Cloud Engineer Cloud Engineer: Google Associate 2 — Questions and Answers
Question 1: You need to allow only internal VM instances in a VPC to communicate with a Cloud SQL instance without exposing it to the public internet. What should you configure?
- Assign a public IP to the Cloud SQL instance and restrict with firewall rules
- Use Private Service Connect or Private IP for Cloud SQL (Correct answer)
- Enable Cloud SQL Auth Proxy with a public IP
- Configure a VPN tunnel to the Cloud SQL endpoint
Correct answer: Use Private Service Connect or Private IP for Cloud SQL
Private IP (or Private Service Connect) keeps Cloud SQL traffic within the VPC, avoiding public internet exposure.
Question 2: Which GCP storage class is most cost-effective for data accessed less than once a year, such as disaster recovery archives?
- Standard
- Nearline
- Coldline
- Archive (Correct answer)
Correct answer: Archive
Archive storage has the lowest storage cost but highest retrieval cost, making it ideal for data accessed less than once a year.
Question 3: A team wants to enforce that all GCP resources in a project have a specific label 'env=production'. Which tool enforces this at resource creation time?
- Cloud Monitoring alerts
- Organization Policy constraints (Correct answer)
- IAM conditions
- Cloud Asset Inventory
Correct answer: Organization Policy constraints
Organization Policy Service can enforce resource label requirements using constraints like `constraints/compute.restrictCloudSQLInstances` or custom OPA policies.
Question 4: You are deploying a stateless HTTP microservice on GCP that needs to scale from zero and handle unpredictable traffic spikes. Which service is the best fit?
- Google Kubernetes Engine (GKE)
- Compute Engine with managed instance groups
- Cloud Run (Correct answer)
- App Engine Flexible environment
Correct answer: Cloud Run
Cloud Run is fully managed, scales to zero, and handles sudden traffic spikes automatically for stateless containers.
Question 5: A Cloud Storage bucket needs to retain objects for exactly 7 years for compliance and prevent any deletion during that period. What feature should you enable?
- Object Versioning
- Bucket Lock with a Retention Policy (Correct answer)
- Lifecycle management rules
- Uniform bucket-level access
Correct answer: Bucket Lock with a Retention Policy
Bucket Lock enforces a retention policy so objects cannot be deleted or modified before the retention period expires, satisfying compliance requirements.
Question 6: You want to give a Compute Engine instance access to Cloud Storage without storing credentials on the VM. What is the recommended approach?
- Create a service account key and place it on the VM
- Attach a service account to the VM instance (Correct answer)
- Hardcode access keys in the application environment variables
- Use end-user OAuth credentials
Correct answer: Attach a service account to the VM instance
Attaching a service account to the VM lets the instance obtain short-lived credentials automatically via the metadata server, eliminating stored key files.
Question 7: Which Cloud Load Balancing type supports WebSocket connections and can distribute traffic across regions using anycast IP?
- Internal TCP/UDP Load Balancer
- Regional External HTTP(S) Load Balancer
- Global External HTTP(S) Load Balancer (Correct answer)
- Network Load Balancer
Correct answer: Global External HTTP(S) Load Balancer
The Global External HTTP(S) Load Balancer uses anycast IPs, supports WebSockets, and can route traffic to backends in multiple regions.
Cloud Engineer Cloud Engineer: Google Associate 2
You need to allow only internal VM instances in a VPC to communicate with a Cloud SQL instance without exposing it to the public internet.
What should you configure?