GCP Associate 덤프 문제 51 ~ 100

https://www.examtopics.com/exams/google/associate-cloud-engineer/view/

Associate Cloud Engineer Exam - Free Actual Q&As, Page 1 | ExamTopics

 

위의 GCP Associate 덤프 문제에 대한 풀의를 한다.

 

51. You need to create an autoscaling managed instance group for an HTTPS web application. You want to make sure that unhealthy VMs are recreated. What should you do?

• A. Create a health check on port 443 and use that when creating the Managed Instance Group.
• B. Select Multi-Zone instead of Single-Zone when creating the Managed Instance Group.
• C. In the Instance Template, add the label 'health-check'.
• D. In the Instance Template, add a startup script that sends a heartbeat to the metadata server.

Managed Instance Group(MIG)은 헬스 체크를 기반으로 VM의 상태를 모니터링하며, VM이 비정상적이면 자동으로 대체한다. HTTPS 웹 애플리케이션이므로 포트 443에서 헬스 체크를 설정해야 한다.

정답 A

52. Your company has a Google Cloud Platform project that uses BigQuery for data warehousing. Your data science team changes frequently and has few members. You need to allow members of this team to perform queries. You want to follow Google-recommended practices. What should you do?

• A. 1. Create an IAM entry for each data scientist's user account. 2. Assign the BigQuery jobUser role to the group.
• B. 1. Create an IAM entry for each data scientist's user account. 2. Assign the BigQuery dataViewer user role to the group.
• C. 1. Create a dedicated Google group in Cloud Identity. 2. Add each data scientist's user account to the group. 3. Assign the BigQuery jobUser role to the group.
• D. 1. Create a dedicated Google group in Cloud Identity. 2. Add each data scientist's user account to the group. 3. Assign the BigQuery dataViewer user role to the group.

Google의 권장사항에 따르면, 개별 사용자에게 직접 IAM 역할을 할당하는 것은 관리가 어렵기 때문에 Google Group을 활용하는 것이 좋다.

jobUser 역할은 BigQuery에서 쿼리를 실행하는 역할이므로, 데이터 과학 팀이 쿼리를 실행할 수 있도록 적절한 권한을 부여한다.

dataViewer 역할은 데이터를 조회하는 권한만 부여한다.

정답 C

53. Your company has a 3-tier solution running on Compute Engine. The configuration of the current infrastructure is shown below.

Each tier has a service account that is associated with all instances within it. You need to enable communication on TCP port 8080 between tiers as follows:
* Instances in tier #1 must communicate with tier #2.
* Instances in tier #2 must communicate with tier #3.
What should you do?

• A. 1. Create an ingress firewall rule with the following settings: ג€¢ Targets: all instances ג€¢ Source filter: IP ranges (with the range set to 10.0.2.0/24) ג€¢ Protocols: allow all 2. Create an ingress firewall rule with the following settings: ג€¢ Targets: all instances ג€¢ Source filter: IP ranges (with the range set to 10.0.1.0/24) ג€¢ Protocols: allow all
• B. 1. Create an ingress firewall rule with the following settings: ג€¢ Targets: all instances with tier #2 service account ג€¢ Source filter: all instances with tier #1 service account ג€¢ Protocols: allow TCP:8080 2. Create an ingress firewall rule with the following settings: ג€¢ Targets: all instances with tier #3 service account ג€¢ Source filter: all instances with tier #2 service account ג€¢ Protocols: allow TCP: 8080
• C. 1. Create an ingress firewall rule with the following settings: ג€¢ Targets: all instances with tier #2 service account ג€¢ Source filter: all instances with tier #1 service account ג€¢ Protocols: allow all 2. Create an ingress firewall rule with the following settings: ג€¢ Targets: all instances with tier #3 service account ג€¢ Source filter: all instances with tier #2 service account ג€¢ Protocols: allow all
• D. 1. Create an egress firewall rule with the following settings: ג€¢ Targets: all instances ג€¢ Source filter: IP ranges (with the range set to 10.0.2.0/24) ג€¢ Protocols: allow TCP: 8080 2. Create an egress firewall rule with the following settings: ג€¢ Targets: all instances ג€¢ Source filter: IP ranges (with the range set to 10.0.1.0/24) ג€¢ Protocols: allow TCP: 8080

보안 원칙상 서비스 계정을 기반으로 접근을 제어하는 것이 더 안전하다.
Ingress 방화벽 규칙을 설정하여 특정 서비스 계정에서만 8080 포트를 허용하면 더 보안성이 높다.

정답 B

54. You are given a project with a single Virtual Private Cloud (VPC) and a single subnetwork in the us-central1 region. There is a Compute Engine instance hosting an application in this subnetwork. You need to deploy a new instance in the same project in the europe-west1 region. This new instance needs access to the application. You want to follow Google-recommended practices. What should you do?

• A. 1. Create a subnetwork in the same VPC, in europe-west1. 2. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint.
• B. 1. Create a VPC and a subnetwork in europe-west1. 2. Expose the application with an internal load balancer. 3. Create the new instance in the new subnetwork and use the load balancer's address as the endpoint.
• C. 1. Create a subnetwork in the same VPC, in europe-west1. 2. Use Cloud VPN to connect the two subnetworks. 3. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint.
• D. 1. Create a VPC and a subnetwork in europe-west1. 2. Peer the 2 VPCs. 3. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint.

GCP에서는 동일한 VPC 내에 서브넷을 생성하면 기본적으로 내부 통신이 가능하다.
리전이 다르더라도 동일한 VPC 내의 서브넷 간에는 별도의 라우팅 없이 내부 IP를 사용할 수 있다.

정답 A

55. Your projects incurred more costs than you expected last month. Your research reveals that a development GKE container emitted a huge number of logs, which resulted in higher costs. You want to disable the logs quickly using the minimum number of steps. What should you do?

• A. 1. Go to the Logs ingestion window in Stackdriver Logging, and disable the log source for the GKE container resource.
• B. 1. Go to the Logs ingestion window in Stackdriver Logging, and disable the log source for the GKE Cluster Operations resource.
• C. 1. Go to the GKE console, and delete existing clusters. 2. Recreate a new cluster. 3. Clear the option to enable legacy Stackdriver Logging.
• D. 1. Go to the GKE console, and delete existing clusters. 2. Recreate a new cluster. 3. Clear the option to enable legacy Stackdriver Monitoring.

Stackdriver Logging에서 특정 로그 소스를 비활성화하면 로그 저장 비용을 줄일 수 있다.

정답 A

56. You have a website hosted on App Engine standard environment. You want 1% of your users to see a new test version of the website. You want to minimize complexity. What should you do?

• A. Deploy the new version in the same application and use the --migrate option.
• B. Deploy the new version in the same application and use the --splits option to give a weight of 99 to the current version and a weight of 1 to the new version.
• C. Create a new App Engine application in the same project. Deploy the new version in that application. Use the App Engine library to proxy 1% of the requests to the new version.
• D. Create a new App Engine application in the same project. Deploy the new version in that application. Configure your network load balancer to send 1% of the traffic to that new application.

App Engine은 트래픽 스플리팅 기능을 제공하며, 특정 비율의 사용자만 새로운 버전으로 라우팅할 수 있다.
--splits 옵션을 사용하면 새로운 버전과 기존 버전 간의 트래픽을 비율에 맞춰 자동으로 분배할 수 있다.

정답 B

57. You have a web application deployed as a managed instance group. You have a new version of the application to gradually deploy. Your web application is currently receiving live web traffic. You want to ensure that the available capacity does not decrease during the deployment. What should you do?

• A. Perform a rolling-action start-update with maxSurge set to 0 and maxUnavailable set to 1.
• B. Perform a rolling-action start-update with maxSurge set to 1 and maxUnavailable set to 0.
• C. Create a new managed instance group with an updated instance template. Add the group to the backend service for the load balancer. When all instances in the new managed instance group are healthy, delete the old managed instance group.
• D. Create a new instance template with the new application version. Update the existing managed instance group with the new instance template. Delete the instances in the managed instance group to allow the managed instance group to recreate the instance using the new instance template.

Rolling update를 수행할 때, maxSurge와 maxUnavailable 값을 적절히 조정해야 한다.
maxSurge = 1: 한 번에 1개의 새로운 인스턴스를 추가하면서 업데이트 진행한다.
maxUnavailable = 0: 업데이트 중에 사용할 수 없는 인스턴스의 수로 0인 경우 기존 인스턴스를 삭제하지 않고 새로운 인스턴스가 완전히 준비될 때까지 유지된다.

정답 B

58. You are building an application that stores relational data from users. Users across the globe will use this application. Your CTO is concerned about the scaling requirements because the size of the user base is unknown. You need to implement a database solution that can scale with your user growth with minimum configuration changes. Which storage solution should you use?

• A. Cloud SQL
• B. Cloud Spanner
• C. Cloud Firestore
• D. Cloud Datastore

Cloud SQL은 단일 지역(MySQL, PostgreSQL, SQL Server 기반)으로 운영되며, 수직 확장만 가능하여 대규모 글로벌 트래픽을 처리하기 어렵다.

Cloud Spanner는 수평 확장이 가능한 유일한 관계형 데이터베이스 서비스이며, 글로벌 데이터베이스 시스템을 구축하는 데 적합하다.

Cloud Firestore와 Cloud Datastore는 NoSQL 문서형 데이터베이스이다.

정답 B

59. You are the organization and billing administrator for your company. The engineering team has the Project Creator role on the organization. You do not want the engineering team to be able to link projects to the billing account. Only the finance team should be able to link a project to a billing account, but they should not be able to make any other changes to projects. What should you do?

• A. Assign the finance team only the Billing Account User role on the billing account.
• B. Assign the engineering team only the Billing Account User role on the billing account.
• C. Assign the finance team the Billing Account User role on the billing account and the Project Billing Manager role on the organization.
• D. Assign the engineering team the Billing Account User role on the billing account and the Project Billing Manager role on the organization.

Billing Account User: 특정 결제 계정에서 프로젝트를 연결할 수 있는 권한을 제공.
Project Billing Manager: 프로젝트의 결제 계정을 변경할 수 있는 권한을 부여.

정답 C

60. You have an application running in Google Kubernetes Engine (GKE) with cluster autoscaling enabled. The application exposes a TCP endpoint. There are several replicas of this application. You have a Compute Engine instance in the same region, but in another Virtual Private Cloud (VPC), called gce-network, that has no overlapping IP ranges with the first VPC. This instance needs to connect to the application on GKE. You want to minimize effort. What should you do?

• A. 1. In GKE, create a Service of type LoadBalancer that uses the application's Pods as backend. 2. Set the service's externalTrafficPolicy to Cluster. 3. Configure the Compute Engine instance to use the address of the load balancer that has been created.
• B. 1. In GKE, create a Service of type NodePort that uses the application's Pods as backend. 2. Create a Compute Engine instance called proxy with 2 network interfaces, one in each VPC. 3. Use iptables on this instance to forward traffic from gce-network to the GKE nodes. 4. Configure the Compute Engine instance to use the address of proxy in gce-network as endpoint.
• C. 1. In GKE, create a Service of type LoadBalancer that uses the application's Pods as backend. 2. Add an annotation to this service: cloud.google.com/load-balancer-type: Internal 3. Peer the two VPCs together. 4. Configure the Compute Engine instance to use the address of the load balancer that has been created.
• D. 1. In GKE, create a Service of type LoadBalancer that uses the application's Pods as backend. 2. Add a Cloud Armor Security Policy to the load balancer that whitelists the internal IPs of the MIG's instances. 3. Configure the Compute Engine instance to use the address of the load balancer that has been created.

GKE에서 내부 트래픽을 처리하기 위한 Internal Load Balancer를 사용해야 한다.
현재 두 인스턴스가 다른 VPC에 있기 때문에 VPC Peering이 필요하다. VPC Peering을 설정하면 서로 다른 VPC에 있는 인스턴스들이 내부 IP를 사용하여 통신할 수 있다.
Compute Engine 인스턴스는 Internal Load Balancer의 IP를 사용하여 GKE 애플리케이션과 통신할 수 있음.

정답 C

61. Your organization is a financial company that needs to store audit log files for 3 years. Your organization has hundreds of Google Cloud projects. You need to implement a cost-effective approach for log file retention. What should you do?

• A. Create an export to the sink that saves logs from Cloud Audit to BigQuery.
• B. Create an export to the sink that saves logs from Cloud Audit to a Coldline Storage bucket.
• C. Write a custom script that uses logging API to copy the logs from Stackdriver logs to BigQuery.
• D. Export these logs to Cloud Pub/Sub and write a Cloud Dataflow pipeline to store logs to Cloud SQL.

Cloud Storage의 Coldline Storage는 장기 보관용 스토리지이며, 조회 빈도가 낮은 데이터에 적합하다.

정답 B

62. You want to run a single caching HTTP reverse proxy on GCP for a latency-sensitive website. This specific reverse proxy consumes almost no CPU. You want to have a 30-GB in-memory cache, and need an additional 2 GB of memory for the rest of the processes. You want to minimize cost. How should you run this reverse proxy?

• A. Create a Cloud Memorystore for Redis instance with 32-GB capacity.
• B. Run it on Compute Engine, and choose a custom instance type with 6 vCPUs and 32 GB of memory.
• C. Package it in a container image, and run it on Kubernetes Engine, using n1-standard-32 instances as nodes.
• D. Run it on Compute Engine, choose the instance type n1-standard-1, and add an SSD persistent disk of 32 GB.

Cloud Memorystore for Redis는 메모리 내 데이터 캐싱을 지원하며, HTTP Reverse Proxy에서 요청을 빠르게 제공할 수 있다.

정답 A

63. You are hosting an application on bare-metal servers in your own data center. The application needs access to Cloud Storage. However, security policies prevent the servers hosting the application from having public IP addresses or access to the internet. You want to follow Google-recommended practices to provide the application with access to Cloud Storage. What should you do?

• A. 1. Use nslookup to get the IP address for storage.googleapis.com. 2. Negotiate with the security team to be able to give a public IP address to the servers. 3. Only allow egress traffic from those servers to the IP addresses for storage.googleapis.com.
• B. 1. Using Cloud VPN, create a VPN tunnel to a Virtual Private Cloud (VPC) in Google Cloud. 2. In this VPC, create a Compute Engine instance and install the Squid proxy server on this instance. 3. Configure your servers to use that instance as a proxy to access Cloud Storage.
• C. 1. Use Migrate for Compute Engine (formerly known as Velostrata) to migrate those servers to Compute Engine. 2. Create an internal load balancer (ILB) that uses storage.googleapis.com as backend. 3. Configure your new instances to use this ILB as proxy.
• D. 1. Using Cloud VPN or Interconnect, create a tunnel to a VPC in Google Cloud. 2. Use Cloud Router to create a custom route advertisement for 199.36.153.4/30. Announce that network to your on-premises network through the VPN tunnel. 3. In your on-premises network, configure your DNS server to resolve *.googleapis.com as a CNAME to restricted.googleapis.com.

온프레미스 환경에서 공인 IP 없이 Cloud Storage에 접근해야 하므로 restricted.googleapis.com을 사용해야 한다.
Cloud VPN 또는 Dedicated Interconnect를 사용하여 Google Cloud와 온프레미스 네트워크 간의 전용 연결을 설정을 해야한다.
Cloud Router를 통해 특정 IP 범위를 온프레미스 네트워크에 알린다.
온프레미스 DNS에서 *.googleapis.com을 restricted.googleapis.com으로 CNAME 지정하면 내부 네트워크에서도 GCP API에 접근 가능할 수 있게 한다.

정답 D

64. You want to deploy an application on Cloud Run that processes messages from a Cloud Pub/Sub topic. You want to follow Google-recommended practices. What should you do?

• A. 1. Create a Cloud Function that uses a Cloud Pub/Sub trigger on that topic. 2. Call your application on Cloud Run from the Cloud Function for every message.
• B. 1. Grant the Pub/Sub Subscriber role to the service account used by Cloud Run. 2. Create a Cloud Pub/Sub subscription for that topic. 3. Make your application pull messages from that subscription.
• C. 1. Create a service account. 2. Give the Cloud Run Invoker role to that service account for your Cloud Run application. 3. Create a Cloud Pub/Sub subscription that uses that service account and uses your Cloud Run application as the push endpoint.
• D. 1. Deploy your application on Cloud Run on GKE with the connectivity set to Internal. 2. Create a Cloud Pub/Sub subscription for that topic. 3. In the same Google Kubernetes Engine cluster as your application, deploy a container that takes the messages and sends them to your application.

Cloud Run Invoker 역할을 사용하여 Pub/Sub이 Cloud Run을 호출할 수 있도록 권한을 부여한다.

Cloud Run은 서버리스 환경이므로 지속적인 Pull 방식은 비효율적이며, 푸시 방식을 사용하는 것이 권장된다.

정답 C

65. You need to deploy an application, which is packaged in a container image, in a new project. The application exposes an HTTP endpoint and receives very few requests per day. You want to minimize costs. What should you do?

• A. Deploy the container on Cloud Run.
• B. Deploy the container on Cloud Run on GKE.
• C. Deploy the container on App Engine Flexible.
• D. Deploy the container on GKE with cluster autoscaling and horizontal pod autoscaling enabled.

Cloud Run은 이벤트 기반으로 실행되며, 요청이 없을 때는 비용이 발생하지 않는다.

다른 것들은 유지하는데 비용이 발생하기 때문에 Cloud Run이 가장 적합하다.

정답 A

66. Your company has an existing GCP organization with hundreds of projects and a billing account. Your company recently acquired another company that also has hundreds of projects and its own billing account. You would like to consolidate all GCP costs of both GCP organizations onto a single invoice. You would like to consolidate all costs as of tomorrow. What should you do?

• A. Link the acquired company's projects to your company's billing account.
• B. Configure the acquired company's billing account and your company's billing account to export the billing data into the same BigQuery dataset.
• C. Migrate the acquired company's projects into your company's GCP organization. Link the migrated projects to your company's billing account.
• D. Create a new GCP organization and a new billing account. Migrate the acquired company's projects and your company's projects into the new GCP organization and link the projects to the new billing account.

프로젝트를 조직 수준에서 이동할 필요 없이, 단순히 청구 계정만 변경하면 된다.

정답 A

67. You built an application on Google Cloud that uses Cloud Spanner. Your support team needs to monitor the environment but should not have access to table data.
You need a streamlined solution to grant the correct permissions to your support team, and you want to follow Google-recommended practices. What should you do?

• A. Add the support team group to the roles/monitoring.viewer role
• B. Add the support team group to the roles/spanner.databaseUser role.
• C. Add the support team group to the roles/spanner.databaseReader role.
• D. Add the support team group to the roles/stackdriver.accounts.viewer role.

roles/monitoring.viewer 역할은 Cloud Monitoring 데이터 및 로그를 읽을 수 있는 최소한의 권한을 제공한다.

정답 A

68. For analysis purposes, you need to send all the logs from all of your Compute Engine instances to a BigQuery dataset called platform-logs. You have already installed the Cloud Logging agent on all the instances. You want to minimize cost. What should you do?

• A. 1. Give the BigQuery Data Editor role on the platform-logs dataset to the service accounts used by your instances. 2. Update your instances' metadata to add the following value: logs-destination: bq://platform-logs.
• B. 1. In Cloud Logging, create a logs export with a Cloud Pub/Sub topic called logs as a sink. 2. Create a Cloud Function that is triggered by messages in the logs topic. 3. Configure that Cloud Function to drop logs that are not from Compute Engine and to insert Compute Engine logs in the platform-logs dataset.
• C. 1. In Cloud Logging, create a filter to view only Compute Engine logs. 2. Click Create Export. 3. Choose BigQuery as Sink Service, and the platform-logs dataset as Sink Destination.
• D. 1. Create a Cloud Function that has the BigQuery User role on the platform-logs dataset. 2. Configure this Cloud Function to create a BigQuery Job that executes this query: INSERT INTO dataset.platform-logs (timestamp, log) SELECT timestamp, log FROM compute.logs WHERE timestamp > DATE_SUB(CURRENT_DATE(), INTERVAL 1 DAY) 3. Use Cloud Scheduler to trigger this Cloud Function once a day.

Cloud Logging의 로그 필터링 기능을 사용하면 Compute Engine의 로그만 BigQuery로 전송 가능하기 때문에 필요한 로그만 전송하면 비용을 절감할 수 있다.
BigQuery는 로그 분석에 적합한 스토리지 시스템이므로 로그를 저장하기에 적절한 선택이다.

정답 C

69. You are using Deployment Manager to create a Google Kubernetes Engine cluster. Using the same Deployment Manager deployment, you also want to create a
DaemonSet in the kube-system namespace of the cluster. You want a solution that uses the fewest possible services. What should you do?

• A. Add the cluster's API as a new Type Provider in Deployment Manager, and use the new type to create the DaemonSet.
• B. Use the Deployment Manager Runtime Configurator to create a new Config resource that contains the DaemonSet definition.
• C. With Deployment Manager, create a Compute Engine instance with a startup script that uses kubectl to create the DaemonSet.
• D. In the cluster's definition in Deployment Manager, add a metadata that has kube-system as key and the DaemonSet manifest as value.

Deployment Manager는 기본적으로 Kubernetes 리소스를 직접 배포할 수 없다.

따라서 Type Provider를 추가하면 Kubernetes API를 Deployment Manager에서 사용할 수 있게 되어 DaemonSet을 생성할 수 있다.

정답 A

70. You are building an application that will run in your data center. The application will use Google Cloud Platform (GCP) services like AutoML. You created a service account that has appropriate access to AutoML. You need to enable authentication to the APIs from your on-premises environment. What should you do?

• A. Use service account credentials in your on-premises application.
• B. Use gcloud to create a key file for the service account that has appropriate permissions.
• C. Set up direct interconnect between your data center and Google Cloud Platform to enable authentication for your on-premises applications.
• D. Go to the IAM & admin console, grant a user account permissions similar to the service account permissions, and use this user account for authentication from your data center.

온프레미스 환경에서 GCP API를 호출하려면 서비스 계정 키(JSON)를 사용하여 인증해야 한다.
gcloud iam service-accounts keys create 명령어를 사용하여 서비스 계정 키 파일을 생성한 후, API 요청 시 이를 사용하여 인증한다.

정답 B

71. You are using Container Registry to centrally store your company's container images in a separate project. In another project, you want to create a Google
Kubernetes Engine (GKE) cluster. You want to ensure that Kubernetes can download images from Container Registry. What should you do?

• A. In the project where the images are stored, grant the Storage Object Viewer IAM role to the service account used by the Kubernetes nodes.
• B. When you create the GKE cluster, choose the Allow full access to all Cloud APIs option under 'Access scopes'.
• C. Create a service account, and give it access to Cloud Storage. Create a P12 key for this service account and use it as an imagePullSecrets in Kubernetes.
• D. Configure the ACLs on each image in Cloud Storage to give read-only access to the default Compute Engine service account.

Container Registry는 기본적으로 Cloud Storage에 저장되므로, GKE 클러스터가 이미지를 가져오려면 Storage Object Viewer (roles/storage.objectViewer) 역할을 부여해야 한다.

P12 키는 오래된 방식이며, Kubernetes에서 imagePullSecrets를 사용하는 것은 Private Docker Registry에 로그인할 때 사용된다.

정답 A

72. You deployed a new application inside your Google Kubernetes Engine cluster using the YAML file specified below.

You check the status of the deployed pods and notice that one of them is still in PENDING status:

You want to find out why the pod is stuck in pending status. What should you do?

• A. Review details of the myapp-service Service object and check for error messages.
• B. Review details of the myapp-deployment Deployment object and check for error messages.
• C. Review details of myapp-deployment-58ddbbb995-lp86m Pod and check for warning messages.
• D. View logs of the container in myapp-deployment-58ddbbb995-lp86m pod and check for warning messages.

Pod이 PENDING 상태일 경우 가장 먼저 kubectl describe pod <pod-name> 명령어를 사용하여 상세 정보를 확인한다.

Pod이 PENDING 상태에서는 컨테이너가 실행되지 않으므로 로그를 확인할 수 없다.

정답 C

73. You are setting up a Windows VM on Compute Engine and want to make sure you can log in to the VM via RDP. What should you do?

• A. After the VM has been created, use your Google Account credentials to log in into the VM.
• B. After the VM has been created, use gcloud compute reset-windows-password to retrieve the login credentials for the VM.
• C. When creating the VM, add metadata to the instance using 'windows-password' as the key and a password as the value.
• D. After the VM has been created, download the JSON private key for the default Compute Engine service account. Use the credentials in the JSON file to log in to the VM.

GCP의 Windows VM에서는 gcloud compute reset-windows-passwordPDF를 사용하여 사용자 계정을 생성하고 접근할 수 있다.
이 테스트를 실행하면 Windows VM에 로그인할 수 있는 사용자 이름과 포스틱이 자동으로 생성된다.

정답 B

74. You want to configure an SSH connection to a single Compute Engine instance for users in the dev1 group. This instance is the only resource in this particular
Google Cloud Platform project that the dev1 users should be able to connect to. What should you do?

• A. Set metadata to enable-oslogin=true for the instance. Grant the dev1 group the compute.osLogin role. Direct them to use the Cloud Shell to ssh to that instance.
• B. Set metadata to enable-oslogin=true for the instance. Set the service account to no service account for that instance. Direct them to use the Cloud Shell to ssh to that instance.
• C. Enable block project wide keys for the instance. Generate an SSH key for each user in the dev1 group. Distribute the keys to dev1 users and direct them to use their third-party tools to connect.
• D. Enable block project wide keys for the instance. Generate an SSH key and associate the key with that instance. Distribute the key to dev1 users and direct them to use their third-party tools to connect.

OS 로그인을 활성화(enable-oslogin=true) 하면 SSH 키 관리 없이 IAM을 통해 SSH 액세스를 제어할 수 있다.
dev1 그룹에 compute.osLogin역할을 부여 하면 해당 그룹의 사용자만 SSH 접속이 가능하다.
Cloud Shell을 통해 SSH 접속을 사용하면 보안이 강화된다.

정답 A

75. You need to produce a list of the enabled Google Cloud Platform APIs for a GCP project using the gcloud command line in the Cloud Shell. The project name is my-project. What should you do?

• A. Run gcloud projects list to get the project ID, and then run gcloud services list --project <project ID>.
• B. Run gcloud init to set the current project to my-project, and then run gcloud services list --available.
• C. Run gcloud info to view the account value, and then run gcloud services list --account <Account>.
• D. Run gcloud projects describe <project ID> to verify the project value, and then run gcloud services list --available.

gcloud services list --project <project ID>를 사용해 GCP 프로젝트에서 활성화된 API 목록을 조회하고, gcloud projects list로 프로젝트 ID를 작성 후, 프로젝트 ID를 입력하여 API 목록을 조회할 수 있다.

정답 A

76. You are building a new version of an application hosted in an App Engine environment. You want to test the new version with 1% of users before you completely switch your application over to the new version. What should you do?

• A. Deploy a new version of your application in Google Kubernetes Engine instead of App Engine and then use GCP Console to split traffic.
• B. Deploy a new version of your application in a Compute Engine instance instead of App Engine and then use GCP Console to split traffic.
• C. Deploy a new version as a separate app in App Engine. Then configure App Engine using GCP Console to split traffic between the two apps.
• D. Deploy a new version of your application in App Engine. Then go to App Engine settings in GCP Console and split traffic between the current version and newly deployed versions accordingly.

App Engine은 기본적으로는 트래픽 분할 기능을 제공 하며, 새로운 버전을 배포한 후 로그하도록 설정하여 배포할 수 있다.

정답 D

 

77. You need to provide a cost estimate for a Kubernetes cluster using the GCP pricing calculator for Kubernetes. Your workload requires high IOPs, and you will also be using disk snapshots. You start by entering the number of nodes, average hours, and average days. What should you do next?

• A. Fill in local SSD. Fill in persistent disk storage and snapshot storage.
• B. Fill in local SSD. Add estimated cost for cluster management.
• C. Select Add GPUs. Fill in persistent disk storage and snapshot storage.
• D. Select Add GPUs. Add estimated cost for cluster management.

Kubernetes 클러스터가 높은 IOPS를 요구하는 경우 , 로컬 SSD 를 사용하는 것이 좋다.

정답 A

78. You are using Google Kubernetes Engine with autoscaling enabled to host a new application. You want to expose this new application to the public, using HTTPS on a public IP address. What should you do?

• A. Create a Kubernetes Service of type NodePort for your application, and a Kubernetes Ingress to expose this Service via a Cloud Load Balancer.
• B. Create a Kubernetes Service of type ClusterIP for your application. Configure the public DNS name of your application using the IP of this Service.
• C. Create a Kubernetes Service of type NodePort to expose the application on port 443 of each node of the Kubernetes cluster. Configure the public DNS name of your application with the IP of every node of the cluster to achieve load-balancing.
• D. Create a HAProxy pod in the cluster to load-balance the traffic to all the pods of the application. Forward the public traffic to HAProxy with an iptable rule. Configure the DNS name of your application using the public IP of the node HAProxy is running on.

Kubernetes에서 HTTPS를 외부에서 허용하려면 Cloud Load Balancer와 Ingress를 허용해야한다.

서비스를 NodePort로 설정한 후 Kubernetes Ingress를 사용하여 Cloud Load Balancer를 추가하면 공용 IP를 사용할 수 있다.

정답 A

79. You need to enable traffic between multiple groups of Compute Engine instances that are currently running two different GCP projects. Each group of Compute
Engine instances is running in its own VPC. What should you do?

• A. Verify that both projects are in a GCP Organization. Create a new VPC and add all instances.
• B. Verify that both projects are in a GCP Organization. Share the VPC from one project and request that the Compute Engine instances in the other project use this shared VPC.
• C. Verify that you are the Project Administrator of both projects. Create two new VPCs and add all instances.
• D. Verify that you are the Project Administrator of both projects. Create a new VPC and add all instances.

GCP 조직 내부에서 VPC를 공유하면 프로젝트 간 내부 IP 통신이 가능해진다.

정답 B

80. You want to add a new auditor to a Google Cloud Platform project. The auditor should be allowed to read, but not modify, all project items.
How should you configure the auditor's permissions?

• A. Create a custom role with view-only project permissions. Add the user's account to the custom role.
• B. Create a custom role with view-only service permissions. Add the user's account to the custom role.
• C. Select the built-in IAM project Viewer role. Add the user's account to this role.
• D. Select the built-in IAM service Viewer role. Add the user's account to this role.

servicemanagement.viewer는 관리 API에 대한 권한 권한만 제공하며, 프로젝트에서 모든 리소스를 조회할 수 있는 서비스가 없다.

roles/viewer(프로젝트 뷰어) 역할은 프로젝트에서 모든 것을 공유할 수 있지만, 수정 할 수는 없다.

정답 C

81. You are operating a Google Kubernetes Engine (GKE) cluster for your company where different teams can run non-production workloads. Your Machine Learning
(ML) team needs access to Nvidia Tesla P100 GPUs to train their models. You want to minimize effort and cost. What should you do?

• A. Ask your ML team to add the ג€accelerator: gpuג€ annotation to their pod specification.
• B. Recreate all the nodes of the GKE cluster to enable GPUs on all of them.
• C. Create your own Kubernetes cluster on top of Compute Engine with nodes that have GPUs. Dedicate this cluster to your ML team.
• D. Add a new, GPU-enabled, node pool to the GKE cluster. Ask your ML team to add the cloud.google.com/gke -accelerator: nvidia-tesla-p100 nodeSelector to their pod specification.

GKE에서 GPU를 사용하려면 GPU가 활성화된 노드 풀을 추가해야한다.

정답 D

82. Your VMs are running in a subnet that has a subnet mask of 255.255.255.240. The current subnet has no more free IP addresses and you require an additional
10 IP addresses for new VMs. The existing and new VMs should all be able to reach each other without additional routes. What should you do?

• A. Use gcloud to expand the IP range of the current subnet.
• B. Delete the subnet, and recreate it using a wider range of IP addresses.
• C. Create a new project. Use Shared VPC to share the current network with the new project.
• D. Create a new subnet with the same starting IP but a wider range to overwrite the current subnet.

GCP에서는 서브넷의 IP 범위를 확장할 수 있다. 

확장 명령어 : gcloud compute networks subnets update <SUBNET_NAME> --region <REGION> --add-secondary-ranges <NEW_RANGE>

정답 A

83. Your organization uses G Suite for communication and collaboration. All users in your organization have a G Suite account. You want to grant some G Suite users access to your Cloud Platform project. What should you do?

• A. Enable Cloud Identity in the GCP Console for your domain.
• B. Grant them the required IAM roles using their G Suite email address.
• C. Create a CSV sheet with all users' email addresses. Use the gcloud command line tool to convert them into Google Cloud Platform accounts.
• D. In the G Suite console, add the users to a special group called cloud-console-users@yourdomain.com. Rely on the default behavior of the Cloud Platform to grant users access if they are members of this group.

GCP의 IAM은 G Suite 계정을 기본적으로 지원하므로, G Suite 이메일 주소를 사용하여 권한을 부여할 수 있다.

GCP에서 G Suite 그룹을 자동으로 감지하여 IAM 권한을 부여하는 기능은 없다.

정답 B

84. You have a Google Cloud Platform account with access to both production and development projects. You need to create an automated process to list all compute instances in development and production projects on a daily basis. What should you do?

• A. Create two configurations using gcloud config. Write a script that sets configurations as active, individually. For each configuration, use gcloud compute instances list to get a list of compute resources.
• B. Create two configurations using gsutil config. Write a script that sets configurations as active, individually. For each configuration, use gsutil compute instances list to get a list of compute resources.
• C. Go to Cloud Shell and export this information to Cloud Storage on a daily basis.
• D. Go to GCP Console and export this information to Cloud SQL on a daily basis.

각 설정을 활성화(gcloud config configurations activate <config-name>) 한 후 gcloud compute instances list를 실행하면 해당 프로젝트의 VM 목록을 가져올 수 있다.

gsutil은 Cloud Storage를 관리하는 도구이다.

정답 A

85. You have a large 5-TB AVRO file stored in a Cloud Storage bucket. Your analysts are proficient only in SQL and need access to the data stored in this file. You want to find a cost-effective way to complete their request as soon as possible. What should you do?

• A. Load data in Cloud Datastore and run a SQL query against it.
• B. Create a BigQuery table and load data in BigQuery. Run a SQL query on this table and drop this table after you complete your request.
• C. Create external tables in BigQuery that point to Cloud Storage buckets and run a SQL query on these external tables to complete your request.
• D. Create a Hadoop cluster and copy the AVRO file to NDFS by compressing it. Load the file in a hive table and provide access to your analysts so that they can run SQL queries.

Cloud Datastore는 NoSQL 데이터베이스이다.

BigQuery는 Cloud Storage에 저장된 데이터를 직접 쿼리할 수 있는 외부 테이블 기능을 제공한다.
데이터를 BigQuery로 복사하지 않고도 SQL을 실행할 수 있어 비용 효율적이다.

정답 C

86. You need to verify that a Google Cloud Platform service account was created at a particular time. What should you do?

• A. Filter the Activity log to view the Configuration category. Filter the Resource type to Service Account.
• B. Filter the Activity log to view the Configuration category. Filter the Resource type to Google Project.
• C. Filter the Activity log to view the Data Access category. Filter the Resource type to Service Account.
• D. Filter the Activity log to view the Data Access category. Filter the Resource type to Google Project.

GCP에서 특정 리소스가 생성된 시간을 확인하려면 Activity Log를 확인해야 한다.

Configuration 로그 카테고리는 리소스 생성, 업데이트 및 삭제와 관련된 변경 사항을 기록한다.

 Data Access 로그는 서비스 계정이 데이터를 액세스한 기록을 보여준다.

정답 A

87. You deployed an LDAP server on Compute Engine that is reachable via TLS through port 636 using UDP. You want to make sure it is reachable by clients over that port. What should you do?

• A. Add the network tag allow-udp-636 to the VM instance running the LDAP server.
• B. Create a route called allow-udp-636 and set the next hop to be the VM instance running the LDAP server.
• C. Add a network tag of your choice to the instance. Create a firewall rule to allow ingress on UDP port 636 for that network tag.
• D. Add a network tag of your choice to the instance running the LDAP server. Create a firewall rule to allow egress on UDP port 636 for that network tag.

GCP 방화벽 규칙은 기본적으로 모든 인바운드 트래픽을 차단하므로, 명시적으로 UDP 636 포트를 허용해야한다.

"ingress" 규칙을 설정하면 외부 클라이언트가 해당 VM에 접근 가능하다.

정답 C

88. You need to set a budget alert for use of Compute Engineer services on one of the three Google Cloud Platform projects that you manage. All three projects are linked to a single billing account. What should you do?

• A. Verify that you are the project billing administrator. Select the associated billing account and create a budget and alert for the appropriate project.
• B. Verify that you are the project billing administrator. Select the associated billing account and create a budget and a custom alert.
• C. Verify that you are the project administrator. Select the associated billing account and create a budget for the appropriate project.
• D. Verify that you are project administrator. Select the associated billing account and create a budget and a custom alert.

프로젝트별 예산 설정을 위해서는 "Project Billing Administrator" 권한이 필요하다.

정답 A

89. You are migrating a production-critical on-premises application that requires 96 vCPUs to perform its task. You want to make sure the application runs in a similar environment on GCP. What should you do?

• A. When creating the VM, use machine type n1-standard-96.
• B. When creating the VM, use Intel Skylake as the CPU platform.
• C. Create the VM using Compute Engine default settings. Use gcloud to modify the running instance to have 96 vCPUs.
• D. Start the VM using Compute Engine default settings, and adjust as you go based on Rightsizing Recommendations.

GCP에서 제공하는 "n1-standard-96" 머신 타입을 사용하면 96 vCPUs를 제공한다.

정답 A

90. You want to configure a solution for archiving data in a Cloud Storage bucket. The solution must be cost-effective. Data with multiple versions should be archived after 30 days. Previous versions are accessed once a month for reporting. This archive data is also occasionally updated at month-end. What should you do?

• A. Add a bucket lifecycle rule that archives data with newer versions after 30 days to Coldline Storage.
• B. Add a bucket lifecycle rule that archives data with newer versions after 30 days to Nearline Storage.
• C. Add a bucket lifecycle rule that archives data from regional storage after 30 days to Coldline Storage.
• D. Add a bucket lifecycle rule that archives data from regional storage after 30 days to Nearline Storage.

Nearline Storage는 한 달에 한 번 정도 액세스하는 데이터에 적합하다.

정답 B

91. Your company's infrastructure is on-premises, but all machines are running at maximum capacity. You want to burst to Google Cloud. The workloads on Google
Cloud must be able to directly communicate to the workloads on-premises using a private IP range. What should you do?

• A. In Google Cloud, configure the VPC as a host for Shared VPC.
• B. In Google Cloud, configure the VPC for VPC Network Peering.
• C. Create bastion hosts both in your on-premises environment and on Google Cloud. Configure both as proxy servers using their public IP addresses.
• D. Set up Cloud VPN between the infrastructure on-premises and Google Cloud.

온프레미스 환경과 GCP의 VM들이 사설 IP 주소를 사용하여 직접 통신해야 하므로, Cloud VPN을 설정하는 것이 적절하다.
Cloud VPN을 통해 GCP의 VPC 네트워크와 온프레미스 네트워크를 안전하게 연결할 수 있다.

 VPC Peering은 동일한 GCP 내의 VPC들 간에 네트워크를 연결하는 방법이며, 온프레미스와 연결하는 방법이 아니다.

정답 D

92. You want to select and configure a solution for storing and archiving data on Google Cloud Platform. You need to support compliance objectives for data from one geographic location. This data is archived after 30 days and needs to be accessed annually. What should you do?

• A. Select Multi-Regional Storage. Add a bucket lifecycle rule that archives data after 30 days to Coldline Storage.
• B. Select Multi-Regional Storage. Add a bucket lifecycle rule that archives data after 30 days to Nearline Storage.
• C. Select Regional Storage. Add a bucket lifecycle rule that archives data after 30 days to Nearline Storage.
• D. Select Regional Storage. Add a bucket lifecycle rule that archives data after 30 days to Coldline Storage.

1 년에 한 번 정도 접근하는 경우 Coldline Storage가 적합하다.
Regional Storage를 사용하면 데이터를 하나의 지역 내에서 보관 가능하여, 컴플라이언스 요구사항을 충족할 수 있다.

정답 D

93. Your company uses BigQuery for data warehousing. Over time, many different business units in your company have created 1000+ datasets across hundreds of projects. Your CIO wants you to examine all datasets to find tables that contain an employee_ssn column. You want to minimize effort in performing this task.
What should you do?

• A. Go to Data Catalog and search for employee_ssn in the search box.
• B. Write a shell script that uses the bq command line tool to loop through all the projects in your organization.
• C. Write a script that loops through all the projects in your organization and runs a query on INFORMATION_SCHEMA.COLUMNS view to find the employee_ssn column.
• D. Write a Cloud Dataflow job that loops through all the projects in your organization and runs a query on INFORMATION_SCHEMA.COLUMNS view to find employee_ssn column.

Data Catalog를 사용하면 BigQuery 테이블과 같은 항목을 메타데이터로 검색하고 태그할 수 있다.

정답 A

94. You create a Deployment with 2 replicas in a Google Kubernetes Engine cluster that has a single preemptible node pool. After a few minutes, you use kubectl to examine the status of your Pod and observe that one of them is still in Pending status:

What is the most likely cause?

• A. The pending Pod's resource requests are too large to fit on a single node of the cluster.
• B. Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod.
• C. The node pool is configured with a service account that does not have permission to pull the container image used by the pending Pod.
• D. The pending Pod was originally scheduled on a node that has been preempted between the creation of the Deployment and your verification of the Pods' status. It is currently being rescheduled on a new node.

선점형이라고 명시를 해서 해당 부분을 생각하면 해당 노드에서 실행되던 Pod이 종료되고, 새로운 노드에서 다시 스케줄링되기를 기다리는 중일 가능성이 높다.

정답 D

95. You want to find out when users were added to Cloud Spanner Identity Access Management (IAM) roles on your Google Cloud Platform (GCP) project. What should you do in the GCP Console?

• A. Open the Cloud Spanner console to review configurations.
• B. Open the IAM & admin console to review IAM policies for Cloud Spanner roles.
• C. Go to the Stackdriver Monitoring console and review information for Cloud Spanner.
• D. Go to the Stackdriver Logging console, review admin activity logs, and filter them for Cloud Spanner IAM roles.

AM 역할 변경 사항은 "Admin Activity Logs"에 기록되고, Stackdriver Logging에서 필터링하여 확인 가능하다.

정답 D

96. Your company implemented BigQuery as an enterprise data warehouse. Users from multiple business units run queries on this data warehouse. However, you notice that query costs for BigQuery are very high, and you need to control costs. Which two methods should you use? (Choose two.)

• A. Split the users from business units to multiple projects.
• B. Apply a user- or project-level custom query quota for BigQuery data warehouse.
• C. Create separate copies of your BigQuery data warehouse for each business unit.
• D. Split your BigQuery data warehouse into multiple data warehouses for each business unit.
• E. Change your BigQuery query model from on-demand to flat rate. Apply the appropriate number of slots to each Project.

BigQuery의 IAM 및 할당량(Quota) 설정을 사용하여 특정 사용자가 사용할 수 있는 쿼리 비용을 제한할 수 있다.

On-demand 대신 Flat-rate를 사용하면, 일정한 비용으로 예측 가능한 운영이 가능하다.

정답 B, E

97. You are building a product on top of Google Kubernetes Engine (GKE). You have a single GKE cluster. For each of your customers, a Pod is running in that cluster, and your customers can run arbitrary code inside their Pod. You want to maximize the isolation between your customers' Pods. What should you do?

• A. Use Binary Authorization and whitelist only the container images used by your customers' Pods.
• B. Use the Container Analysis API to detect vulnerabilities in the containers used by your customers' Pods.
• C. Create a GKE node pool with a sandbox type configured to gvisor. Add the parameter runtimeClassName: gvisor to the specification of your customers' Pods.
• D. Use the cos_containerd image for your GKE nodes. Add a nodeSelector with the value cloud.google.com/gke-os-distribution: cos_containerd to the specification of your customers' Pods.

GKE의 "gVisor"는 컨테이너 샌드박스를 제공하여 Pod 간 보안 격리를 강화하는 기술로 Pod을 gVisor로 실행하면, 실행 환경이 격리되어 악성 코드 실행 등의 위험을 줄일 수 있다.

정답 C

98. Your customer has implemented a solution that uses Cloud Spanner and notices some read latency-related performance issues on one table. This table is accessed only by their users using a primary key. The table schema is shown below.

You want to resolve the issue. What should you do?

• A. Remove the profile_picture field from the table.
• B. Add a secondary index on the person_id column.
• C. Change the primary key to not have monotonically increasing values.
• D. Create a secondary index using the following Data Definition Language (DDL): 

  

현재 테이블의 Primary Key가 단조 증가하는 정수값인데, Cloud Spanner는 Primary Key를 기준으로 데이터를 물리적으로 정렬하여 저장한다.
Primary Key가 순차적으로 증가하면, 모든 쓰기가 특정 노드로 집중되어 성능 저하가 발생할 수 있다.
Primary Key를 무작위 값으로 변경하면, 데이터가 여러 노드에 분산되어 읽기 성능이 개선된다.

그리고 D번의 경우 Secondary Index를 생성해도, PK를 이용한 조회에는 영향을 주지 않는다. 왜냐하면 PK 기반 조회가 아닌 경우에만 성능 향상 가능하므로, 문제 해결과 무관하기 때문이다.

정답 C

 

99. Your finance team wants to view the billing report for your projects. You want to make sure that the finance team does not get additional permissions to the project. What should you do?

• A. Add the group for the finance team to roles/billing user role.
• B. Add the group for the finance team to roles/billing admin role.
• C. Add the group for the finance team to roles/billing viewer role.
• D. Add the group for the finance team to roles/billing project/Manager role.

Billing Viewer (roles/billing.viewer)는 프로젝트의 비용 관련 데이터를 볼 수 있지만, 결제 정보 변경 권한이 없다.

정답 C

100.

Your organization has strict requirements to control access to Google Cloud projects. You need to enable your Site Reliability Engineers (SREs) to approve requests from the Google Cloud support team when an SRE opens a support case. You want to follow Google-recommended practices. What should you do?

• A. Add your SREs to roles/iam.roleAdmin role.
• B. Add your SREs to roles/accessapproval.approver role.
• C. Add your SREs to a group and then add this group to roles/iam.roleAdmin.role.
• D. Add your SREs to a group and then add this group to roles/accessapproval.approver role.

SRE를 그룹으로 추가하면, 관리가 더 용이해진다.

GCP의 Access Approval 기능은 지원팀이 프로젝트 변경 요청을 할 때, 특정 사용자(SRE)가 이를 승인할 수 있도록 한다.

정답 D