Cloud Engineer Cloud Engineer: Essential Google Infrastructure 2 — Questions and Answers
Question 1: Which GCP service provides a fully managed, serverless execution environment for building and connecting cloud services using event-driven functions?
- Cloud Run
- Cloud Functions (Correct answer)
- App Engine
- Cloud Tasks
Correct answer: Cloud Functions
Cloud Functions is GCP's serverless, event-driven compute service that runs code in response to events without managing infrastructure.
Question 2: What is the default behavior of a newly created Google Cloud Storage bucket with respect to public access?
- Public read access is enabled by default
- All objects are publicly accessible unless ACLs are set
- Public access is blocked by default at the project level (Correct answer)
- Buckets inherit the organization's IAM policy only
Correct answer: Public access is blocked by default at the project level
GCP enforces 'Prevent Public Access' by default at the project level, blocking public ACLs and policies unless explicitly overridden.
Question 3: A Cloud Engineer needs to ensure that a Compute Engine VM instance automatically restarts if the underlying host machine fails. Which setting should be enabled?
- Live Migration
- Automatic Restart (Correct answer)
- Preemptible VM
- Sole-Tenant Node
Correct answer: Automatic Restart
Automatic Restart causes GCP to restart a VM automatically if it is terminated due to a non-user-initiated reason such as hardware failure.
Question 4: Which Google Cloud networking feature allows you to extend your on-premises network to GCP using a private, encrypted connection over the public internet?
- Cloud Interconnect
- Cloud VPN (Correct answer)
- Shared VPC
- VPC Peering
Correct answer: Cloud VPN
Cloud VPN establishes an encrypted IPsec tunnel between your on-premises network and GCP over the public internet.
Question 5: In Google Cloud IAM, what is the purpose of a 'condition' within an IAM binding?
- To restrict which APIs a service account can call
- To enforce MFA for sensitive roles
- To grant access only when specified attributes like time or resource tags match (Correct answer)
- To require approval workflows before access is granted
Correct answer: To grant access only when specified attributes like time or resource tags match
IAM conditions allow attribute-based access control, granting permissions only when conditions such as resource name, date, or request origin are satisfied.
Question 6: Which GCP managed service should a Cloud Engineer use to run containerized workloads without managing the underlying Kubernetes cluster control plane?
- Compute Engine with Docker
- Google Kubernetes Engine (GKE) Autopilot (Correct answer)
- Cloud Run
- App Engine Flexible
Correct answer: Google Kubernetes Engine (GKE) Autopilot
GKE Autopilot is a fully managed Kubernetes mode where Google manages the cluster infrastructure including nodes, while you deploy standard Kubernetes workloads.
Question 7: What happens to a Preemptible VM instance when Google needs to reclaim the resources?
- The instance is migrated to another host automatically
- The instance is paused and resumed later
- The instance receives a 30-second warning and is then terminated (Correct answer)
- The instance is converted to a standard VM
Correct answer: The instance receives a 30-second warning and is then terminated
Preemptible VMs receive a preemption notice 30 seconds before GCP terminates them, giving workloads time to checkpoint or clean up.
Cloud Engineer Cloud Engineer: Essential Google Infrastructure 2
Which GCP service provides a fully managed, serverless execution environment for building and connecting cloud services using event-driven functions?