Google Associate-Cloud-Engineer 問題集

質問 1：
You are deploying an application to Google Kubernetes Engine (GKE) that needs to call an external third- party API. You need to provide the external API vendor with a list of IP addresses for their firewall to allow traffic from your application. You want to follow Google-recommended practices and avoid any risk of interrupting traffic to the API due to IP address changes. What should you do?
A. Configure your GKE cluster with one node, and set the node to have a static external IP address. Ensure that the GKE cluster autoscaler is off. Send the external IP address of the node to the vendor to be added to the allowlist.
B. Configure your GKE cluster with private nodes. Configure a Cloud NAT instance with dynamic IP addresses. Provide these IP addresses to the vendor to be added to the allowlist.
C. Configure your GKE cluster with public nodes. Write a Cloud Function that pulls the public IP addresses of each node in the cluster. Trigger the function to run every day with Cloud Scheduler. Send the list to the vendor by email every day.
D. Configure your GKE cluster with private nodes. Configure a Cloud NAT instance with static IP addresses. Provide these IP addresses to the vendor to be added to the allowlist.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 2：
You need to host an application on a Compute Engine instance in a project shared with other teams. You want to prevent the other teams from accidentally causing downtime on that application. Which feature should you use?
A. Enable deletion protection on the instance.
B. Use a sole-tenant node.
C. Use a Shielded VM.
D. Use a Preemptible VM.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 3：
(You are managing the security configuration of your company's Google Cloud organization. The Operations team needs specific permissions on both a Google Kubernetes Engine (GKE) cluster and a Cloud SQL instance. Two predefined Identity and Access Management (IAM) roles exist that contain a subset of the permissions needed by the team. You need to configure the necessary IAM permissions for this team while following Google-recommended practices. What should you do?)
A. Create a custom IAM role that combines the permissions from the two relevant predefined roles.
B. Grant the team the two predefined IAM roles.
C. Create a custom IAM role that includes only the required permissions from the predefined roles.
D. Grant the team the IAM roles of Kubernetes Engine Admin and Cloud SQL Admin.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 4：
(You are migrating your company's on-premises compute resources to Google Cloud. You need to deploy batch processing jobs that run every night. The jobs require significant CPU and memory for several hours but can tolerate interruptions. You must ensure that the deployment is cost-effective. What should you do?)
A. Containerize the batch processing jobs and deploy them on Compute Engine.
B. Use custom machine types on Compute Engine.
C. Use Spot VMs on Compute Engine.
D. Use the M1 machine series on Compute Engine.
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Your company's infrastructure is on-premises, but all machines are running at maximum capacity. You want to burst to Google Cloud. The workloads on Google Cloud must be able to directly communicate to the workloads on-premises using a private IP range. What should you do?
A. In Google Cloud, configure the VPC for VPC Network Peering.
B. Set up Cloud VPN between the infrastructure on-premises and Google Cloud.
C. In Google Cloud, configure the VPC as a host for Shared VPC.
D. Create bastion hosts both in your on-premises environment and on Google Cloud. Configure both as proxy servers using their public IP addresses.
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 6：
You need to set up permissions for a set of Compute Engine instances to enable them to write data into a particular Cloud Storage bucket. You want to follow Google-recommended practices. What should you do?
A. Create a service account and add it to the IAM role 'storage.objectCreator' for that bucket.
B. Create a service account with an access scope. Use the access scope 'https://www.googleapis.com/auth
/cloud-platform'.
C. Create a service account and add it to the IAM role 'storage.objectAdmin' for that bucket.
D. Create a service account with an access scope. Use the access scope 'https://www.googleapis.com/auth
/devstorage.write_only'.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 7：
Your company wants to standardize the creation and management of multiple Google Cloud resources using Infrastructure as Code. You want to minimize the amount of repetitive code needed to manage the environment What should you do?
A. Develop templates for the environment using Cloud Deployment Manager
B. Create a bash script that contains all requirement steps as gcloud commands
C. Use the Cloud Console interface to provision and manage all related resources
D. Use curl in a terminal to send a REST request to the relevant Google API for each individual resource.
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 8：
You just installed the Google Cloud CLI on your new corporate laptop. You need to list the existing instances of your company on Google Cloud. What must you do before you run the gcloud compute instances list command?
Choose 2 answers
A. Run gcloud auth login, enter your login credentials in the dialog window, and paste the received login token to gcloud CLI.
B. Run gcloud config set project $my_project to set the default project for gcloud CLI.
C. Create a Google Cloud service account, and download the service account key. Place the key file in a folder on your machine where gcloud CLI can find it.
D. Download your Cloud Identity user account key. Place the key file in a folder on your machine where gcloud CLI can find it.
E. Run gcloud config set compute/zone $my_zone to set the default zone for gcloud CLI.
正解：A,B
解説: (Topexam メンバーにのみ表示されます)

質問 9：
Your auditor wants to view your organization's use of data in Google Cloud. The auditor is most interested in auditing who accessed data in Cloud Storage buckets. You need to help the auditor access the data they need.
What should you do?
A. Use the export logs API to provide the Admin Activity Audit Logs in the format they want
B. Turn on Data Access Logs for the buckets they want to audit, and Then build a query in the log viewer that filters on Cloud Storage
C. Assign the appropriate permissions, and then use Cloud Monitoring to review metrics
D. Assign the appropriate permissions, and then create a Data Studio report on Admin Activity Audit Logs
正解：B
解説: (Topexam メンバーにのみ表示されます)