QUESTIONS 1 TO 60

Question 1

“Every employee of your company has a Google account. Your operational team needs to manage a large
number of instances on Compute Engine. Each member of this team needs only administrative access to
the servers. Your security team wants to ensure that the deployment of credentials is operationally
efficient and must be able to determine who accessed a given instance. What should you do?”

Answer 1

“Ask each member of the team to generate a new SSH key pair and to add the public key to their
Google account. Grant the “compute.osAdminLogin” role to the Google group corresponding to this
team”

Question 2

“You need to create a custom VPC with a single subnet. The subnet’s range must be as large as
possible. Which range should you use?”

Answer 2

10.0.0.0/8

Question 3

“You want to select and configure a cost-effective solution for relational data on Google Cloud Platform.
You are working with a small set of operational data in one geographic location. You need to support
point-in-time recovery. What should you do?
“

Answer 3

“Select Cloud SQL (MySQL). Verify that the enable binary logging option is
selected. “

cloudsql - relational db - one region ;cloud spanner- RDB - Multiple

Question 4

“You want to configure autohealing for network load balancing for a group of Compute Engine instances
that run in multiple zones, using the fewest possible steps. You need to configure re-creation of VMs if
they are unresponsive after 3 attempts of 10 seconds each. What should you do?”

Answer 4

“Create a managed instance group. Set the Autohealing health check to healthy
(HTTP)”

Question 5

“You are using multiple configurations for gcloud. You want to review the configured Kubernetes
Engine cluster of an inactive configuration using the fewest possible steps. What should you do?”

Answer 5

Usekubectl config use-context and kubectl config view to review the output.

Question 6

“Your company uses Cloud Storage to store application backup files for disaster recovery purposes. You want
to follow Google’s recommended practices. Which storage option should you use?”

Answer 6

Coldline Storage

Question 7

“Several employees at your company have been creating projects with Cloud Platform and paying for it with
their personal credit cards, which the company reimburses. The company wants to centralize all these
projects under a single, new billing account. What should you do?”

Answer 7

In the Google Cloud Platform Console, create a new billing account and set up a payment method.

Question 8

“You have an application that looks for its licensing server on the IP 10.0.3.21. You need to deploy the
licensing server on Compute Engine. You do not want to change the configuration of the application and want
the application to be able to reach the licensing server. What should you do?”

Answer 8

“Reserve the IP 10.0.3.21 as a static internal IP address using gcloud and assign it to the licensing
server.”

Question 9

“You are deploying an application to App Engine. You want the number of instances to scale based on request
rate. You need at least 3 unoccupied instances at all times. Which scaling type should you use?”

Answer 9

Automatic Scaling with min_idle_instances set to 3.

Question 10

“You have a development project with appropriate IAM roles defined. You are creating a production project
and want to have the same IAM roles on the new project, using the fewest possible steps. What should you
do?”

Answer 10

Usegcloud iam roles copy and specify the production project as the destination project.

Question 11

“You need a dynamic way of provisioning VMs on Compute Engine. The exact specifications will be in a
dedicated configuration file. You want to follow Google’s recommended practices. Which method should you
use?”

Answer 11

Deployment Manager

Question 12

You have a Dockerfile that you need to deploy on Kubernetes Engine. What should you do?

Answer 12

“Create a docker image from the Dockerfile and upload it to Container Registry. Create a Deployment
YAML file to point to that image. Use kubectl to create the deployment with that file.”

Question 13

“Your development team needs a new Jenkins server for their project. You need to deploy the server using
the fewest steps possible. What should you do?”

Answer 13

Use GCP Marketplace to launch the Jenkins solution.

Question 14

“You need to update a deployment in Deployment Manager without any resource downtime in the deployment.
Which command should you use?”

Answer 14

gcloud deployment-manager deployments update –config <deployment-config-path></deployment-config-path>

Question 15

“You have a single binary application that you want to run on Google Cloud Platform. You decided to
automatically scale the application based on underlying infrastructure CPU usage. Your organizational
policies require you to use virtual machines directly. You need to ensure that the application scaling is
operationally efficient and completed as quickly as possible. What should you do?”

Answer 15

“Create an instance template, and use the template in a managed instance group with autoscaling
configured.”

Question 15

“You need to run an important query in BigQuery but expect it to return a lot of records. You want to find out
how much it will cost to run the query. You are using on-demand pricing. What should you do?”

Answer 15

“Use the command line to run a dry run query to estimate the number of bytes read. Then convert that
bytes estimate to dollars using the Pricing Calculator.”

Question 16

“You need to set up a policy so that videos stored in a specific Cloud Storage Regional bucket are moved to
Coldline after 90 days, and then deleted after one year from their creation. How should you set up the policy?”

Answer 16

“Use Cloud Storage Object Lifecycle Management using Age conditions with SetStorageClass and Delete
actions. Set the SetStorageClass action to 90 days and the Delete action to 365 days.”

Question 17

“You are analyzing Google Cloud Platform service costs from three separate projects. You want to use this
information to create service cost estimates by service type, daily and monthly, for the next six months using
standard query syntax. What should you do?”

Answer 17

Export your bill to a BigQuery dataset, and then write time window-based SQL queries for analysis.

Question 18

“You have a Linux VM that must connect to Cloud SQL. You created a service account with the appropriate
access rights. You want to make sure that the VM uses this service account instead of the default Compute
Engine service account. What should you do?”

Answer 18

“When creating the VM via the web console, specify the service account under the ‘Identity and API
Access’ section.”

Question 19

“You created an instance of SQL Server 2017 on Compute Engine to test features in the new version. You
want to connect to this instance using the fewest number of steps. What should you do?”

Answer 19

“Install a RDP client in your desktop. Set a Windows username and password in the GCP Console. Use
the credentials to log in to the instance.”

Question 20

“You have one GCP account running in your default region and zone and another account running in a non-
default region and zone. You want to start a new Compute Engine instance in these two Google Cloud
Platform accounts using the command line interface. What should you do?”

Answer 20

“Create two configurations using gcloud config configurations create [NAME]. Run gcloud
config configurations activate [NAME] to switch between accounts when running the
commands to start the Compute Engine instances.”

Question 21

“You significantly changed a complex Deployment Manager template and want to confirm that the
dependencies of all defined resources are properly met before committing it to the project. You want the
most rapid feedback on your changes. What should you do?”

Answer 21

“Execute the Deployment Manager template using the –-preview option in the same project, and
observe the state of interdependent resources.”

Question 22

You are building a pipeline to process time-series data. Which Google Cloud Platform services
should you put in boxes 1,2,3, and 4?

Answer 22

Cloud Pub/Sub, Cloud Dataflow, Cloud Bigtable, BigQuery

Question 23

“You have a project for your App Engine application that serves a development environment. The required
testing has succeeded and you want to create a new project to serve as your production environment. What
should you do?”

Answer 23

Use gcloud to create the new project, and then deploy your application to the new project.

Question 24

“You need to configure IAM access audit logging in BigQuery for external auditors. You want to follow Google-
recommended practices. What should you do?”

Answer 24

Add the auditors group to the ‘logging.viewer’ and ‘bigQuery.dataViewer’ predefined IAM roles.

Question 25

“You need to set up permissions for a set of Compute Engine instances to enable them to write data into a
particular Cloud Storage bucket. You want to follow Google-recommended practices. What should you do?”

Answer 25

Create a service account and add it to the IAM role ‘storage.objectCreator’ for that bucket.

Question 26

“You have sensitive data stored in three Cloud Storage buckets and have enabled data access logging. You
want to verify activities for a particular user for these buckets, using the fewest possible steps. You need to
verify the addition of metadata labels and which files have been viewed from those buckets. What should
you do?”

Answer 26

Using the GCP Console, filter the Activity log to view the information.

Question 27

“You are the project owner of a GCP project and want to delegate control to colleagues to manage buckets
and files in Cloud Storage. You want to follow Google-recommended practices. Which IAM roles should you
grant your colleagues?”

Answer 27

Storage Admin

Question 28

“You have an object in a Cloud Storage bucket that you want to share with an external company. The object
contains sensitive data. You want access to the content to be removed after four hours. The external
company does not have a Google account to which you can grant specific user-based access privileges. You
want to use the most secure method that requires the fewest steps. What should you do?”

Answer 28

Create a signed URL with a four-hour expiration and share the URL with the company.

Question 29

“You are creating a Google Kubernetes Engine (GKE) cluster with a cluster autoscaler feature enabled. You
need to make sure that each node of the cluster will run a monitoring pod that sends container metrics to a
third-party monitoring solution. What should you do?”

Answer 29

Deploy the monitoring pod in a DaemonSet object.

Question 30

“You want to send and consume Cloud Pub/Sub messages from your App Engine application. The Cloud Pub/
Sub API is currently disabled. You will use a service account to authenticate your application to the API. You
want to make sure your application can use Cloud Pub/Sub. What should you do?”

Answer 30

Enable the Cloud Pub/Sub API in the API Library on the GCP Console.

Question 31

“You need to monitor resources that are distributed over different projects in Google Cloud Platform. You
want to consolidate reporting under the same Stackdriver Monitoring dashboard. What should you do?”

Answer 31

Configure a single Stackdriver account, and link all projects to the same account.

Question 32

“You are deploying an application to a Compute Engine VM in a managed instance group. The application
must be running at all times, but only a single instance of the VM should run per GCP project. How should
you configure the instance group?”

Answer 32

“Set autoscaling to On, set the minimum number of instances to 1, and then set the maximum number of
instances to 1.”

Question 33

“You want to verify the IAM users and roles assigned within a GCP project named my-project. What should
you do?”

Answer 33

Navigate to the project and then to the IAM section in the GCP Console. Review the members and roles.

Question 34

role verify

“You need to create a new billing account and then link it with an existing Google Cloud Platform project.
What should you do?”

Answer 34

“Verify that you are Project Billing Manager for the GCP project. Create a new billing account and link the
new billing account to the existing project.”

Question 35

“You have one project called proj-sa where you manage all your service accounts. You want to be able to

use a service account from this project to take snapshots of VMs running in another project called proj-
vm. What should you do?”

Answer 35

Grant the service account the IAM Role of Compute Storage Admin in the project called proj-vm.

Question 36

“You created a Google Cloud Platform project with an App Engine application inside the project. You initially
configured the application to be served from the us-central region. Now you want the application to be served
from the asia-northeast1 region. What should you do?”

Answer 36

“Create a new GCP project and create an App Engine application inside this new project. Specify asia-
northeast1 as the region to serve your application.”

Question 37

“You need to grant access for three users so that they can view and edit table data on a Cloud Spanner
instance. What should you do?”

Answer 37

“Run gcloud iam roles describe roles/spanner.databaseUser. Add the users to a new
group. Add the group to the role.”

Question 38

“You create a new Google Kubernetes Engine (GKE) cluster and want to make sure that it always runs a
supported and stable version of Kubernetes. What should you do?”

Answer 38

Enable the Node Auto-Upgrades feature for your GKE cluster.

Question 39

“You have an instance group that you want to load balance. You want the load balancer to terminate the client
SSL session. The instance group is used to serve a public web application over HTTPS. You want to follow
Google-recommended practices. What should you do?”

Answer 39

Configure an HTTP(S) load balancer.

Question 40

“You have 32 GB of data in a single file that you need to upload to a Nearline Storage bucket. The WAN
connection you are using is rated at 1 Gbps, and you are the only one on the connection. You want to use as
much of the rated 1 Gbps as possible to transfer the file rapidly. How should you upload the file?”

Answer 40

Enable parallel composite uploads using gsutil on the file transfer.

gsutil - Command Line tool to eprform opn on storage - buckets etc

Question 41

You’ve deployed a microservice called myapp1 to a Google Kubernetes Engine cluster using the YAML file specified below:
apiversion: apps/v1
kind: Deployment
metadata:
name: myapp1-deployment
spec:
selector:
matchLabels:
app: myappl
replicas: 2
template
metadata:
label:

app: myappl
spe:
containers:
- name: main-container
image: gcr.io/my-company-repo/myapp1:1.4
env:
- name: DB_PASSWORD
value: “tOugh2guess!”
ports:
= containerPort: 8080

Answer 41

Store the database password inside a Secret object. Modify the YAML file to populate the DB_PASSWORD environment variable from the Secret.

Question 42

“You are running an application on multiple virtual machines within a managed instance group and have
autoscaling enabled. The autoscaling policy is configured so that additional instances are added to the group

if the CPU utilization of instances goes above 80%. VMs are added until the instance group reaches its
maximum limit of five VMs or until CPU utilization of instances lowers to 80%. The initial delay for HTTP
health checks against the instances is set to 30 seconds. The virtual machine instances take around three
minutes to become available for users. You observe that when the instance group autoscales, it adds more
instances then necessary to support the levels of end-user traffic. You want to properly maintain instance
group sizes when autoscaling. What should you do?”

Answer 42

Increase the initial delay of the HTTP health check to 200 seconds.

Question 43

“You need to select and configure compute resources for a set of batch processing jobs. These jobs take
around 2 hours to complete and are run nightly. You want to minimize service costs. What should you do?”

Answer 43

Select Compute Engine. Use preemptible VM instances of the appropriate standard machine type.

Question 44

“You recently deployed a new version of an application to App Engine and then discovered a bug in the
release. You need to immediately revert to the prior version of the application. What should you do?”

Answer 44

On the App Engine Versions page of the GCP Console, route 100% of the traffic to the previous version.

Question 45

“You deployed an App Engine application using gcloud app deploy, but it did not deploy to the intended
project. You want to find out why this happened and where the application deployed. What should you do?”

Answer 45

“Go to Cloud Shell and run gcloud config list to review the Google Cloud configuration used for
deployment.”

Question 46

“You want to configure 10 Compute Engine instances for availability when maintenance occurs. Your
requirements state that these instances should attempt to automatically restart if they crash. Also, the
instances should be highly available including during system maintenance. What should you do?”

Answer 46

“Create an instance template for the instances. Set the ‘Automatic Restart’ to on. Set the ‘On-host
maintenance’ to Migrate VM instance. Add the instance template to an instance group.”

Question 47

“You have a virtual machine that is currently configured with 2 vCPUs and 4 GB of memory. It is running out
of memory. You want to upgrade the virtual machine to have 8 GB of memory. What should you do?”

Answer 47

Stop the VM, increase the memory to 8 GB, and start the VM.

Question 48

“You host a static website on Cloud Storage. Recently, you began to include links to PDF files on this site.
Currently, when users click on the links to these PDF files, their browsers prompt them to save the file onto
their local system. Instead, you want the clicked PDF files to be displayed within the browser window directly,
without prompting the user to save the file locally. What should you do?”

Answer 48

Set Content-Type metadata to application/pdf on the PDF file objects.

Question 49

“You need to create an autoscaling managed instance group for an HTTPS web application. You want to
make sure that unhealthy VMs are recreated. What should you do?”

Answer 49

Create a health check on port 443 and use that when creating the Managed Instance Group.

Question 49

“You have production and test workloads that you want to deploy on Compute Engine. Production VMs need
to be in a different subnet than the test VMs. All the VMs must be able to reach each other over internal IP
without creating additional routes. You need to set up VPC and the 2 subnets. Which configuration meets
these requirements?”

Answer 49

“Create a single custom VPC with 2 subnets. Create each subnet in a different region and with a different
CIDR range.”

Question 50

“Your company has a GoogleCloud Platform project that uses BigQuery for data warehousing. Your data
science team changes frequently and has few members. You need to allow members of this team to perform
queries. You want to follow Google-recommended practices. What should you do?”

Answer 50

“1. Create a dedicated Google group in Cloud Identity.
2. Add each data scientist’s user account to the group.
3. Assign the BigQuery jobUser role to the group.”

Question 51

Your company has a 3-tier solution running on Compute Engine. The configuration of the current infrastructure is shown below.

Each tier has a service account that is associated with all instances within it. You need to enable communication on TCP port 8080 between tiers as follows:
* Instances in tier #1 must communicate with tier #2.
* Instances in tier #2 must communicate with tier #3.
What should you do?

Answer 51

“1. Create an ingress firewall rule with the following settings: ג€¢ Targets: all instances with tier #2 service
account ג€¢ Source filter: all instances with tier #1 service account ג€¢ Protocols: allow TCP:8080 2. Create an
ingress firewall rule with the following settings: ג€¢ Targets: all instances with tier #3 service account ג€¢
Source filter: all instances with tier #2 service account ג€¢ Protocols: allow TCP: 8080”

Question 52

“You are given a project with a single virtual private cloud (VPC) and a single subnetwork in the us-central1
region. There is a Compute Engine instance hosting an application in this subnetwork. You need to deploy a
new instance in the same project in the europe-west1 region. This new instance needs access to the
application. You want to follow Google-recommended practices. What should you do?”

Answer 52

“1. Create a subnetwork in the same VPC, in europe-west1.
2. Create the new instance in the new subnetwork and use the first instance’s private address as the
endpoint.”

Question 53

“Your projects incurred more costs than you expected last month. Your research reveals that a development
GKE container emitted a huge number of logs, which resulted in higher costs. You want to disable the logs
quickly using the minimum number of steps. What should you do?”

Answer 53

“1. Go to the Logs ingestion window in Stackdriver Logging, and disable the log source for the GKE
container resource.”

Question 54

“You have a website hosted on App Engine standard environment. You want 1% of your users to see a new
test version of the website. You want to minimize complexity. What should you do?”

Answer 54

“Deploy the new version in the same application and use the –splits option to give a weight of 99 to
the current version and a weight of 1 to the new version.”

Question 55

“You have a web application deployed as a managed instance group. You have a new version of the
application to gradually deploy. Your web application is currently receiving live web traffic. You want to
ensure that the available capacity does not decrease during the deployment. What should you do?”

Answer 55

Performa rolling-action start-update with maxSurge set to 1 and maxUnavailable set to 0.

Question 56

“You are building an application that stores relational data from users. Users across the globe will use this
application. Your CTO is concerned about the scaling requirements because the size of the user base is
unknown. You need to implement a database solution that can scale with your user growth with minimum
configuration changes. Which storage solution should you use?”

Answer 56

Cloud Spanner

Question 57

“You are the organization and billing administrator for your company. The engineering team has the Project
Creator role on the organization. You do not want the engineering team to be able to link projects to the
billing account. Only the finance team should be able to link a project to a billing account, but they should not
be able to make any other changes to projects. What should you do?”

Answer 57

Assign the finance team only the Billing Account User role on the billing account.

Question 58

“You have an application running in Google Kubernetes Engine (GKE) with cluster autoscaling enabled. The
application exposes a TCP endpoint. There are several replicas of this application. You have a Compute
Engine instance in the same region, but in another Virtual Private Cloud (VPC), called gce-network, that
has no overlapping IP ranges with the first VPC. This instance needs to connect to the application on GKE.
You want to minimize effort. What should you do?”

Answer 58

“1. In GKE, create a Service of type LoadBalancer that uses the application’s Pods as backend. 2. Add an
annotation to this service: cloud.google.com/load-balancer-type: Internal 3. Peer the two VPCs together.
4. Configure the Compute Engine instance to use the address of the load balancer that has been
created.”