[Nov-2021] The Best Google Cloud Certified Study Guide for the Associate-Cloud-Engineer Exam
Associate-Cloud-Engineer certification guide Q&A from Training Expert PrepAwayExam
Below is a salary of Associate Cloud Engineer Certified Professional
- United States: 71,399 USD
- Europe: 64758.65 Euro
- England: 54610.82 Pound
- India: 5092569.37 INR
NEW QUESTION 33
Your auditor wants to view your organization's use of data in Google Cloud. The auditor is most interested in auditing who accessed data in Cloud Storage buckets. You need to help the auditor access the data they need. What should you do?
- A. Turn on Data Access Logs for the buckets they want to audit, and then build a query in the log viewer that filters on Cloud Storage.
- B. Use the export logs API to provide the Admin Activity Audit Logs in the format they want.
- C. Assign the appropriate permissions, and then create a Data Studio report on Admin Activity Audit Logs.
- D. Assign the appropriate permissions, and the use Cloud Monitoring to review metrics.
Answer: B
Explanation:
https://cloud.google.com/storage/docs/audit-logging
NEW QUESTION 34
You want to find out when users were added to Cloud Spanner Identity Access Management (IAM) roles on your Google Cloud Platform (GCP) project. What should you do in the GCP Console?
- A. Go to the Stackdriver Logging console, review admin activity logs, and filter them for Cloud Spanner IAM roles.
- B. Open the IAM & admin console to review IAM policies for Cloud Spanner roles.
- C. Go to the Stackdriver Monitoring console and review information for Cloud Spanner.
- D. Open the Cloud Spanner console to review configurations.
Answer: A
NEW QUESTION 35
Your company has embraced a hybrid cloud strategy where some of the applications are deployed on Google Cloud. A Virtual Private Network (VPN) tunnel connects your Virtual Private Cloud (VPC) in Google Cloud with your company's on-premises network. Multiple applications in Google Cloud need to connect to an on- premises database server, and you want to avoid having to change the IP configuration in all of your applications when the IP of the database changes. What should you do?
- A. Create a private zone on Cloud DNS, and configure the applications with the DNS name.
- B. Configure Cloud NAT for all subnets of your VPC to be used when egressing from the VM instances.
- C. Configure the IP of the database as custom metadata for each instance, and query the metadata server.
- D. Query the Compute Engine internal DNS from the applications to retrieve the IP of the database.
Answer: B
NEW QUESTION 36
Your finance team wants to view the billing report for your projects. You want to make sure that the finance team does not get additional permissions to the project. What should you do?
- A. Add the group for the finance team to roles/billing project/Manager role.
- B. Add the group for the finance team to roles/billing user role.
- C. Add the group for the finance team to roles/billing admin role.
- D. Add the group for the finance team to roles/billing viewer role.
Answer: D
Explanation:
Billing Account Viewer access would usually be granted to finance teams, it provides access to spend information, but does not confer the right to link or unlink projects or otherwise manage the properties of the billing account.
https://cloud.google.com/billing/docs/how-to/billing-access
NEW QUESTION 37
You want to configure autohealing for network load balancing for a group of Compute Engine instances that run in multiple zones, using the fewest possible steps. You need to configure re-creation of VMs if they are unresponsive after 3 attempts of 10 seconds each. What should you do?
- A. Create a managed instance group. Set the Autohealing health check to healthy (HTTP)
- B. Create a managed instance group. Verify that the autoscaling setting is on.
- C. Create an HTTP load balancer with a backend configuration that references an existing instance group.
Define a balancing mode and set the maximum RPS to 10. - D. Create an HTTP load balancer with a backend configuration that references an existing instance group. Set the health check to healthy (HTTP)
Answer: B
NEW QUESTION 38
You are building a pipeline to process time-series dat
a. Which Google Cloud Platform services should you put in boxes 1,2,3, and 4?
- A. Firebase Messages, Cloud Pub/Sub, Cloud Spanner, BigQuery
- B. Cloud Pub/Sub, Cloud Dataflow, Cloud Datastore, BigQuery
- C. Cloud Pub/Sub, Cloud Dataflow, Cloud Bigtable, BigQuery
- D. Cloud Pub/Sub, Cloud Storage, BigQuery, Cloud Bigtable
Answer: C
NEW QUESTION 39
Every employee of your company has a Google account. Your operational team needs to manage a large number of instances on Compute Engine. Each member of this team needs only administrative access to the servers. Your security team wants to ensure that the deployment of credentials is operationally efficient and must be able to determine who accessed a given instance. What should you do?
- A. Generate a new SSH key pair. Give the private key to each member of your team. Configure the public key as a project-wide public SSH key in your Cloud Platform project and allow project-wide public SSH keys on each instance.
- B. Ask each member of the team to generate a new SSH key pair and to add the public key to their Google account. Grant the "compute.osAdminLogin" role to the Google group corresponding to this team.
- C. Ask each member of the team to generate a new SSH key pair and to send you their public key. Use a configuration management tool to deploy those keys on each instance.
- D. Generate a new SSH key pair. Give the private key to each member of your team. Configure the public key in the metadata of each instance.
Answer: A
NEW QUESTION 40
You are deploying an application to App Engine. You want the number of instances to scale based on request rate. You need at least 3 unoccupied instances at all times. Which scaling type should you use?
- A. Basic Scaling with min_instances set to 3.
- B. Automatic Scaling with min_idle_instances set to 3.
- C. Basic Scaling with max_instances set to 3.
- D. Manual Scaling with 3 instances.
Answer: B
Explanation:
Reference:
https://cloud.google.com/appengine/docs/standard/python/how-instances-are-managed
NEW QUESTION 41
You've created the code for a Cloud Function that will respond to HTTP triggers and return some data in JSON format. You have the code locally, it's tested and working. Which command can you use to create the function inside Google Cloud?
- A. gcloud functions deploy
- B. gcloud function create
- C. gcloud function deploy
- D. gcloud functions create
Answer: A,C
NEW QUESTION 42
Which is the correct command to bind an IAM policy to a service account at an organisation or folder level?
- A. gcloud organizations add-iam-policy-binding org_id --member serviceAccount:whizlab@amazon- prj.iam.gserviceaccount.com --role roles/viewer
- B. gcloud organizations add-iam-policy-binding --member serviceAccount:whizlab@amazon- prj.iam.gserviceaccount.com --role roles/viewer
- C. gcloud iam service-accounts keys create amazon-prj --iam-account amazon@amazon- prj.iam.gserviceaccount.com
- D. gcloud projects add-iam-policy-binding amazon-prj --member serviceAccount:amazonamazon- prj.iam.gserviceaccount.com --role roles/viewer
Answer: A
NEW QUESTION 43
You are storing sensitive information in a Cloud Storage bucket. For legal reasons, you need to be able to record all requests that read any of the stored data. You want to make sure you comply with these requirements. What should you do?
- A. Allow only a single Service Account access to read the data.
- B. Enable Data Access audit logs for the Cloud Storage API.
- C. Enable the Identity Aware Proxy API on the project.
- D. Scan the bucker using the Data Loss Prevention API.
Answer: B
Explanation:
https://cloud.google.com/storage/docs/audit-logs
NEW QUESTION 44
Your Dataproc cluster runs in a single Virtual Private Cloud (VPC) network in a single subnet with range 172.16.20.128/25. There are no private IP addresses available in the VPC network. You want to add new VMs to communicate with your cluster using the minimum number of steps.
What should you do?
- A. Create a new VPC network for the VMs with a subnet of 172.32.0.0/16.
Enable VPC network Peering between the Dataproc VPC network and the VMs VPC network.
Configure a custom Route exchange. - B. Create a new VPC network for the VMs.
Enable VPC Peering between the VMs' VPC network and the Dataproc cluster VPC network. - C. Modify the existing subnet range to 172.16.20.0/24.
- D. Create a new Secondary IP Range in the VPC and configure the VMs to use that range.
Answer: B
Explanation:
A subnet has a single primary IP address range and, optionally, one or more secondary IP address ranges. For each subnet IP address range, Google Cloud creates a subnet route. When you use VPC Network Peering, Google Cloud always exchanges the subnet routes that don't use privately reused public IP addresses between the two peered networks. If firewall rules in each network permit communication, VM instances in one network can communicate with instances in the peered network.
Reference: https://cloud.google.com/vpc/docs/vpc-peering
NEW QUESTION 45
Your team has chosen to use Deployment Manager to create the Compute Engine infrastructure for your application. You've already run the gcloud deployment-manager deployments create command to create the deployment.
You've updated 2 resources in the template and need to deploy the change. What command should you use?
- A. gcloud deployment-manager resources apply
- B. gcloud deployment-manager deployments apply
- C. gcloud deployment-manager deployments update
- D. gcloud deployment-manager resources update
Answer: C
NEW QUESTION 46
You have been asked to deploy a highly available Kubernetes cluster using Google Kubernetes Engine by your manager. While spinning up the cluster you realize you do not see option of creating master. What can be the reason?
- A. GKE does not use master node to control child nodes.
- B. You need to spin up a compute instance and set it up as master node.
- C. None of the above.
- D. Master node is created automatically by GKE.
Answer: D
NEW QUESTION 47
You are hosting an application on bare-metal servers in your own data center. The application needs access to Cloud Storage. However, security policies prevent the servers hosting the application from having public IP addresses or access to the internet. You want to follow Google- recommended practices to provide the application with access to Cloud Storage. What should you do?
- A. 1. Using Cloud VPN, create a VPN tunnel to a Virtual Private Cloud (VPC) in Google Cloud Platform (GCP).
2. In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance.
3. Configure your servers to use that instance as a proxy to access Cloud Storage. - B. 1. Use nslookup to get the IP address for storage.googleapis.com.
2. Negotiate with the security team to be able to give a public IP address to the servers.
3. Only allow egress traffic from those servers to the IP addresses for storage.googleapis.com. - C. 1. Using Cloud VPN or Interconnect, create a tunnel to a VPC in GCP.
2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel.
3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com. - D. 1. Use Migrate for Compute Engine (formerly known as Velostrata) to migrate those servers to Compute Engine.
2. Create an internal load balancer (ILB) that uses storage.googleapis.com as backend.
3. Configure your new instances to use this ILB as proxy.
Answer: C
Explanation:
https://cloud.google.com/vpc/docs/configure-private-google-access-hybrid
NEW QUESTION 48
Your team has been working on building a web application. The plan is to deploy to Kubernetes. You currently have a Dockerfile that works locally. How can you get the application deployed to Kubernetes?
- A. Use kubectl apply to push the Dockerfile to Kubernetes.
- B. Use docker to create a container image, push it to the Google Container Registry, deploy the uploaded image to Kubernetes with kubectl.
- C. Use docker to create a container image, save the image to Cloud Storage, deploy the uploaded image to Kubernetes with kubectl.
- D. Use kubectl to push the convert the Dockerfile into a deployment.
Answer: B
NEW QUESTION 49
Your developers have created an application that needs to be able to make calls to Cloud Storage and BigQuery. The code is going to run inside a container and will run on Kubernetes Engine and on-premises.
What's the best way for them to authenticate to the Google Cloud services?
- A. Create a service account, with editor permissions, generate and download a key. Use the key to authenticate inside the application.
- B. Create a service account, grant it the least viable privileges to the required services, generate and download a key. Use the key to authenticate inside the application.
- C. Use the default service account for App Engine which already has the required permissions.
- D. Use the default service account for Compute Engine which already has the required permissions.
Answer: B
NEW QUESTION 50
You have a 20 GB file that you need to securely share with some contractors. They need it as fast as possible. Which steps would get them the file quickly and securely?
- A. Upload the file to Bigtable using the bulk data import tool. Then provide the contractors with read access to the database.
- B. Upload the file to Cloud Storage. Grant the allAuthenticated users token view permissions.
- C. Set up a VPC with a custom subnet. Create a subnet tunnel. Upload the file to a network share. Grant the contractors temporary access.
- D. Using composite objects and parallel uploads to upload the file to Cloud Storage quickly. Then generate a signed URL and securely share it with the contractors.
Answer: D
NEW QUESTION 51
Your company has a 3-tier solution running on Compute Engine. The configuration of the current infrastructure is shown below.
Each tier has a service account that is associated with all instances within it. You need to enable communication on TCP port 8080 between tiers as follows:
* Instances in tier #1 must communicate with tier #2.
* Instances in tier #2 must communicate with tier #3.
What should you do?
- A. 1. Create an ingress firewall rule with the following settings:
* Targets: all instances with tier #2 service account
* Source filter: all instances with tier #1 service account
* Protocols: allow TCP:8080
2. Create an ingress firewall rule with the following settings:
* Targets: all instances with tier #3 service account
* Source filter: all instances with tier #2 service account
* Protocols: allow TCP: 8080 - B. 1. Create an ingress firewall rule with the following settings:
* Targets: all instances with tier #2 service account
* Source filter: all instances with tier #1 service account
* Protocols: allow all
2. Create an ingress firewall rule with the following settings:
* Targets: all instances with tier #3 service account
* Source filter: all instances with tier #2 service account
* Protocols: allow all - C. 1. Create an ingress firewall rule with the following settings:
* Targets: all instances
* Source filter: IP ranges (with the range set to 10.0.2.0/24)
* Protocols: allow all
2. Create an ingress firewall rule with the following settings:
* Targets: all instances
* Source filter: IP ranges (with the range set to 10.0.1.0/24)
* Protocols: allow all - D. 1. Create an egress firewall rule with the following settings:
* Targets: all instances
* Source filter: IP ranges (with the range set to 10.0.2.0/24)
* Protocols: allow TCP: 8080
2. Create an egress firewall rule with the following settings:
* Targets: all instances
* Source filter: IP ranges (with the range set to 10.0.1.0/24)
* Protocols: allow TCP: 8080
Answer: A
NEW QUESTION 52
You need to host an application on a Compute Engine instance in a project shared with other teams. You want to prevent the other teams from accidentally causing downtime on that application. Which feature should you use?
- A. Use a Preemptible VM.
- B. Enable deletion protection on the instance.
- C. Use a sole-tenant node.
- D. Use a Shielded VM.
Answer: B
NEW QUESTION 53
You need to manage multiple Google Cloud projects in the fewest steps possible. You want to configure the Google Cloud SDK command line interface (CLI) so that you can easily manage multiple projects. What should you do?
- A. 1. Create a configuration for each project you need to manage.
2. Use gcloud initto update the configuration values when you need to work with a non-default project - B. 1. Create a configuration for each project you need to manage.
2. Activate the appropriate configuration when you work with each of your assigned Google Cloud projects. - C. 1. Use the default configuration for one project you need to manage.
2. Use gcloud initto update the configuration values when you need to work with a non-default project. - D. 1. Use the default configuration for one project you need to manage.
2. Activate the appropriate configuration when you work with each of your assigned Google Cloud projects.
Answer: C
NEW QUESTION 54
You are the team lead of a group of 10 developers. You provided each developer with an individual Google Cloud Project that they can use as their personal sandbox to experiment with different Google Cloud solutions.
You want to be notified if any of the developers are spending above $500 per month on their sandbox environment. What should you do?
- A. Create a single billing account for all sandbox projects and enable BigQuery billing exports. Create a Data Studio dashboard to plot the spending per project.
- B. Create a separate billing account per sandbox project and enable BigQuery billing exports. Create a Data Studio dashboard to plot the spending per billing account.
- C. Create a single budget for all projects and configure budget alerts on this budget.
- D. Create a budget per project and configure budget alerts on all of these budgets.
Answer: D
NEW QUESTION 55
......
Career prospects
The professionals with the Google Associate Cloud Engineer certification can explore different job roles. Some of these include a Cloud Operations Engineer, a Cloud Services Engineer, a Cloud Solutions Systems Engineer, a Cloud Network Engineer, and a Software Engineer. The average salary for these certified specialists is $74,000 per year. The actual salary depends on your position and level of experience.
The Google Associate Cloud Engineer exam targets software engineers who would like to dabble into the Google Cloud. So, you need to be capable of using the command-line interfaces and Google Cloud Console to handle core platform-based tasks. These mostly include monitoring operations and managing enterprise solutions to maintain deployed applications. In addition, after successful writing of the test, candidates obtain the appropriate Google Cloud certification.
The Best Google Associate-Cloud-Engineer Study Guides and Dumps of 2021: https://www.prepawayexam.com/Google/braindumps.Associate-Cloud-Engineer.ete.file.html
Associate-Cloud-Engineer Certification Overview Latest Associate-Cloud-Engineer PDF Dumps: https://drive.google.com/open?id=17JPXxXpHtIq2FJVciiy9O1B7K54ErXG1