Weekly Consultation 10 CC-39

You are required to set up a secure and dedicated connection between your on-premises data center and your Google Cloud VPC for a latency-sensitive application. Your solution must also support high throughput. Which option should you choose?

• Implement Cloud CDN to optimize network latency and increase throughput.

• Establish a VPC Peering connection with the on-premises data center.

• Use Cloud VPN with a high-availability configuration to ensure a stable connection.

• Provision a Cloud Interconnect - Dedicated connection for a direct physical link.

Answer explanation

Cloud Interconnect - Dedicated provides a direct physical connection between Google Cloud and on-premises infrastructure, offering the lowest latency and highest throughput, making it the best choice for such applications.

You need to deploy an application on Google Cloud that reacts to Cloud Pub/Sub events. Which of the following is the most appropriate service to use for this purpose?

• Compute Engine

• Google Kubernetes Engine

• Cloud Storage

• Cloud Functions

Answer explanation

Cloud Functions is a serverless execution environment for building and connecting cloud services. It allows you to execute your code in response to events without having to manage the underlying infrastructure. It is particularly well-suited to handling Cloud Pub/Sub events.

You are tasked with designing a multi-region, highly available application architecture on Google Cloud Platform (GCP). The application requires low-latency access to a globally distributed relational database. Which GCP service would you recommend for achieving this requirement?

• Cloud SQL

• Cloud Spanner

• Firestore

• Bigtable

Answer explanation

Cloud Spanner is the recommended GCP service for achieving low-latency access to a globally distributed database in a multi-region, highly available architecture. It is a globally distributed relational database service designed to provide strong consistency, horizontal scalability, and high availability across multiple regions and continents.

An associate cloud engineer is working with Cloud Shell. What's the accurate description of Cloud Shell's persistence behavior?

• Cloud Shell instances are ephemeral, and all changes including home directory modifications are lost after each session.

• Cloud Shell provides a persistent 5GB home directory that remains across sessions.

• Cloud Shell provides a persistent 1GB home directory that remains across sessions.

• Cloud Shell instances persist indefinitely until they are manually stopped.

Answer explanation

Cloud Shell offers users a persistent 5GB home directory that is stored in Google Cloud Storage. This allows for the persistence of files across sessions.

A company has decided to store their data in Cloud Storage and needs to estimate the costs. They expect to store 200 TB of data per month in a multi-regional bucket and the data will be stored for a year. Which of the following options is the most appropriate way to calculate the estimated costs of this data storage?

• Use the Google Cloud Console to estimate the costs.

• Use the Google Cloud Pricing Calculator by entering the number of GBs to be stored.

• Use the Google Cloud Functions to calculate the cost.

• Use the Storage Pricing Page directly to calculate costs.

Answer explanation

The Google Cloud Pricing Calculator allows you to estimate your monthly cloud bill by providing the anticipated resources. In this case, the company can input their expected storage in TBs to get an estimate of the cost.

As an associate cloud engineer working on Google Cloud Platform, one of your tasks is to ensure that best practices are being followed within your organization. Which of the following actions aligns with Google Cloud's best practices for identity and access management?

• Assign roles based on the principle of least privilege.

• Create custom roles for all users to provide more granular access control.

• Grant users the broadest possible roles so they can perform all necessary tasks.

• Always assign roles at the project level, rather than at the resource level.

Answer explanation

The principle of least privilege suggests that users should be granted only the permissions they need to perform their tasks. This minimizes the potential damage from accidents or compromises.

As a cloud associate engineer, you are tasked with designing and implementing a Google Cloud environment for a new project. Which of the following best represents a Google Cloud best practice?

• Only use single-zone storage for critical data to minimize storage costs.

• Regularly create and review audit logs to track service usage.

• Use a single Virtual Private Cloud (VPC) for all projects to simplify network design.

• Assign all team members the Owner role to simplify permissions management.

Answer explanation

Regularly creating and reviewing audit logs is a best practice for maintaining security and visibility over your Google Cloud environment. Audit logs provide a record of the activities in your Google Cloud projects and allow you to analyze and act upon any suspicious activity.

You are deploying a solution from the Google Cloud Marketplace to your Google Cloud Project. Which of the following statements correctly describes the process?

• You can only deploy solutions to projects in the same region as the Cloud Marketplace.

• Solutions in the Cloud Marketplace are solely developed by Google.

• The Google Cloud Marketplace allows you to deploy pre-configured applications and development stacks.

• You must manually manage all updates for applications installed from the Cloud Marketplace.

Answer explanation

Google Cloud Marketplace provides pre-configured and ready-to-go solutions, which includes both applications and development stacks. These solutions can be quickly deployed to your Google Cloud environment, saving you time and resources.

You are designing a network in Google Cloud VPC and need to divide your network range into several smaller ranges. Your organization requires that all services should be isolated for security purposes. Which of the following options should you choose?

• Use Shared VPC

• Use Subnets

• Use Network Peering

• Use Firewall Rules

Answer explanation

In Google Cloud VPC, a subnet is a range of IP addresses in your VPC. You can launch Google Cloud resources into a specified subnet. Subnets allow you to segment your network, improve security and isolation, reduce congestion, and improve network performance, which matches the requirements in the question.

You are an associate cloud engineer working on a Google Cloud Platform (GCP) project. You have several service accounts each with varying roles across different projects in your organization. One service account, named "service-account-1," is running an application on a Compute Engine instance and needs to access a Cloud Storage bucket, named "bucket-1," from another project.

• Assign the Storage Object Viewer role to "service-account-1" specifically on "bucket-1".

• Create a new custom role with all storage permissions and assign it to "service-account-1" at the project level.

• Assign the Storage Admin role to "service-account-1" at the organization level.

• Assign the Viewer role to "service-account-1" at the project level of the project that owns "bucket-1".

Answer explanation

Storage Object Viewer allows a service account to view objects in a specific bucket without the ability to modify or delete them. This adheres to the principle of least privilege by providing just the necessary access to "service-account-1".