Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS DevOps Cards > GCP > Flashcards

GCP Flashcards

1
Q

Cloud Composer

A

Fully managed workflow orchestration service built on Apache Workflow.
Create, Schedule, Monitor, Manage workflows.

DAG - Directed Acyclic Graphs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Create Instances

A

gcloud compute instances create gcelab2 –machine-type n1-standard-2 –zone us-central1-f

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

SSH into created VM machine

A

gcloud compute ssh gcelab2 –zone us-central1-f

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Check windows machine is up

A

gcould compute instances get-serial-port-output instance-1 –zone us-central1-a

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Reset password of windows machine

A

gcloud compute reset-windows-password instance-1 –zone us-central1-a –user admin

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Check the project from gcloud

A

gcloud config list project

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Fetch set values

A

gcloud config get-value compute/zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Create kubeconfig entry for kubernetes cluster

A

gcloud container clusters get-credentials gcelab2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Resource Hierarchy

A

Google Cloud resources are organized hierarchically. This allows us to map the enterprise’s operational structure to GCP, and to manage access control and permissions for groups of related resources.

Top-level node - Organization resource
provides central visibility and control over all resources.

Next in the hierarchy are Folders.
Used for isolating requirements for different departments and teams.

Next in the hierarchy are Projects.
They contain computing, storage and networking resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is Cloud Identity

A

A unified identity, access, app, and endpoint management (IAM/EMM) platform.

  • give users access to apps with single sign on
  • multi factor authentication
  • endpoint management enforces policies for personal and corporate devices.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

BeyondCorp

A

Google’s Zero trust solution, that let’s employees work from anywhere without having to log into VPN.

BeyondCorp allows for single sign-on, access control policies, access proxy, and user- and device-based authentication and authorization. The BeyondCorp principles are:

  • Access to services must not be determined by the network from which you connect
  • Access to services is granted based on contextual factors from the user and their device
  • Access to services must be authenticated, authorized, and encrypted
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

VPC Service Controls

A

Used to create perimeters that protect the resources and data of services specified.
Following controls:
1. Clients within a perimeter do not have access to resources outside the perimeter.
2. Data cannot be copied to unauthorized resources outside the perimeter.
3. Data exchange between clients and resources separated by perimeter is secured by ingress and egress rules.
4. Context-aware access to resources is based on client attributes.

Created at the organization level.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Cloud Computing

A
  • On-demand self-service
  • Broad network access
  • Resource Pooling
  • Rapid Elasticity
  • Measured service
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Edge network location

A

Information served from here for lowest latency.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Zone

A

The zone is not a single DC. They are independent geographic areas.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Data Center

A

ISO 14001 Certification

17
Q

Billing

A
  • Billing in sub-hour
  • Discount for sustained use
  • Discount for committed use
  • Discount for preemptible use
  • Custom VM - Pay only for application
18
Q

GCP doesn’t lock-in

A

BigTable - Apache HSpace
Dataproc - Hadoop
TensorFlow - Opensource libraries

19
Q

Compute

A
  • Compute Engine
  • Kubernetes Engine
  • App Engine
  • Cloud Functions
20
Q

Storage

A
  • Bigtable
  • Cloud Storage
  • Cloud SQL
  • Cloud Spanner
  • Cloud Datastore
21
Q

Big Data

A
  • Big Query
  • Pub/Sub
  • Data flow
  • Data proc
  • Data lab
22
Q

Machine Learning

A
  • Natural Language API
  • Vision API
  • Machine Learning
  • Speech API
  • Translate API
23
Q

Operational Security

A
  • Intrusion detection systems
  • techniques to reduce insider risk
  • employee U2F use
  • software development practices
24
Q

Internet Communication security

A
  • Google Front End

- Designed-in Denial of Service protection

25
Q

Storage services security

A
  • Encryption at rest
26
Q

Service deployment security

A
  • Encryption of inter-service communication
27
Q

Hardware Infrastructure

A
  • Hardware design and provenance
  • Secure boot stack
  • Premises security
28
Q

User Identity Security

A

Central identity service with support for U2F

29
Q

Budgets

A
  • Budgets and alerts
    • can be based on the billing account or GCP project
    • can be triggered as a % previous month spend or fixed amount
  • Billing export
    store detailed information in a location which can be analyzed later, like in Big Query or Cloud Storage
  • Reports
    Visual tool
  • Quotas
    prevent overconsumption of resources
    Rate quota - Resets after a certain time
    Allocation quota - Fixed quotas, for example, 5 networks per project. Can be raised by Google support.
30
Q

Resources organization

A

The main way to organize the resources we use in GCP

All resources in a project should have a common business objective.

This helps in setting up policies that follow the principle of least privilege.

Organization

  • Folder
    • Folder
      • Folder
        • Project
          • Resources

Policies are inherited downwards. Each of the elements above is a point where policies can be defined.

31
Q

Google Cloud Security Responsibility

A

Google:

  • Managing infrastructure security
  • helps with best practices, templates, products, and solutions.

Customer:
- responsible for securing their data

32
Q

Project attributes

A
  • Project ID - globally unique - by client - immutable
  • Project name - not unique - by client - mutable
  • Priject number - globally unique - by GCP - Immutable
33
Q

Folders

A

Provide flexible management
Can be used to assign policies for specific departments.

The organization node is mandatory to use this.

We can move projects to folders at any time.

34
Q

Organization node

A

Top of hierarchy

Special roles:

  • Organization Policy Administrator
  • Project Creator

GSuite automatically creates an organization node, if the client doesn’t have this, they can use Client Identity to create one.

35
Q

Hierarchy policies

A

The more generous policies are accepted.

If project says Bob can access GCS while Org policy says Bob can’t access, the final result would be Bob being able to access GCS,

36
Q

IAM Policy

A
  • who (google group, google account, gsuite/cloud identity domain)
  • can do what (Roles: Primitive, Predefined, Custom)
  • on which resource

Primitive roles: Very coarse
Owner, Editor, Viewer, Billing Administrator

Predefined roles: A little finer control on access.
E.g. Instance Admin Role - specific to instance service.

Custom roles can be used only at project and organization level, and cannot be used at folder level.

37
Q

Service Account

A

SAs, control server to server interactions.
Used to authenticate one service to another.
Used to control privileges used by resources.
Identified with email address:
PROJECT_NUMBER-compute@developer.gserviceaccount.com

They use cryptographic keys/tokens to manage access. They do not have passwords.

A predefined or custom role can be assigned to the service account.

A service account also acts as a resource, so an IAM policy can be attached to it.

AWS DevOps Cards (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions