1. You need to manage a third-party application that will run on a Compute Engine instance.

Other Compute Engine instances are already running with default configuration. Application
installation files are hosted on Cloud Storage. You need to access these files from the new
instance without allowing other virtual machines (VMs) to access these files. What should you
do?

A. Create the instance with the default Compute Engine service account Grant the service
account permissions on Cloud Storage.

B. Create the instance with the default Compute Engine service account Add metadata to the
objects on Cloud Storage that matches the metadata on the new instance.

C. Create a new service account and assign this service account to the new instance Grant the
service account permissions on Cloud Storage.

D. Create a new service account and assign this service account to the new instance Add
metadata to the objects on Cloud Storage that matches the metadata on the new instance.

Answer: C

2. You need to configure optimal data storage for files stored in Cloud Storage for minimal cost.
The files are used in a mission-critical analytics pipeline that is used continually. The users are in
Boston, MA (United States). What should you do?

A. Configure regional storage for the region closest to the users Configure a Nearline storage
class

B. Configure regional storage for the region closest to the users Configure a Standard storage
class

C. Configure dual-regional storage for the dual region closest to the users Configure a Nearline
storage class

D. Configure dual-regional storage for the dual region closest to the users Configure a Standard
storage class

Answer: B

3. You need to manage a Cloud Spanner Instance for best query performance. Your instance in
production runs in a single Google Cloud region. You need to improve performance in the
shortest amount of time. You want to follow Google best practices for service configuration.
What should you do?

A. Create an alert in Cloud Monitoring to alert when the percentage of high priority CPU
utilization reaches 45% If you exceed this threshold, add nodes lo your instance.

B. Create an alert in Cloud Monitoring to alert when the percentage ot high priority CPU
utilization reaches 45% Use database query statistics to identify queries that result in high CPU
usage, and then rewrite those queries to optimize their resource usage

C. Create an alert in Cloud Monitoring to alert when the percentage of high priority CPU
utilization reaches 65% If you exceed this threshold, add nodes to your instance

D. Create an alert in Cloud Monitoring to alert when the percen tage of high priority CPU
utilization reaches 65%. Use database query statistics to identity queries that result in high CPU
usage, and then rewrite those queries to optimize their resource usage.

Ans : C

4. You are building an application that stores relational data from users. Users across the globe
will use this application. Your CTO is concerned about the scaling requirements because the size
of the user base is unknown. You need to implement a database solution that can scale with
your user growth with minimum configuration changes. Which storage solution should you use?

A. Cloud SQL B. Cloud Spanner C. Cloud Firestore D. Cloud Datastore

Ans - B

5. Your organization uses G Suite for communication and collaboration. All users in your
organization have a G Suite account. You want to grant some G Suite users access to your Cloud
Platform project. What should you do?

A. Enable Cloud Identity in the GCP Console for your domain.

B. Grant them the required IAM roles using their G Suite email address.

C. Create a CSV sheet with all users’ email addresses. Use the gcloud command line tool to
convert them into Google Cloud Platform accounts.

D. In the G Suite console, add the users to a special group called cloud-console-
[email protected]. Rely on the default behavior of the Cloud Platform to grant users
access if they are members of this group.

Ans -B

6. You need to verify that a Google Cloud Platform service account was created at a particular
time. What should you do?

A. Filter the Activity log to view the Configuration category. Filter the Resource type to Service
Account.
B. Filter the Activity log to view the Configuration category. Filter the Resource type to Google
Project.

C. Filter the Activity log to view the Data Access category. Filter the Resource type to Service
Account.

D. Filter the Activity log to view the Data Access category. Filter the Resource type to Google
Project.

Ans -A

7. Your company set up a complex organizational structure on Google Could Platform. The
structure includes hundreds of folders and projects. Only a few teammembers should be able to
view the hierarchical structure. You need to assign minimum permissions to these team
members and you want to follow Googlerecommended practices. What should you do?

A. Add the users to roles/browser role.

B. Add the users to roles/iam.roleViewer role.

C. Add the users to a group, and add this group to roles/browser role.

D. Add the users to a group, and add this group to roles/iam.roleViewer role.

Ans -C

8. Your organization has a dedicated person who creates and manages all service accounts for
Google Cloud projects. You need to assign this person the minimum role for projects. What
should you do?

A. Add the user to roles/iam.roleAdmin role.

B. Add the user to roles/iam.securityAdmin role.

C. Add the user to roles/iam.serviceAccountUser role.

D. Add the user to roles/iam.serviceAccountAdmin role

Ans- D

9. Your organization has user identities in Active Directory. Your organization wants to use Active
Directory as their source of truth for identities. Your organizationwants to have full control over
the Google accounts used by employees for all Google services, including your Google Cloud
Platform (GCP) organization. What should you do?

A. Use Google Cloud Directory Sync (GCDS) to synchronize users into Cloud Identity.

B. Use the cloud Identity APIs and write a script to synchronize users to Cloud Identity.
C. Export users from Active Directory as a CSV and import them to Cloud Identity via the Admin
Console.

D. Ask each employee to create a Google account using self signup. Require that each employee
use their company email address and password

Ans- A

10. You have successfully created a development environment in a project for an application.
This application uses Compute Engine and Cloud SQL. Now, you need to create a production
environment for this application. The security team has forbidden the existence of network
routes between these 2 environments, and asks you to follow Google-recommended practices.
What should you do?

A. Create a new project, enable the Compute Engine and Cloud SQL APIs in that project, and
replicate the setup you have created in the development environment.

B. Create a new production subnet in the existing VPC and a new production Cloud SQL instance
in your existing project, and deploy your application using those resources.

C. Create a new project, modify your existing VPC to be a Shared VPC, share that VPC with your
new project, and replicate the setup you have in the development environment in that new
project, in the Shared VPC.

D. Ask the security team to grant you the Project Editor role in an existing production project
used by another division of your company. Once they grant you that role, replicate the setup you
have in the development environment in that project.

Ans -A

11. You need to reduce GCP service costs for a division of your company using the fewest
possible steps. You need to turn off all configured services in an existing GCP project. What
should you do?

A. 1. Verify that you are assigned the Project Owners IAM role for this project. 2. Locate the
project in the GCP console, click Shut down and then enter the project ID.

B. 1. Verify that you are assigned the Project Owners IAM role for this project. 2. Switch to the
project in the GCP console, locate the resources and delete them.

C. 1. Verify that you are assigned the Organizational Administrator IAM role for this project. 2.
Locate the project in the GCP console, enter the project ID and then click Shut down.

D. 1. Verify that you are assigned the Organizational Administrators IAM role for this project. 2.
Switch to the project in the GCP console, locate the resources and delete them.

Ans- A
12. You have a Compute Engine instance hosting a production application. You want to receive
an email if the instance consumes more than 90% of its CPU resources for more than 15
minutes. You want to use Google services. What should you do?

A. 1. Create a consumer Gmail account. 2. Write a script that monitors the CPU usage. 3. When
the CPU usage exceeds the threshold, have that script send an email using the Gmail account
and smtp.gmail.com on port 25 as SMTP server.

B. 1. Create a Stackdriver Workspace, and associate your Google Cloud Platform (GCP) project
with it. 2. Create an Alerting Policy in Stackdriver that uses the threshold as a trigger condition.
3. Configure your email address in the notification channel.

C. 1. Create a Stackdriver Workspace, and associate your GCP project with it. 2. Write a script
that monitors the CPU usage and sends it as a custom metric to Stackdriver. 3. Create an uptime
check for the instance in Stackdriver.

D. 1. In Stackdriver Logging, create a logs-based metric to extract the CPU usage by using this
regular expression: CPU Usage: ([0-9] {1,3})% 2. In Stackdriver Monitoring, create an Alerting
Policy based on this metric. 3. Configure your email address in the notification channel.

Ans- B

13. Your company has workloads running on Compute Engine and on-premises. The Google
Cloud Virtual Private Cloud (VPC) is connected to your WAN over a Virtual Private Network
(VPN). You need to deploy a new Compute Engine instance and ensure that no public Internet
traffic can be routed to it. What should you do?

A. Create the instance without a public IP address.

B. Create the instance with Private Google Access enabled.

C. Create a deny-all egress firewall rule on the VPC network.

D. Create a route on the VPC to route all traffic to the instance over the VPN tunnel.

Ans -A

14. You have just created a new project which will be used to deploy a globally distributed
application. You will use Cloud Spanner for data storage. You want to create a Cloud Spanner
instance. You want to perform the first step in preparation of creating the instance. What should
you do?

A. Grant yourself the IAM role of Cloud Spanner Admin

B. Create a new VPC network with subnetworks in all desired regions

D. Enable the Cloud Spanner API

Ans-D

15. You manage an App Engine Service that aggregates and visualizes data from BigQuery. The
application is deployed with the default App Engine Service account. The data that needs to be
visualized resides in a different project managed by another team. You do not have access to this
project, but you want your application to be able to read data from the BigQuery dataset. What
should you do?

A. Ask the other team to grant your default App Engine Service account the role of BigQuery Job
User.

B. Ask the other team to grant your default App Engine Service account the role of BigQuery
Data Viewer.

C. In Cloud IAM of your project, ensure that the default App Engine service account has the role
of BigQuery Data Viewer.

D. In Cloud IAM of your project, grant a newly created service account from the other team the
role of BigQuery Job User in your project.

Ans -B

16. You need to manage a third-party application that will run on a Compute Engine instance.
Other Compute Engine instances are already running with default configuration. Application
installation files are hosted on Cloud Storage. You need to access these files from the new
instance without allowing other virtual machines (VMs) to access these files. What should you
do?

A. Create the instance with the default Compute Engine service account Grant the service
account permissions on Cloud Storage.

B. Create the instance with the default Compute Engine service account Add metadata to the
objects on Cloud Storage that matches the metadata on the new instance.

C. Create a new service account and assign this service account to the new instance Grant the
service account permissions on Cloud Storage.

D. Create a new service account and assign this service account to the new instance Add
metadata to the objects on Cloud Storage that matches the metadata on the new instance.

Ans-C

17. You have a website hosted on App Engine standard environment. You want 1% of your users
to see a new test version of the website. You want to minimize complexity. What should you do?

A. Deploy the new version in the same application and use the --migrate option.

B. Deploy the new version in the same application and use the --splits option to give a weight of
99 to the current version and a weight of 1 to the new version.

C. Create a new App Engine application in the same projec

D. Deploy the new version in that application.Use the App Engine library to proxy 1% of the
requests to the new version.

E. Create a new App Engine application in the same projec

F. Deploy the new version in that application.Configure your network load balancer to send 1%
of the traffic to that new application.

Ans-B

18. Your company uses BigQuery for data warehousing. Over time, many different business units
in your company have created 1000+ datasets across hundreds of projects. Your CIO wants you
to examine all datasets to find tables that contain an employee_ssn column. You want to
minimize effort in performing this task. What should you do?

A. Go to Data Catalog and search for employee_ssn in the search box.

B. Write a shell script that uses the bq command line tool to loop through all the projects in your
organization.

C. Write a script that loops through all the projects in your organization and runs a query on
INFORMATION_SCHEMA.COLUMNS view to find the employee_ssn column.

D. Write a Cloud Dataflow job that loops through all the projects in your organization and runs a
query on INFORMATION_SCHEMA.COLUMNS view to find employee_ssn column.

Ans-A

19. Your company runs its Linux workloads on Compute Engine instances. Your company will be
working with a new operations partner that does not use Google Accounts. You need to grant
access to the instances to your operations partner so they can maintain the installed tooling.
What should you do?

A. Enable Cloud IAP for the Compute Engine instances, and add the operations partner as a
Cloud IAP Tunnel User.
B. Tag all the instances with the same network tag

C. Create a firewall rule in the VPC to grant TCP access on port 22 for traffic from the operations
partner to instances with the network tag.

D. Set up Cloud VPN between your Google Cloud VPC and the internal network of the operations
partner.

E. Ask the operations partner to generate SSH key pairs, and add the public keys to the VM
instances.

Ans -E

20. You need to host an application on a Compute Engine instance in a project shared with other
teams. You want to prevent the other teams from accidentally causing downtime on that
application. Which feature should you use?

A. Use a Shielded VM.

B. Use a Preemptible VM.

C. Use a sole-tenant node.

D. Enable deletion protection on the instance.

Ans- D

21.You have a Compute Engine instance hosting an application used between 9 AM and 6 PM on
weekdays. You want to back up this instance daily for disaster recovery purposes. You want to
keep the backups for 30 days. You want the Google-recommended solution with the least
management overhead and the least number of services. What should you do?

A. * 1. Update your instances’ metadata to add the following value: snapshot–schedule: 0 1 * *

B. * 1. In the Cloud Console, go to the Compute Engine Disks page and select your instance’s
disk.* 2. In the Snapshot Schedule section, select Create Schedule and configure the following
parameters:–Schedule frequency: Daily–Start time: 1:00 AM – 2:00 AM–Autodelete snapshots
after 30 days

C. * 1. Create a Cloud Function that creates a snapshot of your instance’s disk.* 2. Create a Cloud
Function that deletes snapshots that are older than 30 day

D. 3.Use Cloud Scheduler to trigger both Cloud Functions daily at 1:00 AM.

E. * 1. Create a bash script in the instance that copies the content of the disk to Cloud Storage.*
2. Create a bash script in the instance that deletes data older than 30 days in the backup Cloud
Storage bucket.* 3. Configure the instance’s crontab to execute these scripts daily at 1:00 AM.

Ans- B

22. You have an instance group that you want to load balance. You want the load balancer to
terminate the client SSL session. The instance group is used to serve a public web application
over HTTPS. You want to follow Google-recommended practices. What should you do?

A. Configure an HTTP(S) load balancer.

B. Configure an internal TCP load balancer.

C. Configure an external SSL proxy load balancer.

D. Configure an external TCP proxy load balancer.

Ans -A

23. You have deployed multiple Linux instances on Compute Engine. You plan on adding more
instances in the coming weeks. You want to be able to access all of these instances through your
SSH client over me Internet without having to configure specific access on the existing and new
instances. You do not want the Compute Engine instances to have a public IP. What should you
do?

A. Configure Cloud Identity-Aware Proxy (or HTTPS resources

B. Configure Cloud Identity-Aware Proxy for SSH and TCP resources.

C. Create an SSH keypair and store the public key as a project-wide SSH Key

D. Create an SSH keypair and store the private key as a project-wide SSH Key

Ans-C

24. You created a Google Cloud Platform project with an App Engine application inside the
project. You initially configured the application to be served from the uscentral region. Now you
want the application to be served from the asia-northeast1 region. What should you do?

A. Change the default region property setting in the existing GCP project to asia-northeast1.

B. Change the region property setting in the existing App Engine application from us-central to
asia-northeast1.

C. Create a second App Engine application in the existing GCP project and specify asia-northeast1
as the region to serve your application.

D. Create a new GCP project and create an App Engine application inside this new project
E. Specify asia-northeast1 as the region to serve your application.

Ans-D, E

25. You are developing a new web application that will be deployed on Google Cloud Platform.
As part of your release cycle, you want to test updates to your application on a small portion of
real user traffic. The majority of the users should still be directed towards a stable version of
your application. What should you do?

A. Deploy me application on App Engine For each update, create a new version of the same
service Configure traffic splitting to send a small percentage of traffic to the new version

B. Deploy the application on App Engine For each update, create a new service Configure traffic
splitting to send a small percentage of traffic to the new service.

C. Deploy the application on Kubernetes Engine For a new release, update the deployment to
use the new version

D. Deploy the application on Kubernetes Engine For a now release, create a new deployment for
the new version Update the service e to use the now deployment.

Ans-A

26. You have one project called proj-sa where you manage all your service accounts. You want to
be able to use a service account from this project to take snapshots of VMs running in another
project called proj-vm. What should you do?

A. Download the private key from the service account, and add it to each VMs custom metadata.

B. Download the private key from the service account, and add the private key to each VM’s SSH
keys.

C. Grant the service account the IAM Role of Compute Storage Admin in the project called proj-
vm.

D. When creating the VMs, set the service account’s API scope for Compute Engine to
read/write.

Ans -C

27. Your finance team wants to view the billing report for your projects. You want to make sure
that the finance team does not get additional permissions to the project. What should you do?

A. Add the group for the finance team to roles/billing user role.

B. Add the group for the finance team to roles/billing admin role.

C. Add the group for the finance team to roles/billing viewer role.
D. Add the group for the finance team to roles/billing project/Manager role.

Ans-C

28. You are managing several Google Cloud Platform (GCP) projects and need access to all logs
for the past 60 days. You want to be able to explore and quickly analyze the log contents. You
want to follow Google- recommended practices to obtain the combined logs for all projects.
What should you do?

A. Navigate to Stackdriver Logging and select resource.labels.project_id="*"

B. Create a Stackdriver Logging Export with a Sink destination to a BigQuery datase

C. Configure the table expiration to 60 days.

D. Create a Stackdriver Logging Export with a Sink destination to Cloud Storage

E. Create a lifecycle rule to delete objects after 60 days.

F. Configure a Cloud Scheduler job to read from Stackdriver and store the logs in BigQuer

G. Configure the table expiration to 60 days

Ans-B,C

29. You have downloaded and installed the gcloud command line interface (CLI) and have
authenticated with your Google Account. Most of your Compute Engine instances in your project
run in the europe-west1-d zone. You want to avoid having to specify this zone with each CLI
command when managing these instances. What should you do?

A. Set the europe-west1-d zone as the default zone using the gcloud config subcommand.

B. In the Settings page for Compute Engine under Default location, set the zone to europe–
west1-d.

C. In the CLI installation directory, create a file called default.conf containing zone=europe–
west1–d.

D. Create a Metadata entry on the Compute Engine page with key compute/zone and value
europe–west1–d.

Ans-A

30. You need to create a copy of a custom Compute Engine virtual machine (VM) to facilitate an
expected increase in application traffic due to a business acquisition. What should you do?
A. Create a Compute Engine snapshot of your base VM

B. Create your images from that snapshot.

C. Create a Compute Engine snapshot of your base VM

D. Create your instances from that snapshot.

E. Create a custom Compute Engine image from a snapshot

F. Create your images from that image.

G. Create a custom Compute Engine image from a snapshot

H. Create your instances from that image

Ans-C,D

31. The sales team has a project named Sales Data Digest that has the ID acme-data-digest You
need to set up similar Google Cloud resources for the marketing team but their resources must
be organized independently of the sales team. What should you do?

A. Grant the Project Editor role to the Marketing learn for acme data digest

B. Create a Project Lien on acme-data digest and then grant the Project Editor role to the
Marketing team

C. Create another protect with the ID acme-marketing-data-digest for the Marketing team and
deploy the resources there

D. Create a new protect named Meeting Data Digest and use the ID acme-data-digest Grant the
Project Editor role to the Marketing team.

Ans-C

32.Your company has an internal application for managing transactional orders. The application
is used exclusively by employees in a single physical location. The application requires strong
consistency, fast queries, and ACID guarantees for multi-table transactional updates. The first
version of the application is implemented inPostgreSQL, and you want to deploy it to the cloud
with minimal code changes. Which database is most appropriate for this application?

A. BigQuery

B. Cloud SQL

C. Cloud Spanner

D. Cloud Datastore
Ans-B

33. You are building an application that will run in your data center. The application will use
Google Cloud Platform (GCP) services like AutoML. You created a service account that has
appropriate access to AutoML. You need to enable authentication to the APIs from your on-
premises environment. What should you do?

A. Use service account credentials in your on-premises application.

B. Use gcloud to create a key file for the service account that has appropriate permissions.

C. Set up direct interconnect between your data center and Google Cloud Platform to enable
authentication for your on-premises applications.

D. Go to the IAM & admin console, grant a user account permissions similar to the service
account permissions, and use this user account for authentication from your data center.

Ans -B