ACE4 Flashcards
While working on a project, an application administrator has been given the responsibility of managing all resources. He wants to delegate the responsibility of managing the existing service accounts to another administrator. He will also be responsible to manage the other service accounts that will be created. Which of the following is the best way to delegate the privileges required to manage all the service accounts?
A. Granting iam.serviceAccountUser to the administrator at the project level
B. Granting iam.serviceProjectAccountUser to the administrator at the project level
C. Granting iam.serviceAccountUser to the administrator at the service account level
D. Granting iam.serviceProjectAccountUser to the administrator at the service account level
Answer: A
A user can manage all the service accounts in the project if service account user role iam.serviceAccountUser is granted to him at the project level. Also, whenever a new service account will be created, the administrator will be granted iam.serviceAccountUser automatically for that new service account.
The service account user role (iam.serviceAccountUser) for all service accounts in a project can be granted at the project level. While the service account user role for a specific service account in a project can be granted at the service account level. So, as per given scenario, to delegate the privileges to manager all the service accounts, service account user role (iam.serviceAccountUser) will be granted to the administrator at the project level.
You are currently working on a freelance project where you have to deploy a WordPress website on VM. You decided to use startup script to install WordPress and other libraries instead of manual install. While launching you forgot to use startup script and are wondering how to do it now?
A. Edit the instance by selecting it, add your startup script into the user data field and restart your instance.
B. Stop the instance, add a metadata with startup-script as key, and script content as value, and start the instance.
C. Stop the instance, add script into startup script field, and start the instance.
D. Edit the instance by selecting it, add a metadata with script as key, add script content as value, and restart the instance.
Answer: B
The startup script is executed every time an instance is started. By stopping an instance and launching it again will start it on a host resulting in execution of startup script.
Wrong:
- Just restarting the instance does not trigger startup script.
- There is no such field with name of startup script. You need to create a metadata with key as startup-script and value as script itself.
- Script is an incorrect key. The correct key for metadata is startup-script.
Reference: https://cloud.google.com/compute/docs/startupscript
Your company has decided to build an in-house application for payroll processing, and you have been assigned task to create a VM, Cloud SQL DB and bucket for the same. While testing the application, developers found that they couldn’t upload files to bucket. How would you fix it?
A. Enable ufw on linux instance and allow port 443.
B. Check if the default service account is attached to VM, if not edit the instance and attach it.
C. Check if egress firewall rules are applied to instance allowing connection between bucket and VM.
D. None of the above.
Answer D
None of the above-Tackle it this way:
Create a custom service account with write permission for Storage service and attach it to instance.
While launching the instance under Identity and API access section stick to default service account, click on “Set access for API” and select either Write Only or Read Write scope for your instance.
https://cloud.google.com/compute/docs/access/service-accounts
In VPC, which firewall rules are created by default while creating an automatic default VPC?
A. Deny all ingress, allow all egress
B. Deny all ingress and egress
C. Allow SSH, RDP, HTTP, HTTPS
D. Allow SSH, RDP, ICMP, and internal traffic
Answer D
While creating a default automatic VPC, rules are created by default and these are allow, SSH, RDP, ICMP, and internal traffic.
Wrong:
- B By default, it creates allow all egress and denies all ingress
- C Allow HTTP and HTTPS are not part of the firewall rules list that can be created during the VPC launch process.
- A These rules exist, but are not shown in the Cloud Console. The implied rules cannot be removed, but they have the lowest possible priorities.
Reference:
https://cloud.google.com/vpc/docs/firewalls#more_rules_default_vpc
As per your manager’s instruction, you created a custom VPC with a subnet mask of 24 which provides 256 IP addresses but are only able to use 252 addresses out of it. You manager is trying to figure out what’s going wrong and approaches you for the answer. What will you answer to your manager?
Answer B
Google Cloud always reserves 4 IP addresses for every subnet you create. Reason for this is: -First IP is a network address.
- Second is reserved for the default gateway.
- Second-to-last is reserved for future use.
- Last address is the broadcast address.
Wrong:
-A Subnet creation process has nothing to do with a smaller number of the available IP address.
-C Soft limit has nothing to do in this case.
Your company has been working on an application for the last three months and is now ready to roll out the same to the UAT environment for beta testing. Your manager has asked you to create a replica of dev project. Which is the best way to clone/replicate the existing project?
Answer D
There is no inbuilt option provided by GCP to clone/replicate the project.
You are a Google Cloud Engineer and assigned to set up a project for the team of four members. You need to grant only general permissions for all the resources of the project. You decided to grant a primitive role to each person for different levels of access on the basis of their responsibilities in the project. What is not considered as a primitive role in the Google Cloud Platform console?
A. Viewer
B. Editor
C. Owner
D. Publisher
Answer D
Publisher is not a primitive role in Google Cloud Platform, but a predefined role.
Reference:
Google Cloud Identity and Access Management Overview - https://cloud.google.com/iam/docs/overview
A cloud engineer wants to create a VM named whiz-server-1 with four CPUs. Which of the following commands would he use to create the VM whiz-server-1?
A. gcloud compute instances create –machine-type=n1-standard-4 whiz-server-1
B. gcloud compute instances create –cpus=4 whiz-server-1
C. gcloud compute instances create –machine-type=n1-standard-4 –instancename whiz-server-1
D. gcloud compute instances create –machine-type=n1-4-cpu whiz-server-1
Answer A
gcloud compute instances create –machine-type=n1-standard-4 whiz-server-1 is the correct command to create VM with 4 CPUs. It includes a correct machine type and specifies the name of the instance properly.
Wrong:
-gcloud compute instances create –cpus=4 whiz-server-1 is wrong. This command includes cpus parameter that does not exist in a google cloud command.
What is the gcloud command to create a cluster named ch09-cluster-10 with four nodes?
A. gcloud container clusters create ch09-cluster-10 4
B. gcloud container clusters create ch09-cluster-10 –num-nodes=4
C. gcloud clusters container create ch09-cluster-10 –num-nodes=4
D. gcloud container beta clusters create ch09-cluster-10 –nodes-num=4
Answer B
The command:
gcloud container clusters create ch09-cluster-10 –num-nodes=4 is the correct command to create a cluster named ch09-cluster-10 with four nodes as it uses the correct pattern.
Which of the following IP address would you specify to define a CIDR range that will apply to all the destination addresses? A. 0.0.0.0/0 B. 172.16.0.0/12 C. 192.168.0.0/16 D. 10.0.0.0/8
Answer A
The IP address 0.0.0.0/0 matches all the IP addresses. Using the 0.0.0.0/0 IP address, you can define a CIDR range that will apply to all the destination addresses.
You have set a firewall rule that will permit inbound connections to a VM instance named whizserver-2. You want to apply this rule only if there is not another rule that would deny that traffic. What priority would you give to this rule? A. 1000 B. 1 C. 65535 D. 0
Answer C
If the rule will have the lowest priority, it will permit inbound traffic/connections to the VM instance whizserver-2. The large will be the number, the low will be the priority. The lowest priority will ensure that the other rules that match will apply. So, the largest number should be selected to make the priority lowest.Option A is incorrect. 1000 is not the largest number from the given options. For the lowest priority, it is required to choose the largest number.
B: is incorrect. 1 is a very small number, it will increase the priority. So, it is not the correct answer.
D: is incorrect. Lower the number, higher will be the priority. The number 0 will result in higher priority while the priority should be the lowest.
Reference: Virtual Private Cloud - Firewall Rules Overview
You have recently joined a startup that is migrating its infrastructure from AWS to Google Cloud. A junior has been assigned the task of migrating one of their web servers with Amazon Linux OS from AWS to GCP in a public subnet of custom VPC. He is able to migrate the instance successfully, but not able to get SSH access of migrated instance. What are the possible steps to look for? (Multiple Answer)
A. Check if he has attached correct firewall rule with port udp:22 open to the instance.
B. Check if he has added SSH key to the instance while launching phase.
C. Google Cloud does not support Amazon Linux images because of market competition.
D. Make sure the firewall is attached to the instance with tcp port 22 open.
Answer B and D
B. Check if he has added SSH key to the instance while launching phase.
D. Make sure the firewall is attached to the instance with tcp port 22 open.
Wrong:
A. SSH by default does NOT work on UDP port 22
You work for a retail company that has a busy online store. As you are approaching New Year, you find that your e-store is getting more and more traffic. You ensure that your web servers are behind a managed instance group. However, you notice that the web tier is frequently scaling, sometimes multiple times in an hour. You need to prevent the instance group from scaling up and down so rapidly. Which of the following options would help you to achieve this?
A. Change the auto scaling metric to use multiple metrics instead of just one metric.
B. Reduce the number of maximum instance count.
C. Associate a health check with instance group.
D. Increase the cool down period.
Answer D
Increasing the cool down period will make scaling policy wait slightly longer period before taking next action of either scale up or down.
A is incorrect: This will not be beneficial in anything except creating a complex scaling policy.
B: is incorrect: Just reducing the VM count will stop scaling policy to launch VMs more than threshold and won’t help us control rapid scaling up and down behaviour.
C: is incorrect: Health check only provides information whether instance is responding or not.
You are working with a healthcare startup as Google Cloud Consultant on a new project which they are about to launch next week as a beta version. All the static files are stored on GCS and you have been asked to make one of the PDF named whizlabs-bucket publicly available for the customers to download. You only have access to CLI to achieve the same. Which of the following command would you use to do it?
A: gsutil acl ch -u allUsers:r gs://whizlabs-bucket/file.pdf
B: gsutil acl update -u allUsers:R gs://whizlabs-bucket/file.pdf
C: gcloud gs update-acl –public-read gs://whizlabs-bucket/file.pdf
D: gcloud storage update-acl –public-read gs://whizlabs-bucket/file.pdf
Answer A
gsutil acl ch -u allUsers:r gs://whizlabs-bucket/file.pdf
B: is incorrect: gsutil acl does not have update as an option. Only supported ones are set, get, and ch
C: is incorrect: gcloud does not have any group called gs
D: is incorrect: gcloud does not have any group with the name of storage
Which command will let you enable Google Compute service using gcloud CLI?
A. gcloud enable compute
B. gcloud service enable compute
C. gcloud service compute enable
D. gcloud services enable compute
Answer D
The gcloud command to enable compute engine API is:
gcloud services enable compute.
You want your application hosted on a VM to fetch metadata of that instance. Which command will help you to fetch it?
A. curl metadata.google.internal/compute-metadata/v1/
B. curl /metadata/v1/
C. curl metadata.google.internal/computeMetadata/v1/
D. curl internal.googleapi.com/computeMetadata/v1/
Answer C
The right command to fetch metadata is:
curl metadata.google.internal/computeMetadata/v1/
*The rest of the commands are not valid gcloud commands
Your department head has asked you to create a new custom manual VPC with three subnets having 20 usable IP addresses individually. Which subnet mask suits your requirement? A. 24 B. 28 C. 18 D. 27
Answer D
IPv4 consists of 4 octets which sum up to 32 bit.
The formula to calculate the number of hosts is 2 power of n where n is the difference between 32 and subnet mask to be used.
In this case, it will be 2 power of 5 = 32 hosts. In each CIDR block, two IPs are reserved: one for the network address and another one for broadcast which leaves us with 30 usable IP addresses.
32 - 27 = 5
2 power of 5 = 32 total IP addresses
32 - 2 = 30 usable IP addresses
You have 100TB of non-relational data and want to run analytics on it to see previous year net sales. Which tool suits best to your requirement? A. BigQuery B. BigTable C. Datastore D. GCS
Answer B
BigTable is a managed NoSQL DB service designed for handling and processing large amounts of data.
A: is incorrect: BigQuery is a relational database service, hence cannot be used to store non-relational data.
C: is incorrect: Datastore is NoSQL managed DB service but the amount of data we are looking at is quite big for Datastore to efficiently process.
D: is incorrect: GCS is only used for storing files. It does not support relational or non-relational data.
https://cloud.google.com/bigtable/
Which of the following export options are available with Google Cloud Billing? A. BigTable and Storage B. BigQuery and File C. BigQuery and BigTable D. CloudSQL and BigTable
Answer B
Billing export at the time of writing supports only BigQuery and File export
A: is incorrect: Storage is supported, but not BigTable.
C: is incorrect: Billing export supports BigQuery but not BigTable.
D: is incorrect: Both CloudSQL and BigTable are supported as export option.
Reference:
https: //cloud.google.com/billing/docs/how-to/export-data-bigquery
https: //cloud.google.com/billing/docs/how-to/export-data-file
Engineering team is building an application which routes request on TCP layer. They need a load balancer with support of SSL termination on load balancer. Which of the following is the best available option? A. HTTPS Load Balancer B. UDP Load Balancer C. SSL Proxy Load Balancer D. TCP Load Balancer
Answer C
SSL Proxy is a Layer 3 load balancer with support of SSL termination.
A: is incorrect: HTTPS LB does support SSL termination but works on Layer 7 i.e. application layer.
B: is incorrect: UDP LB, as the name says, works with UDP protocol and our application works on TCP protocol.
D is incorrect: TCP LB could have been the choice if we didn’t have SSL termination requirement.
Reference:
https://cloud.google.com/load-balancing/
