Updated May-2023 Associate-Cloud-Engineer Exam Practice Test Questions

Verified Associate-Cloud-Engineer dumps Q&As 100% Pass in First Attempt Guaranteed Updated Dump

NEW QUESTION # 121
You need to monitor resources that are distributed over different projects in Google Cloud Platform. You want to consolidate reporting under the same Stackdriver Monitoring dashboard.
What should you do?

• A. Configure a single Stackdriver account for one of the projects. In Stackdriver, create a Group and add the other project names as criteria for that Group.
• B. Configure a single Stackdriver account, and link all projects to the same account.
• C. Use Shared VPC to connect all projects, and link Stackdriver to one of the projects.
• D. For each project, create a Stackdriver account. In each project, create a service account for that project and grant it the role of Stackdriver Account Editor in all other projects.

Answer: A

NEW QUESTION # 122
Your company has a large quantity of unstructured data in different file formats. You want to perform ETL transformations on the data. You need to make the data accessible on Google Cloud so it can be processed by a Dataflow job. What should you do?

• A. Upload the data to BigQuery using the bqcommand line tool.
• B. Upload the data into Cloud Spanner using the import function in the console.
• C. Upload the data into Cloud SQL using the import function in the console.
• D. Upload the data to Cloud Storage using the gsutilcommand line tool.

Answer: D

Explanation:
Explanation/Reference: https://cloud.google.com/solutions/performing-etl-from-relational-database-into-bigquery

NEW QUESTION # 123
You significantly changed a complex Deployment Manager template and want to confirm that the dependencies of all defined resources are properly met before committing it to the project. You want the most rapid feedback on your changes. What should you do?

• A. Use granular logging statements within a Deployment Manager template authored in Python.
• B. Monitor activity of the Deployment Manager execution on the Stackdriver Logging page of the GCP Console.
• C. Execute the Deployment Manager template using the --previewoption in the same project, and observe the state of interdependent resources.
• D. Execute the Deployment Manager template against a separate project with the same configuration, and monitor for failures.

Answer: C

Explanation:
Explanation/Reference: https://cloud.google.com/deployment-manager/docs/deployments/updating-deployments

NEW QUESTION # 124
You deployed an LDAP server on Compute Engine that is reachable via TLS through port 636 using UDP.
You want to make sure it is reachable by clients over that port. What should you do?

• A. Create a route called allow-udp-636 and set the next hop to be the VM instance running the LDAP server.
• B. Add a network tag of your choice to the instance running the LDAP server. Create a firewall rule to allow egress on UDP port 636 for that network tag.
• C. Add a network tag of your choice to the instance. Create a firewall rule to allow ingress on UDP port
  636 for that network tag.
• D. Add the network tag allow-udp-636 to the VM instance running the LDAP server.

Answer: C

NEW QUESTION # 125
Your organization is a financial company that needs to store audit log files for 3 years. Your organization has hundreds of Google Cloud projects. You need to implement a cost-effective approach for log file retention.
What should you do?

• A. Create an export to the sink that saves logs from Cloud Audit to BigQuery.
• B. Export these logs to Cloud Pub/Sub and write a Cloud Dataflow pipeline to store logs to Cloud SQL.
• C. Create an export to the sink that saves logs from Cloud Audit to a Coldline Storage bucket.
• D. Write a custom script that uses logging API to copy the logs from Stackdriver logs to BigQuery.

Answer: A

Explanation:
Explanation
Explanation/Reference: https://cloud.google.com/logging/docs/audit/

NEW QUESTION # 126
You have created a new project in Google Cloud through the gcloud command line interface (CLI) and linked a billing account. You need to create a new Compute Engine instance using the CLI.
You need to perform the prerequisite stops. What should you do?

• A. Grant yourself the IAM role of Computer Admin.
• B. Create a Cloud Monitoring Workspace.
• C. Enable the compute googleapis.com API.
• D. Create a VPC network in the project.

Answer: C

Explanation:
Always grant access to apis first in order to use GCP services

NEW QUESTION # 127
You are performing a monthly security check of your Google Cloud environment and want to know who has access to view data stored in your Google Cloud Project. What should you do?

• A. Review the IAM permissions for any role that allows for data access. Most Voted
• B. Create a Data Loss Prevention job.
• C. Enable Audit Logs for all APIs that are related to data storage.
• D. Review the Identity-Aware Proxy settings for each resource.

Answer: A

Explanation:
https://cloud.google.com/logging/docs/audit

NEW QUESTION # 128
Your company uses a large number of Google Cloud services centralized in a single project. All teams have specific projects for testing and development. The DevOps team needs access to all of the production services in order to perform their job. You want to prevent Google Cloud product changes from broadening their permissions in the future. You want to follow Google- recommended practices. What should you do?

• A. Grant all members of the DevOps team the role of Project Editor on the organization level.
• B. Create a custom role that combines the required permissions.
  Grant the DevOps team the custom role on the organization level.
• C. Create a custom role that combines the required permissions.
  Grant the DevOps team the custom role on the production project.
• D. Grant all members of the DevOps team the role of Project Editor on the production project.

Answer: C

Explanation:
Understanding IAM custom roles
Key Point: Custom roles enable you to enforce the principle of least privilege, ensuring that the user and service accounts in your organization have only the permissions essential to performing their intended functions.
Basic concepts
Custom roles are user-defined, and allow you to bundle one or more supported permissions to meet your specific needs. Custom roles are not maintained by Google; when new permissions, features, or services are added to Google Cloud, your custom roles will not be updated automatically.
When you create a custom role, you must choose an organization or project to create it in. You can then grant the custom role on the organization or project, as well as any resources within that organization or project.
https://cloud.google.com/iam/docs/understanding-custom-roles#basic_concepts

NEW QUESTION # 129
Every employee of your company has a Google account. Your operational team needs to manage a large number of instances on Compute Engine. Each member of this team needs only administrative access to the servers. Your security team wants to ensure that the deployment of credentials is operationally efficient and must be able to determine who accessed a given instance. What should you do?

• A. Ask each member of the team to generate a new SSH key pair and to add the public key to their Google account.
  Grant the "compute.osAdminLogin" role to the Google group corresponding to this team.
• B. Generate a new SSH key pair. Give the private key to each member of your team.
  Configure the public key in the metadata of each instance.
• C. Ask each member of the team to generate a new SSH key pair and to send you their public key.
  Use a configuration management tool to deploy those keys on each instance.
• D. Generate a new SSH key pair. Give the private key to each member of your team.
  Configure the public key as a project-wide public SSH key in your Cloud Platform project and allow project-wide public SSH keys on each instance.

Answer: A

Explanation:
https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys

NEW QUESTION # 130
You have an application running in Google Kubernetes Engine (GKE) with cluster autoscaling enabled. The application exposes a TCP endpoint. There are several replicas of this application. You have a Compute Engine instance in the same region, but in another Virtual Private Cloud (VPC), called gce-network, that has no overlapping IP ranges with the first VPC. This instance needs to connect to the application on GKE. You want to minimize effort. What should you do?

• A. 1. In GKE, create a Service of type NodePortthat uses the application's Pods as backend.
  2. Create a Compute Engine instance called proxy with 2 network interfaces, one in each VPC.
  3. Use iptables on this instance to forward traffic from gce-network to the GKE nodes.
  4. Configure the Compute Engine instance to use the address of proxyin gce-networkas endpoint.
• B. 1. In GKE, create a Serviceof type LoadBalancerthat uses the application's Pods as backend.
  2. Add a Cloud Armor Security Policy to the load balancer that whitelists the internal IPs of the MIG's instances.
  3. Configure the Compute Engine instance to use the address of the load balancer that has been created.
• C. 1. In GKE, create a Serviceof type LoadBalancerthat uses the application's Pods as backend.
  2. Add an annotation to this service: cloud.google.com/load-balancer-type: Internal
  3. Peer the two VPCs together.
  4. Configure the Compute Engine instance to use the address of the load balancer that has been created.
• D. 1. In GKE, create a Serviceof type LoadBalancer that uses the application's Pods as backend.
  2. Set the service's externalTrafficPolicyto Cluster.
  3. Configure the Compute Engine instance to use the address of the load balancer that has been created.

Answer: D

Explanation:
Explanation/Reference:

NEW QUESTION # 131
Every employee of your company has a Google account. Your operational team needs to manage a large number of instances on Compute Engine. Each member of this team needs only administrative access to the servers. Your security team wants to ensure that the deployment of credentials is operationally efficient and must be able to determine who accessed a given instance. What should you do?

• A. Ask each member of the team to generate a new SSH key pair and to send you their public key. Use a configuration management tool to deploy those keys on each instance.
• B. Ask each member of the team to generate a new SSH key pair and to add the public key to their Google account. Grant the "compute.osAdminLogin" role to the Google group corresponding to this team.
• C. Generate a new SSH key pair. Give the private key to each member of your team. Configure the public key in the metadata of each instance.
• D. Generate a new SSH key pair. Give the private key to each member of your team. Configure the public key as a project-wide public SSH key in your Cloud Platform project and allow project-wide public SSH keys on each instance.

Answer: D

NEW QUESTION # 132
Your company has a single sign-on (SSO) identity provider that supports Security Assertion Markup Language (SAML) integration with service providers. Your company has users in Cloud Identity. You would like users to authenticate using your company's SSO provider. What should you do?

• A. Obtain OAuth 2.0 credentials, configure the user consent screen, and set up OAuth 2.0 for Web Server Applications.
• B. In Cloud Identity, set up SSO with a third-party identity provider with Google as a service provider.
• C. Obtain OAuth 2.0 credentials, configure the user consent screen, and set up OAuth 2.0 for Mobile & Desktop Apps.
• D. In Cloud Identity, set up SSO with Google as an identity provider to access custom SAML apps.

Answer: C

NEW QUESTION # 133
You need to manage multiple Google Cloud Platform (GCP) projects in the fewest steps possible. You want to configure the Google Cloud SDK command line interface (CLI) so that you can easily manage multiple GCP projects. What should you?

• A. 1. Use the default configuration for one project you need to manage.
  2. Use gcloud init to update the configuration values when you need to work with a non-default project.
• B. 1. Create a configuration for each project you need to manage.
  2. Activate the appropriate configuration when you work with each of your assigned GCP projects.
• C. 1. Create a configuration for each project you need to manage.
  2. Use gcloud init to update the configuration values when you need to work with a non-default project
• D. 1. Use the default configuration for one project you need to manage.
  2. Activate the appropriate configuration when you work with each of your assigned GCP projects.

Answer: A

NEW QUESTION # 134
A Solutions Architect is designing a high-performance computing job that runs on Amazon EC2 instances in private subnets. To allow the application to download patches, the infrastructure must be altered to allow the instances to access external endpoints. Any changes to the infrastructure must involve minimal ongoing systems management effort.
What will allow the EC2 instances to access the endpoint while meeting these requirements?

• A. Virtual private gateway
• B. NAT gateway
• C. AWS Direct Connect
• D. Elastic IP address

Answer: B

Explanation:
Explanation/Reference: https://aws.amazon.com/vpc/

NEW QUESTION # 135
You are using multiple configurations for gcloud. You want to review the configured Kubernetes Engine cluster of an inactive configuration using the fewest possible steps. What should you do?

• A. Use kubectl config get-contexts to review the output.
• B. Use gcloud config configurations describe to review the output.
• C. Use kubectl config use-context and kubectl config view to review the output.
• D. Use gcloud config configurations activate and gcloud config list to review the output.

Answer: C

Explanation:
Use kubectl config get-contexts to review the output: shows the clusters and the configurations and based on the output we can identify the inactive configurations.
https://kubernetes.io/docs/reference/kubectl/cheatsheet/#kubectl-context-and-configuration

NEW QUESTION # 136
You are given a project with a single virtual private cloud (VPC) and a single subnetwork in the us-central1 region. There is a Compute Engine instance hosting an application in this subnetwork. You need to deploy a new instance in the same project in the europe-west1 region.
This new instance needs access to the application. You want to follow Google-recommended practices. What should you do?

• A. 1. Create a VPC and a subnetwork in europe-west1.
  2. Expose the application with an internal load balancer.
  3. Create the new instance in the new subnetwork and use the load balancer's address as the endpoint.
• B. 1. Create a VPC and a subnetwork in europe-west1.
  2. Peer the 2 VPCs.
  3. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint.
• C. 1. Create a subnetwork in the same VPC, in europe-west1.
  2. Use Cloud VPN to connect the two subnetworks.
  3. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint.
• D. 1. Create a subnetwork in the same VPC, in europe-west1.
  2. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint.

Answer: D

NEW QUESTION # 137
A company is launching a static website using the zone apex (mycompany.com). The company wants to use Amazon Route 53 for DNS.
Which steps should the company perform to implement a scalable and cost-effective solution? (Choose two.)

• A. Host the website using AWS Elastic Beanstalk, and map a Route 53 alias record to the Beanstalk stack.
• B. Host the website on an Amazon EC2 instance, and map a Route 53 alias record to the public IP address of the Amazon EC2 instance.
• C. Serve the website from an Amazon S3 bucket, and map a Route 53 alias record to the website endpoint.
• D. Create a Route 53 hosted zone, and set the NS records of the domain to use Route 53 name servers.
• E. Host the website on an Amazon EC2 instance with ELB and Auto Scaling, and map a Route 53 alias record to the ELB endpoint.

Answer: C,E

NEW QUESTION # 138
You created an instance of SQL Server 2017 on Compute Engine to test features in the new version. You want to connect to this instance using the fewest number of steps.
What should you do?

• A. Install a RDP client on your desktop. Verify that a firewall rule for port 3389 exists.
• B. Install a RDP client in your desktop. Set a Windows username and password in the GCP Console.
  Use the credentials to log in to the instance.
• C. Set a Windows password in the GCP Console. Verify that a firewall rule for port 22 exists.
  Click the RDP button in the GCP Console and supply the credentials to log in.
• D. Set a Windows username and password in the GCP Console. Verify that a firewall rule for port
  3389 exists.
  Click the RDP button in the GCP Console, and supply the credentials to log in.

Answer: B

Explanation:
Option D is not correct. When you click the RDP button, you are asked to install a client or use the Windows RDP client if you are running Windows. There is no option to enter credentials or get an RDP session through the web interface.
Option B is correct. Using the internal IP address is always preferred to going through the Internet using the Public one.
Through Internal IP option:
- Chrome Remote Desktop is a service that lets you remotely access another computer by using a web browser.
- Chrome Remote Desktop works on Windows, macOS, and Linux and does not require the VM instance to have a public IP address.
Before you connect by using Chrome Remote Desktop, make sure that the following prerequisites are met:
- You've created a Windows account and password on the VM instance.
- You've installed the Chrome Remote Desktop service on the VM instance.
https://cloud.google.com/compute/docs/instances/connecting-to-windows#chrome-remote- desktop

NEW QUESTION # 139
You need to help a developer install the App Engine Go extensions. However, you've forgotten the exact name of the component. Which command could you run to show all of the available options?

• A. gcloud config list
• B. gcloud config components list
• C. gcloud component list
• D. gcloud components list

Answer: D

NEW QUESTION # 140
You need to create an autoscaling managed instance group for an HTTPS web application. You want to make sure that unhealthy VMs are recreated. What should you do?

• A. Create a health check on port 443 and use that when creating the Managed Instance Group.
• B. Select Multi-Zone instead of Single-Zone when creating the Managed Instance Group.
• C. In the Instance Template, add the label `health-check'.
• D. In the Instance Template, add a startup script that sends a heartbeat to the metadata server.

Answer: A

Explanation:
MIGs support autohealing, load balancing, autoscaling, and auto-updating. no the Images templates, this is set up in the MIG.

NEW QUESTION # 141
Your managed instance group raised an alert stating that new instance creation has failed to create new instances. You need to maintain the number of running instances specified by the template to be able to process expected application traffic. What should you do?

• A. Verify that the instance template being used by the instance group contains valid syntax. Delete any persistent disks with the same name as instance names. Set the disks.autoDelete property to true in the instance template.
• B. Delete the current instance template and replace it with a new instance template. Verify that the instance name and persistent disk name values are not the same in the template. Set the disks.autoDelete property to true in the instance template.
• C. Create an instance template that contains valid syntax that will be used by the instance group. Verify that the instance name and persistent disk name values are not the same in the template.
• D. Create an instance template that contains valid syntax which will be used by the instance group. Delete any persistent disks with the same name as instance names.

Answer: A

NEW QUESTION # 142
You have a development project with appropriate IAM roles defined. You are creating a production project and want to have the same IAM roles on the new project, using the fewest possible steps. What should you do?

• A. Use gcloud iam roles copy and specify the production project as the destination project.
• B. Use gcloud iam roles copy and specify your organization as the destination organization.
• C. In the Google Cloud Platform Console, use the 'create role from role' functionality.
• D. In the Google Cloud Platform Console, use the 'create role' functionality and select all applicable permissions.

Answer: B

NEW QUESTION # 143
......

Google Associate Cloud Engineer Practice Test Questions, Google Associate Cloud Engineer Exam Practice Test Questions

The Google Associate Cloud Engineer certification is aimed at those professionals who deploy applications, manage enterprise solutions, and monitor operations. These individuals have the ability to utilize Google Cloud Console. They also use the command-line interface to carry out basic platform-based roles for the maintenance of multiple deployed solutions. These solutions leverage self-managed or Google-managed services on Google Cloud.

 

Pass Google Cloud Certified Associate-Cloud-Engineer Exam With 218 Questions: https://pass4sure.dumptorrent.com/Associate-Cloud-Engineer-braindumps-torrent.html