2. Google Cloud Fundamentals Flashcards

Question 1

Q

Google Cloud Global Infrastructure (regions, zones, locations)

Answer

A

40 regions
121 zones
187 network edge locations (PoP - point of presence locations)
200+ countries and territories

Question 2

Q

Google Infrastructure: multi-regions, regions & zones

Answer

A

Multi-regions:
- contain 2+ regions
- ensures your data is always available
- E.g. Cloud Spanner has multi-region configs - allows to replicate your app in several zones and several regions - good for low latency

Regions:
- comprise several zones

Zones:
- smallest entity
- they are called deployment areas for Google Cloud resources within a region

Question 3

Q

VPC (Virtual private cloud)

Answer

A

Resources can be in different zones but on the same subnet.

The size of the subnet can be increased by expanding the range of IP addresses

VPCs provide a global distributed firewall.

Recommendation don’t use default: it’s too big, broad (too many regions), insecure (only default firewall rules exist and no restrictions on the internal network)

Question 4

Q

Compute Service Options: Compute Engine
- Characteristics

Answer

A

IaaS (offers the greatest flexibility out of all the compute service options)
offers VMs as instances
can choose zone and region for VM
can choose operating system for VM
can use private & public images

Question 5

Q

Compute Service Options: Compute Engine
- How to manage multiple instances?

Answer

A

Using instance groups; can add/remove capacity using autoscaling with instance groups

Question 6

Q

Compute Service Options: Google Kubernetes Engine (GKE)
- Characteristics

Answer

A

Container-orchestration system for automating, deploying, scaling and managing containers
CaaS (container as a service)
Set of APIs to deploy containers on a aset of nodes/clusters/compute instances like machines (not VMs aka nodes, like in Google Cloud)
The smallest unit that can be deployed by Kubernetes is a Pod - generally one pod will include one container (sometimes 2 if they are closely linked)
Pods provide a unique IP
kubectl command allows to control containers in a pod
To see the list of pods: kubectl get pods
Kubernetes creates a fixed IP for all the pods
Load balancer is created as a Network load balancer to control the containers and is attached to the external IP of the cluster of pods (kubectl expose deployments nginx –port=80 –type=LoadBalancer)
a service has an external IP too, this is used to refer to the pods ‘cluster’. This is because individual pod IPs change all the time, but the server IP is fixed. It can be used by another service/cluster of pods to communicate between each other even if the inner pods change
kubectl scale - allows to change the no. of pods depending on the requirements
kubectl get deployments shows how many pods we have and what they are
kubectl apply -f nginx-deployment.yaml applies the changes in the config yaml file. The changes were made to eg change the no. of pods
kubectl get services - to see the public IP of the service
kubectl rollout - to update a new version of the app
GKE consists of multiple machines/Compute Engine instances, grouped together under a ‘cluster’.
GKE adds advantages such as: load balancing, auto scaling, auto upgrades, node auto-repair, logging and monitoring.
gcloud container clusters create k1 - To start Kubernetes on a cluster in a GKE through a command

Question 7

Q

GKE added features (unlike basic Kubernetes)

Answer

A

Load balancing for Compute Engine instances
Node pools to designate subsets of nodes within a cluster for additional flexibility
Automatic scaling of your cluster’s node instance count
Automatic upgrades for your cluster’s node software
Node auto-repair to maintain node health and availability
Logging and Monitoring with Cloud Monitoring for visibility into your cluster

Question 8

Q

Cluster definition

Answer

A

Group of nodes = group of Compute Engine instances.

A cluster consists of at least one cluster master machine and multiple worker machines called nodes (compute engine instances).

Question 9

Q

Lab:
Create new GKE cluster - command & comments

Answer

A

To create a new cluster:
gcloud container clusters create –machine-type=e2-medium –zone=us-central1-a lab-cluster
After the cluster is created, you need auth credentials to be able to interact with it. These can be obtained by running:
gcloud container clusters get-credentials lab-cluster

Once you know credentials, you can deploy a containerised application to the cluster.
GKE uses Kubernetes objects (Examples of Kubernetes objects include Pods, Services, Deployments, ConfigMaps, and more) to create and manage your cluster’s resources. Kubernetes provides the Deployment object for deploying stateless applications like web servers. Service objects define rules and load balancing for accessing your application from the internet.
There are different types of services, such as ClusterIP (internal service), NodePort (exposes the service on each node’s IP at a static port), and LoadBalancer (provisions an external IP address and distributes traffic to the service).

To create a new Deployment hello-server from the hello-app container image, run the following kubectl create command:
kubectl create deployment hello-server –image=gcr.io/google-samples/hello-app:1.0
To create a Kubernetes Service, which is a Kubernetes resource that lets you expose your application to external traffic, run the following kubectl expose command:
kubectl expose deployment hello-server –type=LoadBalancer –port 8080
To inspect the hello-server Service, run kubectl get:
kubectl get service
To view the application from your web browser, open a new tab and enter the following address, replacing [EXTERNAL IP] with the EXTERNAL-IP for hello-server.
http://[EXTERNAL-IP]:8080
To delete the cluster, run the following command:
gcloud container clusters delete lab-cluster

Question 10

Q

Compute Service Options: App Engine
- Characteristics

Answer

A

PaaS
fully managed, serverless platform for developing and hosting web applications at scale
here google manages required resources for your application to run, i.e. on-demand scaling is available
integrates with Web Security Scanner to identify threats

Question 11

Q

Compute Service Options: Cloud Functions
- Characteristics

Answer

A

FaaS (Function as a Service)
Function is triggered when an even being watched (monitored) is fired
Serverless execution environment for building and connecting cloud services
Cloud functions can be written using JavaScript, Python 3, Go, Java

Question 12

Q

Compute Service Options: Cloud Functions
- Use cases

Answer

A

Data processing or ETL operations
Webhooks to respond to HTTP triggers
APIs that compose loosely coupled logic
Mobile backend functions

Question 13

Q

Compute Service Options: Cloud Run
- Characteristics

Answer

A

serverless (no need to focus on infrastructure, just on the app development)
used to deploy and scale containerised applications
no need to do infrastructure management, as it scales up and down automatically

1.write code in any language, any library, any binary
2. build and package your app into a container image - use docker, create a Dockerfile. Then create a container image from the same directory where the Dockerfile is saved by running (gcloud builds submit –tag gcr.io/$GOOGLE_CLOUD_PROJECT/helloworld)
3. image is pushed to Artifact Registry (Cloud Run) for deployment
- FaaS

Once deployed, you will get a unique HTTPs URL - the on-demand container starts, and any further containers are added/removed as needed

Cloud Run adds all the encryption, only worry about web requests because it handles HTTPs requests for you.
Pay only for the resources used while the container is handling the request / pay for when it’s starting a container / pay for when it’s shutting down a container
Adding a container to Cloud Run allows us to make our project publicly available using the URL assigned to it by Cloud Run. Unless pushed to Cloud Run, the website will only be available for viewing on my PC.

Question 14

Q

Command to move data to storage (if drag and drop isn’t used)

Answer

A

gcloud storage

The command is used in “Online Transfer” process

Question 15

Q

Storage Transfer Service vs Transfer appliance

Answer

A

Service that allows to transfer large amounts of online data.

Allows to move data:
- from a diff cloud provider
- a diff Cloud Storage region
- from an HTTPs endpoint

Transfer appliance
Actual disk that is given to which you can transfer data and then you ship it back to the upload facility. Can transfer up to 1 Petabyte of data (1024 Terabytes = 1024 * 1024 GB)

Offline media Import
Another 3rd party company ships the USB drives to google

Question 16

Q

Storage Options: Cloud Storage
- Overview
MAIN storage options

Answer

A

object storage (docs, pics)
unstructured data with no file sharing
11 9s durability (99.999999999%) - unlikely to lose a file
Unlimited storage with no minimum object size
scalable
single API across storage classes
by default the object will take the same storage class property as the bucket where it was placed, but this can be changed for the object
bucket’s storage class can be changed, but not the availability area, cannot switch between Regional/Multi-region/Dual-region

Control on buckets
- IAM
- ACLs - access control lists - Who has access and the level of access (owner/writer/reader); each object can have up to 100 ACLs
- Signed URL (cryptographic key) - time limited access to a bucket/object; can be used by someone without google account, a URL is created with certain permissions, time-limited (gcloud storage signurl -d 10m path/to/key.p12 gs://bucket/object
- signed policy document - what kind of file can be uploaded by someone with a signed URL

Object Lifecycle Management - control if to delete the object or maybe archive it after a certain period of time (if changed the rules, may take 24hrs to update)
strong global consistency is offered: so if a bucket is created, it immediately shows, if a file is deleted/added all is immediately reflected across the globe

Question 17

Q

Storage Options: Cloud Storage
- Storage Classes

Answer

A

Standard (no limitations, the one you access all the time)
Nearline (low-cost, to be accessed less than 1/month, retrieval costs start with this class)
Coldline (lower-cost, to be accessed once every quarter)
Archive (lowest cost, to be accessed once a year)
Autoclass (the storage class is assigned automatically by the system based on the storage usage pattern)

Question 18

Q

Storage Options: Cloud Storage
- Availability

Answer

A

Region (storing data in one region)
Dual-region
Multi-region (storing in one same geographic area but across several regions)

Question 19

Q

Cloud Storage: use cases and URL keys

Answer

A

URL keys hold the following info:
- Globally unique identifier
- binary form of the actual data itself
- relevant associated meta-data

Eg. video storage, pictures, audios

Cloud Storage use cases:
- Online content
- Backup and archiving
- Storage of intermediate results

Cloud storage units are buckets, they have unique names and must have a location specified for lower latency.

Objects are immutable, if changed, a new version of the file is created. Object versioning exists, so if you delete a file it can be recovered from the previous version - but the versioning must be pre-enabled.

Question 20

Q

Storage Options: Filestore

Answer

A

fully managed NFS (Network File System) file server
unstructured data
use with VM instances and Kubernetes Clusters accessing the data at the same time
several VM instances use the storage at the same time
for GKE or Compute Engines
good for high-performance workload
migration of on-premises applications
complex financial models
web developers

Question 21

Q

1. Storage Options (SQL/Relational):
  Cloud SQL VS Cloud Spanner
  MAIN storage options

Answer

A

For STRUCTURED data

Cloud SQL:
- available in many zones
- managed service of PostgreSQL, MySQL, and SQL Server
- when 2 zones are used, the process of failover (when the primary instance (zone) fails and the users are directed to the standby instance (second zone)) can be managed.
- scaling up is available (but instance restart is required)
- Choosing a connection type
– if an application is in the same project and in the same region -> private IP connection
– if it’s in a different region/project –> cloud SQL auth proxy for auto key rotation OR for manual SSL connection OR Unencrypted connection
- to download Cloud SQL proxy:
wget ___
./cloud_sql_proxy_new -instances=database_name
- connect Cloud SQL via private IP (note the private IP of the SQL instance; copy external IP of a VM and use it as a website name)

Cloud Spanner:
- available across zones + regions + globally
- scalable relational DB
- designed to support transactions, consistency, synchronous replication, high performance
- good for financial apps due to having transactional consistency

Alloy DB
- good for machine learning and generative AI
- PostgreSQL
- good for backups
- fast transactional processing
- real-time fast business insights

Question 22

Q

Storage Options (NoSQL): BigTable
MAIN storage options

Answer

A

used for data analytics and operations
fully-managed, scalable up - very well, NoSQL database
low latency
offers cluster resizing without downtime
handles massive workloads (good for quickly changing data eg finance)
data can be uploaded using APIs, streaming services etc
good for ML
it learns to adjust to specific access patterns
the smallest number of Nodes you could have is 3 and you have to pay for them regardless

Tables structure
- Column family (a general name for all the columns)
- Column qualifier (the actual columns)
- Tables are stored on Colossus - google’s file system

Note: it is not serverless, used in Search, Google Maps, Analytics, FinTech

Question 23

Q

Storage Options (NoSQL): Firestore
MAIN storage options

Answer

A

NoSQL, realtime database - data sync is use to update any connected device
optimised for offline use
cluster resizing without downtime
Data is stored in documents and then organised into collections
You are charged for every Read Write Delete of documents + for the amount of database storage used (there is also free quota per day)
supports ACID trxns, so if one trxn in the process fails, the whole process will fail
Firestore is an improved version of a datastore
allows to scale down very well but can scale up too
includes transactional consistency (if it is not required, use Bigtable)

2 modes:
Datastore mode (for new server projects)
Native mode (for new mobile and web apps)

Note: it is also only horizontally scalable and not serverless.

Question 24

Q

Storage Options: Persistent Disks

Answer

A

Durable block storage for instances

Options (available per zones and per regions):
- Standard
- Solid State (SSD): lower latency, higher iops
- Local SSD: attached to your VM hardware directly but will only persist till the VM is stopped/deleted. Has higher storage capacity

Note: block storage stores operating system info

Question 25

Q

Storage/Database Options (NoSQL): Memorystore

Answer

A

highly available in-memory service for Redis and Memcached
in memory caching
fully-managed
allows for high-availability, failover, patching

Note: it is not scalable, it is not serverless, not realtime.

Question 26

Q

Database Options (NoSQL): Datastore

Answer

A

fast, fully-managed, serverless, NoSQL document database
for mobile, web and IoT apps
multi-region replication
ACID transactions (maintains data integrity even in the presence of system failures, crashes, or errors)

Note: it is not scalable

Question 27

Q

Cloud Storage vs Cloud SQL vs Spanner vs Firestore vs Cloud Bigtable

Answer

A

Cloud Storage
- good when storing immutable objects larger than 10 mb, eg videos (Stores PBs of data)
Cloud SQL
- if you need full support from SQL for an online transaction processing system
- good for storing user credentials/customer orders, i.e. good for web frameworks (up to 64 TB of data)
Spanner
- same as Cloud SQL but allows horizontal flexibility (Stores PBs of data)
Firestore
- massive scaling (TBs of data)
- Storing and syncing data from mobile and web apps
Cloud Bigtable
- No SQL queries support, good for large amount of structured objects
- Analytical data, heavy with read and write events (PBs of data)

Question 28

Q

Networks, Firewalls and Routes: VPC

Answer

A

virtualised network (can think of it as a virtualised datacentre)
global resource
default network already pre-exists, new networks can be added but cannot be shared between different projects
default isn’t secure enough

Question 29

Q

Networks: default/auto-mode

Answer

A

Each region gets its own subnet
subnets have non-overlapping CIDR (Classless Inter-Domain Routing) blocks, i.e. sets of IP addresses that are unique.
default firewall rules of RDP, SSH, ICMP
auto-mode adds new IPs that become available automatically to the subnets
the IPs in the auto-mode end with /20 mask but can be expanded to /16. If a larger IP range is required (number below 16), use custom-mode. But custom mode doesn’t go below /8

But scaling subnet too much (expanding the IP range too much is NOT recommended as it becomes harder to track if they are still unique and fall within the allowed IP range).

Note: custom-mode allows you to customise all

An IPv4 address consists of 32 bits. If we have a /29 mask, this means we have 32-29 = 3 bits left for us to use. Each bit has 2 combinations (0s or 1s), so total number of three bit combinations is 2^3 = 8. But the first 2 and the last 2 IPs are reserved by GCP. So /29 mask gives us 4 available IPs. Eg. /23 would give 2^(32-23) = 512 possibilities.

Question 30

Q

Networks and VM communications

Answer

A

If 2 VMs are in the same Network (VPC network), they can use internal IP even if they are in different zones. (lower cost)

If 2 VMs are in separate Networks, even if they are in the same region, they need to use external IPs to communicate.

To connect to the Network from the on-premise infrastructure, use VPN.

In a subnet the first two IPs (0.0, 0.1) are reserved for the network and the subnets gateway. The last two are also reserved.

A single subnet IP range can be used by two VMs in different regions. Therefore, one firewall rule can be applied to them both at the same time.

Question 31

Q

Networks, Firewalls and Routes: Firewall Rules

Answer

A

govern traffic coming into instances on a network
default rules exist
custom rules can be created
when custom rules are created, I can attach them to specific VPC. To attach to a specific VPC can use:
– tags
– service accounts more secure, because you get to select who has the ability to select this custom firewall rule when they create a new VM
– simply by VPC name

Question 32

Q

Networks, Firewalls and Routes: Routes

Answer

A

specify how your traffic should be routed within your VPC
i.e. routes specify how packets leaving an instance should be directed

Question 33

Q

Load Balancing

Answer

A

NOTE: internal load balancers are REGIONAL!

Global HTTP(S) Load Balancing:
- covers worldwide/global autoscaling
- distributes traffic across various regions including the closest region.
- traffic can be distributed based on content type

Network Load Balancing:
- region specific load balancing only
- it separates connection, one is between user and LB and another is between the LB and the backend instance
- based on the incoming IP protocol data such as address, port, and protocol
- traffic goes on UDP or TCP/SSL ports
- used with backend service-based architecture
– regional
– defines how Load Balancer distributes traffic across backend instance groups
– autoscaling of MIGs
– non legacy health checks
– failover policy
- used with backend target pool-based architecture
– receive traffic based on the forwarding rules (TCP and UDP), when the traffic is directed to a target pool LB picks an instance from that pool based on the hash, IPs
– each target pool can only have 1 health check
– all instances must be in the same region

Global SSL Proxy
- Secure Socket Layer
- used for encrypted traffic
- Terminates user SSL connection at the Load Balancing layer
- Uses IPv4 and IPv6
- certificates updates can be done uniformly from one place, no need to go one by one

Network Load Balancing: Global TCP Proxy
- used for unencrypted traffic
- balancing on TCP specific ports
- Terminates user TCP connection at the Load Balancing layer
- Uses IPv4 and IPv6
- no quick certifications update

Regional External
- balancing on any port number
- traffic coming into Google network from the internet

Regional Internal
- balancing traffic within your project
- Internal TCP/UDP load balancer
- lower latency (cuz all is within the same network/region)
- can only be accessed through internal IP (?)
- balancing is NOT defined by IPs
- connection between user - LB - backend is NOT broken down (this works on Andromeda - Google’s network virtualisation stack)

Cross-region Internal
- balances globally distributed sources including traffic management that ensures traffic is directed to the nearest backend

Choose HTTPs/SSL Proxy/TCP proxy if you need support for IPv6 clients
Sometimes it’s good to combine internal and external LBs to support 3 tier web services; External LB provides single external IP for users in different areas; Internal LBs define which backend to choose within their designated region… So there would be eg 3 internal LB for 3 separate regions responsible for backend services on their own

Question 34

Q

Global & Regional Load Balancers

Answer

A

Global
- Global LBs act as proxies - tools that handle a connection on behalf of another service
- the connection is stopped at a LB and a new connection is created to the actual backend service behind it (more secure)

Global External HTTP(S) LB
External HTTP(S) LB
External SSL Proxy LB
- Encrypted
External TCP Proxy LB
- Unencrypted

Regional
- if it doesn’t say ‘proxy’ the connection is not stopped, and goes directly from customer to the service
- Regional External means these LBs face the internet
- Regional Internal LBs are facing the backends of the applications and don’t need to be public faced

Regional External HTTP(S) LB
Internal HTTP(S) LB
Internal TCP Proxy LB
Internal TCP/UDP LB
External TCP/UDP Network LB
External Regional TCP Proxy LB

Question 35

Q

Backend configuration of the Load Balancers

Answer

A

Instance Group:
- This is a group of virtual machine (VM) instances that you can manage collectively.
- Managed Instance Groups automatically manage the creation, deletion, and scaling of VM instances.
Zonal Network Endpoint Group:
-Zonal Network Endpoint Groups are used for load balancing traffic to instances in a single zone.
You can configure these groups to load balance traffic to VM instances, VM instances with containers, or to internal TCP/UDP endpoints.
Internet Network Endpoint Group:
- Internet Network Endpoint Groups allow you to specify external IP addresses for load balancing.
- These are typically used for external HTTP(S) load balancing.
Serverless Network Endpoint Group:
- Serverless Network Endpoint Groups are used for serverless applications.
- These can include Cloud Functions, Cloud Run services, or App Engine flexible environment instances.
Private Service Connect Network Endpoint Group:
- Private Service Connect Network Endpoint Groups enable you to connect your VPC network to services provided by Google or other service providers.
- They allow private connectivity to Google APIs and services.
Hybrid Connectivity Network Endpoint Group (Zonal):
- Hybrid Connectivity Network Endpoint Groups are used for hybrid environments where you have on-premises instances connected to Google Cloud.
- You can use these groups to balance traffic to on-premises instances and Google Cloud instances in the same zone.

Routing rules
These rules are used to specify which backend the LB should forward the traffic to depending on eg the website extension the customer used.

Question 36

Q

Google Cloud DNS

Answer

A

Domain Name System - used to translate human-readable domain names (like www.example.com) into IP addresses (like 192.0.2.1)

publish and maintain DNS records by using the same infrastructure that Google uses
work with managed zones and DNS records through the CLI, API, or SDK

Question 37

Q

Advanced Connectivity options (two main)

Answer

A

Cloud VPN
- connects your existing network to your VPC through and IPsec connection
- the traffic is encrypted and travels over the public internet, not always good because of the security concerns or bandwidth reliability
- Cloud Router makes the connection dynamic using the Border Gateway Protocol

Dedicated/Direct Interconnect
- connect an existing network to your VPC using a highly available, low-latency, enterprise-grade connection (doesn’t go through the public internet)

Question 38

Q

Advanced Connectivity options (3 other options)

Answer

A

Direct Peering
- allows traffic to flow through the google’s edge network locations
- putting the router in the same public data centre as a Google PoP (Point of Presence)

Carrier Peering
- third party carrier is used to transmit information

Partner interconnect
- through a supported service provider
- used with applications that can tolerate some down time

Cross-Cloud Interconnect
- high-bandwidth dedicated connectivity between Google cloud and another cloud service provider
- two connection sizes available: 10GB or 100GB

Question 39

Q

Operations Suite

Answer

A

Allows to monitor applications across different Cloud providers.
- Pay for what you use
- Monitoring, logging, error reporting, fault tracing

Question 40

Q

Per second billing (services)

Answer

A

Compute Engine
Google Kubernetes Engine (GKE) - container infrastructure as a service
Data Prog = similar to big data system Hadoop
App Engine flexible environment VMs (PaaS)

Question 41

Q

Sustained-use discounts

Answer

A

Compute Engine - discounts for running a VM instance for a significant portion of the billing month

Question 42

Q

Custom VM pricing

Answer

A

As they are custom, pricing varies depending on the recourses used (virtual CPU etc)

Question 43

Q

Compute Engine Pricing

Answer

A

Bills by the second
1 minute minimum
Sustained-use discount (if VM instance runs for longer than 25% of the month)
Committed-use discount (up to 57% discount if committed to use for 1-3 years)
Preemptible & Spot VMs (Compute Engine resources can be used elsewhere if needed, so that job can be stopped; preemptible VM resources cannot be used by other processes)

Question 44

Q

Preemptible VS Spot VMs

Answer

A

Spot VMs
- More features
- No max runtime
- same pricing
- no auto restarts
- no live migration

Preemptible VMs
- Less features
- In one go can only run for 24hrs max
- Same pricing (discount of up to 91% of the original VM price)
- no auto restarts
- no live migration (when maintenance happens)
- but a load balancer can be used to create a new Preemptible VM in case of the failure

Question 45

Q

Sole-tenant nodes

Answer

A

Nodes with YOUR VMs physically grouped together in the datacentre, maybe your policy requires all your ‘payments’ related VMs to be together in the PHYSICAL space.

Question 46

Q

Shielded VM
Confidential VM

Answer

A

Shielded:
Offers verified integrity

Confidential:
Allows to encrypt data while it is in use (N2D)
No impact on performance
When high workload is included

Question 47

Q

Budget

Answer

A

Defined at an account or project level
Can be tied to a specific metric, eg percentage of the previous month spend
Reports

Question 48

Q

Security of Google

Answer

A

Hardware - it’s built by Google, premises security
Network - all communication between networks is encrypted, any communication through the fibre cables (except for from within the same building)
User identity - Multi Factor Authentication
Storage service level - the info stored is spread across building and is encrypted at rest. Centrally managed keys are used.
Internet communication level - Google Front End globally distributed scanner- examins all the traffic that flows from the internet into the Google fibre network. It scans for signature of a potential cyber attack
Operational security - engineers who always look for attacks

Question 49

Q

Edge caches / Cloud CDN

Answer

A

Use of caching service to store content closer to end user.

This can be used to accelerate content delivery using cloud CDN (content delivery network).

Cloud CDN is available by clicking a single check box once the load balancing is enabled first.

Cloud CDN cache modes define whether or not the requested content will be cached.
Cloud CND cache modes:
1. USE_ORIGIN_HEADERS - caches specified content
2. CACHE_ALL_STATIC - caches static content
3. FORCE_CACHE_ALL (with this mode configured make sure you are not storing sensitive data)

Question 50

Q

BigQuery

Answer

A

Sits on the edge between Data Storage and Data Processing
- Serverless
- Fully-managed

used for data analytics

Question 51

Q

Default Firewall Rules

Answer

A

default-allow-rdp
default-allow-ssh
default-allow-internal
default-allow-icmp –> allows to ‘ping’ external IP from one VM instance to another
mynetwork-allow-custom –> allows to ‘ping’ internal IP from one VM instance to another

Question 52

Q

Checking connectivity between VM instances (pinging)

Answer

A

ping -c 3 internal/external ip address

ping count three …

Question 53

Q

VPC lab results

Answer

A

In this lab, you explored the default network along with its subnets, routes, and firewall rules. You deleted the default network and determined that you cannot create any VM instances without a VPC network.

Thus, you created a new auto mode VPC network with subnets, routes, firewall rules, and two VM instances. Then you tested the connectivity for the VM instances and explored the effects of the firewall rules on connectivity.

Question 54

Q

Start-up script example in VM

Answer

A

Update the OS, download apache 2 and restart it

apt-get update
apt-get install apache2 php php-mysql -y
service apache2 restart

Question 55

Q

Environment variable that contains your project ID

Answer

A

DEVSHELL_PROJECT_ID

Question 56

Q

Creating a Cloud Storage bucket using the project ID as the name

Answer

A

Note: previously we did:
export LOCATION=US

gcloud storage buckets create -l $LOCATION gs://$DEVSHELL_PROJECT_ID

Retrieve a picture from inet to be put into the bucket:
gcloud storage cp gs://cloud-training/gcpfci/my-excellent-blog.png my-excellent-blog.png

Copy the image into the bucket:
gcloud storage cp my-excellent-blog.png gs://$DEVSHELL_PROJECT_ID/my-excellent-blog.png

Make the object readable to everyone:
gsutil acl ch -u allUsers:R gs://$DEVSHELL_PROJECT_ID/my-excellent-blog.png

Question 57

Q

Cloud Storage lab outcome

Answer

A

In this lab, you create a Cloud Storage bucket and place an image in it. You also configure an application running in Compute Engine to use a database managed by Cloud SQL. For this lab, you configure a web server with PHP, a web development environment that is the basis for popular blogging software.

Question 58

Q

Command to list the project ID

Answer

A

gcloud config list project

Question 59

Q

Command to enable Cloud Run API

Answer

A

gcloud services enable run.googleapis.com

Question 60

Q

Creating a container - steps
+ adding the container to Cloud Run

Answer

A

Create an app and then create a Dockerfile
In the same folder build and push the image using Cloud Build: gcloud builds submit –tag gcr.io/$GOOGLE_CLOUD_PROJECT/helloworld
To list all the images in the container: gcloud container images list
Register gcloud as the credential helper for all Google-supported Docker registries: gcloud auth configure-docker
To test the application run a docker command: docker run -d -p 8080:8080 gcr.io/$GOOGLE_CLOUD_PROJECT/helloworld
Adding to Cloud Run: gcloud run deploy –image gcr.io/$GOOGLE_CLOUD_PROJECT/helloworld –allow-unauthenticated –region=$LOCATION
The allow-unauthenticated flag in the command above makes your service publicly accessible.

7. DELETE an image (not to be billed): gcloud container images delete gcr.io/$GOOGLE_CLOUD_PROJECT/helloworld
8. DELETE the Cloud Run service: gcloud run services delete helloworld –region=”REGION”

Question 61

Q

GKE vs Kubernetes vs Cloud Run

Answer

A

Kubernetes:

Imagine a toolkit to manage containers in your digital garden. It provides tools for planting (deploying), watering (scaling), and organizing (orchestrating) plants (containers). You manage everything manually.

GKE (Google Kubernetes Engine):

Now, think of GKE as a magical gardener. It’s like hiring an expert to take care of your garden (Kubernetes cluster) – watering, organizing, and handling all the details. GKE simplifies Kubernetes management.

Cloud Run:

Like renting a car when you need it. It’s easy, convenient, and you only pay when you’re using it. Great for quick rides.

GKE (Kubernetes):

It’s like owning a car, but you manage everything – fueling, maintenance, parking. Gives more control but needs more attention.

Question 62

Q

Lab:
Network load balancer vs HTTP load balancer

Answer

A

To create several VMs from the Cloud shell:
Note: use –tags to reference all three instances at once.
**gcloud compute instances create www3 \
–zone=us-west1-c \
–tags=network-lb-tag \
–machine-type=e2-small \
–image-family=debian-11 \
–image-project=debian-cloud \
–metadata=startup-script=’#!/bin/bash
apt-get update
apt-get install apache2 -y
service apache2 restart
echo “

<h3>Web Server: www3</h3>

” | tee /var/www/html/index.html’**

Create a firewall rule for 3 VM instances at once using the tag:
gcloud compute firewall-rules create www-firewall-network-lb \
–target-tags network-lb-tag –allow tcp:80
Get the external IPs of all VMs
gcloud compute instances list
Static External IP is required to receive packets from the Load Balancers:
gcloud compute addresses create network-lb-ip-1 \
–region us-west1
Create an HTTP health check - crucial for load balancers to ensure that they are directing traffic to healthy instances.
gcloud compute http-health-checks create basic-check
We also need to create a ‘Target Pool’, like a group of VM instances that will handle the incoming traffic. It is between these VM instances that the load balancer will be allowed to redistribute the traffic:
Pool creation:
gcloud compute target-pools create www-pool \
–region us-west1 –http-health-check basic-check
Adding instances to the pool:
gcloud compute target-pools add-instances www-pool \
–instances www1,www2,www3
Adding a forwarding rule (this will set up a route rule, so it tells what external IP can be used by users to access my website, which is attached to the ‘Pool’. The forwarding rule is responsible for directing external traffic to the appropriate instances in the target pool. It defines the IP address and port that external clients will use to access your application.
Note that above we created an external IP which is network-lb-ip-1, this is what people will use to connect to this Pool of VMs which is managed by the Load Balancer.
gcloud compute forwarding-rules create www-rule \
–region us-west1 \
–ports 80 \
–address network-lb-ip-1 \
–target-pool www-pool
To be able to actually see the external IP that people should use, we need to see what the forwarding rule in the region ‘entails’, run:
gcloud compute forwarding-rules describe www-rule –region us-west1
Note: if I wanna save this IP in a variable:
IPADDRESS=$(gcloud compute forwarding-rules describe www-rule –region us-west1 –format=”json” | jq -r .IPAddress)
Display the variable:
echo $IPADDRESS
To see how load balancer redistributes traffic between the instances use curl (it shows in Shell what we would see on the website):
while true; do curl -m1 $IPADDRESS; done

Now about the HTTP load balancer (instead of Pool we will be talking about Managed Instance Group (MIG)).
MIGs provide features like autoscaling, autohealing, regional (multiple zone) deployment, and automatic updating because they are a group of identical VM instances that are created from a common instance template.

Create a load balancer template, template that VMs will use to self-create
gcloud compute instance-templates create lb-backend-template \
–region=us-west1 \
–network=default \
–subnet=default \
–tags=allow-health-check \
–machine-type=e2-medium \
–image-family=debian-11 \
–image-project=debian-cloud \
–metadata=startup-script=’#!/bin/bash
apt-get update
apt-get install apache2 -y
a2ensite default-ssl
a2enmod ssl
vm_hostname=”$(curl -H “Metadata-Flavor:Google” \
http://169.254.169.254/computeMetadata/v1/instance/name)”
echo “Page served from: $vm_hostname” | \
tee /var/www/html/index.html
systemctl restart apache2’
VM instances need to be in ‘Instance groups’ for the Load Balancer. The managed instance group provides VMs running the backend servers of an external HTTP load balancer.
Here we create 2 VMs based on the template above.
gcloud compute instance-groups managed create lb-backend-group \
–template=lb-backend-template –size=2 –zone=us-west1-c
Create a firewall rule to define which traffic is allowed to reach instances. Firewall rules are primarily concerned with allowing or blocking traffic at the network level. They determine which packets can reach your instances based on predefined criteria:
gcloud compute firewall-rules create fw-allow-health-check \
–network=default \
–action=allow \
–direction=ingress \
–source-ranges=130.211.0.0/22,35.191.0.0/16 \
–target-tags=allow-health-check \
–rules=tcp:80
Set up a global static external IP address that your customers use to reach your load balancer:
gcloud compute addresses create lb-ipv4-1 \
–ip-version=IPV4 \
–global
View the IPv4 address that was reserved:
gcloud compute addresses describe lb-ipv4-1 \
–format=”get(address)” \
–global
Create a health check for the load balancer:
gcloud compute health-checks create http http-basic-check \
–port 80
A Backend service needs to be installed - it acts as a configuration that the Load Balancer uses to route traffic appropriately by specifying protocol (HTTP) and health check settings:
gcloud compute backend-services create web-backend-service \
–protocol=HTTP \
–port-name=http \
–health-checks=http-basic-check \
–global
Now we need to add the MIG (managed instance group) to the backend service:
gcloud compute backend-services add-backend web-backend-service \
–instance-group=lb-backend-group \
–instance-group-zone=us-west1-c \
–global
Step that creates the HTTP load balancer: Create a URL map to route the incoming requests to the default backend service (A URL map is a resource that defines how traffic is routed based on the URL. It associates paths with specific backend services):
gcloud compute url-maps create web-map-http \
–default-service web-backend-service
Create a Target HTTP Proxy. Target HTTP Proxy is like the traffic cop that follows the instructions in the URL Map. It is responsible for directing traffic to the appropriate backend service based on the URL.
gcloud compute target-http-proxies create http-lb-proxy \
–url-map web-map-http
Create a global forwarding rule to route incoming requests to the proxy
Purpose: A forwarding rule defines how external traffic should be directed by the load balancer. It specifies the target of the traffic, which is typically a target HTTP proxy, target TCP proxy, or target HTTPS proxy.
Use Case: Forwarding rules are part of the load balancing setup and determine where incoming traffic should be sent based on the configuration of the associated proxy:
gcloud compute forwarding-rules create http-content-rule \
–address=lb-ipv4-1\
–global \
–target-http-proxy=http-lb-proxy \
–ports=80

we can set up 2 MIGs so that the Load Balancer jumps between them for example based on the file type (video/image) defined in the URL map

Question 63

Q

Network Endpoint Groups (NEG)

Answer

A

Configuration object that specifies a group of backend endpoints or services.

Used to deploy services in containers.

Serverless NEGs don’t contain endpoints.

Zonal NEGs - 1+ endpoints (specified by an IP address and representing VMs)
Internet NEG - single endpoint hosted outside of Gcloud
Hybrid Connectivity - points to services outside of google cloud
Serverless - points to Cloud Run, App Engine, Cloud Function services residing in the same region as NEG

Question 64

Q

Lab: Cloud Storage

Answer

A

copy bucket permissions into a file:
gsutil acl get gs://bucket/file > acl.txt
make the file publicly readable:
gsutil acl ch -u AllUsers: R gs://bucket/file
generate customer supplied encryption key
python -c ‘import base64; import os; print(base64.encodestring(os.urandom(32)))’
– need a .boto file and update the key there
– gsutil config -n
– nano .boto
– find the encryption key bit and paste the key there
– Note: if the key is also copied into the ‘decryption_key1=’ line (and uncomment this line)
view current lifecycle policy
gsutil lifecycle get gs://bucket/file
– can create a json lifecycle policy file
– set a new policy: gsutil lifecycle set new.json gs://bucket/file
view if versioning is enabled
gsutil versioning get gs://bucket/file
gsutil versioning set on gs://bucket/file

Answer 65

A

Make Bucket:
**gsutil mb gs://<YOUR-BUCKET-NAME>**</YOUR-BUCKET-NAME>
Download inet img and save it in a file on the persistent drive:
curl https://upload.wikimedia.org/wikipedia/commons/thumb/a/a4/Ada_Lovelace_portrait.jpg/800px-Ada_Lovelace_portrait.jpg –output ada.jpg
Upload image into bucket:
gsutil cp ada.jpg gs://YOUR-BUCKET-NAME
Delete the img from persistent disk
rm ada.jpg
To download an img from bucket
gsutil cp -r gs://YOUR-BUCKET-NAME/ada.jpg .
Create a folder and copy the img there as well:
gsutil cp gs://YOUR-BUCKET-NAME/ada.jpg gs://YOUR-BUCKET-NAME/image-folder/
List all buckets:
gsutil ls gs://YOUR-BUCKET-NAME
List object details:
gsutil ls -l gs://YOUR-BUCKET-NAME/ada.jpg
Make object publicly accessible:
gsutil acl ch -u AllUsers:R gs://YOUR-BUCKET-NAME/ada.jpg
Remove public access
gsutil acl ch -d AllUsers gs://YOUR-BUCKET-NAME/ada.jpg
Delete object
gsutil rm gs://YOUR-BUCKET-NAME/ada.jpg

Answer 66

A

Create new folder and open it, create a file in there:
mkdir gcf_hello_world
cd gcf_hello_world
nano index.js
Paste function into the file
**
/**
* Background Cloud Function to be triggered by Pub/Sub.
* This function is exported by index.js, and executed when
* the trigger topic receives a message.
*
* @param {object} data The event payload.
* @param {object} context The event metadata.
*/
exports.helloWorld = (data, context) => {
const pubSubMessage = data;
const name = pubSubMessage.data
? Buffer.from(pubSubMessage.data, ‘base64’).toString() : “Hello World”;

console.log(My Cloud Function: ${name});
};
**

Create Cloud Storage Bucket:
gsutil mb -p [PROJECT_ID] gs://[BUCKET_NAME]
Set trigger type
- When deploying a new function, you must specify –trigger-topic, –trigger-bucket, or –trigger-http
Deploying a function
gcloud functions deploy helloWorld \
–stage-bucket [BUCKET_NAME] \
–trigger-topic hello_world \
–runtime nodejs20

(in a different lab this was the way to create a function:
*gcloud functions deploy memories-thumbnail-creator –runtime=nodejs20 –trigger-bucket=qwiklabs-gcp-01-bef9ba130cdc-bucket –entry-point=memories-thumbnail-creator *

Verify the status of the function:
gcloud functions describe helloWorld
Create a message test for the function (cloud returns the execution ID for the function, which means a message has been written in the log)
DATA=$(printf ‘Hello World!’|base64) && gcloud functions call helloWorld –data ‘{“data”:”‘$DATA’”}’
View the logs to see the message was successfully output
gcloud functions logs read helloWorld

Answer 67

A

As stated earlier, Pub/Sub is an asynchronous global messaging service. There are three terms in Pub/Sub that appear often: topics, publishing, and subscribing.

A topic is a shared string that allows applications to connect with one another through a common thread.

Publishers push (or publish) a message to a Cloud Pub/Sub topic.

Subscribers make a “subscription” to a topic where they will either pull messages from the subscription or configure webhooks for push subscriptions. Every subscriber must acknowledge each message within a configurable window of time.

To sum it up, a producer publishes messages to a topic and a consumer creates a subscription to a topic to receive messages from it.

Pub/Sub is a messaging service for exchanging event data among applications and services. A producer of data publishes messages to a Pub/Sub topic. A consumer creates a subscription to that topic. Subscribers either pull messages from a subscription or are configured as webhooks for push subscriptions. Every subscriber must acknowledge each message within a configurable window of time.

Cloud Pub/Sub is an asynchronous messaging service designed to be highly reliable and scalable.

Answer 68

A

Make a ‘topic’ from Pub/Sub window
Add subscription to the topic (3 dots next to the topic)
Add name of the subscription and set delivery type to Pull
Publish a message to the topic (go into the topic, messages, create msg, enter ‘Hello World’)
To view the message, use the subscription (MySub) to pull the message (Hello World) from the topic (MyTopic):
gcloud pubsub subscriptions pull –auto-ack MySub

You created a Pub/Sub topic, published to the topic, created a subscription, then used the subscription to pull data from the topic.

Answer 69

A

Create a topic:
gcloud pubsub topics create myTopic
To see all topics created (we made 3 in the lab):
gcloud pubsub topics list
To delete topics:
gcloud pubsub topics delete Test1
Create subscription added to myTopic:
gcloud pubsub subscriptions create –topic myTopic mySubscription
List all subscriptions related to myTopic:
gcloud pubsub topics list-subscriptions myTopic
Delete subscriptions:
gcloud pubsub subscriptions delete Test1
Publish a message to Pub/Sub
gcloud pubsub topics publish myTopic –message “Hello”
Pull messages from a pub/sub topic:
gcloud pubsub subscriptions pull mySubscription –auto-ack
NOTE:
*Using the pull command without any flags will output only one message, even if you are subscribed to a topic that has more held in it.

Once an individual message has been outputted from a particular subscription-based pull command, you cannot access that message again with the pull command.

Each msg can only be accessed once, once pulled, it cannot be pulled again later*

Pulling ALL msgs from subscription using a flag (limit):
gcloud pubsub subscriptions pull mySubscription –auto-ack –limit=3

Answer 70

A

How important is moving info in an orderly way.

TCP
- sets up a channel for every communication and attempts to establish whether all packets reached the destination
- we get a recognition that the no. of packages claimed to be sent matches the no. of packages actually returned in the right order
- eg banking details
- tcp:22 –> SSH linux
- tcp:3389 –> rdp windows (remote desktop protocol)

UDP
- send info in the best effort manner
- eg streaming, recordings, music

Brainscape's Knowledge GenomeTM

2. Google Cloud Fundamentals Flashcards

Brainscape's Knowledge Genome^TM