Get Latest [Mar-2026] Conduct effective penetration tests using LatestCram Associate-Cloud-Engineer
Penetration testers simulate Associate-Cloud-Engineer exam PDF
NEW QUESTION # 195
You have production and test workloads that you want to deploy on Compute Engine. Production VMs need to be in a different subnet than the test VMs. All the VMs must be able to reach each other over internal IP without creating additional routes. You need to set up VPC and the 2 subnets. Which configuration meets these requirements?
- A. Create 2 custom VPCs, each with a single subnet. Create each subnet in the same region and with the same CIDR range.
- B. Create a single custom VPC with 2 subnets. Create each subnet in the same region and with the same CIDR range.
- C. Create 2 custom VPCs, each with a single subnet. Create each subnet is a different region and with a different CIDR range.
- D. Create a single custom VPC with 2 subnets. Create each subnet in a different region and with a different CIDR range.
Answer: D
Explanation:
Explanation
When we create subnets in the same VPC with different CIDR ranges, they can communicate automatically within VPC. Resources within a VPC network can communicate with one another by using internal (private) IPv4 addresses, subject to applicable network firewall rules Ref: https://cloud.google.com/vpc/docs/vpc
NEW QUESTION # 196
You are developing a new web application that will be deployed on Google Cloud Platform. As part of your release cycle, you want to test updates to your application on a small portion of real user traffic. The majority of the users should still be directed towards a stable version of your application. What should you do?
- A. Deploy the application on Kubernetes Engine.
For a new release, update the deployment to use the new version - B. Deploy me application on App Engine.
For each update, create a new version of the same service.
Configure traffic splitting to send a small percentage of traffic to the new version - C. Deploy the application on App Engine.
For each update, create a new service.
Configure traffic splitting to send a small percentage of traffic to the new service. - D. Deploy the application on Kubernetes Engine.
For a now release, create a new deployment for the new version Update the service e to use the now deployment.
Answer: B
Explanation:
When deploying new versions you can split traffic for A/B testing to see how user base reacts to changes.
NEW QUESTION # 197
You need to configure IAM access audit logging in BigQuery for external auditors. You want to follow Google-recommended practices. What should you do?
- A. Add the auditor user accounts to the 'logging.viewer' and 'bigQuery.dataViewer' predefined IAM roles.
- B. Add the auditors group to two new custom IAM roles.
- C. Add the auditors group to the 'logging.viewer' and 'bigQuery.dataViewer' predefined IAM roles.
- D. Add the auditor user accounts to two new custom IAM roles.
Answer: A
Explanation:
Reference:
https://cloud.google.com/iam/docs/roles-audit-logging
NEW QUESTION # 198
Your company wants to standardize the creation and management of multiple Google Cloud resources using Infrastructure as Code. You want to minimize the amount of repetitive code needed to manage the environment. What should you do?
- A. Create a bash script that contains all requirement steps as gcloudcommands.
- B. Use the Cloud Console interface to provision and manage all related resources.
- C. Develop templates for the environment using Cloud Deployment Manager.
- D. Use curlin a terminal to send a REST request to the relevant Google API for each individual resource.
Answer: C
Explanation:
Explanation/Reference: https://cloud.google.com/deployment-manager/docs/fundamentals (see templates)
NEW QUESTION # 199
A company is migrating its data center to AWS. As part of this migration, there is a three-tier web application that has strict data-at-rest encryption requirements. The customer deploys this application on Amazon EC2 using Amazon EBS, and now must provide encryption at-rest.
How can this requirement be met without changing the application?
- A. Use an application-specific encryption API with AWS server-side encryption.
- B. Use encrypted EBS storage volumes with AWS-managed keys.
- C. Use third-party tools to encrypt the EBS data volumes with Key Management Service Bring Your Own Keys.
- D. Use AWS Key Management Service and move the encrypted data to Amazon S3.
Answer: B
NEW QUESTION # 200
You are migrating a production-critical on-premises application that requires 96 vCPUs to perform its task.
You want to make sure the application runs in a similar environment on GCP. What should you do?
- A. When creating the VM, use machine type n1-standard-96.
- B. Start the VM using Compute Engine default settings, and adjust as you go based on Rightsizing Recommendations.
- C. When creating the VM, use Intel Skylake as the CPU platform.
- D. Create the VM using Compute Engine default settings. Use gcloud to modify the running instance to have 96 vCPUs.
Answer: A
Explanation:
Ref: https://cloud.google.com/compute/docs/machine-types#n1_machine_type
NEW QUESTION # 201
You are the project owner of a GCP project and want to delegate control to colleagues to manage buckets and files in Cloud Storage. You want to follow Google-recommended practices. Which IAM roles should you grant your colleagues?
- A. Storage Object Admin
- B. Project Editor
- C. Storage Admin
- D. Storage Object Creator
Answer: C
NEW QUESTION # 202
You need to configure optimal data storage for files stored in Cloud Storage for minimal cost. The files are used in a mission-critical analytics pipeline that is used continually. The users are in Boston, MA (United States). What should you do?
- A. Configure regional storage for the region closest to the users.
Configure a Standard storage class - B. Configure dual-regional storage for the dual region closest to the users.
Configure a Nearline storage class - C. Configure dual-regional storage for the dual region closest to the users.
Configure a Standard storage class - D. Configure regional storage for the region closest to the users.
Configure a Nearline storage class
Answer: A
Explanation:
Continuous access to data means Standard since all of the other options are for infrequently accessed storage (Nearline, Coldline, Archive). Since no other regions are mentioned, single region is best in this case.
NEW QUESTION # 203
You deployed a new application inside your Google Kubernetes Engine cluster using the YAML file specified below.
You check the status of the deployed pods and notice that one of them is still in PENDING status:
You want to find out why the pod is stuck in pending status. What should you do?
- A. View logs of the container in myapp-deployment-58ddbbb995-lp86m pod and check for warning messages.
- B. Review details of the myapp-deployment Deployment object and check for error messages.
- C. Review details of the myapp-service Service object and check for error messages.
- D. Review details of myapp-deployment-58ddbbb995-lp86m Pod and check for warning messages.
Answer: D
NEW QUESTION # 204
You are assigned to maintain a Google Kubernetes Engine (GKE) cluster named dev that was deployed on Google Cloud. You want to manage the GKE configuration using the command line interface (CLI). You have just downloaded and installed the Cloud SDK. You want to ensure that future CLI commands by default address this specific cluster. What should you do?
- A. Create a file called defaults.json in the ~/.gcloud folder that contains the cluster name.
- B. Use the command gcloud config set container/cluster dev.
- C. Use the command gcloud container clusters update dev.
- D. Create a file called gke.default in the ~/.gcloud folder that contains the cluster name.
Answer: B
Explanation:
Explanation
To set a default cluster for gcloud commands, run the following command: gcloud config set container/cluster CLUSTER_NAME https://cloud.google.com/kubernetes-engine/docs/how-to/managing-clusters?hl=en
NEW QUESTION # 205
You are asked to set up application performance monitoring on Google Cloud projects A, B, and C as a single pane of glass. You want to monitor CPU, memory, and disk. What should you do?
- A. Enable API and then share charts from project A, B, and C.
- B. Enable API, create a workspace under project A, and then add project B and C.
- C. Enable API and then use default dashboards to view all projects in sequence.
- D. Enable API and then give the metrics.reader role to projects A, B, and C.
Answer: B
Explanation:
Workspaces is made for monitoring multiple projects.
NEW QUESTION # 206
Your company has a Google Cloud Platform project that uses BigQuery for data warehousing.
Your data science team changes frequently and has few members. You need to allow members of this team to perform queries.
You want to follow Google-recommended practices. What should you do?
- A. 1. Create a dedicated Google group in Cloud Identity.
2. Add each data scientist's user account to the group.
3. Assign the BigQuery dataViewer user role to the group. - B. 1. Create an IAM entry for each data scientist's user account.
2. Assign the BigQuery dataViewer user role to the group. - C. 1. Create an IAM entry for each data scientist's user account.
2. Assign the BigQuery jobUser role to the group. - D. 1. Create a dedicated Google group in Cloud Identity.
2. Add each data scientist's user account to the group.
3. Assign the BigQuery jobUser role to the group.
Answer: D
Explanation:
Provides permissions to run jobs, including queries, within the project. This role can check the existence of all jobs, enumerate their own jobs, and cancel their own jobs.
https://cloud.google.com/bigquery/docs/access-control
NEW QUESTION # 207
You have been asked to migrate a docker application from datacenter to cloud. Your solution architect has suggested uploading docker images to GCR in one project and running an application in a GKE cluster in a separate project. You want to store images in the project img-278322 and run the application in the project prod-278986. You want to tag the image as acme_track_n_trace:v1. You want to follow Google-recommended practices. What should you do?
- A. Run gcloud builds submit --tag gcr.io/prod-278986/acme_track_n_trace:v1
- B. Run gcloud builds submit --tag gcr.io/img-278322/acme_track_n_trace:v1
- C. Run gcloud builds submit --tag gcr.io/prod-278986/acme_track_n_trace
- D. Run gcloud builds submit --tag gcr.io/img-278322/acme_track_n_trace
Answer: B
Explanation:
Run gcloud builds submit tag gcr.io/img-278322/acme_track_n_trace:v1. is the right answer.
This command correctly tags the image as acme_track_n_trace:v1 and uploads the image to the img-278322 project.
Ref: https://cloud.google.com/sdk/gcloud/reference/builds/submit
NEW QUESTION # 208
You are monitoring an application and receive user feedback that a specific error is spiking. You notice that the error is caused by a Service Account having insufficient permissions. You are able to solve the problem but want to be notified if the problem recurs. What should you do?
- A. Create a sink to BigQuery to export all the logs. Create a Data Studio dashboard on the exported logs.
- B. Create a custom log-based metric for the specific error to be used in an Alerting Policy.
- C. In the Log Viewer, filter the logs on severity 'Error' and the name of the Service Account.
- D. Grant Project Owner access to the Service Account.
Answer: C
Explanation:
Explanation/Reference: https://cloud.google.com/logging/docs/view/advanced-queries
NEW QUESTION # 209
You need to configure optimal data storage for files stored in Cloud Storage for minimal cost. The files are used in a mission-critical analytics pipeline that is used continually. The users are in Boston, MA (United States). What should you do?
- A. Configure regional storage for the region closest to the users Configure a Standard storage class
- B. Configure dual-regional storage for the dual region closest to the users Configure a Nearline storage class
- C. Configure dual-regional storage for the dual region closest to the users Configure a Standard storage class
- D. Configure regional storage for the region closest to the users Configure a Nearline storage class
Answer: A
NEW QUESTION # 210
You have successfully created a development environment in a project for an application. This application uses Compute Engine and Cloud SQL. Now, you need to create a production environment for this application.
The security team has forbidden the existence of network routes between these 2 environments, and asks you to follow Google-recommended practices. What should you do?
- A. Create a new project, modify your existing VPC to be a Shared VPC, share that VPC with your new project, and replicate the setup you have in the development environment in that new project, in the Shared VPC.
- B. Create a new project, enable the Compute Engine and Cloud SQL APIs in that project, and replicate the setup you have created in the development environment.
- C. Ask the security team to grant you the Project Editor role in an existing production project used by another division of your company. Once they grant you that role, replicate the setup you have in the development environment in that project.
- D. Create a new production subnet in the existing VPC and a new production Cloud SQL instance in your existing project, and deploy your application using those resources.
Answer: B
Explanation:
This aligns with Googles recommended practices. By creating a new project, we achieve complete isolation between development and production environments; as well as isolate this production application from production applications of other departments.
Ref: https://cloud.google.com/docs/enterprise/best-practices-for-enterprise-organizations#define-hierarchy
NEW QUESTION # 211
Your VMs are running in a subnet that has a subnet mask of 255.255.255.240. The current subnet has no more free IP addresses and you require an additional 10 IP addresses for new VMs. The existing and new VMs should all be able to reach each other without additional routes. What should you do?
- A. Use gcloud to expand the IP range of the current subnet.
- B. Delete the subnet, and recreate it using a wider range of IP addresses.
- C. Create a new subnet with the same starting IP but a wider range to overwrite the current subnet.
- D. Create a new project. Use Shared VPC to share the current network with the new project.
Answer: A
Explanation:
https://cloud.google.com/sdk/gcloud/reference/compute/networks/subnets/expand-ip-range gcloud compute networks subnets expand-ip-range - expand the IP range of a Compute Engine subnetwork gcloud compute networks subnets expand-ip-range NAME --prefix-length=PREFIX_LENGTH
[--region=REGION] [GCLOUD_WIDE_FLAG ...]
NEW QUESTION # 212
You need to assign a Cloud Identity and Access Management (Cloud IAM) role to an external auditor. The auditor needs to have permissions to review your Google Cloud Platform (GCP) Audit Logs and also to review your Data Access logs. What should you do?
- A. Assign the auditor's IAM user to a custom role that has logging.privateLogEntries.list permission.
Direct the auditor to also review the logs for changes to Cloud IAM policy. - B. Assign the auditor the IAM role roles/logging.privateLogViewer.
Perform the export of logs to Cloud Storage. - C. Assign the auditor the IAM role roles/logging.privateLogViewer.
Direct the auditor to also review the logs for changes to Cloud IAM policy. - D. Assign the auditor's IAM user to a custom role that has logging.privateLogEntries.list permission.
Perform the export of logs to Cloud Storage.
Answer: C
Explanation:
Google Cloud provides Cloud Audit Logs, which is an integral part of Cloud Logging. It consists of two log streams for each project: Admin Activity and Data Access.
Admin Activity logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. Admin Activity logs are always enabled. There is no charge for your Admin Activity audit logs.
Data Access logs record API calls that create, modify, or read user-provided data. Data Access audit logs are disabled by default because they can be large.
logging.viewer: The logging.viewer role gives the security admin team the ability to view the Admin Activity logs.
logging.privateLogViewer : The logging.privateLogViewer role gives the ability to view the Data Access logs.
NEW QUESTION # 213
You host a static website on Cloud Storage. Recently, you began to include links to PDF files on this site.
Currently, when users click on the links to these PDF files, their browsers prompt them to save the file onto their local system. Instead, you want the clicked PDF files to be displayed within the browser window directly, without prompting the user to save the file locally. What should you do?
- A. Enable Cloud CDN on the website frontend.
- B. Enable 'Share publicly' on the PDF file objects.
- C. Add a label to the storage bucket with a key of Content-Type and value of application/pdf.
- D. Set Content-Type metadata to application/pdf on the PDF file objects.
Answer: D
Explanation:
Explanation
https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_Types#importance_of_setting_th
NEW QUESTION # 214
......
Google Associate-Cloud-Engineer Certification Exam is an entry-level certification that can help individuals kick-start their career in cloud computing. Google Associate Cloud Engineer Exam certification is suitable for individuals who have some basic knowledge of cloud computing concepts and have experience working with GCP. Associate-Cloud-Engineer exam is ideal for IT professionals, system administrators, and developers who want to validate their skills and knowledge in using GCP. Google Associate Cloud Engineer Exam certification exam is conducted online and comprises of multiple-choice questions that assess the candidates' understanding of GCP services and their ability to use them in real-world scenarios. Passing the exam leads to the award of the Google Associate Cloud Engineer certification, which is highly valued in the IT industry.
Tested Material Used To Associate-Cloud-Engineer Test Engine: https://www.latestcram.com/Associate-Cloud-Engineer-exam-cram-questions.html
Steps Necessary To Pass The Associate-Cloud-Engineer Exam: https://drive.google.com/open?id=15x88ssYDImfWpgmKN30JWZGBdnNwGmoH
