Topic 1 Flashcards

Question

Question #: 181 Topic #: 1 You have a Compute Engine managed instance group that adds and removes Compute Engine instances from the group in response to the load on your application. The instances have a shutdown script that removes REDIS database entries associated with the instance. You see that many database entries have not been removed, and you suspect that the shutdown script is the problem. You need to ensure that the commands in the shutdown script are run reliably every time an instance is shut down. You create a Cloud Function to remove the database entries. What should you do next? A. Modify the shutdown script to wait for 30 seconds before triggering the Cloud Function. B. Do not use the Cloud Function. Modify the shutdown script to restart if it has not completed in 30 seconds. C. Set up a Cloud Monitoring sink that triggers the Cloud Function after an instance removal log message arrives in Cloud Logging. D. Modify the shutdown script to wait for 30 seconds and then publish a message to a Pub/Sub queue. ## Footnote https://www.examtopics.com/discussions/google/view/80034-exam-professional-cloud-architect-topic-1-question-181/

Answer 1

C. Set up a Cloud Monitoring sink that triggers the Cloud Function after an instance removal log message arrives in Cloud Logging ## Footnote Actually C is correct but Wrong also in a way : You cannot trigger a Cloud Function directly from a Cloud Monitoring sink. Instead, you can set up a Cloud Monitoring alert that sends notifications to a Pub/Sub topic, and then trigger the Cloud Function from that Pub/Sub topic. In this scenario, you want to ensure that the commands in the shutdown script are run reliably every time an instance is shut down. One way to do this is by setting up a Cloud Monitoring sink that triggers a Cloud Function after an instance removal log message arrives in Cloud Logging. This will allow you to use the Cloud Function to perform the necessary tasks (such as removing database entries) when an instance is shut down, and it will ensure that these tasks are performed reliably and consistently. Option A: Modifying the shutdown script to wait for 30 seconds before triggering the Cloud Function is not a reliable solution, as it relies on the shutdown script being able to run for at least 30 seconds before the instance is shut down.

Answer 2

C. Use public key infrastructure (PKI) to encrypt the message client side using the originating user's private key.

Answer 3

Digitally sign all of your JAR files and redeploy your application ## Footnote 1. JAR signing and integrity: Digitally signing your JAR files ensures their authenticity and integrity. It adds a digital signature that verifies the origin and confirms that the file hasn't been tampered with. This is crucial for security and prevents issues like the SHA1 digest error you're encountering. 2. App Engine requirement: Google App Engine enforces JAR signing for security reasons. All deployed applications must have properly signed JAR files.

Answer 4

C. Binary logging D. Automated backups ## Footnote Ans) C and D Cloud SQL. If you use Cloud SQL, the fully managed Google Cloud MySQL database, you should enable automated backups and binary logging for your Cloud SQL instances. This allows you to perform a point-in-time recovery, which restores your database from a backup and recovers it to a fresh Cloud SQL instance Binary Logging: Binary logging in MySQL records changes to the database. It can be used for backup and replication, and it's essential for point-in-time recovery. With binary logging, you can roll your database forward to any point in time, minimizing data loss. Automated Backups: Automated backups periodically take a snapshot of your database. In the event of a catastrophic failure, you can restore your database to the state it was in at the time of the last backup. This can also help minimize data loss. While read replicas and semisynchronous replication can enhance availability and performance, they do not directly minimize data loss. Also, you cannot create a read replica without enabling Automated backups and Enable binary logging Sharding can improve performance but it's not directly aimed at data loss prevention. https://cloud.google.com/sql/docs/mysql/backup-recovery/backups Prerequisites for creating a read replica Before you can create a read replica of a primary Cloud SQL instance, the instance must meet the following requirements: Automated backups must be enabled. Binary logging must be enabled which requires point-in-time recovery to be enabled. Learn more about the impact of these logs. At least one backup must have been created after binary logging was enabled. https://cloud.google.com/sql/docs/mysql/replication#requirements Before being able to create a read replica, you have to make sure "binary logging and automated backup" are enabled. So picking only D or C without the other one makes no sense. https://cloud.google.com/sql/docs/mysql/replication/create-replica

Answer 5

C. Meet with the cloud operations team and the engineer to discuss load balancer options ## Footnote https://cloud.google.com/load-balancing/docs/https#websocket_support Session affinity for WebSockets works the same as for any other request. For information, see Session affinity. Beside the reasons mentioned above regarding why A, B and D are wrong, there are also: A and D are wrong because are abot changing the app - whereas in the task "You want to help him ensure his application will run properly on GCP" (not REDESIGN/CHANGE). B is wrong because you don't have to "Review the encryption requirements for websocket connections with the security team"...

Answer 6

B. Cloud Pub/Sub to Cloud Dataflow ## Footnote Pub/Sub doesn't provide guarantees about the order of message delivery. Strict message ordering can be achieved with buffering, often using Dataflow."

Answer 7

C. Create a Cloud Filestore instance and mount it in each instance. ## Footnote The requirement is explicitly POSIX filesystem - using gcsfuse Cloud Storage still remains an object storage - IMHO gcsfuse brings a lot of downsizes compared with Filestore and in the question there are no indications that a non-POSIX filesystem shall be used. https://cloud.google.com/storage/docs/gcs-fuse#differences-and-limitations While Cloud Storage FUSE has a file system interface, it is not like an NFS or CIFS file system on the backend. Additionally, Cloud Storage FUSE is not POSIX compliant. For a POSIX file system product in Google Cloud, see Filestore. When using Cloud Storage FUSE, be aware of its limitations and semantics, which are different than that of POSIX file systems. Cloud Storage FUSE should only be used within its capabilities.

Answer 8

A. Navigate the predefined dashboards in the Cloud Monitoring workspace, and then add metrics and create alert policies. ## Footnote Yeah, creating a new dashboard for each incident doesn't seem like the quickest option. A is correct. Option D is highly inefficient and time-consuming. Creating individual dashboards for every incident is impractical and slows down the triage process. quickly would mean custom, and you can call it what you want. D

Answer 9

C. Set up a Cloud VPN gateway in each Shared VPC and peer Cloud VPNs. ## Footnote VPC peering cannot be established between VPCs if there is IP range overlap. C is ok since you can establish VPN across these VPCs and only include the applications required IP ranges as its mentioned that they do not overlap

Answer 10

D. Save the files in multiple Multi-Regional Cloud Storage buckets, one bucket per multi-region. ## Footnote There are 3 multi-regions: ASIA, EU and US. In order to be global, there must be multi-region buckets in this 3 locations.

Answer 11

C. GKE and GCP provide the tools you need to build a PCI DSS-compliant environment. D. All Google Cloud services are usable because Google Cloud Platform is certified PCI-compliant. ## Footnote https://cloud.google.com/security/compliance/pci-dss

Answer 12

A. App Engine ## Footnote arsav Highly Voted 3 years, 5 months ago Answer should be A as only with App Engine we have a default service account which allows the user to deploy the changes per project. for GKE we may have to configure additional permission for both DEV and Operations team to deploy the changes. https://cloud.google.com/appengine/docs/standard/php/service-account

Answer 13

D. Use Jenkins to monitor tags in the repository. Deploy staging tags to a staging environment for testing. After testing, tag the repository for production and deploy that to the production environment.

Answer 14

D. Set an Organization Policy with a constraint on constraints/compute.vmExternalIpAccess. List the approved instances in the allowedValues list. ## Footnote https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address#disableexternalip you might want to restrict external IP address so that only specific VM instances can use them. This option can help to prevent data exfiltration or maintain network isolation. Using an Organization Policy, you can restrict external IP addresses to specific VM instances with constraints to control use of external IP addresses for your VM instances within an organization or a project.

Answer 15

D. 1. Create an image of the on-premises virtual machines. 2. Import the image as a virtual disk on Compute Engine using --os=windows-2022-dc-v. 3. Create a sole-tenancy instance on Compute Engine that uses the imported disk as a boot disk. ## Footnote Well, yes, you actually need a sole-tenant instance to install a windows server with your licence. A lot of links were pasted here, but after reading a lot of them, I reached this one who explicitly states: 'To create a VM instance that uses the custom BYOL image, you must provision the VM instance on a sole-tenant node.' https://cloud.google.com/compute/docs/images/creating-custom-windows-byol-images#use_the_custom_image

Answer 16

B. Create a Debian-based Compute Engine instance, install and configure the application, and use OS patch management to install available updates.

Answer 17

B. Memcache backed by Cloud Datastore for the customer session state data. Lifecycle-managed Cloud Storage for log archives, thumbnails, and VM boot/data volumes. ## Footnote WHY NOT OTHERS. A: is wrong Local SSD in non-persistent therefore cannot be used for session state (as questions also need to save data for users who are offline for several days). C: Again Local SSD cannot be used for boot volume (because its Non-persistent again) and always used for temporary data storage. D: Same reason as C. WHY B? Left with B that's why, but the question is how to store Boot/Data volume on Cloud Storage? - Storing other type of data is easy but most comments were about boot volume. - Boot volume can be stored to Cloud Storage by creating an Custom Image. https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#selecting_image_storage_location

Answer 18

D. Add tags to each tier and set up firewall rules to allow the desired traffic flow ## Footnote refer to target filtering. https://cloud.google.com/solutions/best-practices-vpc-design

Answer 19

A. Load logs into Google BigQuery E. Upload log files into Google Cloud Storage ## Footnote A. Load logs into Google BigQuery: BigQuery is Google Cloud's serverless, highly scalable, and cost-effective multicloud data warehouse designed for data analytics. It's ideal for storing and analyzing large volumes of log data (100 TB in this case). You can use BigQuery's powerful SQL capabilities to run queries, generate reports, and gain insights from your logs. E. Upload log files into Google Cloud Storage: Cloud Storage provides durable, scalable, and secure object storage. It's perfect for storing your log data as a long-term disaster recovery backup. Cloud Storage offers different storage classes to optimize costs based on your data access frequency and retention needs.

Answer 20

A. Use Stackdriver Logging to search for the module log entries C. Use gcloud or Cloud Console to connect to the serial console and observe the logs E. Adjust the Google Stackdriver timeline to match the failure time, and observe the batch server metrics ## Footnote A. Use Stackdriver Logging to search for the module log entries = Check logs C. Use gcloud or Cloud Console to connect to the serial console and observe the logs = Check grub messages, remember new kernel module was installed. E. Adjust the Google Stackdriver timeline to match the failure time, and observe the batch server metrics = Zoom into the time window when problem happened.

Answer 21

B. Lease a Transfer Appliance, upload archived files to it, and send it to Google to transfer archived data to Cloud Storage. Establish a connection with Google using a Dedicated Interconnect or Direct Peering connection and use it to upload files daily. ## Footnote Dedicated Interconnect will be a new connection and will not run over the existing internet connection. With dedicated interconnect the existing ISP becomes irrelevant. If you were trying to use VPN the existing internet connection would be relevant

Answer 22

D. Store the data in a Cloud Storage bucket. Design the processing pipelines to retrieve the data from the bucket. ## Footnote The data needs to be stored as it is retrieved. This would mean that any processing should be done after it is stored. store RAW unstructured data as-is in Cloud Storage, and then define how to process it. Classical Data Lake ELT (Extract -> Load -> Transform ) https://cloud.google.com/architecture/big-data-analytics/analytics-lakehouse

Answer 23

C. Schedule a disaster simulation exercise during which you can shut off all VMs in a zone to see how your application behaves. ## Footnote https://cloud.google.com/solutions/scalable-and-resilient-apps C: A well-designed application should scale seamlessly as demand increases and decreases, and be resilient enough to withstand the loss of one or more compute resources. Resilience: designed to withstand the unexpected A highly-available, or resilient, application is one that continues to function despite expected or unexpected failures of components in the system. If a single instance fails or an entire zone experiences a problem, a resilient application remains fault tolerant—continuing to function and repairing itself automatically if necessary. Because stateful information isn’t stored on any single instance, the loss of an instance—or even an entire zone—should not impact the application’s performance. D. is not correct as this tests the resilience of the database (Cloud SQL) but not necessarily the authentication layer. The authentication layer might have separate components or dependencies that need to be tested under failure conditions.

Answer 24

B. Implement retry logic using a truncated exponential backoff strategy. ## Footnote You should use exponential backoff to retry your requests when receiving errors with 5xx or 429 response codes from Cloud Storage. https://cloud.google.com/storage/docs/request-rate HTTP 408, 429, and 5xx response codes. Exponential backoff algorithm For requests that meet both the response and idempotency criteria, you should generally use truncated exponential backoff. Truncated exponential backoff is a standard error handling strategy for network applications in which a client periodically retries a failed request with increasing delays between requests. An exponential backoff algorithm retries requests exponentially, increasing the waiting time between retries up to a maximum backoff time. See the following workflow example to learn how exponential backoff works: You make a request to Cloud Storage. If the request fails, wait 1 + random_number_milliseconds seconds and retry the request. If the request fails, wait 2 + random_number_milliseconds seconds and retry the request. If the request fails, wait 4 + random_number_milliseconds seconds and retry the request. And so on, up to a maximum_backoff time. Continue waiting and retrying up to a maximum amount of time (deadline), but do not increase the maximum_backoff wait period between retries

Answer 25

B. Create a separate Google Cloud project to use for the load-testing environment D. Ensure all third-party systems your services use is capable of handling high load F. Instrument the load-testing tool and the target services with detailed logging and metrics collection ## Footnote Selected Answer: BDF A: No. Not needed since it's a managed GCP product. It'll scale to satisfy demand. B: Yes. You could leave it in the same project as the app, but it'll eventually be deployed to production and be a risk if anyone accidentally runs it against prod. C: No. You musn't run load testing against prod. D: Yes. The capability of the third party systems should be tested. They are another link in the chain and if they are not up to the task, they may be replaced. E: No. There is no need to use real data in the requests, this is a load test, not a behavior one. F: Yes. Having detailed logs and metrics helps diagnosing problems during the tests. Selected Answer: ABF after reading link: https://cloud.google.com/bigtable/docs/performance A:Run your typical workloads against Bigtable :Always run your own typical workloads against a Bigtable cluster when doing capacity planning, so you can figure out the best resource allocation for your applications. B. Create a separate Google Cloud project to use for the load-testing environment F : The most important/standard factor of testing, you gather logs and metrics in TEST environment for further scaling.

Answer 26

B. Use source code security analyzers as part of the CI/CD pipeline E. Run a vulnerability security scanner as part of your continuous-integration /continuous-delivery (CI/CD) pipeline D. Enable code signing and a trusted binary repository integrated with your CI/CD pipeline E. Run a vulnerability security scanner as part of your continuous-integration /continuous-delivery (CI/CD) pipeline ## Footnote Selected Answer: BE B. Source Code Security Analyzers: Integrating source code security analyzers into the CI/CD pipeline helps identify vulnerabilities in the codebase early in the development cycle. This ensures that security errors are caught and addressed before they make it into production. E. Vulnerability Security Scanner: Running a vulnerability scanner as part of the CI/CD pipeline identifies weaknesses in dependencies, configurations, and deployed artifacts. This provides an additional layer of security by detecting risks that might not be evident in the source code alone. Answer - D & E Speed will nit get hampered if the images are verified and attested. Checks need to be there. If you argument would be true than why to introduce VA scanner , as that will also induce delay in deployment. when we select E , it might auto include B . Some VA scanning tools also do SAST. So why choose B and E in that case. D makes more sense with E . Authorised repo will add an additional layer of security with verified images and artifacts in it.

Answer 27

C. Cloud Deployment Manager is unfamiliar to the company's engineers F. Cloud Deployment Manager only supports automation of Google Cloud resources

Answer 28

C. 1. Set up Cloud VPN to provide private network connectivity between the Compute Engine application and the on-premises MySQL server. 2. Stop the on-premises application. 3. Start the Compute Engine application, configured to read and write to the on-premises MySQL server. 4. Create the replication configuration in Cloud SQL. 5. Configure the source database server to accept connections from the Cloud SQL replica. 6. Finalize the Cloud SQL replica configuration. 7. When replication has been completed, stop the Compute Engine application. 8. Promote the Cloud SQL replica to a standalone instance. 9. Restart the Compute Engine application, configured to read and write to the Cloud SQL standalone instance. ## Footnote External replica promotion migration In the migration strategy of external replica promotion, you create an external database replica and synchronize the existing data to that replica. This can happen with minimal downtime to the existing database. When you have a replica database, the two databases have different roles that are referred to in this document as primary and replica. After the data is synchronized, you promote the replica to be the primary in order to move the management layer with minimal impact to database uptime. In Cloud SQL, an easy way to accomplish the external replica promotion is to use the automated migration workflow. This process automates many of the steps that are needed for this type of migration.

Answer 29

A. Customize the cache keys to omit the protocol from the key. ## Footnote https://cloud.google.com/cdn/docs/caching#cache-keys Cache Keys and Protocols: Cloud CDN uses cache keys to identify and store content in its cache. By default, the protocol (HTTP or HTTPS) is included in the cache key. This means that the same content served over HTTP and HTTPS will be cached separately, reducing the cache hit ratio. Omitting the Protocol: Customizing the cache keys to omit the protocol allows Cloud CDN to treat HTTP and HTTPS requests for the same content as identical. This increases the chance of a cache hit, as the CDN can serve the cached content regardless of the protocol used in the request. Improved Cache Hit Ratio: By consolidating the cache entries for HTTP and HTTPS versions of the content, you effectively increase the cache hit ratio. This leads to better performance, reduced latency, and lower costs.

Answer 30

B. Review the Stackdriver logs for the specific GKE container that is serving the unresponsive part of the application. ## Footnote Stackdriver Logging seems to be enabled by default for GKE. Looking here: https://cloud.google.com/monitoring/kubernetes-engine/legacy-stackdriver/logging For container and system logs, GKE deploys a per-node logging agent that reads container logs, adds helpful metadata, and then stores them. The logging agent checks for container logs in the following sources: Standard output and standard error logs from containerized processes

Answer 31

B. Create a Google Group per department and add all department members to their respective groups. Create a folder per department and grant the respective group the required IAM permissions at the folder level. Add the projects under the respective folders. ## Footnote https://cloud.google.com/resource-manager/docs/access-control-folders#best-practices-folders-iam Use groups whenever possible to manage principals. https://cloud.google.com/resource-manager/docs/creating-managing-folders A folder can contain projects, other folders, or a combination of both. Organizations can use folders to group projects under the organization node in a hierarchy. For example, your organization might contain multiple departments, each with its own set of Google Cloud resources. Folders allow you to group these resources on a per-department basis.

Answer 32

A. Configure an organization policy to restrict identities by domain. ## Footnote https://cloud.google.com/resource-manager/docs/organization-policy/restricting-domains Domain restricted sharing lets you limit resource sharing based on a domain or organization resource. When domain restricted sharing is active, only principals that belong to allowed domains or organizations can be granted IAM roles in your Google Cloud organization.

Answer 33

C. In the GCP Console, navigate to Stackdriver Logging. Consult logs for (GKE) and Cloud SQL. ## Footnote jcmoranp Highly Voted 4 years, 2 months ago post mortem always includes log analysis,

Answer 34

B. Cloud Run and Cloud Bigtable ## Footnote Any correct answer must involve Cloud Bigtable over BigQuery since Bigtable is optimized for heavy write loads. That leaves B and D. I would suggest B b/c it is lower cost ("The business wants to keep costs low") Additionally data need to store now so use Bigtable as question is not for analysing or data Analytics etc occasionally there will be no requests. so Cloud Run will scale to zero we are talking about a predefined set of queries. For any predefined list of (simple) queries, we use Bigtable, and for any (complex) queries that we do not know ahead of time, we use BigQuery. At first I thought Cloud Run could not handle this request rate and then chose D. After a little bit of research on the docs I changed my mind to B. On each instance concurrency, it clearly says > By default each Cloud Run instance can receive up to 80 requests at the same time; you can increase this to a maximum of 1000 https://cloud.google.com/run/docs/about-concurrency The maximum number of auto-scaling instances by default is 100, which can be configured depending on the regional quota. With the default max instances it can already handle 100 * 1000 = 100,000 requests concurrently, which should be able to achieve the 50,000 rps requirement. https://cloud.google.com/run/docs/about-instance-autoscaling

Answer 35

C. De-identify the data with the Cloud Data Loss Prevention API ## Footnote https://cloud.google.com/dlp The recommended approach for sanitizing data of personally identifiable information or payment card information before storing it in Cloud Bigtable is option C: De-identify the data with the Cloud Data Loss Prevention API. The Cloud Data Loss Prevention (DLP) API is a powerful tool that allows you to automatically discover, classify, and redact sensitive data in your organization. It uses advanced machine learning techniques to accurately identify and protect a wide range of sensitive data types, including personal information such as names, addresses, phone numbers, and payment card information. Using the DLP API to de-identify your data before storing it in Cloud Bigtable is the most effective way to ensure that sensitive information is protected and not accessible to unauthorized users.

Answer 36

A. Create a Dataflow pipeline to retrieve the data from the external sources. As part of the pipeline, use the Cloud Data Loss Prevention (Cloud DLP) API to remove any PII data. Store the result in BigQuery. ## Footnote Option C seems to be an option, but there are two non-conformities there. In addition to storing personal data in the GCS, it is being improperly retained. C -- is wrong because PII data is uploaded and the bucket is locked which means the data cannot be deleted B and D are wron as they do not use Data loss prevention to protect data

Answer 37

B. Enable Firewall Rules Logging for the firewall rules you want to monitor. ## Footnote when you create a firewall rule there is an option for firewall rule logging on/off. It is set to off by default. To get firewall insights or view the logs for a specific firewall rule you need to enable logging while creating the rule or you can enable it by editing that rule. https://cloud.google.com/network-intelligence-center/docs/firewall-insights/how-to/using-firewall-insights#enabling-fw-rules-logging

Answer 38

C. Configure a HorizontalPodAutoscaler for all stateless workloads and for all compatible stateful workloads. Configure the cluster to use node auto scaling. ## Footnote A: Is not necessary because you can have multiple node pools with different configurations. B: Optimizes resource usage of CPU/memory in your existing node pool but does not necessarily improve cost - still an option that should be considered. C: This looks really good. Autoscaling workloads and the node pools makes your whole infrastructure more elastic and gives you the option to rely on the same node pool. D: This might not be a good option for every type of workload. Batch and stateless workloads can often handle this quite well, but stateful workloads are not well-suited for operation on preemptible VMs.

Answer 39

C. Create a shutdown script and use it as the value for a new metadata entry with the key shutdown-script in the Cloud Platform Console when you create the new virtual machine instance ## Footnote https://cloud.google.com/compute/docs/shutdownscript

Answer 40

B. Have users upload the images to Cloud Storage using a signed URL that expires after 24 hours. ## Footnote "When should you use a signed URL? In some scenarios, you might not want to require your users to have a Google account in order to access Cloud Storage" "Signed URLs contain authentication information in their query string, allowing users without credentials to perform specific actions on a resource" https://cloud.google.com/storage/docs/access-control/signed-urls

Answer 41

A. Use Google Cloud Shell in the Google Cloud Console to interact with Google Cloud. ## Footnote C / D are totally not it. Since they will do so much work and it says "do not want to manage gcoud CLI manually" Then B is not a good cost option, besides at the end you are managing your gcloud cli manually. So A is the only left correct answer.

Answer 42

A. App Engine

Answer 43

A. Set the memcache service level to dedicated. Create a key from the hash of the query, and return database values from memcache before issuing a query to Cloud SQL ## Footnote hiteshrup Highly Voted 3 years ago A dedicated memset is always better than shared until cost-effectiveness specify in the exam as objective. So Option C and D are ruled out. From A and B, Option B is sending and updating query every minutes which is over killing. So reasonable option left with A which balance performance and cost. https://cloud.google.com/appengine/docs/standard/php/memcache/using

Answer 44

B. Object Versioning

Answer 45

B. Use the Data Transfer appliance to perform an offline migration.

Answer 46

D. Implement routinely scheduled failovers of your databases M ## Footnote In order to avoid a similar situation in the future where a replica is never promoted to a master during a high traffic portion of the day, the best option is to implement routinely scheduled failovers of your databases. Option A, using a different database, may not solve the issue as other databases may have similar issues with replica promotion during high traffic periods. Option B, choosing larger instances for your database, may improve performance but will not necessarily prevent a replica from being promoted to a master. Option C, creating snapshots of your database more regularly, is a good practice for backup and recovery purposes, but it does not address the issue of replica promotion. Implementing routinely scheduled failovers of your databases is a proactive approach that ensures that replicas are periodically promoted to masters, allowing for more reliable database performance. This can be achieved through the use of automated failover mechanisms, such as Amazon RDS Multi-AZ or Cloud SQL High Availability, which automatically promote a replica to a master in the event of a failure. In addition to implementing routinely scheduled failovers, it is important to ensure that your database environment is properly configured for high availability and resilience. This may involve the use of load balancing, redundant network connections, and multiple availability zones. Regular monitoring and testing of your database environment can also help identify potential issues before they become critical.

Answer 47

D. Configure serverless VPC access. ## Footnote https://cloud.google.com/vpc/docs/serverless-vpc-access Serverless VPC Access makes it possible for you to connect directly to your Virtual Private Cloud (VPC) network from serverless environments such as Cloud Run, App Engine, or Cloud Run functions. Configuring Serverless VPC Access allows your serverless environment to send requests to your VPC network by using internal DNS and internal IP addresses Answer is D. Here the explanation since I didn't see any good answer: 1- We have a VPC. 2- We have an onpremisses DB. 3- We have App Engine (that runs on a isolated network that does not belong to the VPC). 4- We can connect the VPC to the onpremisses network using Cloud VPN, which is the main purpose of Cloud VPN (let's say to simplify this answer). 5 - Now how we connect the AppEngine that is isolated from the VPC and needs to use "something" to reach out the onpremisses DB directly (no public ip, only private ip)? Here we will have to have somehow access to the VPC and then the VPN and then the on premisses DB. That is the serverless vpc access. 6- So flow can be something like app engine --> serverless vpc access --> cloud VPN ---> on premessises db through private ip.

Answer 48

B. Configure the Compute Engine instances with an instance template for the application, and use a regional persistent disk for the application data. Whenever a zonal outage occurs, use the instance template to spin up the application in another zone in the same region. Use the regional persistent disk for the application data. ## Footnote Regional persistent disk is a storage option that provides synchronous replication of data between two zones in a region. Regional persistent disks can be a good building block to use when you implement HA services in Compute Engine. https://cloud.google.com/compute/docs/disks/high-availability-regional-persistent-disk A regional persistent disk is designed to provide synchronous replication of data between two zones in the same region, ensuring that data remains available even if one zone is affected by an outage. By using an instance template along with a regional disk, you can quickly create new instances in an available zone during a zonal outage and attach the regional persistent disk to continue operations with the latest application data.

Answer 49

B. Utilize free tier and sustained use discounts. Provide training to the team about service cost management. ## Footnote Sustained are automatic discounts for running specific GCE a significant portion of the billing month: https://cloud.google.com/compute/docs/sustained-use-discounts Committed is for workloads with predictable resource needs between 1 year or 3 year, discount is up to 57% for most resources: https://cloud.google.com/compute/docs/instances/signing-up-committed-use-discounts

Answer 50

A. Create a tokenizer service and store only tokenized data ## Footnote Final Decision to go with Option A. I have done PCI DSS Audit for my project and thats the best suited case. 100% sure to use tokenised data instead of actual card number To minimize the scope of Payment Card Industry (PCI) compliance while still being able to analyze transactional data and trends, the best design approach is to use tokenization and network isolation. Option A, "Create a tokenizer service and store only tokenized data," is the correct answer. Tokenization involves replacing sensitive data with a randomly generated token, which can then be stored and analyzed without compromising the security of the original data. By tokenizing credit card data, the application can analyze transactional data and trends without having to worry about PCI compliance for the actual credit card data. Option B, "Create separate projects that only process credit card data," is not the best approach as it would require creating multiple projects and duplicating the necessary components for each project. This can lead to higher costs and management complexity. Option C, "Create separate subnetworks and isolate the components that process credit card data," is also a good option. By isolating the components that process credit card data into their own subnetworks, the risk of a security breach or unauthorized access to sensitive data is reduced. Option D, "Streamline the audit discovery phase by labeling all of the virtual machines (VMs) that process PCI data," is not a comprehensive solution to minimize PCI compliance scope. Labeling VMs can help with auditing, but it does not provide a complete solution for protecting sensitive data. Option E, "Enable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor," is not the best approach as it still requires PCI compliance for the actual credit card data. Logging export to BigQuery can provide valuable insights into transactional data and trends, but it is not a complete solution for minimizing the PCI compliance scope. In summary, the best approach is to use tokenization to replace sensitive credit card data with randomly generated tokens, allowing the application to analyze transactional data and trends without having to worry about PCI compliance for the actual credit card data. Additionally, isolating the components that process credit card data into their own subnetworks can further reduce the risk of security breaches or unauthorized access.

Answer 51

A. Supply the encryption key in a .boto configuration file. Use gsutil to upload the files C. Use gsutil to upload the files, and use the flag --encryption-key to supply the encryption key. ## Footnote Answer A In GCP document, key could be configured in .boto. I didn't find information show gsutil suppots flag "--encryption-key". https://cloud.google.com/storage/docs/encryption/customer-supplied-keys Answer C https://cloud.google.com/storage/docs/encryption/using-customer-supplied-keys#upload-encrypt Option C is correct. You can upload a file using customer-supplied encryption with the command: gcloud storage cp SOURCE_DATA gs://BUCKET_NAME/OBJECT_NAME --encryption-key=YOUR_ENCRYPTION_KEY

Answer 52

C. Configure binary authorization policies for the development, staging, and production clusters. Create attestations as part of the continuous integration pipeline. ## Footnote https://cloud.google.com/binary-authorization/docs/overview#policy_model Option A, "Configure a Kubernetes lifecycle hook to prevent the container from starting if it is not approved for usage in the given environment," would not be a good choice because it would not prevent the deployment of the container to the cluster in the first place. Option D, "Create a Kubernetes admissions controller to prevent the container from starting if it is not approved for usage in the given environment," would also not be a good choice because it would not prevent the deployment of the container to the cluster in the first place. Option B, "Implement a corporate policy to prevent teams from deploying Docker images to an environment unless the Docker image was tested in an earlier environment," would be a good option, but it would not be as effective as using binary authorization policies, as it would rely on the team following the policy rather than enforcing it automatically.

Answer 53

B. Enable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor or D. Enable Google Cloud Storage (GCS) log export to audit logs into a GCS bucket and delegate access to the bucket ## Footnote The best option for streamlining and expediting the analysis and audit process of Google Cloud Identity and Access Management (Cloud IAM) policy changes over the previous 12 months is to enable Google Cloud Storage (GCS) log export to audit logs into a GCS bucket and delegate access to the bucket. Option D is the correct answer. Here's why: Google Cloud IAM is a critical component of managing cloud resources on the Google Cloud Platform. It enables you to control access to resources in your cloud projects and manage the permissions of users, service accounts, and Google groups. It is important to track any changes made to Cloud IAM policies to ensure that access to resources is granted or revoked appropriately. Option A: Create custom Google Stackdriver alerts and send them to the auditor Creating custom Google Stackdriver alerts for Cloud IAM policy changes could help notify the auditor of any changes. However, this option does not provide the auditor with direct access to the data they need to review the policy changes. It only notifies them when there is a change, which means that they will need to request access to the relevant data before conducting an audit. This could potentially slow down the audit process and is not the most efficient option. Option B: Enable Logging export to Google BigQuery and use ACLs and views to scope the data shared with the auditor Enabling Logging export to Google BigQuery is a good option to store and manage the audit logs. It provides an efficient way to search, analyze and visualize the logs. However, this option requires additional work to set up the ACLs and views to limit an auditor's view of the data. This could be time-consuming and complex to implement. Furthermore, BigQuery may not be the ideal tool for auditors who are only interested in reviewing Cloud IAM policy changes. Option C: Use cloud functions to transfer log entries to Google Cloud SQL and use ACLs and views to limit an auditor's view Using Cloud Functions to transfer log entries to Google Cloud SQL is an interesting option as it could provide a relational database solution for storing audit logs. However, as with option B, it requires additional work to set up the ACLs and views to limit the auditor's view of the data. This option is also more complex and potentially more expensive to set up and maintain than option D. Option D: Enable Google Cloud Storage (GCS) log export to audit logs into a GCS bucket and delegate access to the bucket Enabling GCS log export to audit logs into a GCS bucket is the most straightforward and efficient option for this scenario. It provides auditors with direct access to the audit logs in a simple and cost-effective way. Additionally, GCS buckets offer robust security features that can be used to control access to the audit logs. Delegating access to the bucket can be done using IAM roles and permissions, which simplifies the setup process. Overall, this option is the most practical and efficient solution to streamline and expedite the analysis and audit process.

Answer 54

D. Configure Stackdriver Monitoring for all Projects, and export to Google Cloud Storage ## Footnote The correct answer for this scenario is D. Configure Stackdriver Monitoring for all Projects, and export to Google Cloud Storage. Here's why: A. Grant the security team access to the logs in each Project: This approach does not meet the requirement of retaining metrics for five years, as logs in each project may be deleted after a certain period. Moreover, granting access to the security team alone may not be sufficient to retain and analyze the logs. B. Configure Stackdriver Monitoring for all Projects, and export to BigQuery: This approach can work, but it may be expensive since BigQuery charges for the storage and processing of data. Additionally, you may need to configure a specific retention policy to retain the data for 5 years, which can further increase the cost. C. Configure Stackdriver Monitoring for all Projects with the default retention policies: By default, Stackdriver Monitoring retains logs for 30 days only, which does not meet the requirement of retaining metrics for 5 years. D. Configure Stackdriver Monitoring for all Projects, and export to Google Cloud Storage: This approach is the most appropriate because it allows for the configuration of retention policies that meet the requirement of retaining metrics for 5 years. Also, Google Cloud Storage is a cost-effective solution for long-term data storage. Exporting the logs to Google Cloud Storage can be automated and scheduled for regular intervals, reducing the manual effort required to ensure compliance with the retention policy. The exported logs can then be analyzed using various tools, including BigQuery, if needed. In conclusion, the best approach for this scenario is to configure Stackdriver Monitoring for all projects and export logs to Google Cloud Storage, which can meet the requirement of retaining metrics for 5 years, while also being cost-effective and manageable.

Answer 55

B. Allocate budget for team training. Create a roadmap for your team to achieve Google Cloud certification based on job role.

Answer 56

C. Add all users to a group. Grant the group the roles of BigQuery jobUser on the billing project and BigQuery dataViewer on the projects that contain the data. ## Footnote BigQuery User: (roles/bigquery.user) When applied to a dataset, this role provides the ability to read the dataset's metadata and list tables in the dataset. When applied to a project, this role also provides the ability to run jobs, including queries, within the project. A principal with this role can enumerate their own jobs, cancel their own jobs, and enumerate datasets within a project. Additionally, allows the creation of new datasets within the project; the creator is granted the BigQuery Data Owner role(roles/bigquery.dataOwner) on these new datasets. Lowest-level resources where you can grant this role: Dataset BigQuery Job User: (roles/bigquery.jobUser) Provides permissions to run jobs, including queries, within the project. Lowest-level resources where you can grant this role: Project Source: https://cloud.google.com/bigquery/docs/access-control

Answer 57

C. Change the filter to metric.label.state = 'used' AND metric.label.state = 'buffered' AND metric.label.state = 'cached' AND metric.label.state = 'slab'. ## Footnote C is correct answer: A. Change the Target type to DELTA_PER_MINUTE. (in this case the utlization tagret need to be in minutes which is not the case its percentage % and not time based. B. Change the Metric identifier to agent.googleapis.com/memory/bytes_used. (not applicable) C. Change the filter to metric.label.state = 'used' AND metric.label.state = 'buffered' AND metric.label.state = 'cached' AND metric.label.state = 'slab'. (this gives total memory used) D. Change the filter to metric.label.state = 'free' and the Target utilization to 20. (you would still need to change the the percent_used to percent_free) Selected Answer: A TARGET_TYPE: the value type for the metric. gauge: the autoscaler computes the average value of the data collected in the last couple of minutes and compares that to the utilization target. delta-per-minute: the autoscaler calculates the average rate of growth per minute and compares that to the utilization target. delta-per-second: the autoscaler calculates the average rate of growth per second and compares that to the utilization target. For accurate comparisons, if you set the utilization target in seconds, use delta-per-second as the target type. Likewise, use delta-per-minute for a utilization target in minutes.

Answer 58

B. NoSQL ## Footnote 1. High Volume and Velocity of Data: You have 1000 rooms reporting data every second, resulting in a massive amount of data with high velocity. NoSQL databases are designed to handle this kind of volume and speed efficiently. 2. Simple Data Structure: The data from the motion sensor is relatively simple (sensor ID and discrete information). NoSQL databases are well-suited for storing and processing this type of data without the need for complex schemas. 3. Flexible Schema: NoSQL databases offer schema flexibility, allowing you to easily adapt to changes in the data structure if needed. This is important as your tracking requirements might evolve over time. 4.Scalability: NoSQL databases are highly scalable, making it easy to accommodate future growth in the number of meeting rooms or data volume. ---------- Relational databases were not designed to cope with the scale and agility challenges that face modern applications, nor were they built to take advantage of the commodity storage and processing power available today. NoSQL fits well for: -> Developers are working with applications that create massive volumes of new, rapidly changing data types " structured, semi-structured, unstructured and polymorphic data. Incorrect Answers: D: The Blobstore API allows your application to serve data objects, called blobs, that are much larger than the size allowed for objects in the Datastore service. Blobs are useful for serving large files, such as video or image files, and for allowing users to upload large data files. https://www.mongodb.com/nosql-explained Based on the provided scenario, the recommended database type would be NoSQL. Here are the reasons why: Scalability: The system needs to track data from 1000 meeting rooms, which generates a large amount of data every second. With such a large scale of data, a NoSQL database can handle data more efficiently than a relational database, which has a fixed schema and requires expensive scaling operations. Flexibility: NoSQL databases can accommodate a wide variety of data types, including unstructured and semi-structured data, which is well-suited to the motion detector data that contains sensor IDs and different types of information. Moreover, NoSQL databases allow for easy updates to the data schema, making them adaptable to evolving data requirements. High availability: The system requires 24/7 availability for detecting and tracking room occupancy in real-time. NoSQL databases are designed to be highly available, with built-in replication and failover mechanisms. Performance: NoSQL databases are optimized for high-performance, low-latency data processing, making them ideal for real-time analytics and data processing. In summary, NoSQL databases are better suited for the scenario described in the question, due to their scalability, flexibility, high availability, and performance characteristics.

Answer 59

B. Configure a Google Cloud Dedicated Interconnect ## Footnote Adding VPN connections may improve bandwidth but does not resolve latency or packet loss issues caused by public internet routing... though not mentioned, we must 'think' beyond the scope of the question and ask 'what is causing the latency'...

Answer 60

A. Load data into Google BigQuery ## Footnote IMHO, it should be A only. The reason is that they want to perform analysis on the data and BigQuery excels in that over Cloud SQL. You can run SQL queries in both but I BigQuery has better analytical tools. It can do ad-hoc analysis like Cloud SQL using Cloud Standard SQL and it can do geo-spatial and ML analysis via its Cloud Standard SQL interface.

Answer 61

B. Google Cloud Dataproc ## Footnote Dataproc is a managed Spark and Hadoop service that lets you take advantage of open source data tools for batch processing, querying, streaming, and machine learning. Dataproc automation helps you create clusters quickly, manage them easily, and save money by turning clusters off when you don't need them. With less time and money spent on administration, you can focus on your jobs and your data. https://cloud.google.com/dataproc/docs/concepts/overview

Answer 62

C. Store the data in Cloud Storage and use lifecycle management to delete files when they expire.

Answer 63

C. Google Cloud Bigtable ## Footnote 1. High Write Throughput: Bigtable excels at handling high-volume write operations, which is crucial for your application receiving data from 50,000 sensors sending 10 readings per second. 2. Low Latency: Bigtable offers very low latency for read operations, essential for real-time charting and data visualization. 3. Time-Series Data: Bigtable is well-suited for storing and querying time-series data, like your weather sensor readings with timestamps. 4. Scalability: Bigtable can handle massive amounts of data and scale seamlessly as your application grows. Google Cloud Bigtable is a scalable, fully-managed NoSQL wide-column database that is suitable for both real-time access and analytics workloads. Good for: -> Low-latency read/write access -> High-throughput analytics -> Native time series support Common workloads: -> IoT, finance, adtech -> Personalization, recommendations -> Monitoring -> Geospatial datasets -> Graphs Reference: https://cloud.google.com/storage-options/

Answer 64

A. Set up a network peering between vpc-a and vpc-b. ## Footnote https://cloud.google.com/vpc/docs/vpc-peering Google Cloud VPC Network Peering allows internal IP address connectivity across two Virtual Private Cloud (VPC) networks regardless of whether they belong to the same project or the same organization.

Answer 65

C. Increase the load on your test and staging environments ## Footnote According to the question, [Your solution is producing "performance" bugs in production], so I think it is about the load. Plus canary test will not reproduce the bugs related to high load, I vote for C

Answer 66

B. Create an HTTPS load balancer with URL Maps. ## Footnote https://cloud.google.com/load-balancing/docs/url-map-concepts

Answer 67

B. Use Google Cloud Directory Sync to synchronize Active Directory usernames with cloud identities and configure SAML SSO. ## Footnote And in the document(https://cloud.google.com/iap/docs/concepts-overview), it says: If you need to create Google Accounts for your existing users, you can use Google Cloud Directory Sync to synchronize with your Active Directory or LDAP server.

Answer 68

B. Stackdriver automatically collects admin activity logs for most services. The Stackdriver Logging agent must be installed on each instance to collect system logs. ## Footnote Admin and event logs are configured by default. VM System logs require a logging agent to be configured. So A is not valid. Answer is B Now it is recommended to use OpsAgent as a replacement. Although you can create a VM instance with OpsAgent automatically enabled, which makes it look like 'the logging is automatically enabled', under the hood you need to install the agent on the instance. https://cloud.google.com/stackdriver/docs/solutions/agents/ops-agent/install-agent-vm-creation

Answer 69

A. Use the Horizontal Pod Autoscaler and enable cluster autoscaling. Use an Ingress resource to load-balance the HTTPS traffic. ## Footnote B is incorrect because of this: "service of type LoadBalancer to load-balance the HTTPS traffic." GKE Service Load Balancer is L4 Network or Internal Load Balancer, does not support HTTPS traffic. "Ingress is a Kubernetes resource that encapsulates a collection of rules and configuration for routing external HTTP(S) traffic to internal services. On GKE, Ingress is implemented using Cloud Load Balancing. When you create an Ingress in your cluster, GKE creates an HTTP(S) load balancer and configures it to route traffic to your application."

Answer 70

C. Review your RowKey strategy and ensure that keys are evenly spread across the alphabet. ## Footnote https://cloud.google.com/bigtable/docs/schema-design#row-keys he RowKey is used to sort data within a Cloud Bigtable cluster. If the keys are not evenly spread across the alphabet, it can result in a hotspot and slow down queries. To prevent this from happening in the future, you should review your RowKey strategy and ensure that keys are evenly spread across the alphabet. This will help to distribute the data evenly across the cluster and improve query performance. Other potential solutions to consider include adding more nodes to the cluster or optimizing your query patterns. However, deleting records older than 30 days or advising clients to use HBase APIs instead of NodeJS APIs would not address the issue of a hotspot in the cluster.

Answer 71

B. Federate authentication via SAML 2.0 to the existing Identity Provider ## Footnote Provision users to Google's directory The global Directory is available to both Cloud Platform and G Suite resources and can be provisioned by a number of means. Provisioned users can take advantage of rich authentication features including single sign-on (SSO), OAuth, and two-factor verification. You can provision users automatically using one of the following tools and services: Google Cloud Directory Sync (GCDS) Google Admin SDK - A third-party connector - GCDS is a connector that can provision users and groups on your behalf for both Cloud Platform and G Suite. Using GCDS, you can automate the addition, modification, and deletion of users, groups, and non-employee contacts. You can synchronize the data from your LDAP directory server to your Cloud Platform domain by using LDAP queries. This synchronization is one-way: the data in your LDAP directory server is never modified. https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#authentication-and-identity The best authentication strategy for this scenario is to federate authentication via SAML 2.0 to the existing Identity Provider (option B). Federated authentication allows users to authenticate to Google Cloud Platform using their existing corporate credentials. This means that users do not need to create new accounts or remember additional passwords, minimizing user disruption. Additionally, this approach enables the organization to maintain control over user access and permissions. SAML 2.0 is a widely adopted standard for federated authentication. It allows for secure exchange of authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP). In this case, the on-premises corporate IdP would be the source of truth for user authentication, and Google Cloud Platform would be the SP. Using G Suite Password Sync (option A) would replicate passwords into Google, but this approach does not support federated authentication and requires additional effort to manage password synchronization. Furthermore, storing passwords in this way may not meet the security team requirements for password storage. Provisioning users in Google using the Google Cloud Directory Sync tool (option C) is a viable option, but it may require users to remember and manage additional passwords, which could lead to user disruption. Additionally, this approach would require ongoing management and synchronization of user data between the corporate directory and Google. Asking users to set their Google password to match their corporate password (option D) is not recommended because it may not meet the security team's requirements for password storage. Furthermore, this approach would require users to remember and manage yet another password, which could lead to user disruption. In summary, federating authentication via SAML 2.0 to the existing Identity Provider is the best authentication strategy for this scenario because it minimizes user disruption, enables the organization to maintain control over user access and permissions, and supports secure password storage.

Answer 72

B. Configure Cloud NAT and select sub-b in the NAT mapping section.

Answer 73

C. 1. Perform an assessment of virtual machines running in the current VMware environment. 2. Define a migration plan, prepare a Migrate for Compute Engine migration RunBook, and execute the migration. ## Footnote Migrate for Compute Engine organizes groups of VMs into Waves. After understanding the dependencies of your applications, create runbooks that contain groups of VMs and begin your migration! https://cloud.google.com/migrate/compute-engine/docs/4.5/how-to/migrate-on-premises-to-gcp/overview

Answer 74

A. 1. Set a CORS configuration in the target Cloud Storage bucket where the base URL of the App Engine application is an allowed origin. 2. Use the Cloud Storage Signed URL feature to generate a POST URL. ## Footnote Here's why this approach is most suitable: * CORS configuration: This allows cross-origin requests from your App Engine application to access the Cloud Storage bucket for uploads. Setting the App Engine base URL as an allowed origin ensures secure communication. * Cloud Storage Signed URL: This feature generates a temporary URL with specific permissions and expiration time. You can provide this signed URL to the user's browser for uploading files directly to Cloud Storage. The payload (music file) doesn't pass through your backend, reducing server load. The same-origin policy is a security policy enforced on client-side web applications (like web browsers) to prevent interactions between resources from different origins. While useful for preventing malicious behavior, this security measure also prevents legitimate interactions between known origins. For example, a script on a page hosted at example.appspot.com might need to use resources stored in a Cloud Storage bucket at example.storage.googleapis.com. However, because these are two different origins from the perspective of the browser, the browser won't allow a script from example.appspot.com to fetch resources from example.storage.googleapis.com. https://cloud.google.com/storage/docs/cross-origin The Cross Origin Resource Sharing (CORS) spec was developed by the World Wide Web Consortium (W3C) to get around this limitation. Cloud Storage supports this specification by allowing you to configure your buckets to support CORS. Continuing the previous example, you can configure the example.storage.googleapis.com bucket so that a browser can share its resources with scripts from example.appspot.com.

Answer 75

C. Create a Cloud Build trigger based on the development branch that tests the code, builds the container, and stores it in Container Registry. Create a deployment pipeline that watches for new images and deploys the new image on the development cluster. Ensure only the deployment tool has access to deploy new versions. ## Footnote Questions say "relevant microservice will be deployed automatically in the development environment." Therefore A and B are out. D says "Rely on Vulnerability Scanning to ensure the code tests succeed." Vulnerability Scanning is not test so D is out. The correct Answer is therefore C.

Answer 76

A. Point gcloud datastore create-indexes to your configuration file ## Footnote Here’s how you can do it: 1. **Ensure you have the `gcloud` CLI installed**: You need the Google Cloud SDK installed and set up on your local machine. If you haven't done this yet, follow the [installation guide](https://cloud.google.com/sdk/docs/install). 2. **Navigate to the directory containing your `index.yaml` file**: This file contains the definitions of the indexes you want to deploy. 3. **Run the following command**: ```bash gcloud datastore indexes create index.yaml ``` This command will deploy the indexes defined in the `index.yaml` file to Cloud Datastore.

Answer 77

D. Start a new rolling update. Select the Opportunistic update mode. Most Voted ## Footnote In Google Cloud, the main difference between proactive and opportunistic updates in a managed instance group (MIG) is when they are applied: Proactive updates: Automatically apply updates to existing VMs. Opportunistic updates: Only apply updates when you manually select a VM to update or when new instances are created. see: https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed-instance-groups

Answer 78

C. Use a versioning strategy for the APIs that increases the version number on every backward-incompatible change. ## Footnote Deprecating API functionality API elements (fields, messages, RPCs) may be marked deprecated in any channel to indicate that they should no longer be used: // Represents a scroll. Books are preferred over scrolls. message Scroll { option deprecated = true; // ... } Deprecated API functionality must not graduate from alpha to beta, nor beta to stable. In other words, functionality must not arrive "pre-deprecated" in any channel. The beta channel's functionality may be removed after it has been deprecated for a sufficient period; we recommend 180 days. For functionality that exists only in the alpha channel, deprecation is optional, and functionality may be removed without notice. If functionality is deprecated in an API's alpha channel before removal, the API should apply the same annotation, and may use any timeframe it wishes. https://cloud.google.com/apis/design/versioning#release-based_versioning

Answer 79

D. Import a key in Cloud KMS. Create a dataset in BigQuery using the customer-supplied key option and select the created key. ## Footnote The answer is easy. It says keys must be left outside of Google Cloud. This automatically eliminates A / B. Now the C option says decrypts before storing it in BigQuery which the point is to encrypt the data while been in BigQuery, D is the only possible answer.

Answer 80

C. Configure VPC Service Controls and configure Private Google Access. ## Footnote Security benefits of VPC Service Controls Access from unauthorized networks using stolen credentials Data exfiltration by malicious insiders or compromised code https://cloud.google.com/vpc-service-controls/docs/overview#benefits

Answer 81

B. Using the Cron service provided by App Engine, publish messages to a Cloud Pub/Sub topic. Subscribe to that topic using a message-processing utility service running on Compute Engine instances. ## Footnote Answer is B, but this question is outdated, Today the best practices for cron is Cloud Scheduler: fully managed enterprise-grade cron job scheduler https://cloud.google.com/scheduler/?gad_source=1&gclsrc=ds&gclsrc=ds

Answer 82

B. Use the Storage Transfer Service to move the data.

Answer 83

A. Use the - -no-auto-delete flag on all persistent disks and stop the VM D. Use Google BigQuery billing export and labels to associate cost to groups ## Footnote The question describes a scenario where developers are required to move their development infrastructure resources from on-premises VMs to Google Cloud Platform (GCP) to reduce costs. The resources go through multiple start/stop events during the day and require state to persist. The challenge is to design a process of running a development environment in GCP while providing cost visibility to the finance department. There are two steps that can be taken to address this challenge, which are described below: Use the --no-auto-delete flag on all persistent disks and stop the VM Option A suggests using the --no-auto-delete flag on all persistent disks and stopping the VM instead of terminating it. This approach ensures that the data stored in the persistent disks is not deleted when the VM is stopped, and the state is preserved for the next start. By stopping the VM instead of terminating it, developers can quickly resume their work from where they left off, without having to recreate their environment. This approach also enables cost savings by avoiding the need to recreate the environment from scratch every time developers start working. Use Google BigQuery billing export and labels to associate cost to groups Option D suggests using Google BigQuery billing export and labels to associate costs with groups. By applying VM CPU utilization labels and including them in the BigQuery billing export, the finance department can get visibility into the cost associated with each group of resources. This approach enables accurate cost allocation and provides developers with visibility into the cost of their environment. By associating costs with groups, the finance department can identify areas where cost optimization can be applied. In summary, the recommended approach is to use the --no-auto-delete flag on all persistent disks and stop the VM instead of terminating it to preserve the state of the environment, and use Google BigQuery billing export and labels to associate costs with groups for accurate cost allocation and optimization. Option A and Option D are the correct answers to the question. Options B and E are incorrect because terminating the VM or storing the state into local SSD would result in the loss of data, which is not desirable in this scenario. Option C is incorrect because it only provides visibility into CPU utilization, which is not sufficient to associate costs with groups accurately. Option F is incorrect because storing state in Google Cloud Storage and snapshotting the persistent disks can be costly, and it does not address the issue of associating costs with groups.

Answer 84

A. ~/bin ## Footnote Cloud Shell provisions 5 GB of free persistent disk storage mounted as your $HOME directory on the virtual machine instance. This storage is on a per-user basis and is available across projects. Unlike the instance itself, this storage does not time out on inactivity. All files you store in your home directory, including installed software, scripts and user configuration files like .bashrc and .vimrc, persist between sessions. Your $HOME directory is private to you and cannot be accessed by other users.

Answer 85

C. Assign the development team group the Project Owner role on the Shopping folder, and remove the development team group Project Owner role from the Organization. ## Footnote Answer C is correct. Answer A and B are both overridden by the less-restrictive permission on Organization level. Answer D permission was already there on Organization level, and does not remove the project owner permission on the other folder

Answer 86

C. A single Organization with Folders for each departmen ## Footnote https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations https://cloud.google.com/architecture/identity/best-practices-for-planning#use_organizations_to_delineate_administrative_authority

Answer 87

C. Digitally sign each timestamp and log entry and store the signature ## Footnote C (Correct answer) - Digitally sign each timestamp and log entry and store the signature. Answer A, B, and D don’t have any added value to verify the authenticity of your logs. Besides, Logs are mostly suitable for exporting to Cloud storage, BigQuery, and PubSub. SQL database is not the best way to be exported to nor store log data. Simplified Explanation To verify the authenticity of your logs if they are tampered with or forged, you can use a certain algorithm to generate digest by hashing each timestamp or log entry and then digitally sign the digest with a private key to generate a signature. Anybody with your public key can verify that signature to confirm that it was made with your private key and they can tell if the timestamp or log entry was modified. You can put the signature files into a folder separate from the log files. This separation enables you to enforce granular security policies. C – Digitally sign each timestamp and log entry and store the signature. This is fun Q where all options are technically correct. But, the point is to find most efficient. Since, Q asks about verification of log entry - then you don't need to dub it. Using of much shorter timestamp-hash pair will address the request. So, when reading log from original source, you also read hash for this timestamp and then verify the entry's body. BTW, this is one of general purpose questions, which is not directly related to GCP. Just checks your attentiveness A - is about duplication, can work, but redundant; B / D - both have similar design, but don’t allow verification of entry. No cross-checking of entry. E.g. person having access to log can change it in one place. C - storing log in one place, and hash-code in another. So, even if "trusted" person has modified original log, then it will break correspondence with hash code in other storage. That storage should be available only for authentication program (via service account).

Answer 88

A. An HA Cloud VPN gateway connected with two tunnels to an on-premises VPN gateway ## Footnote A is true only if the on-prem (peer) gateway has two separate external P addresses. The HA VPN gateway uses two tunnels, one tunnel to each external IP address on the peer device as described in https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies#configurations_that_support_9999_availability https://cloud.google.com/network-connectivity/docs/vpn/concepts/topologies-increase-bandwidth

Answer 89

D. Create a Compute Engine instance with CPU and memory options similar to your application's current on-premises virtual machine. Install the Cloud Monitoring agent, and deploy the third-party application. Run a load test with normal traffic levels on the application, and follow the Rightsizing Recommendations in the Cloud Console. ## Footnote "Rightsizing provides two types of recommendations: 1. Performance-based recommendations: Recommends Compute Engine instances based on the CPU and RAM currently allocated to the on-premises VM. This recommendation is the default. 2. Cost-based recommendations: Recommends Compute Engine instances based on: - The current CPU and RAM configuration of the on-premises VM. - The average usage of this VM during a given period. To use this option, you must activate rightsizing monitoring with vSphere for this group of VMs and allow time for Migrate for Compute Engine to analyze usage. -------- https://cloud.google.com/compute/docs/instances/apply-machine-type-recommendations-for-instances Use the monitoring agent for more precise recommendations Cloud Monitoring offers a Monitoring agent that collects additional disk, CPU, network, and process metrics from your VM instances. To collect this data, install the Monitoring agent on your VM instances so it can access system resources and app services. If the Monitoring agent is installed and running on a VM instance, the CPU and memory metrics collected by the agent are automatically used to compute machine type recommendations. The agent metrics provided by the Monitoring agent give better insights into resource utilization of the instance than the default Compute Engine metrics. This allows the recommendation engine to estimate resource requirements better and make more precise recommendations.

Answer 90

A. 1. Create a VPC Service Controls perimeter that includes the projects with the buckets. 2. Create an access level with the CIDR of the office network ## Footnote For all Google Cloud services secured with VPC Service Controls, you can ensure that: Resources within a perimeter are accessed only from clients within authorized VPC networks using Private Google Access with either Google Cloud or on-premises. https://cloud.google.com/vpc-service-controls/docs/overview Enforce a security perimeter with VPC Service Controls to isolate resources of multi-tenant Google Cloud services—reducing the risk of data exfiltration or data breach.

Answer 91

D. Create a failover replica instance in the same region, but in a different zone ## Footnote https://cloud.google.com/sql/docs/mysql/replication As a best practice, put read replicas in a different zone than the primary instance when you use HA on your primary instance. This practice ensures that read replicas continue to operate when the zone that contains the primary instance has an outage.

Answer 92

B. Develop the application for App Engine standard environment. ## Footnote https://cloud.google.com/appengine/docs/the-appengine-environments

Answer 93

A. Cloud Functions ## Footnote A. Cloud Functions - managed service scales down to 0 B. Compute Engine - not a managed service C. Google Kubernetes Engine - not a managed service and wont scale down to 0 D. AppEngine flexible environment - managed service but wont scale down to 0

Answer 94

B. Use firewall rules based on network tags attached to the compute instances

Answer 95

A. Use a unique identifier for each individual. Upon a deletion request, delete all rows from BigQuery with this identifier. ## Footnote According to me, the question states "The association collects a large amount of health data, such as sustained injuries." and the nuance on the word such => " Current legislation requires you to delete "SUCH" information upon request of the subject. " So from that point of view the question is not to delete the entire user records but specific data related to personal health data. With DLP you can use InfoTypes and InfoType detectors to specifically scan for those entries and how to act upon them (link https://cloud.google.com/dlp/docs/concepts-infotypes) I would say B. I vote for B. I had some doubts whether A was correct, but: - I'm not convinced by the argument "only A talks about deleting" (it would be too easy if it was about choosing an answer containing the word "delete" ;) - the question says "design a solution that can accommodate such a request" - I'm not very fluent in english, but "accommodate" imho means more "facilitate" than "accomplish" here - I think that the task is about deleting health data not everything related with unique identifier - Data Catalog allows you to manage data, knowing in which datasets and in which tables what data is stored. Answer "A" somehow imposes the data model - each table with data related to a given individual must contain the ID of this individual (in a real data model this does not have to be the case).

Answer 96

D. Increase the maximum number of instances in the autoscaling group. ## Footnote The question is not asking for a permanent solution to the problem, it is asking what to do to have the production traffic to be served again as quickly as possible. Therefore, the best answer is D.

Answer 97

B. Deploy the update as a new version in the App Engine application, and split traffic between the new and current versions. ## Footnote B. Deploy the update as a new version in the App Engine application, and split traffic between the new and current versions. To test an update to an App Engine application with production traffic before replacing the current version, you can deploy the update as a new version in the App Engine application and split traffic between the new and current versions. This is known as a "blue-green" deployment, and it allows you to test the new version with a portion of production traffic while the current version is still serving the remainder of traffic. To split traffic between the new and current versions, you can use the App Engine traffic splitting feature. This feature allows you to specify the percentage of traffic that should be sent to each version, and it can be used to gradually ramp up traffic to the new version over time. This allows you to test the new version with a small portion of traffic initially, and gradually increase the traffic as you become more confident in the update. https://cloud.google.com/appengine/docs/standard/splitting-traffic

Answer 98

B. Add two additional NICs to Instance #1 with the following configuration: ג€¢ NIC1 ג—‹ VPC: VPC #2 ג—‹ SUBNETWORK: subnet #2 ג€¢ NIC2 ג—‹ VPC: VPC #3 ג—‹ SUBNETWORK: subnet #3 Update firewall rules to enable traffic between instances. ## Footnote According to my understanding the requirement is that only VM1 shall be able to communicate with VM2 and VM3, but not VM2 with VM3. We can exclude d) as d) would enable VM2 to communicate with VM3 as well - my assumption is, that if the quizzer wanted that d) is the correct answer, he would make just 2 peerings - 1x between VM1 and VM2 and 1x between VM1 and VM3 repectively the VPCs. We can exclude c) as well - there is no connection between VPC1 and VPC3. IMHO a) will not work. So the only correct answer seems to be b) - what I don't understand is why we have to update the firewall rules as IMHO the default firewall rules enable such communication (maybe some restrictive rules are implemented - not enough details in the question to clarify that part). Please correct me if I am wrong. https://cloud.google.com/vpc/docs/multiple-interfaces-concepts#firewall_rules_and_multiple_network_interfaces

Answer 99

C. Create a custom image from the existing disk. Create an instance template from the custom image. Create an autoscaled managed instance group from the instance template. ## Footnote (image -> template -> mig). Not recommended to create template from --source-instance as If the existing instance contains a static external IP address, that address is copied into the instance template and might limit the use of the template. Templates are best created from images or other templates. Creating the template from a running instance may require work to clean it up before it can be used for a MIG

Answer 100

B. Use Cloud Scheduler to trigger a Cloud Function that will stop the development and acceptance environments after office hours and start them just before office hours. ## Footnote https://cloud.google.com/blog/products/it-ops/best-practices-for-optimizing-your-cloud-costs Schedule VMs to auto start and stop: The benefit of a platform like Compute Engine is that you only pay for the compute resources that you use. Production systems tend to run 24/7; however, VMs in development, test or personal environments tend to only be used during business hours, and turning them off can save you a lot of money! https://cloud.google.com/blog/products/storage-data-transfer/save-money-by-stopping-and-starting-compute-engine-instances-on-schedule Cloud Scheduler, GCP’s fully managed cron job scheduler, provides a straightforward solution for automatically stopping and starting VMs. By employing Cloud Scheduler with Cloud Pub/Sub to trigger Cloud Functions on schedule, you can stop and start groups of VMs identified with labels of your choice (created in Compute Engine). Here you can see an example schedule that stops all VMs labeled "dev" at 5pm and restarts them at 9am, while leaving VMs labeled "prod" untouched

Answer 101

C. 1. Create folders under the Organization resource named ג€Developmentג€ and ג€Production.ג€ 2. Grant all developers the Project Creator IAM role on the ג€Developmentג€ folder. 3. Move the developer projects into the ג€Developmentג€ folder. 4. Set the policies for all projects on the Organization. 5. Additionally, set the production policies on the ג€Productionג€ folder. ## Footnote I would recommend option C, creating two folders under the Organization resource named "Development" and "Production" and placing developer and production projects in the respective folders. This approach would allow you to centrally manage policies for all projects, while also being able to set more restrictive policies for production projects. It would also allow you to easily move projects between the Development and Production folders as business needs change, without disrupting users or developers. Option D, designating the Organization for production projects only, would not allow developers to create projects within the Organization and could lead to confusion around project ownership and management. It would also make it more difficult to move projects between development and production environments. Option A, creating a second Google Workspace account and Organization, would not be a recommended practice as it would create unnecessary complexity and make it more difficult to manage policies and move projects between environments. Option B, creating a single folder under the Organization resource and placing all projects in that folder, would not allow you to set different policies for development and production projects.

Answer 102

C. 1. Create a dataset for the data science team. 2. Create views of tables that you want to share, excluding PII. 3. Assign an appropriate project-level IAM role to the members of the data science team. 4. Assign access controls to the dataset that contains the view. 5. Authorize the view to access the source dataset. ## Footnote Materialized view is too costly for the requirement. Authorized views should be created in a different dataset from the source data. That way, data owners can give users access to the authorized view without simultaneously granting access to the underlying data. https://cloud.google.com/bigquery/docs/share-access-views views A view is a virtual table defined by a SQL query. You can use views to provide an easily reusable name for a complex query or a limited set of data that you can then authorize other users to access. Once you create a view, a user can then query the view as they would a table. Query results contain only the data from the tables and fields specified in the query that defines the view. The query that defines the view is run each time the view is queried. If you frequently query a large or computationally expensive view, then you should consider creating a materialized view. materialized views In BigQuery, materialized views are precomputed views that periodically cache the results of a query for increased performance and efficiency. BigQuery leverages precomputed results from materialized views and whenever possible reads only changes from the base tables to compute up-to-date results. Materialized views can be queried directly or can be used by the BigQuery optimizer to process queries to the base tables. Queries that use materialized views are generally faster and consume fewer resources than queries that retrieve the same data only from the base tables. Materialized views can significantly improve the performance of workloads that have the characteristic of common and repeated queries.

Answer 103

D. 1. Use gsutil -m to upload the files to Cloud Storage. 2. Use gsutil hash -c FILE_NAME to generate CRC32C hashes of all on-premises files. 3. Use gsutil ls -L gs://[YOUR_BUCKET_NAME] to collect CRC32C hashes of the uploaded files. 4. Compare the hashes. ## Footnote https://cloud.google.com/storage/docs/data-validation

Answer 104

A. Create a retention policy on the bucket for the duration of 5 years. Create a lock on the retention policy. ## Footnote A is correct. - retention policy must be locked - the is now need for retention policy for all buckets in organization or all buckets in the project

Answer 105

C. In the Logging section of the console, specify GCE Network as the logging section. Search for the Create Insert entry ## Footnote A doesn't seem to fit because the matter of when a VM was created. Answer B focuses on Data Access logs which doesn't seem to fit since the matter of creating a network firewall rule is an Admin activity, not a data access activity. D focuses on who logged in which is good to know but doesn't answer the question of how the network was created. C focuses on logging, the selection of network events, and the Create/Insert entry.

Answer 106

A. 1. Enable automatic storage increase for the instance. 2. Create a Stackdriver alert when CPU usage exceeds 75%, and change the instance type to reduce CPU usage. 3. Create a Stackdriver alert for replication lag, and shard the database to reduce replication time. ## Footnote Sharding database will reduce latency

Answer 107

B. Provision preemptible VMs to reduce cost. Disable and then discontinue use of all GCP services and APIs that are not HIPAA-compliant. ## Footnote Disabling and then discontinuing allows you to see the effects of not using the APIs, so you can gauge (check) alternatives. So that leaves B and D as viable answers. The question says only some are not time-critical which implies others are... this means preemptible VMs are good because they will secure a spot for scaling when needed. So I'm also going to choose B.

Answer 108

A. Install Anthos Service Mesh on your cluster. Use the Google Cloud Console to define a Service Level Objective (SLO), and create an alerting policy based on this SLO. ## Footnote Cloud Service Mesh displays a Latency graph on the Metrics page for each of your services. The Latency graph shows you the latency over time, which can help you determine a latency threshold or upper bound for a service. https://cloud.google.com/service-mesh/docs/observability/slo-overview

Answer 109

D. Use node affinity labels based on the node name when creating Compute Engine instances in order to host each workload on the correct node. ## Footnote Y'all not reading the fine details. The question is about aligning EACH client to their dedicated nodes (D), not to a node group (C). https://cloud.google.com/compute/docs/nodes/sole-tenant-nodes#default_affinity_labels The above reference clearly articulates the default affinity label for node group and node name. Unless we're thinking about growing each client to their own dedicated node groups (not in the current requirement), then the answer is not C, rather D. Compute Engine assigns two default affinity labels to each node: A label for the node group name: Key: compute.googleapis.com/node-group-name Value: Name of the node group. A label for the node name: Key: compute.googleapis.com/node-name Value: Name of the individual node.

Answer 110

D. Configure a Cloud Dedicated Interconnect connection between the on-premises environment and Google Cloud. ## Footnote Reason : high throughput via internal IPs

Answer 111

A. Create a Cloud VPN connection from the new VPC to the data center, create a Cloud Router, and apply new IP addresses so there is no overlapping IP space. B. Create a Cloud VPN connection from the new VPC to the data center, and create a Cloud NAT instance to perform NAT on the overlapping IP space. C. Create a Cloud VPN connection from the new VPC to the data center, create a Cloud Router, and apply a custom route advertisement to block the overlapping IP space. ## Footnote Correct Answer: A - IP Should not overlap so applying new IP address is the solution A is not correct. "What should you do to enable connectivity and make sure that there are no routing conflicts when connectivity is established?" if you apply VPN con BGP, the actual IP address will be propagated to on prem environment with overlapping RFC1918 as result. B is correct with custom route Answer is C. https://cloud.google.com/network-connectivity/docs/router/how-to/advertising-custom-ip

Answer 112

D. Use Cloud Audit Logging to view Cloud Audit Logs, and create a filter on the query operation to get the required information. ## Footnote 1.-Cloud Audit Logs maintains audit logs for admin activity, data access and system events. BIGQUERY is automatically send to cloud audit log functionality. 2.- In the filter you can filter relevant BigQuery Audit messages, you can express filters as part of the export https://cloud.google.com/logging/docs/audit https://cloud.google.com/bigquery/docs/reference/auditlogs#ids https://cloud.google.com/bigquery/docs/reference/auditlogs#auditdata_examples Option A, connecting Google Data Studio to BigQuery and creating a dimension for the users and a metric for the amount of queries per user, is a valid method of visualizing data, but it would not provide the specific information about the number of queries that were run by each user in the last month. Option B, executing a query on the JOBS table to get the required information, is not a viable option because the JOBS table does not contain information about the user who ran the query. Option C, using the 'bq show' and 'bq ls' commands to list job information, is not a viable option because these commands do not provide information about the user who ran the query.

Answer 113

B. Verify that Dedicated Interconnect can replicate files to GCP. Verify that Cloud VPN can establish a secure connection between your networks if Dedicated Interconnect fails. ## Footnote Transfer appliance is a physical appliance for transferring huge bulk of data. does not fit into disaster recovery testing. out of A and B, B seems to be more nearest answer. One would not have direct peering and Dedicated interconnect in a solution

Answer 114

A. Google Kubernetes Engine, Jenkins, and Helm ## Footnote it should be A .. helm is needed for "Deploy application bundles using dynamic templates" Load Balancing should be part of GKE Already Kubernetes Engine offers integrated support for two types of Cloud Load Balancing (Ingress and External Network Load Balancing) , hence Option A Reference : https://cloud.google.com/kubernetes-engine/docs/tutorials/http-balancer

Answer 115

A. Deploy each microservice as a Deployment. Expose the Deployment in the cluster using a Service, and use the Service DNS name to address it from other microservices within the cluster. ## Footnote B is incorrect. Ingress comes with a HTTP(S) LB with external IP hence is not needed for communications within the cluster internally. each microservice with a specific number of replicas = Deployment internal to the cluster = Service

Answer 116

A. The session variable is local to just a single instance ## Footnote It's A. AppEngine spins up new containers automatically according to the load. During peak traffic, HTTP requests originated by the same user could be served by different containers. Given that the variable `sessions` is recreated for each container, it might store different data. The problem here is that this Flask app is stateful. The `sessions` variable is the state of this app. And stateful variables in AppEngine / Cloud Run / Cloud Functions are problematic. A solution would be to store the session in some database (e.g. Firestore, Memorystore) and retrieve it from there. This way the app would fetch the session from a single place and would be stateless.

Answer 117

B. Output custom metrics to Stackdriver from the game servers, and create a Dashboard in Stackdriver Monitoring Console to view them. ## Footnote Data studio cannot be used with BigTable https://datastudio.google.com/datahttps://datastudio.google.com/data

Answer 118

D. Deploy Cloud VPN Gateway in each region. Ensure that each region has at least one VPN tunnel to the on-premises peer gateway. ## Footnote It can't be -A - VPC Network Peering only allows private RFC 1918 connectivity across two Virtual Private Cloud (VPC) networks. In this example is one VPC with on-premise network https://cloud.google.com/vpc/docs/vpc-peering It is not definitely - B - Can't be It is not C - Because Cloud VPN gateways and tunnels are regional objects, not global So, it the answer is D - https://cloud.google.com/vpn/docs/how-to/creating-static-vpns

Answer 119

B. Use Istio's fault injection on the particular microservice whose faulty behavior you want to simulate. ## Footnote application crash, not node. Fault injection is a technique used in chaos engineering to deliberately introduce errors into a system to test its resilience and observe its behavior under failure conditions. Istio is a service mesh that can manage the traffic between microservices. It includes fault injection capabilities that enable you to simulate failures such as delays or crashed services without actually stopping the service or damaging the environment. This allows you to validate how the rest of your application reacts to the failure of a specific microservice.

Answer 120

A. Configure liveness and readiness probes in the Pod specification. ## Footnote A: Configuring the right liveness and readiness probes prevents outages when rolling out a new ReplicaSet of a Deployment, because Pods are only getting traffic when they are considered ready. B: With GKE, you do not deal with MIGs. C: Does not use GKE tools and is therefore not the best option. D: Does alert you but does not prevent the outage. https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-setting-up-health-checks-with-readiness-and-liveness-probes?hl=en

Answer 121

A. Create an egress rule with priority 1000 to deny all traffic for all instances. Create another egress rule with priority 100 to allow the Active Directory traffic for all instances. ## Footnote Should be A, there is no implied deny egress but only implied allow egress https://cloud.google.com/vpc/docs/firewalls#default_firewall_rules Every VPC network has two implied firewall rules. These rules exist, but are not shown in the Cloud Console: The implied allow egress rule: An egress rule whose action is allow, destination is 0.0.0.0/0, and priority is the lowest possible (65535) lets any instance send traffic to any destination, except for traffic blocked by GCP. Outbound access may be restricted by a higher priority firewall rule. Internet access is allowed if no other firewall rules deny outbound traffic and if the instance has an external IP address or uses a NAT instance. Refer to Internet access requirements for more details. The implied deny ingress rule: An ingress rule whose action is deny, source is 0.0.0.0/0, and priority is the lowest possible (65535) protects all instances by blocking incoming traffic to them. Incoming access may be allowed by a higher priority rule. Note that the default network includes some additional rules that override this one, allowing certain types of incoming traffic.

Answer 122

A. Use kubectl set image deployment/echo-deployment ## Footnote https://cloud.google.com/kubernetes-engine/docs/how-to/updating-apps#updating_an_application

Answer 123

A. StatefulSets ## Footnote To ensure that a workload in Kubernetes has a consistent set of hostnames even after pod scaling and relaunches, you should use StatefulSets. StatefulSets are a type of controller in Kubernetes that is used to manage stateful applications. They provide a number of features that are specifically designed to support stateful applications, including: Stable, unique network identifiers for each pod in the set Persistent storage that is automatically attached to pods Ordered, graceful deployment and scaling of pods Ordered, graceful deletion and termination of pods By using StatefulSets, you can ensure that your workload has a consistent set of hostnames even if pods are scaled or relaunched, which can be important for applications that rely on stable network identifiers. StatefulSets is a feature of Kubernetes, which the question asks about. Yes, Persistent volumes are required by StatefulSets (https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/). See the Google documentations for mentioning of hostnames (https://cloud.google.com/kubernetes-engine/docs/concepts/statefulset).

Answer 124

A. Configure the GKE cluster as a private cluster, and configure Cloud NAT Gateway for the cluster subnet. ## Footnote Cloud NAT is the correct answer

Answer 125

A. Upload the required installation files to Cloud Storage. Configure the VM on a subnet with a Private Google Access subnet. Assign only an internal IP address to the VM. Download the installation files to the VM using gsutil ## Footnote Option B: Uploading the required installation files to Cloud Storage and using firewall rules to block all traffic except the IP address range for Cloud Storage is not a valid option, as it does not allow the VM to access the installation files without public internet access. Option C: Uploading the required installation files to Cloud Source Repositories and using gcloud to download the files to the VM is not a valid option, as Cloud Source Repositories does not support storing large binary files such as installation files. Option D: Uploading the required installation files to Cloud Source Repositories and using firewall rules to block all traffic except the IP address range for Cloud Source Repositories is not a valid option, as it does not allow the VM to access the installation files without public internet access. To install specific software on a Compute Engine instance in a highly secured environment where public Internet access is not allowed, you can follow these steps: Upload the required installation files to Cloud Storage. Configure the VM on a subnet with a Private Google Access subnet. This will allow the VM to access Google APIs and services, such as Cloud Storage, without requiring a public IP address or internet access. Assign only an internal IP address to the VM. This will ensure that the VM is not accessible from the public internet. Download the installation files to the VM using gsutil, which is a command-line tool that allows you to access Cloud Storage from the VM.

Answer 126

B. 1. Create a project with a standalone Virtual Private Cloud (VPC), assign the Network Admin role to the networking team, and assign the Compute Admin role to the development team. C. 1. Create a project with a Shared VPC and assign the Network Admin role to the networking team. 2. Create a second project without a VPC, configure it as a Shared VPC service project, and assign the Compute Admin role to the development team. ## Footnote For the same project , same VPC, Network Admin role to the networking team, and Compute Admin role to the development team. What is the need for another project? For full separation of the teams you will need to use a shared VPC in this case. If you compare the two roles you will see that Compute Admin includes the permissions of the Network Admin so with option B you don't separate the teams as Compute Admin includes compute.network.* permissions (and others). https://cloud.google.com/iam/docs/understanding-roles Complete separation was not required. However, the networking team shouldn't have access to the compute engine. For this, no need a full separation. Any better idea? They're getting the Compute Admin permissions either way. The key words in the statement are actually "Create a second project without a VPC, configure it as a Shared VPC service project." Since the VPC being used doesn't exist in their project, they're unable to manage network changes. Because Compute Admin has compute.* permissions, which includes Network Admin's. This is tricky. Both B & C could seem okay, but C is the right answer. The compute.networkAdmin role gives broad permissions on the project, which also affects compute instances. For instance, it gives "compute.instances.get" and "compute.instances.use" permissions. Even though this roles does not grant permissions to start/stop/create/delete instances, it still gives broad permissions on compute instances. This gets much clearer if we do the same analysis on the other role: compute.Admin. This role gives permissions on "compute.*", which also includes "compute.networks.*". That is exactly what we don't want to happen. If we spawn the VPC and the compute VMs in the same project, then compute admins will be able to mess around with the VPC. That is why we need to separate networks and compute within 2 projects, unless creating custom roles, etc. Shared VPC are aimed at that. Therefore, C is the right answer.

Answer 127

B. Use Deployment Manager to automate service provisioning. Use Stackdriver to monitor and debug your tests. ## Footnote Google Best practice ---> never use scripts. They do not trust anyone else's code it seems. https://cloud.google.com/architecture/dr-scenarios-planning-guide?hl=en

Answer 128

D. Save a history of recommendations and results of the recommendations in BigQuery, to be used as training data. ## Footnote Model performance is generally based on the volume of its training data input. The more the data, the better the model. A,B,C is defining about the performance of ML but not the result....only the training data will give good ML result/predictions

Answer 129

B. 1. Create a Cloud Logging sink to export BigQuery data access logs to BigQuery. 2. Perform a BigQuery query on the generated table to extract the information you need ## Footnote D also can be continuous https://cloud.google.com/billing/docs/how-to/export-data-bigquery#setup. I think D is the right answer. Why not D: Billing export can provide cost data in BigQuery, but it doesn't capture details about individual queries or users, making it insufficient for the specific needs of identifying costly queries and high-spending users. B is the correct answer https://cloud.google.com/blog/products/data-analytics/taking-a-practical-approach-to-bigquery-cost-monitoring A is incorrect as there is not billing page for a project, its billing account that handles all org billing.

Answer 130

ACE A. Port the application code to run on Google App Engine C. Instrument the application with a monitoring tool like Stackdriver Debugger E. Deploy a continuous integration tool with automated testing in a staging environment ADE A. Port the application code to run on Google App Engine D. Select an automation framework to reliably provision the cloud infrastructure E. Deploy a continuous integration tool with automated testing in a staging environment ## Footnote ACE This is talking about the APPLICATION not the infrastructure, therefore I believe we should focus on the APP-side of things: 1. port the app to app engine for content delivery 2. add monitoring for troubleshooting 3. use a CI/CD workflow for continuous delivery w/testing for a stable application ----------- Let's go with option elimination A. Port the application code to run on Google App Engine >> PaaS serverless managed service, so all my infra provisioning is taken care by GCP. B. Integrate Cloud Dataflow into the application to capture real-time metrics >> Good to have C. Instrument the application with a monitoring tool like Stackdriver Debugger >> Is a must for debugging issues and monitoring application logs this is now GCP Cloud monitoring and logging. D. Select an automation framework to reliably provision the cloud infrastructure >> App Engine is a PaaS so the infrastructure is taken care of by App Engine, I would select this if I have not selected A, hence will eliminate this option for now E. Deploy a continuous integration tool with automated testing in a staging environment >> Good to have F. Migrate from MySQL to a managed NoSQL database like Google Cloud Datastore or Bigtable >> There is no requirement for DB enhancement hence will elimination this option A and C are must-have B and E are Good to have, but E has more importance than Big -------- ADE. References: https://cloud.google.com/appengine/docs/standard/java/tools/uploadinganapp https://cloud.google.com/appengine/docs/standard/java/building-app/cloud-sql. When migrating a J2EE (Java Enterprise Edition) application to the cloud, there are several best practices that should be considered. Here are three of the most important ones: Instrument the application with a monitoring tool like Stackdriver Debugger (Option C) Monitoring is essential for any application running in the cloud. In order to ensure that the application is performing as expected, you need to monitor it for issues like performance bottlenecks, errors, and crashes. Stackdriver Debugger is a monitoring tool that allows you to monitor your application's performance and troubleshoot issues in real-time. It enables you to take snapshots of your application's state at any point in time, which can be extremely helpful when debugging problems. Select an automation framework to reliably provision the cloud infrastructure (Option D) Automation is key when it comes to cloud infrastructure management. When you're dealing with large, complex systems, it's easy for things to go wrong if you're relying on manual processes. That's why it's important to use an automation framework to provision and manage your cloud infrastructure. There are several automation frameworks available, such as Terraform and CloudFormation, that make it easy to manage your infrastructure as code. Deploy a continuous integration tool with automated testing in a staging environment (Option E) Continuous integration (CI) is the practice of continuously building and testing your application as you develop it. This helps you catch issues early on in the development process, before they become bigger problems. When migrating a J2EE application to the cloud, it's important to deploy a CI tool like Jenkins or CircleCI, and set up automated testing in a staging environment. This will allow you to catch issues before they're deployed to production, and ensure that your application is working as expected. While the other options listed (porting the application code to run on Google App Engine, integrating Cloud Dataflow into the application to capture real-time metrics, and migrating from MySQL to a managed NoSQL database like Google Cloud Datastore or Bigtable) may also be important considerations, they are not as essential as the three practices listed above.

Answer 131

A. 1. Install a Cloud Logging agent on all instances. 2. Create a sink to export logs into a regional Cloud Storage bucket. 3. Create an Object Lifecycle rule to move files into a Coldline Cloud Storage bucket after one month. 4. Configure a retention policy at the bucket level using bucket lock. ## Footnote The practice for managing logs generated on Compute Engine on Google Cloud is to install the Cloud Logging agent and send them to Cloud Logging. The sent logs will be aggregated into a Cloud Logging sink and exported to Cloud Storage. The reason for using Cloud Storage as the destination for the logs is that the requirement in question requires setting up a lifecycle based on the storage period. In this case, the log will be used for active queries for 30 days after it is saved, but after that, it needs to be stored for a longer period of time for auditing purposes. If the data is to be used for active queries, we can use BigQuery's Cloud Storage data query feature and move the data past 30 days to Coldline to build a cost-optimal solution. Therefore, the correct answer is as follows 1. Install the Cloud Logging agent on all instances. Create a sync that exports the logs to the region's Cloud Storage bucket. 3. Create an Object Lifecycle rule to move the files to the Coldline Cloud Storage bucket after one month. 4. 4. set up a bucket-level retention policy using bucket locking." https://cloud.google.com/logging/docs/agent/logging/installation https://cloud.google.com/logging/docs/export/configure_export_v2 https://cloud.google.com/bigquery/external-data-cloud-storage A - It should be archive (>= 365 days) and not coldline ( >= 90 days) - Proposed solution is more expensive that what is possible. Also no way to query unless you use BigQuery external tables. B & C - Wrong because CRON is not the way to do this. D - Wrong because data is deleted after 30 days and not retained for 2 years.

Answer 132

C. Dynamically resize the SSD persistent disk to 500 GB ## Footnote Answer is C because persistent disk performance is based on the total persistent disk capacity attached to an instance and the number of vCPUs that the instance has. Incrementing the persistent disk capacity will increment its throughput and IOPS, which in turn improve the performance of MySQL. C. Dynamically resize the SSD persistent disk to 500 GB: Increasing the disk size can improve the database's performance by providing more space for storing data and indexes. It can also help reduce I/O operations by enabling more data to be stored in memory. However, it depends on the current disk utilization and the rate at which data is being added to the database.

Answer 133

A. Use Google App Engine to serve the website and Google Cloud Datastore to store user data. C. Use a managed instance group to serve the website and Google Cloud Bigtable to store user data. ## Footnote A: Google App Engine is a fully managed platform for building and running web applications and APIs. It can automatically scale to meet high traffic demands, making it a good choice for serving the website for the promotional email campaign. Google Cloud Datastore can also scale automatically to meet high traffic demands, making it a good choice for storing user data. C: A managed instance group are managed as a single entity and can automatically scale up or down based on demand. This makes it a good choice for serving the website for the promotional email campaign. Google Cloud Bigtable is a fully managed, high-performance NoSQL database that can store and serve large amounts of structured data with low latency. It is designed to scale horizontally and can handle high traffic demands, making it a good choice for storing user data.

Answer 134

D. Deploy your application on App Engine flexible environment and use Cloud VPN to limit access to the on-premises database ## Footnote https://cloud.google.com/appengine/docs/the-appengine-environments https://cloud.google.com/appengine/docs/flexible/python/using-third-party-databases Standard requires more setup compared to Flexible. Standard Environment: To connect from the standard environment, you primarily use "Serverless VPC Access" which allows your App Engine app to reach your VPC network over private IP addresses without exposing it directly to the public internet. Flexible Environment: In the flexible environment, you can directly connect to your VPC network by deploying your app within the same VPC as your Cloud VPN gateway, enabling a more seamless connection using the private IP addresses of your network resources. I just had the same confusion. Serverless VPC Connector is something relatively newer than this question on the exam, so probably it's safer to assume that a VPC connection is not supported (at least directly) by App Engine Standard. Besides, this would add extra overhead, and would also increase the costs for the solution. Most of these questions haven't been updated or repurposed according to newer products and services. For this particular question, using a Serverless VPC Connector would add unnecessary complexity and the solution would become more expensive. I swore to god it was B lol, but after a few hours of reading the documentation, I changed my mind and switched to option D. You might want to do the same.

Answer 135

D. Use separate backend pools for each API path behind the load balancer ## Footnote D is the answer because HTTP(S) load balancer can direct traffic reaching a single IP to different backends based on the incoming URL. A is not correct because configuring a new load balancer would require a new or different SSL and DNS records which conflicts with the requirements to keep the same SSL and DNS records. B is not correct because it goes against the requirements. The company wants to keep the old API available while new customers and testers try the new API. C is not correct because it is not a requirement to decommission the implementation behind the old API. Moreover, it introduces unnecessary risk in case bugs or incompatibilities are discovered in the new API.

Answer 136

C. Create a new service account with BigQuery access and execute your script with that user ## Footnote C - service account is Google Cloud's best practice Access scopes are the legacy method of specifying permissions for your instance. read from > https://cloud.google.com/compute/docs/access/service-accounts . So , I would go with C

Answer 137

A. Create an aggregated export on the Production folder. Set the log sink to be a Cloud Storage bucket in an operations project. ## Footnote This solution will allow the operations team to store logs from all the production projects in your Organization, without including logs from other projects. All of the production projects are contained in a folder, so you can create an aggregated export on the Production folder. You can then set the log sink to be a Cloud Storage bucket in an operations project. This will allow the operations team to store all of the logs from the production projects in one place. Option B is not the correct solution because it creates an aggregated export on the Organization resource, which will capture logs from all projects in the Organization, including those outside the Production folder. Option C is not the correct solution because it requires you to create log exports in each production project, which can be time-consuming and error-prone. Additionally, setting the log sink to a Cloud Storage bucket in an operations project will not automatically capture logs for new production projects. Option D is not the correct solution because it requires you to create log exports in each production project, which can be time-consuming and error-prone. Additionally, storing the logs in BigQuery datasets in the production projects will not allow the operations team to easily access the logs. Instead, they would need to be granted IAM access to run queries on the datasets.

Answer 138

B. Make the tables time-partitioned, and configure the partition expiration at 45 days ## Footnote https://cloud.google.com/bigquery/docs/managing-tables#updating_a_tables_expiration_time When you delete a table, any data in the table is also deleted. To automatically delete tables after a specified period of time, set the default table expiration for the dataset or set the expiration time when you create the table.

Answer 139

A. Inspect the logs and metrics from the instances in Cloud Logging and Cloud Monitoring. ## Footnote First thing to do is to inspect logs and monitoring to see what is happening A is the only inpection. You want to inspect and find the underlying cause in order to solve the problem. B & D are possible solutions, not inspection. C is neither solution nor inspection. C will just lead to the issue again.

Answer 140

C. Roll back to an earlier known good release initially, then use Stackdriver Trace and Logging to diagnose the problem in a development/test/staging environment ## Footnote 1. Prioritize User Experience: Rolling back to a stable version quickly minimizes user impact and restores the application to a functional state. This should be the immediate first step. 2. Controlled Environment: Diagnosing the issue in a development/test/staging environment allows you to investigate without affecting real users. You can reproduce the problem, gather data, and test potential solutions safely. 3. Powerful Diagnostic Tools: Stackdriver Trace helps you pinpoint performance bottlenecks by tracing requests across your application. Stackdriver Logging provides detailed logs to understand application behavior and identify errors.

Answer 141

C. Configure Identity-Aware Proxy (IAP) for the instance and ensure that you have the role of IAP-secured Tunnel User. Use the gcloud command line tool to ssh into the instance. ## Footnote https://cloud.google.com/iap/docs/using-tcp-forwarding#tunneling_with_ssh

Answer 142

B. Google Kubernetes Engine with containers C. Google App Engine Standard Environment ## Footnote Option B, Google Kubernetes Engine (GKE) with containers, is a managed Kubernetes service that automatically manages and scales containerized applications. GKE handles cluster management tasks like scaling, upgrades, and security patches, allowing you to focus on the application itself. Option C, Google App Engine Standard Environment, is a fully managed platform for building and deploying applications. It automatically scales applications based on demand and provides a no-ops experience. With App Engine Standard Environment, you don't need to worry about infrastructure management, as Google handles it for you.

Answer 143

A. Google Cloud Dedicated Interconnect ## Footnote Google Cloud Dedicated Interconnect provides direct physical connections and RFC 1918 communication between your on-premises network and Google's network. Dedicated Interconnect enables you to transfer large amounts of data between networks, which can be more cost effective than purchasing additional bandwidth over the public Internet or using VPN tunnels. Benefits: -> Traffic between your on-premises network and your VPC network doesn't traverse the public Internet. Traffic traverses a dedicated connection with fewer hops, meaning there are less points of failure where traffic might get dropped or disrupted. -> Your VPC network's internal (RFC 1918) IP addresses are directly accessible from your on-premises network. You don't need to use a NAT device or VPN tunnel to reach internal IP addresses. Currently, you can only reach internal IP addresses over a dedicated connection. To reach Google external IP addresses, you must use a separate connection. -> You can scale your connection to Google based on your needs. Connection capacity is delivered over one or more 10 Gbps Ethernet connections, with a maximum of eight connections (80 Gbps total per interconnect) -> The cost of egress traffic from your VPC network to your on-premises network is reduced. A dedicated connection is generally the least expensive method if you have a high-volume of traffic to and from Google's network. https://cloud.google.com/interconnect/docs/details/dedicated

Answer 144

A. Create a VPC and connect it to your on-premises data center using Dedicated Interconnect.

Answer 145

A. Create a retention policy on the bucket for the duration of 5 years. Create a lock on the retention policy. ## Footnote o If a bucket has a retention policy, objects in the bucket can only be deleted or replaced once their age is greater than the retention period. o Once you lock a retention policy, you cannot remove it or reduce the retention period it has. https://cloud.google.com/storage/docs/bucket-lock#policy-locks

Answer 146

B. Google Cloud Bigtable ## Footnote Google Cloud Bigtable is a scalable, fully-managed NoSQL wide-column database that is suitable for both real-time access and analytics workloads. Good for: -> Low-latency read/write access -> High-throughput analytics -> Native time series support Common workloads: -> IoT, finance, adtech -> Personalization, recommendations -> Monitoring -> Geospatial datasets -> Graphs Incorrect Answers: C: Google Cloud Storage is a scalable, fully-managed, highly reliable, and cost-efficient object / blob store. Is good for: -> Images, pictures, and videos -> Objects and blobs -> Unstructured data D: Google Cloud Datastore is a scalable, fully-managed NoSQL document database for your web and mobile applications. Is good for: -> Semi-structured application data -> Hierarchical data -> Durable key-value data -> Common workloads: -> User profiles -> Product catalogs -> Game state Reference: https://cloud.google.com/storage-options/ Given the scenario, we need to select a storage system for click-data that can handle high traffic and large volumes of data. It should also be able to store the data for future analysis. A. Google Cloud SQL: Google Cloud SQL is a fully managed relational database service that uses MySQL or PostgreSQL. It is suitable for storing structured data and handling moderate traffic. However, it may not be the best option for storing click-data that requires high write rates and can quickly grow to large volumes. Additionally, it is not designed to handle unstructured data, which could be a requirement for click-data. Therefore, Google Cloud SQL is not the best option for this scenario. B. Google Cloud Bigtable: Google Cloud Bigtable is a scalable, fully managed NoSQL database service that can handle large volumes of structured and unstructured data. It is designed to handle high write rates and is ideal for storing click-data. With its ability to handle up to 8,500 clicks per second, it is the most suitable option for this scenario. C. Google Cloud Storage: Google Cloud Storage is a scalable object storage service that is designed for unstructured data. It can handle high volumes of data and can be used to store click-data. However, it may not be the best option for real-time data ingestion and analysis. Google Cloud Storage is best suited for storing data that does not require immediate access. D. Google Cloud Datastore: Google Cloud Datastore is a NoSQL document database service that is designed for storing structured data. It is suitable for handling moderate traffic and can handle data volumes of up to a few terabytes. However, it may not be the best option for storing click-data, which requires high write rates and can quickly grow to large volumes. In summary, the most suitable storage infrastructure for storing click-data in this scenario is Google Cloud Bigtable.

Answer 147

Deploy the application on two Compute Engine instance groups, each in the same project but in a different region. Use the first instance group to serve traffic, and use the HTTP load balancing service to fail over to the standby instance group in case of a disaster. ## Footnote o set up a load balancer with a Compute Engine backend, your VMs need to be in an instance group. The managed instance group provides VMs running the backend servers of an external HTTP load balancer Now you can use regional load balancer to route traffic to instance groups in different GCP projects. Welcome to cloud :-) https://cloud.google.com/blog/products/networking/cloud-load-balancing-gets-cross-project-service-referencing

Answer 148

D. Upload the data with gcloud storage cp B. Use the Data Transfer appliance to perform an offline migration. ## Footnote This Transfer Appliance docs says it is suitable when "It would take more than one week to upload your data over the network" Since 10TB would take way less than a week for that bandwidth, I would go for D https://cloud.google.com/transfer-appliance/docs/4.0/overview#suitability The current maximum object size supported by GCS is 5 TB, so it should be B

Answer 149

B. Write a lifecycle management rule in JSON and push it to the bucket with gsutil ## Footnote https://cloud.google.com/storage/docs/lifecycle To remove backup files older than 90 days from the Cloud Storage bucket and optimize ongoing Cloud Storage spend, you can use a lifecycle management rule. A lifecycle management rule defines the lifecycle of an object in a Cloud Storage bucket, and allows you to automate the deletion of older files. 1. Lifecycle Management: Google Cloud Storage offers built-in lifecycle management rules specifically designed for automated data retention and deletion. This is the most efficient and cost-effective way to manage your backup files. 2. JSON Format: Lifecycle rules are defined in JSON format. 3. gsutil: The gsutil command-line tool is used to interact with Cloud Storage, including setting lifecycle configuration.

Answer 150

D. 1. Create a managed instance group with Compute Engine instances. 2. Create a global load balancer and configure it with two backends: ג—‹ Managed instance group ג—‹ Cloud Storage bucket 3. Enable Cloud CDN on the bucket backend. ## Footnote The correct answer is: D. Create a managed instance group with Compute Engine instances. Create a global load balancer and configure it with two backends: Managed instance group, Cloud Storage bucket. Enable Cloud CDN on the bucket backend. This solution will improve the performance of the application by: Automatically scaling the number of Compute Engine instances to meet demand. Distributing traffic across multiple instances to reduce load on each instance. Caching popular songs in memory to reduce the number of times that they need to be loaded from Cloud Storage. Using a global load balancer to distribute traffic evenly across all regions. Using Cloud CDN to deliver files to users from a location that is closer to them. This solution is the most efficient and cost-effective way to improve the performance of the application. upvoted 10 times

Answer 151

C. Export logs to a Pub/Sub topic, and trigger Cloud Function with the relevant log events. ## Footnote https://cloud.google.com/blog/products/management-tools/automate-your-response-to-a-cloud-logging-event

Answer 152

B. Google Compute Engine managed instance groups with auto-scaling ## Footnote https://cloud.google.com/compute/docs/autoscaler/ Changing the tests as little as possible rules out C & D. Test takes several hours and you need to improve perfromace. Autocaling with MIG will do it Unmanaged group cannot autosacle. Load balancer will not improve perfromance A: The Load Balancer offers no benefit. C: Hadoop doesn't process C++ D: App Engine is for web apps.

Answer 153

A. Use a load testing tool to simulate the expected number of concurrent users and total requests to your application, and inspect the results. ## Footnote The correct answer is: A. Use a load testing tool to simulate the expected number of concurrent users and total requests to your application, and inspect the results. A load testing tool can be used to simulate the expected number of concurrent users and total requests to your application. This will allow you to test how your application handles the expected load and to identify any potential problems. Enabling autoscaling on the GKE cluster and enabling horizontal pod autoscaling on your application deployments will not help you to test the latency of your application. This will only help to ensure that your application can handle the expected load.

Answer 154

A. Use the Service Mesh visualization in the Cloud Console to inspect the telemetry between the microservices. ## Footnote The Anthos Service Mesh pages in the Google Cloud Console provide both summary and in-depth metrics, charts, and graphs that enable you to observe service behavior. You can monitor the overall health of your services, or drill down on a specific service to set a service level objective (SLO) or troubleshoot an issue. https://cloud.google.com/service-mesh/docs/observability/explore-dashboard

Answer 155

B. Mount a Local SSD volume as the backup location. After the backup is complete, use gsutil to move the backup to Google Cloud Storage. C. Use gcsfise to mount a Google Cloud Storage bucket as a volume directly on the instance and write backups to the mounted location using mysqldump. ## Footnote I think it's B. If you use a tool like GCFUSE it will write immediatly to GCS which is a cost benefit because you don't need intermediate storage. In this case however "Quickly as possible" key for understanding. GCFUSE will write to GCS which is much slower than writing directly to an added SSD. During the write to GCS it would also execute reads for a longer period on the production database. Therefor writing to the extra SSD would be my recommended solution. Offloading from the SSD to GCS would not impact the running database because the data is already separated. I think it's C (GCFUSE) We cannot attach and mount a local SSD to a running instance. "Because Local SSDs are located on the physical machine where your virtual machine instance is running, they can be created only during the instance creation process." The above is from https://cloud.google.com/compute/docs/disks/local-ssd#formatandmount

Answer 156

C. Use an IP range on Google Cloud that does not overlap with the range you use on-premises ## Footnote https://cloud.google.com/vpc/docs/using-vpc "Primary and secondary ranges can't conflict with on-premises IP ranges if you have connected your VPC network to another network with Cloud VPN, Dedicated Interconnect, or Partner Interconnect."

Answer 157

C. Ensure that a firewall rule exists to allow load balancer health checks to reach the instances in the instance group. ## Footnote A. Ensure that a firewall rules exists to allow source traffic on HTTP/HTTPS to reach the load balancer. >> not correct, load balancer is not the issue here. B. Assign a public IP to each instance and configure a firewall rule to allow the load balancer to reach the instance public IP. >> defeats the purpose of getting load balancers , not correct C. Ensure that a firewall rule exists to allow load balancer health checks to reach the instances in the instance group.>> Correct. if using different port then appropriate FW rule need to be setup to ensure LB can reach backend instances for healthcheck. if healthcheck traffic is blcked, instances will be marked unhealthy and will be restarted. D. Create a tag on each instance with the name of the load balancer. Configure a firewall rule with the name of the load balancer as the source and the instance tag as the destination.>> tagging is not useful here as the instance is not the source of traffic, just the port need to be opened on FW.

Answer 158

B. Google Cloud Dataflow ## Footnote 1. Unified Batch and Stream Processing: Dataflow is a fully managed service designed for both batch and stream data processing. This makes it ideal for your company's needs, as they require both hourly batch jobs and live stream processing. 2. No Existing Code: Dataflow provides a unified programming model and SDKs (Java, Python) for building data pipelines, which is beneficial since your company doesn't have existing code and needs to develop new solutions. 3. Serverless and Scalable: Dataflow is serverless, meaning you don't need to manage infrastructure. It automatically scales resources based on the workload, ensuring efficient processing of both batch and stream data. 4. Cost-Effective: Dataflow's autoscaling and pay-per-use model optimize costs by only utilizing resources when needed.

Answer 159

B. Revert the source code change, and rerun the deployment pipeline ## Footnote B. keyword is "self-healing" not "auto-healing" - which means MIG not used. So correct answer is B A. Log in to a server, and iterate on the fix locally >> Long step, hence eliminate B. Revert the source code change and rerun the deployment pipeline >> This revert will be logged in the source repo. Will go with this way although D also is correct. C. login to the servers with the bad code change, and swap in the previous code >> C is manually doing what can be automatically done by B and C, hence eliminate. D. Change the instance group template to the previous one and delete all instances >> This is similar to B but why manually do something which is automated. Hence eliminate. But is also correct. But B is better from code lifecycle perspective

Answer 160

D. Use an unmanaged instance group with an active and standby instance in different zones, use a regional persistent disk, and use a network load balancer in front of the instances. ## Footnote Since the Traffic is TCP, Ans A & C gets eliminated as HTTPS load balance is not supported. B - File storage system is Cloud Firestore which do not give full control, hence eliminated. D - Unmanaged instance group with network load balance with regional persistent disk for storage gives full control which is required for the migration. Since the application does not support horizontal scaling, a managed instance group is not required. Instead, an unmanaged instance group can be used to ensure that the application runs on multiple instances in different zones for high availability. The network load balancer is designed to handle TCP and UDP traffic The HTTP(S) load balancer is designed specifically for HTTP and HTTPS traffic

Answer 161

C. Make the container tag match the source code commit hash. ## Footnote Sephethus Most Recent 6 months, 3 weeks ago Selected Answer: C Linking Deployments to Commits: By tagging the container image with the source code commit hash, you create a direct link between the deployed container and the specific state of the source code. This provides a clear and auditable trail from the deployed application back to the exact source code that was used to build it. Auditability: Using the commit hash as the container tag ensures that each deployment can be traced back to a unique and immutable source code commit. This makes it easy to audit deployments and verify which version of the code is running in production.

Answer 162

D. Define a design for the security of data in your web application that meets GDPR requirements. ## Footnote The General Data Protection Regulation (GDPR) is a comprehensive data protection law that applies to any company that processes the personal data of individuals in the European Union (EU). As the technical architect of your web application, it is your responsibility to ensure that the application is compliant with GDPR requirements. https://cloud.google.com/security/gdpr The GDPR lays out specific requirements for businesses and organizations who are established in Europe or who serve users in Europe. It: Regulates how businesses can collect, use, and store personal data Builds upon current documentation and reporting requirements to increase accountability Authorizes fines on businesses who fail to meet its requirements Option A: While it is true that Google has various certifications and provides pass-on compliance when you use native features, simply using native features and services of Google Cloud Platform is not sufficient to ensure compliance with GDPR. You still need to implement appropriate controls and safeguards to protect personal data and meet GDPR requirements. Option B: Enabling the relevant GDPR compliance setting within the GCP console for each of the services in use within your application may help ensure compliance with GDPR, but it is not sufficient on its own. You still need to implement appropriate controls and safeguards to protect personal data and meet GDPR requirements. Option C: Using Cloud Security Scanner as part of your test planning strategy can help identify potential security vulnerabilities and compliance gaps in your web application, but it is not sufficient on its own to ensure compliance with GDPR. You still need to implement appropriate controls and safeguards to protect personal data and meet GDPR requirements.

Answer 163

C. Create a second GKE cluster in asia-southeast1, and use kubemci to create a global HTTP(s) load balancer. ## Footnote Rzla 2 years, 9 months ago Problem with A is that a service load bancer is not l7 https. The question is outdated, the answer will have been C. Now it would be Anthos multi cluster ingress - https://cloud.google.com/kubernetes-engine/docs/concepts/multi-cluster-ingress

Answer 164

A. In the Cloud Platform Console, increase the size of the persistent disk and use the resize2fs command in Linux. ## Footnote 1. Online Resizing: Google Cloud Platform allows you to increase the size of a persistent disk while it's attached to a running VM. This means you don't need to shut down the database server. 2. resize2fs: This Linux command extends the file system to utilize the newly added space on the disk. It can be run while the file system is mounted, minimizing downtime

Answer 165

C. 1. Attach a regional SSD persistent disk to the first instance. 2. In case of a zone outage, force-attach the disk to the other instance. ## Footnote https://cloud.google.com/compute/docs/disks/repd-failover

Answer 166

B. Org viewer, project viewer ## Footnote A is not correct because Project owner is too broad. The security team does not need to be able to make changes to projects. B is correct because:-Org viewer grants the security team permissions to view the organization's display name. -Project viewer grants the security team permissions to see the resources within projects. C is not correct because Org admin is too broad. The security team does not need to be able to make changes to the organization. D is not correct because Project owner is too broad. The security team does not need to be able to make changes to projects.

Answer 167

A. Deploy a new revision to Cloud Run with the new version. Configure traffic percentage between revisions. ## Footnote o Each deployment to a service creates a revision. A revision consists of a specific container image, along with environment settings such as environment variables, memory limits, or concurrency value. o Once the new revision is deployed to a Service you can manage the traffic using MANAGE TRAFFIC option inside the revision tab https://cloud.google.com/run/docs/resource-model Cloud Run for Anthos allows you to deploy new revisions of your application with a specific percentage of traffic, which allows you to perform a gradual rollout of the new version. To do this, you can follow these steps: Deploy a new revision of your application to Cloud Run with the new version. In the Cloud Run for Anthos console, navigate to the service that you want to roll out the new version for. In the "Revisions" tab, you should see the new revision listed alongside the current revision. Use the traffic percentage slider to specify the percentage of traffic that you want to send to the new revision. You can set the percentage to a small value initially, such as 5%, and gradually increase it over time as you evaluate the new version. Once you have set the traffic percentage, Cloud Run for Anthos will start directing a portion of the traffic to the new revision, allowing you to evaluate the new version with a subset of production traffic.

Answer 168

B. Create a key with Cloud Key Management Service (KMS). Set the encryption key on the bucket to the Cloud KMS key. ## Footnote https://cloud.google.com/storage/docs/encryption/customer-managed-keys#key-rotation Key rotation Cloud KMS supports both automatic and manual key rotation to a new version. After rotating a key, Cloud Storage uses the new version for all operations that encrypt using the key, such as: Object uploads when the destination bucket uses the key as its default encryption key. Object upload, copy, and rewrite operations that specifically use the key in the operation. Previous versions of the key are not disabled or destroyed, so Cloud Storage can still decrypt existing objects that were previously encrypted using those versions.

Answer 169

D. Instrument your application with Stackdriver Trace in order to break down the request latencies at each microservice ## Footnote https://cloud.google.com/trace/docs/quickstart#find_a_trace In a microservices-based application, a single API request can traverse multiple services. Therefore, when a small number of API requests take a very long time, it becomes difficult to identify the bottleneck or the service that is causing the delay. In order to identify the problematic service, it is important to instrument the application with a performance monitoring and tracing tool. Option A suggests setting timeouts on the application so that requests fail faster. While this can help reduce the overall response time for the user, it does not provide insights into the specific service that is causing the delay. Option B suggests sending custom metrics for each request to Stackdriver Monitoring. This can help identify patterns in request latency and can provide insights into which requests are taking the longest. However, it does not specifically identify the service that is causing the delay. Option C suggests using Stackdriver Monitoring to look for insights when API latencies are high. While this can help identify when the API is experiencing high latency, it does not provide insights into the specific service that is causing the delay. Option D is the correct answer. It suggests instrumenting the application with Stackdriver Trace to break down request latencies at each microservice. Stackdriver Trace can help identify the performance of each service in the microservices-based application and provide insights into which service is causing the delay. This can help identify the root cause of the delay and help in optimizing the service. Therefore, option D is the best approach to identify the problematic service.

Answer 170

B. Create a Dataproc cluster using preemptible worker instances. ## Footnote Should be B, you want to minimize costs. https://cloud.google.com/dataproc/docs/concepts/compute/secondary-vms#preemptible_and_non-preemptible_secondary_workers Agree, the migration guide also recommends to think about preemptible worker nodes: https://cloud.google.com/architecture/hadoop/hadoop-gcp-migration-jobs#using_preemptible_worker_nodes Using preemptible worker nodes You can gain low-cost processing power for your jobs by adding preemptible worker nodes to your cluster. These nodes use preemptible virtual machines. Consider the inherent unreliability of preemptible nodes before choosing to use them. Dataproc attempts to smoothly handle preemption, but jobs might fail if they lose too many nodes. Only use preemptible nodes for jobs that are fault-tolerant or that are low enough priority that occasional job failure won't disrupt your business. If you decide to use preemptible worker nodes, consider the ratio of regular nodes to preemptible nodes. There is no universal formula to get the best results, but in general, the more preemptible nodes you use relative to standard nodes, the higher the chances are that the job won't have enough nodes to complete the task. You can determine the best ratio of preemptible to regular nodes for a job by experimenting with different ratios and analyzing the results. Note that SSDs are not available on preemptible worker nodes. If you use SSDs on your dedicated nodes, any preemptible worker nodes that you use will match every other aspect of the dedicated nodes, but will have no SSDs available.

Topic 1 Flashcards

(194 cards)