom VPC with 2 subnets. Create each subnet in a different region and with a different CIDR range.

Answer: D

NEW QUESTION # 147
You have an application that receives SSL-encrypted TCP traffic on port 443. Clients for this application are located all over the world. You want to minimize latency for the clients. Which load balancing option should you use?

• A. Internal TCP/UDP Load Balancer. Add a firewall rule allowing ingress traffic from 0.0.0.0/0 on the target instances.
• B. SSL Proxy Load Balancer
• C. HTTPS Load Balancer
• D. Network Load Balancer

Answer: B

Explanation:
Reference:
https://cloud.google.com/load-balancing/docs/ssl

NEW QUESTION # 148
You are building an architecture for one of your client with a requirement of streaming millions of requests with high availability and durability along with HIPPA compliance. Which managed service will you prefer?

• A. Cloud Pub/Sub
• B. RabbitMQ
• C. Cloud Function
• D. Cloud DataProc

Answer: A

NEW QUESTION # 149
You have a web application deployed as a managed instance group. You have a new version of the application to gradually deploy. Your web application is currently receiving live web traffic.
You want to ensure that the available capacity does not decrease during the deployment. What should you do?

• A. Create a new instance template with the new application version.
  Update the existing managed instance group with the new instance template.
  Delete the instances in the managed instance group to allow the managed instance group to recreate the instance using the new instance template.
• B. Perform a rolling-action start-update with maxSurge set to 1 and maxUnavailable set to 0.
• C. Create a new managed instance group with an updated instance template.
  Add the group to the backend service for the load balancer.
  When all instances in the new managed instance group are healthy, delete the old managed instance group.
• D. Perform a rolling-action start-update with maxSurge set to 0 and maxUnavailable set to 1.

Answer: B

Explanation:
We need to ensure the global capacity remains intact, for that reason we need to establish maxUnavailable to 0. On the other hand, we need to ensure new instances can be created. We do that by establishing the maxSurge to 1.
Option C is more expensive and more difficult to set up and option D won't meet requirements since it won't keep global capacity intact.
https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed- instance-groups#options

NEW QUESTION # 150
You create a new Google Kubernetes Engine (GKE) cluster and want to make sure that it always runs a supported and stable version of Kubernetes. What should you do?

• A. Enable the Node Auto-Upgrades feature for your GKE cluster.
• B. Select the latest available cluster version for your GKE cluster.
• C. Enable the Node Auto-Repair feature for your GKE cluster.
• D. Select "Container-Optimized OS (cos)" as a node image for your GKE cluster.

Answer: A

Explanation:
Explanation
Creating or upgrading a cluster by specifying the version as latest does not provide automatic upgrades. Enable node auto-upgrades to ensure that the nodes in your cluster are up-to-date with the latest stable version.
https://cloud.google.com/kubernetes-engine/versioning-and-upgrades
Node auto-upgrades help you keep the nodes in your cluster up to date with the cluster master version when your master is updated on your behalf. When you create a new cluster or node pool with Google Cloud Console or the gcloud command, node auto-upgrade is enabled by default.
Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-upgrades

NEW QUESTION # 151
You are building an application that stores relational data from users. Users across the globe will use this application. Your CTO is concerned about the scaling requirements because the size of the user base is unknown. You need to implement a database solution that can scale with your user growth with minimum configuration changes. Which storage solution should you use?

• A. Cloud SQL
• B. Cloud Datastore
• C. Cloud Firestore
• D. Cloud Spanner

Answer: D

Explanation:
Explanation
Cloud Spanner is a relational database and is highly scalable. Cloud Spanner is a highly scalable, enterprise-grade, globally-distributed, and strongly consistent database service built for the cloud specifically to combine the benefits of relational database structure with a non-relational horizontal scale. This combination delivers high-performance transactions and strong consistency across rows, regions, and continents with an industry-leading 99.999% availability SLA, no planned downtime, and enterprise-grade security Ref: https://cloud.google.com/spanner Graphical user interface, application, Teams Description automatically generated

NEW QUESTION # 152
You have several users who need access to some very specific Google Cloud functionality. You'd like to follow the principle of least privilege. What's the best way to ensure these users can list Cloud Storage buckets, list BigQuery jobs, and list compute disks?

• A. Use the Cloud Storage Bucket Viewer, BigQuery Job User, and Compute User predefined roles.
• B. Add the users to the viewer role.
• C. Add the users to a group, apply the Cloud Storage Bucket Viewer, BigQuery Job User, and Compute User predefined roles.
• D. Create a custom role for this job role, add the required permissions, and add the users to the role.

Answer: D

NEW QUESTION # 153
You have a development project with appropriate IAM roles defined. You are creating a production project and want to have the same IAM roles on the new project, using the fewest possible steps. What should you do?

• A. Use gcloud iam roles copy and specify your organization as the destination organization.
• B. In the Google Cloud Platform Console, use the 'create role' functionality and select all applicable permissions.
• C. Use gcloud iam roles copy and specify the production project as the destination project.
• D. In the Google Cloud Platform Console, use the 'create role from role' functionality.

Answer: A

Explanation:
Reference:
https://cloud.google.com/sdk/gcloud/reference/iam/roles/copy

NEW QUESTION # 154
You have a website hosted on App Engine standard environment. You want 1% of your users to see a new test version of the website. You want to minimize complexity. What should you do?

• A. Create a new App Engine application in the same project. Deploy the new version in that application.
  Configure your network load balancer to send 1% of the traffic to that new application.
• B. Deploy the new version in the same application and use the --splits option to give a weight of 99 to the current version and a weight of 1 to the new version.
• C. Create a new App Engine application in the same project. Deploy the new version in that application.
  Use the App Engine library to proxy 1% of the requests to the new version.
• D. Deploy the new version in the same application and use the --migrate option.

Answer: B

NEW QUESTION # 155
A company wants to build an application that stores images in a Cloud Storage bucket and wants to generate thumbnails as well as resize the images. They want to use a google managed service that can scale up and scale down to zero automatically with minimal effort. You have been asked to recommend a service. Which GCP service would you suggest?

• A. Google Kubernetes Engine
• B. Google Compute Engine
• C. Google App Engine
• D. Cloud Functions

Answer: D

Explanation:

Cloud Functions is Google Cloud's event-driven serverless compute platform. It automatically scales based on the load and requires no additional configuration. You pay only for the resources used.
Ref: https://cloud.google.com/functions
While all other options i.e. Google Compute Engine, Google Kubernetes Engine, Google App Engine support autoscaling, it needs to be configured explicitly based on the load and is not as trivial as the scale up or scale down offered by Google's cloud functions.

NEW QUESTION # 156
Your company wants to standardize the creation and management of multiple Google Cloud resources using Infrastructure as Code. You want to minimize the amount of repetitive code needed to manage the environment. What should you do?

• A. Use the Cloud Console interface to provision and manage all related resources.
• B. Use curl in a terminal to send a REST request to the relevant Google API for each individual resource.
• C. Create a bash script that contains all requirement steps as gcloud commands.
• D. Develop templates for the environment using Cloud Deployment Manager.

Answer: D

Explanation:
You can use Google Cloud Deployment Manager to create a set of Google Cloud resources and manage them as a unit, called a deployment. For example, if your team's development environment needs two virtual machines (VMs) and a BigQuery database, you can define these resources in a configuration file, and use Deployment Manager to create, change, or delete these resources. You can make the configuration file part of your team's code repository, so that anyone can create the same environment with consistent results.
https://cloud.google.com/deployment-manager/docs/quickstart

NEW QUESTION # 157
......

The Google Associate Cloud Engineer Exam certification exam is intended for professionals who are involved in cloud computing or are looking to build their knowledge and skills in managing cloud services. Associate-Cloud-Engineer exam is also suitable for IT professionals who are interested in gaining knowledge of the Google Cloud Platform.

 

Free Google Cloud Certified Associate-Cloud-Engineer Exam Question: https://torrentking.practicematerial.com/Associate-Cloud-Engineer-questions-answers.html