Google Cloud Certified Associate-Cloud-Engineer Updated Exam

Google Cloud Certified - Associate Cloud Engineer Questions and Answers

Question 29

Your company ' s security vulnerability management policy wonts 3 member of the security team to have visibility into vulnerabilities and other OS metadata for a specific Compute Engine instance This Compute Engine instance hosts a critical application in your Goggle Cloud project. You need to implement your company ' s security vulnerability management policy. What should you dc?

Options:

• Ensure that the Ops Agent Is Installed on the Compute Engine instance.• Create a custom metric in the Cloud Monitoring dashboard.• Provide the security team member with access to this dashboard.

• Ensure that the Ops Agent is installed on tie Compute Engine instance.• Provide the security team member roles/configure.inventoryViewer permission.

• Ensure that the OS Config agent Is Installed on the Compute Engine instance.• Provide the security team member roles/configure.vulnerabilityViewer permission.

• Ensure that the OS Config agent is installed on the Compute Engine instance• Create a log sink Co a BigQuery dataset.• Provide the security team member with access to this dataset.

Question 30

You need to update a deployment in Deployment Manager without any resource downtime in the deployment. Which command should you use?

Options:

gcloud deployment-manager deployments create --config < deployment-config-path >

gcloud deployment-manager deployments update --config < deployment-config-path >

gcloud deployment-manager resources create --config < deployment-config-path >

gcloud deployment-manager resources update --config < deployment-config-path >

Question 31

You have an application that looks for its licensing server on the IP 10.0.3.21. You need to deploy the licensing server on Compute Engine. You do not want to change the configuration of the application and want the application to be able to reach the licensing server. What should you do?

Options:

Reserve the IP 10.0.3.21 as a static internal IP address using gcloud and assign it to the licensing server.

Reserve the IP 10.0.3.21 as a static public IP address using gcloud and assign it to the licensing server.

Use the IP 10.0.3.21 as a custom ephemeral IP address and assign it to the licensing server.

Start the licensing server with an automatic ephemeral IP address, and then promote it to a static internal IP address.

Question 32

You are planning to migrate your on-premises VMs to Google Cloud. You need to set up a landing zone in Google Cloud before migrating the VMs. You must ensure that all VMs in your production environment can communicate with each other through private IP addresses. You need to allow all VMs in your Google Cloud organization to accept connections on specific TCP ports. You want to follow Google-recommended practices, and you need to minimize your operational costs. What should you do?

Options:

Create individual VPCs per Google Cloud project. Peer all the VPCs together. Apply organization policies on the organization level.

Create individual VPCs for each Google Cloud project. Peer all the VPCs together. Apply hierarchical firewall policies on the organization level.

Create a host VPC project with each production project as its service project. Apply organization policies on the organization level.

Create a host VPC project with each production project as its service project. Apply hierarchical firewall policies on the organization level.

Answer:

Explanation:

The goal is to create a landing zone facilitating private IP communication across production projects and apply organization-wide firewall rules, following best practices and minimizing operational costs.

Network Structure:Individual VPCs with Peering (A, B): While VPC Peering allows private connectivity, managing a full mesh or complex peering topology across many projects becomes operationally complex and can hit peering limits. It ' s not the recommended pattern for centralized connectivity in a landing zone.

Shared VPC (C, D): This is the Google-recommended practice for scenarios where resources from multiple projects need to communicate privately within a common VPC network. A central host project owns the network, and service projects use it. This simplifies network administration and connectivity.

Firewall Rules:Organization Policies (A, C): These enforce organizational constraints (e.g., disable external IPs, restrict locations) but do not define specific network firewall rules (like allowing TCP ports).

Hierarchical Firewall Policies (B, D): These allow defining firewall rules at the Organization or Folder level, which are inherited by resources in descendant projects/folders. This is the mechanism to apply consistent firewall rules (like allowing specific TCP ports) across all VMs in the organization (or a specific folder) efficiently, without managing rules in each individual VPC or project.

Combining Shared VPC for the network structure (best practice for cross-project private communication and central management) with Hierarchical Firewall Policies (for applying organization-wide firewall rules) meets all requirements efficiently and follows Google recommendations.

[References:, , Shared VPC Overview: "Shared VPC allows an organization to connect resources from multiple projects to a common Virtual Private Cloud (VPC) network..." - https://cloud.google.com/vpc/docs/shared-vpc , Hierarchical firewall policies: "Hierarchical firewall policies let you create and enforce a consistent firewall policy across your organization... They can be configured to explicitly deny traffic, or allow traffic..." - https://cloud.google.com/firewall/docs/hierarchical-firewall-policies, Google Cloud security foundations guide: Often recommends Shared VPC and centralized firewall management (using Hierarchical Firewalls or traditional firewalls with tags in the host project) as part of a secure landing zone. - (Conceptual reference, specific document may vary), , , ]

Summer Certification Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

Google Cloud Certified Associate-Cloud-Engineer Updated Exam

Google Cloud Certified - Associate Cloud Engineer Questions and Answers

Options:

Answer:

Options:

Answer:

Explanation:

Options:

Answer:

Explanation:

Options:

Answer:

Explanation:

CompTIA

Fortinet

Microsoft

Salesforce