2025 New Associate-Cloud-Engineer Dumps - Real Google Exam Questions
Dependable Associate-Cloud-Engineer Exam Dumps to Become Google Certified
NEW QUESTION # 147
You are working a System Administrator and have been asked to make sure that all images are patched up to date and developers are not allowed to use old images which are not up to date as per PCI compliance. How would you achieve this?
- A. Drop a mail to all the developers regarding which image to use whenever you patch images.
- B. None of the above.
- C. Mark image as deprecated to prevent users from using the old image.
- D. Mark image as obsolete to prevent users from using the old image.
Answer: D
NEW QUESTION # 148
Your learn wants to deploy a specific content management system (CMS) solution lo Google Cloud. You need a quick and easy way to deploy and install the solution. What should you do?
- A. Search for the CMS solution in Google Cloud Marketplace. Use Terraform and the Cloud Marketplace ID to deploy the solution with the appropriate parameters.
- B. Use the installation guide of the CMS provider. Perform the installation through your configuration management system.
- C. Search for the CMS solution in Google Cloud Marketplace. Deploy the solution directly from Cloud Marketplace.
- D. Search for the CMS solution in Google Cloud Marketplace. Use gcloud CLI to deploy the solution.
Answer: C
NEW QUESTION # 149
You deployed an App Engine application using gcloud app deploy, but it did not deploy to the intended project. You want to find out why this happened and where the application deployed. What should you do?
- A. Check the app.yaml file for your application and check project settings.
- B. Go to Deployment Manager and review settings for deployment of applications.
- C. Check the web-application.xml file for your application and check project settings.
- D. Go to Cloud Shell and run gcloud config list to review the Google Cloud configuration used for deployment.
Answer: D
Explanation:
Explanation
C:\GCP\appeng>gcloud config list
[core]
account = [email protected]
disable_usage_reporting = False
project = my-first-demo-xxxx
https://cloud.google.com/endpoints/docs/openapi/troubleshoot-gce-deployment
NEW QUESTION # 150
You created several resources in multiple Google Cloud projects. All projects are linked to different billing accounts. To better estimate future charges, you want to have a single visual representation of all costs incurred. You want to include new cost data as soon as possible. What should you do?
- A. Fill all resources in the Pricing Calculator to get an estimate of the monthly cost.
- B. Use the Reports view in the Cloud Billing Console to view the desired cost information.
- C. Configure Billing Data Export to BigQuery and visualize the data in Data Studio.
- D. Visit the Cost Table page to get a CSV export and visualize it using Data Studio.
Answer: C
NEW QUESTION # 151
You want to select and configure a cost-effective solution for relational data on Google Cloud Platform.You are working with a small set of operational data in one geographic location. You need to support point-in-time recovery. What should you do?
- A. Select Cloud SQL (MySQL). Select the create failover replicas option.
- B. Select Cloud Spanner. Set up your instance as multi-regional.
- C. Select Cloud Spanner. Set up your instance with 2 nodes.
- D. Select Cloud SQL (MySQL). Verify that the enable binary logging option is selected.
Answer: D
NEW QUESTION # 152
A Solutions Architect is designing a photo application on AWS. Every time a user uploads a photo to Amazon S3, the Architect must insert a new item to a DynamoDB table.
Which AWS-managed service is the BEST fit to insert the item?
- A. Lambda@Edge
- B. Amazon API Gateway
- C. AWS Lambda
- D. Amazon EC2 instances
Answer: C
Explanation:
Explanation/Reference:
Reference https://aws.amazon.com/blogs/machine-learning/build-your-own-face-recognition-service-using- amazon-rekognition/
NEW QUESTION # 153
Your customer has implemented a solution that uses Cloud Spanner and notices some read latency-related performance issues on one table. This table is accessed only by their users using a primary key. The table schema is shown below.
You want to resolve the issue. What should you do?
- A. Option B
- B. Option D
- C. Option A
- D. Option C
Answer: D
Explanation:
As mentioned in Schema and data model, you should be careful when choosing a primary key to not accidentally create hotspots in your database. One cause of hotspots is having a column whose value monotonically increases as the first key part, because this results in all inserts occurring at the end of your key space. This pattern is undesirable because Cloud Spanner divides data among servers by key ranges, which means all your inserts will be directed at a single server that will end up doing all the work. https://cloud.
google.com/spanner/docs/schema-design#primary-key-prevent-hotspots
NEW QUESTION # 154
Your company runs its Linux workloads on Compute Engine instances. Your company will be working with a new operations partner that does not use Google Accounts. You need to grant access to the instances to your operations partner so they can maintain the installed tooling.
What should you do?
- A. Set up Cloud VPN between your Google Cloud VPC and the internal network of the operations partner.
- B. Enable Cloud IAP for the Compute Engine instances, and add the operations partner as a Cloud IAP Tunnel User.
- C. Tag all the instances with the same network tag.
Create a firewall rule in the VPC to grant TCP access on port 22 for traffic from the operations partner to instances with the network tag. - D. Ask the operations partner to generate SSH key pairs, and add the public keys to the VM instances.
Answer: C
Explanation:
https://cloud.google.com/vpc/docs/firewalls
NEW QUESTION # 155
Your organization has user identities in Active Directory. Your organization wants to use Active Directory as their source of truth for identities. Your organization wants to have full control over the Google accounts used by employees for all Google services, including your Google Cloud Platform (GCP) organization. What should you do?
- A. Use Google Cloud Directory Sync (GCDS) to synchronize users into Cloud Identity.
- B. Ask each employee to create a Google account using self signup. Require that each employee use their company email address and password.
- C. Use the cloud Identity APIs and write a script to synchronize users to Cloud Identity.
- D. Export users from Active Directory as a CSV and import them to Cloud Identity via the Admin Console.
Answer: A
Explanation:
Reference:
Directory Sync Google Cloud Directory Sync enables administrators to synchronize users, groups and other data from an Active Directory/LDAP service to their Google Cloud domain directory https://tools.google.com/dlpage/dirsync/
NEW QUESTION # 156
You need to add a group of new users to Cloud Identity. Some of the users already have existing Google accounts. You want to follow one of Google's recommended practices and avoid conflicting accounts. What should you do?
- A. Invite the user to transfer their existing account
- B. Tell the user to remove all personal email from the existing account
- C. Tell the user that they must delete their existing account
- D. Invite the user to use an email alias to resolve the conflict
Answer: A
Explanation:
Explanation
https://cloud.google.com/architecture/identity/migrating-consumer-accounts
NEW QUESTION # 157
You have an application that uses Cloud Spanner as a backend database. The application has a very predictable traffic pattern. You want to automatically scale up or down the number of Spanner nodes depending on traffic. What should you do?
- A. Create a Stackdriver alerting policy to send an alert to oncall SRE emails when Cloud Spanner CPU exceeds the threshold. SREs would scale resources up or down accordingly.
- B. Create a Stackdriver alerting policy to send an alert to Google Cloud Support email when Cloud Spanner CPU exceeds your threshold. Google support would scale resources up or down accordingly.
- C. Create a cron job that runs on a scheduled basis to review stackdriver monitoring metrics, and then resize the Spanner instance accordingly.
- D. Create a Stackdriver alerting policy to send an alert to webhook when Cloud Spanner CPU is over or under your threshold. Create a Cloud Function that listens to HTTP and resizes Spanner resources accordingly.
Answer: D
Explanation:
Note: You can scale the number of nodes in your instance based on the Cloud Monitoring metrics on CPU or storage utilization in conjunction with Cloud Functions.
https://cloud.google.com/spanner/docs/instances
NEW QUESTION # 158
You have production and test workloads that you want to deploy on Compute Engine. Production VMs need to be in a different subnet than the test VMs. All the VMs must be able to reach each other over Internal IP without creating additional routes. You need to set up VPC and the 2 subnets. Which configuration meets these requirements?
- A. Create a single custom VPC with 2 subnets. Create each subnet in a different region and with a different CIDR range.
- B. Create 2 custom VPCs, each with a single subnet. Create each subnet in the same region and with the same CIDR range.
- C. Create a single custom VPC with 2 subnets. Create each subnet in the same region and with the same CIDR range.
- D. Create 2 custom VPCs, each with a single subnet. Create each subnet in a different region and with a different CIDR range.
Answer: A
NEW QUESTION # 159
You have successfully created a development environment in a project for an application. This application uses Compute Engine and Cloud SQL. Now, you need to create a production environment for this application.
The security team has forbidden the existence of network routes between these 2 environments, and asks you to follow Google-recommended practices. What should you do?
- A. Create a new production subnet in the existing VPC and a new production Cloud SQL instance in your existing project, and deploy your application using those resources.
- B. Create a new project, enable the Compute Engine and Cloud SQL APIs in that project, and replicate the setup you have created in the development environment.
- C. Create a new project, modify your existing VPC to be a Shared VPC, share that VPC with your new project, and replicate the setup you have in the development environment in that new project, in the Shared VPC.
- D. Ask the security team to grant you the Project Editor role in an existing production project used by another division of your company. Once they grant you that role, replicate the setup you have in the development environment in that project.
Answer: B
Explanation:
Explanation
This aligns with Googles recommended practices. By creating a new project, we achieve complete isolation between development and production environments; as well as isolate this production application from production applications of other departments.
Ref: https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#define-hierarchy
NEW QUESTION # 160
You want to deploy a new containerized application into Google Cloud by using a Kubernetes manifest. You want to have full control over the Kubernetes deployment and at the same time minimize configuring infrastructure. What should you do?
- A. Deploy the application on GKE Standard.
- B. Deploy the application on GKE Autopilot.
- C. Deploy the application on Cloud Run.
- D. Deploy the application on Cloud Functions.
Answer: B
NEW QUESTION # 161
You've created a new "Custom Role" for a specific new job role inside your company. The role consisted of several permissions; some had a status of "Supported" others a status of "Testing." The role has been working for weeks; however, some permissions recently stopped working. What is the most likely cause for this?
- A. One or more permissions with a status of "Testing" have changed.
- B. The custom role has reached its expiration period.
- C. The latest Google applied updates reset all of the custom roles.
- D. Your account has been compromised by hackers.
Answer: A,D
NEW QUESTION # 162
You have one GCP account running in your default region and zone and another account running in a non-default region and zone. You want to start a new Compute Engine instance in these two Google Cloud Platform accounts using the command line interface. What should you do?
- A. Create two configurations using gcloud config configurations create [NAME]. Run gcloud config configurations activate [NAME] to switch between accounts when running the commands to start the Compute Engine instances.
- B. Activate two configurations using gcloud configurations activate [NAME]. Run gcloud configurations list to start the Compute Engine instances.
- C. Create two configurations using gcloud config configurations create [NAME]. Run gcloud configurations list to start the Compute Engine instances.
- D. Activate two configurations using gcloud configurations activate [NAME]. Run gcloud config list to start the Compute Engine instances.
Answer: A
Explanation:
"Run gcloud configurations list to start the Compute Engine instances". How the heck are you expecting to
"start" GCE instances doing "configuration list".
Each gcloud configuration has a 1 to 1 relationship with the region (if a region is defined). Since we have two different regions, we would need to create two separate configurations using gcloud config configurations createRef: https://cloud.google.com/sdk/gcloud/reference/config/configurations/create Secondly, you can activate each configuration independently by running gcloud config configurations activate
[NAME]Ref: https://cloud.google.com/sdk/gcloud/reference/config/configurations/activate Finally, while each configuration is active, you can run the gcloud compute instances start [NAME] command to start the instance in the configurations region.https://cloud.google.com/sdk/gcloud/reference/compute/instances/start
NEW QUESTION # 163
Your auditor wants to view your organization's use of data in Google Cloud. The auditor is most interested in auditing who accessed data in Cloud Storage buckets. You need to help the auditor access the data they need. What should you do?
- A. Assign the appropriate permissions, and then create a Data Studio report on Admin Activity Audit Logs.
- B. Assign the appropriate permissions, and the use Cloud Monitoring to review metrics.
- C. Turn on Data Access Logs for the buckets they want to audit, and then build a query in the log viewer that filters on Cloud Storage.
- D. Use the export logs API to provide the Admin Activity Audit Logs in the format they want.
Answer: D
Explanation:
https://cloud.google.com/storage/docs/audit-logging
NEW QUESTION # 164
Your customer has implemented a solution that uses Cloud Spanner and notices some read latency-related performance issues on one table. This table is accessed only by their users using a primary key. The table schema is shown below.
You want to resolve the issue. What should you do?
- A. Option B
- B. Option D
- C. Option A
- D. Option C
Answer: D
Explanation:
As mentioned in Schema and data model, you should be careful when choosing a primary key to not accidentally create hotspots in your database. One cause of hotspots is having a column whose value monotonically increases as the first key part, because this results in all inserts occurring at the end of your key space. This pattern is undesirable because Cloud Spanner divides data among servers by key ranges, which means all your inserts will be directed at a single server that will end up doing all the work. https://cloud.
google.com/spanner/docs/schema-design#primary-key-prevent-hotspots
NEW QUESTION # 165
You have a workload running on Compute Engine that is critical to your business. You want to ensure that the data on the boot disk of this workload is backed up regularly. You need to be able to restore a backup as quickly as possible in case of disaster. You also want older backups to be cleaned automatically to save on cost. You want to follow Google-recommended practices. What should you do?
- A. Create a cron job to create a new disk from the disk using gcloud.
- B. Create a Cloud Function to create an instance template.
- C. Create a snapshot schedule for the disk using the desired interval.
- D. Create a Cloud Task to create an image and export it to Cloud Storage.
Answer: C
Explanation:
Best practices for persistent disk snapshots
You can create persistent disk snapshots at any time, but you can create snapshots more quickly and with greater reliability if you use the following best practices.
Creating frequent snapshots efficiently
Use snapshots to manage your data efficiently.
Create a snapshot of your data on a regular schedule to minimize data loss due to unexpected failure.
Improve performance by eliminating excessive snapshot downloads and by creating an image and reusing it.
Set your snapshot schedule to off-peak hours to reduce snapshot time.
Snapshot frequency limits
Creating snapshots from persistent disks
You can snapshot your disks at most once every 10 minutes. If you want to issue a burst of requests to snapshot your disks, you can issue at most 6 requests in 60 minutes.
https://cloud.google.com/compute/docs/disks/snapshot-best-practices
NEW QUESTION # 166
You want to add a new auditor to a Google Cloud Platform project. The auditor should be allowed to read, but not modify, all project items.
How should you configure the auditor's permissions?
- A. Create a custom role with view-only service permissions. Add the user's account to the custom role.
- B. Select the built-in IAM service Viewer role. Add the user's account to this role.
- C. Select the built-in IAM project Viewer role. Add the user's account to this role.
- D. Create a custom role with view-only project permissions. Add the user's account to the custom role.
Answer: C
Explanation:
Reference:
The primitive role roles/viewer provides read access to all resources in the project. The permissions in this role are limited to Get and list access for all resources. As we have an out of the box role that exactly fits our requirement, we should use this.
Ref: https://cloud.google.com/resource-manager/docs/access-control-proj It is advisable to use the existing GCP provided roles over creating custom roles with similar permissions as this becomes a maintenance overhead. If GCP modifies how permissions are handled or adds/removes permissions, the default GCP provided roles are automatically updated by Google whereas if they were custom roles, the responsibility is with us and this adds to the operational overhead and needs to be avoided.
NEW QUESTION # 167
You have deployed an application on a Compute Engine instance. An external consultant needs to access the Linux-based instance. The consultant is connected to your corporate network through a VPN connection, but the consultant has no Google account. What should you do?
- A. Instruct the external consultant to generate an SSH key pair, and request the public key from the consultant.Add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key.
- B. Instruct the external consultant to use the gcloud compute ssh command line tool by using the public IP address of the instance to access it.
- C. Instruct the external consultant to generate an SSH key pair, and request the private key from the consultant.Add the private key to the instance yourself, and have the consultant access the instance through SSH with their public key.
- D. Instruct the external consultant to use the gcloud compute ssh command line tool by using Identity- Aware Proxy to access the instance.
Answer: A
Explanation:
The best option is to instruct the external consultant to generate an SSH key pair, and request the public key from the consultant. Then, add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key. This way, you can grant theconsultant access to the instance without requiring a Google account or exposing the instance's public IP address. This option also follows the best practice of using user-managed SSH keys instead of service account keys for SSH access1.
Option A is not feasible because the external consultant does not have a Google account, and therefore cannot use Identity-Aware Proxy (IAP) to access the instance. IAP requires the user to authenticate with a Google account and have the appropriate IAM permissions to access the instance2. Option B is not secure because it exposes the instance's public IP address, which can increase the risk of unauthorized access or attacks. Option D is not correct because it reverses the roles of the public and private keys. The public key should be added to the instance, and the private key should be kept by the consultant. Sharing the private key with anyone else can compromise the security of the SSH connection3.
1: https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys
2: https://cloud.google.com/iap/docs/using-tcp-forwarding
3: https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances
NEW QUESTION # 168
You manage three Google Cloud projects with the Cloud Monitoring API enabled. You want to follow Google-recommended practices to visualize CPU and network metrics for all three projects together. What should you do?
- A. 1. Create a Cloud Monitoring Dashboard
2. Collect metrics and publish them into the Pub/Sub topics 3. Add CPU and network Charts (or each of (he three projects - B. 1. Create a fourth Google Cloud project
2 Create a Cloud Workspace from the fourth project and add the other three projects - C. 1 Create a Service Account and apply roles/viewer on the three projects
2. Collect metrics and publish them lo the Cloud Monitoring API
3. Add CPU and network Charts for each of the three projects. - D. 1. Create a Cloud Monitoring Dashboard.
2. Select the CPU and Network metrics from the three projects.
3. Add CPU and network Charts lot each of the three protects.
Answer: D
NEW QUESTION # 169
......
Get Ready with Associate-Cloud-Engineer Exam Dumps (2025): https://examtests.passcollection.com/Associate-Cloud-Engineer-valid-vce-dumps.html
