100% Free Associate-Cloud-Engineer Exam Dumps to Pass Exam Easily from TrainingDump
Free Associate-Cloud-Engineer Exam Questions Associate-Cloud-Engineer Actual Free Exam Questions
Deploying & Implementing Cloud Solutions
- Deploy and implement Google Kubernetes Engine Resources: this domain includes skills in deploying Google Kubernetes Engine cluster, container application to Google Kubernetes Engine with pods, and configuring Google Kubernetes Engine Application logging and monitoring;
- Deploy solutions with Cloud Marketplace: the candidates must demonstrate the ability to browse the Cloud Marketplace catalog to check solution details; deploy Cloud Marketplace solutions;
- Deploy and implement networking resources: this will measure your ability to launch Compute Engine instances using custom network configuration; create egress and ingress firewall rule or VPC; create VPNs between the external network and Google VPC with Cloud VPN; create the load balancer to allocate the application network traffic for apps;
- Deploy an application infrastructure with Cloud Deployment Manager with a focus on the development and launch of Deployment Manager templates.
- Deploy and implement compute engine resources: the skills required for this area include launching compute instances with Cloud SDK and Cloud Console; creating auto-scaled managed instance groups with instance templates; uploading/generating custom SSH keys for instances; configuring virtual machines or Stackdriver logging and monitoring. It also requires that the students can assess compute quotas and request for increases; install a Stackdriver Agent for logging and monitoring;
- Deploy and implement App Engine, Cloud Functions, and Cloud Run resources: the learners will be required to demonstrate their skills in the deployment of applications, traffic splitting, updating scaling configuration, as well as deployment of applications that accept Google Cloud events;
- Deploy and implement data solutions: the applicants should be able to initialize data systems with Google products and load data;
Configuring Security & Access
- Manage IAM: this domain involves your ability to view IAM role allocations; assign IAM roles to Google Groups or accounts; define custom IAM duties;
- View audit logs or managed services and projects.
- Manage Service Account: the candidates should know how to manage service accounts with restricted privileges; grant access to service accounts within another project; assign service accounts to virtual machine instances;
NEW QUESTION 129
You need a dynamic way of provisioning VMs on Compute Engine. The exact specifications will be in a dedicated configuration file. You want to follow Google's recommended practices. Which method should you use?
- A. Deployment Manager
- B. Unmanaged Instance Group
- C. Managed Instance Group
- D. Cloud Composer
Answer: C
NEW QUESTION 130
Every employee of your company has a Google account. Your operational team needs to manage a large number of instances on Compute Engine. Each member of this team needs only administrative access to the servers. Your security team wants to ensure that the deployment of credentials is operationally efficient and must be able to determine who accessed a given instance. What should you do?
- A. Generate a new SSH key pair. Give the private key to each member of your team. Configure the public key as a project-wide public SSH key in your Cloud Platform project and allow project-wide public SSH keys on each instance.
- B. Ask each member of the team to generate a new SSH key pair and to add the public key to their Google account. Grant the "compute.osAdminLogin" role to the Google group corresponding to this team.
- C. Generate a new SSH key pair. Give the private key to each member of your team. Configure the public key in the metadata of each instance.
- D. Ask each member of the team to generate a new SSH key pair and to send you their public key. Use a configuration management tool to deploy those keys on each instance.
Answer: A
NEW QUESTION 131
You have an application running in Google Kubernetes Engine (GKE) with cluster autoscaling enabled. The application exposes a TCP endpoint. There are several replicas of this application.
You have a Compute Engine instance in the same region, but in another Virtual Private Cloud (VPC), called gce- , that has no overlapping IP ranges with the first VPC. This instance needs to connect to the network application on GKE. You want to minimize effort. What should you do?
- A. 1. In GKE, create a Service of type LoadBalancer that uses the application's Pods as backend.
2. Add a Cloud Armor Security Policy to the load balancer that whitelists the internal IPs of the MIG's instances.
3. Configure the Compute Engine instance to use the address of the load balancer that has been created. - B. 1. In GKE, create a Service of type NodePort that uses the application's Pods as backend.
2. Create a Compute Engine instance called proxy with 2 network interfaces, one in each VPC.
3. Use iptables on this instance to forward traffic from gce-network to the GKE nodes.
4. Configure the Compute Engine instance to use the address of proxy in gce-network as endpoint. - C. 1. In GKE, create a Service of type LoadBalancer that uses the application's Pods as backend.
2. Set the service's externalTrafficPolicy to Cluster.
3. Configure the Compute Engine instance to use the address of the load balancer that has been created. - D. 1. In GKE, create a Service of type LoadBalancer that uses the application's Pods as backend.
2. Add an annotation to this service: cloud.google.com/load-balancer-type: Internal
3. Peer the two VPCs together.
4. Configure the Compute Engine instance to use the address of the load balancer that has been created.
Answer: C
NEW QUESTION 132
Your company publishes large files on an Apache web server that runs on a Compute Engine instance. The Apache web server is not the only application running in the project. You want to receive an email when the egress network costs for the server exceed 100 dollars for the current month as measured by Google Cloud Platform (GCP). What should you do?
- A. Set up a budget alert on the project with an amount of 100 dollars, a threshold of 100%, and notification type of "email."
- B. Use the Stackdriver Logging Agent to export the Apache web server logs to Stackdriver Logging. Create a Cloud Function that uses BigQuery to parse the HTTP response log data in Stackdriver for the current month and sends an email if the size of all HTTP responses, multiplied by current GCP egress prices, totals over 100 dollars. Schedule the Cloud Function using Cloud Scheduler to run hourly.
- C. Set up a budget alert on the billing account with an amount of 100 dollars, a threshold of 100%, and notification type of "email."
- D. Export the billing data to BigQuery. Create a Cloud Function that uses BigQuery to sum the egress network costs of the exported billing data for the Apache web server for the current month and sends an email if it is over 100 dollars. Schedule the Cloud Function using Cloud Scheduler to run hourly.
Answer: A
NEW QUESTION 133
You are building an application that will run in your data center. The application will use Google Cloud Platform (GCP) services like AutoML. You created a service account that has appropriate access to AutoML. You need to enable authentication to the APIs from your on-premises environment. What should you do?
- A. Go to the IAM & admin console, grant a user account permissions similar to the service account permissions, and use this user account for authentication from your data center.
- B. Use service account credentials in your on-premises application.
- C. Set up direct interconnect between your data center and Google Cloud Platform to enable authentication for your on-premises applications.
- D. Use gcloud to create a key file for the service account that has appropriate permissions.
Answer: D
Explanation:
https://cloud.google.com/vision/automl/docs/before-you-begin
NEW QUESTION 134
You're working on creating a script that can extract the IP address of a Kubernetes Service. Your coworker sent you a code snippet that they had saved. Which one is the best starting point for your code?
- A. kubectl get svc -o jsonpath='{.items[*].status.loadBalancer.ingress[0].ip}'
- B. kubectl get svc -o filtered- json='{.items[*].status.loadBalancer.ingress[0].ip}'
- C. kubectl get svc -o html
- D. kubectl get svc
Answer: A
NEW QUESTION 135
You have successfully created a development environment in a project for an application. This application uses Compute Engine and Cloud SQL. Now, you need to create a production environment for this application. The security team has forbidden the existence of network routes between these 2 environments, and asks you to follow Google-recommended practices. What should you do?
- A. Create a new production subnet in the existing VPC and a new production Cloud SQL instance in your existing project, and deploy your application using those resources.
- B. Create a new project, enable the Compute Engine and Cloud SQL APIs in that project, and replicate the setup you have created in the development environment.
- C. Create a new project, modify your existing VPC to be a Shared VPC, share that VPC with your new project, and replicate the setup you have in the development environment in that new project, in the Shared VPC.
- D. Ask the security team to grant you the Project Editor role in an existing production project used by another division of your company. Once they grant you that role, replicate the setup you have in the development environment in that project.
Answer: B
NEW QUESTION 136
You have several users who need access to some very specific Google Cloud functionality. You'd like to follow the principle of least privilege. What's the best way to ensure these users can list Cloud Storage buckets, list BigQuery jobs, and list compute disks?
- A. Add the users to a group, apply the Cloud Storage Bucket Viewer, BigQuery Job User, and Compute User predefined roles.
- B. Use the Cloud Storage Bucket Viewer, BigQuery Job User, and Compute User predefined roles.
- C. Add the users to the viewer role.
- D. Create a custom role for this job role, add the required permissions, and add the users to the role.
Answer: D
NEW QUESTION 137
Your company runs its Linux workloads on Compute Engine instances. Your company will be working with a new operations partner that does not use Google Accounts. You need to grant access to the instances to your operations partner so they can maintain the installed tooling. What should you do?
- A. Ask the operations partner to generate SSH key pairs, and add the public keys to the VM instances.
- B. Tag all the instances with the same network tag. Create a firewall rule in the VPC to grant TCP access on port 22 for traffic from the operations partner to instances with the network tag.
- C. Set up Cloud VPN between your Google Cloud VPC and the internal network of the operations partner.
- D. Enable Cloud IAP for the Compute Engine instances, and add the operations partner as a Cloud IAP Tunnel User.
Answer: B
Explanation:
Explanation/Reference: https://cloud.google.com/vpc/docs/firewalls
NEW QUESTION 138
Your managed instance group raised an alert stating that new instance creation has failed to create new instances. You need to maintain the number of running instances specified by the template to be able to process expected application traffic. What should you do?
- A. Create an instance template that contains valid syntax which will be used by the instance group. Delete any persistent disks with the same name as instance names.
- B. Create an instance template that contains valid syntax that will be used by the instance group. Verify that the instance name and persistent disk name values are not the same in the template.
- C. Delete the current instance template and replace it with a new instance template. Verify that the instance name and persistent disk name values are not the same in the template. Set the disks.autoDelete property to true in the instance template.
- D. Verify that the instance template being used by the instance group contains valid syntax. Delete any persistent disks with the same name as instance names. Set the disks.autoDelete property to true in the instance template.
Answer: D
Explanation:
Reference:
https://cloud.google.com/compute/docs/instance-groups/creating-groups-of-managed-instances
NEW QUESTION 139
You are analyzing Google Cloud Platform service costs from three separate projects. You want to use this information to create service cost estimates by service type, daily and monthly, for the next six months using standard query syntax. What should you do?
- A. Export your bill to a Cloud Storage bucket and then import into Cloud Bigtable for analysis.
- B. Export your transactions to a local file and perform analysis with a desktop tool.
- C. Export your bill to a BigQuery dataset, and then write time window-based SQL queries for analysis.
- D. Export your bill to a Cloud Storage bucket, and then import into Google Sheets for analysis.
Answer: C
NEW QUESTION 140
You've uploaded some PDFs to a public bucket. When users browse to the documents, they're downloaded rather than viewed in the browser. How can we ensure that the PDFs are viewed in the browser?
- A. Set the Content-Type metadata for the object to "application/pdf".
- B. Set the Content metadata for the object to "application/pdf".
- C. Use the gsutil set file-type pdfcommand.
- D. This is a browser setting and not something that can be changed.
Answer: A
NEW QUESTION 141
You have a Dockerfile that you need to deploy on Kubernetes Engine. What should you do?
- A. Use gcloud app deploy <dockerfilename>.
- B. Use kubectl app deploy <dockerfilename>.
- C. Create a docker image from the Dockerfile and upload it to Cloud Storage.
Create a Deployment YAML file to point to that image.
Use kubectl to create the deployment with that file. - D. Create a docker image from the Dockerfile and upload it to Container Registry.
Create a Deployment YAML file to point to that image.
Use kubectl to create the deployment with that file.
Answer: D
Explanation:
https://cloud.google.com/kubernetes-engine/docs/tutorials/hello-app
NEW QUESTION 142
You are asked to set up application performance monitoring on Google Cloud projects A, B, and C as a single pane of glass. You want to monitor CPU, memory, and disk. What should you do?
- A. Enable API, create a workspace under project A, and then add project B and C.
- B. Enable API and then share charts from project A, B, and C.
- C. Enable API and then give the metrics.reader role to projects A, B, and C.
- D. Enable API and then use default dashboards to view all projects in sequence.
Answer: A
NEW QUESTION 143
You are running an application on multiple virtual machines within a managed instance group and have autoscaling enabled. The autoscaling policy is configured so that additional instances are added to the group if the CPU utilization of instances goes above 80%. VMs are added until the instance group reaches its maximum limit of five VMs or until CPU utilization of instances lowers to 80%. The initial delay for HTTP health checks against the instances is set to 30 seconds. The virtual machine instances take around three minutes to become available for users. You observe that when the instance group autoscales, it adds more instances then necessary to support the levels of end-user traffic. You want to properly maintain instance group sizes when autoscaling. What should you do?
- A. Set the maximum number of instances to 1.
- B. Use a TCP health check instead of an HTTP health check.
- C. Increase the initial delay of the HTTP health check to 200 seconds.
- D. Decrease the maximum number of instances to 3.
Answer: C
NEW QUESTION 144
A Solutions Architect is reviewing an application that writes data to an Amazon DynamoDB table on a daily basis. Random table reads occur many times per second.
The company needs to allow thousands of low-latency reads and avoid any negative impact to the rest of the application.
What should the Solutions Architect do to meet the company's goals?
- A. Increase DynamoDB write capacity units.
- B. Use DynamoDB Accelerator to cache reads.
- C. Add Amazon SQS to decouple requests.
- D. Implement Amazon Kinesis to decouple requests.
Answer: A
Explanation:
Explanation
Explanation/Reference: https://aws.amazon.com/blogs/database/amazon-dynamodb-auto-scaling-performance-and-cost- optimization-at-any-scale/
NEW QUESTION 145
A company has an application that generates invoices and makes the invoices available online. Invoices are stored as PDFs in an Amazon S3 bucket. Customers typically only view each invoice during the month it is issued. However, past invoices need to be immediately available. There are concerns over rising storage costs as the company gains more customers.
What is the MOST cost-effective method to store the data?
- A. Use Amazon S3 for current invoices. Set up lifecycle rules to migrate invoices to the GLACIER storage class after 30 days.
- B. Use Amazon S3 for current invoices. Set up lifecycle rules to migrate invoices to Amazon S3 Standard- Infrequent Access (S3 Standard-IA) after 30 days.
- C. Store the invoices as text files. Use Amazon CloudFront to convert the invoices from text to PDF when customers download invoices.
- D. Store the invoices as binaries in an Amazon RDS database instance. Retrieve them from the database when customers request invoices.
Answer: B
NEW QUESTION 146
You want to create a new role for your colleagues that will apply to all current and future projects created in your organization. The role should have the permissions of the BigQuery Job User and Cloud Bigtable User roles. You want to follow Google's recommended practices. How should you create the new role?
- A. For your organization, in the Google Cloud Platform Console under Roles, select both roles and combine them into a new custom role.
- B. Use "gcloud iam combine-roles --global" to combine the 2 roles into a new custom role.
- C. For all projects, in the Google Cloud Platform Console under Roles, select both roles and combine them into a new custom role.
- D. For one of your projects, in the Google Cloud Platform Console under Roles, select both roles and combine them into a new custom role. Use "gcloud iam promote-role" to promote the role from a project role to an organization role.
Answer: A
Explanation:
A is not correct because this does not create a new role.
B is not correct because gcloud cannot promote a role to org level.
C is not correct because it's recommended to define the role on the organization level. Also, the role will not be applied on new projects.
D is correct because this creates a new role with the combined permissions on the organization level.
NEW QUESTION 147
You want to select and configure a solution for storing and archiving data on Google Cloud Platform. You need to support compliance objectives for data from one geographic location. This data is archived after 30 days and needs to be accessed annually. What should you do?
- A. Select Multi-Regional Storage. Add a bucket lifecycle rule that archives data after 30 days to Nearline Storage.
- B. Select Regional Storage. Add a bucket lifecycle rule that archives data after 30 days to Coldline Storage.
- C. Select Multi-Regional Storage. Add a bucket lifecycle rule that archives data after 30 days to Coldline Storage.
- D. Select Regional Storage. Add a bucket lifecycle rule that archives data after 30 days to Nearline Storage.
Answer: B
Explanation:
Google Cloud Coldline is a new cold-tier storage for archival data with access frequency of less than once per year. Unlike other cold storage options, Nearline has no delays prior to data access, so now it is the leading solution among competitors.
NEW QUESTION 148
You are hosting an application on bare-metal servers in your own data center. The application needs access to Cloud Storage. However, security policies prevent the servers hosting the application from having public IP addresses or access to the internet. You want to follow Google-recommended practices to provide the application with access to Cloud Storage. What should you do?
- A. 1. Using Cloud VPN or Interconnect, create a tunnel to a VPC in GCP.
2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel.
3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com. - B. 1. Using Cloud VPN, create a VPN tunnel to a Virtual Private Cloud (VPC) in Google Cloud Platform (GCP).
2. In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance.
3. Configure your servers to use that instance as a proxy to access Cloud Storage. - C. 1. Use Migrate for Compute Engine (formerly known as Velostrata) to migrate those servers to Compute Engine.
2. Create an internal load balancer (ILB) that uses storage.googleapis.com as backend.
3. Configure your new instances to use this ILB as proxy. - D. 1. Use nslookupto get the IP address for storage.googleapis.com.
2. Negotiate with the security team to be able to give a public IP address to the servers.
3. Only allow egress traffic from those servers to the IP addresses for storage.googleapis.com.
Answer: C
NEW QUESTION 149
......
Latest 100% Passing Guarantee - Brilliant Associate-Cloud-Engineer Exam Questions PDF: https://www.trainingdump.com/Google/Associate-Cloud-Engineer-practice-exam-dumps.html
Verified Associate-Cloud-Engineer dumps and 245 unique questions: https://drive.google.com/open?id=14LZftBeLb_lDxuqfv9LHClpQovvfpizG