Google Cloud Associate Cloud Engineer Practice Exam Questions and Answers – Part 8/9

Answer: C. Create an Eventarc trigger filtering on the google.cloud.storage.object.v1.finalized event type for the specific bucket.

Eventarc is the native eventing standard for second-generation Cloud Run Functions, providing direct, managed integration with Cloud Storage without requiring manual Pub/Sub configuration. While Pub/Sub notifications remain valid for legacy architectures, Eventarc is the modern, unified approach expected for native integrations.

Answer: B. Configure Traffic Splitting by Cookie (GOOGAPPUID). Set version v2 to 10% and v1 to 90%.

Splitting traffic by cookie guarantees session affinity by issuing a unique tracking cookie to the client, ensuring a user remains on the same version. IP address splitting is imprecise because corporate proxies and mobile networks cause IP changes, breaking session consistency.

Answer: A. Grant the developer the Service Account Token Creator role on the privileged Service Account. Instruct them to use gcloud auth print-access-token –impersonate-service-account.

Granting the Service Account Token Creator role enables impersonation, allowing the developer to generate short-lived access tokens without handling static keys. Generating a temporary key violates the strict policy because the downloaded JSON file risks leakage and persists until manually deleted.

Answer: B. Initiate a Point-in-Time Recovery (PITR) to a new Cloud SQL instance, specifying the timestamp 9:55 AM. Once verified, export the data and import it back to the primary, or promote the new instance.

Point-in-time recovery creates a new Cloud SQL instance using transaction logs, allowing you to verify the data integrity before routing traffic. Performing recovery on the existing instance is destructive and prevents forensic analysis of the current production database state.

Answer: C. In Project B, grant the roles/storage.objectViewer role to the member serviceAccount:app-sa@project-a.iam.gserviceaccount.com.

IAM policies attach directly to the resource being accessed, so grant the service account from Project A the Object Viewer role inside Project B. Granting roles in Project A only grants access to resources within Project A.

Answer: A. Create a Cloud DNS Private Zone for internal.example.com. Add an A record for db. Authorize the zone for your VPC.

Cloud DNS private zones provide managed internal resolution restricted to your VPC. Public zones publish records to the internet, while IAM roles only control administrative edits, not DNS query visibility.

Answer: C. Cloud Hub, which provides DevOps and SRE teams a centralized view of active events, health data, deployment status, and resource insights for Google Cloud projects and applications.

Cloud Hub is the correct Google Cloud service for SREs to view consolidated operational data, including incidents, alerts, and deployment statuses. Cloud Monitoring is excellent for metrics but lacks this unified operational single-pane view.

Answer: D. Create a Partitioned Table based on the timestamp column.

Partitioning a table by timestamp physically segments the data, allowing BigQuery to prune entire partitions and drastically reduce bytes scanned during date-filtered queries. Clustering helps organize data within partitions but lacks the same hard billing guarantees.

Answer: C. A real-time object detection model that processes video frames with variable input resolutions, producing tensors with dynamic shapes at each step.

Cloud TPUs require ahead-of-time graph compilation, making them poorly suited for workloads with dynamic tensor shapes. GPUs handle variable input resolutions natively without recompilation, avoiding severe performance bottlenecks.

Answer: C. Workforce identity pools are an organization-level resource and must be created at the organization node, not inside a project. The administrator should navigate to the organization in the console and create the pool there.

Workforce identity pools are organization-level resources, not project-level resources. For the exam, remember that federated identity pools are created at the organization node so they can be used across multiple projects. Creating them inside a folder or project will fail.

Answer: B. Use Cloud Asset Inventory with the gcloud asset search-all-resources command and a query filter.

Cloud Asset Inventory lets you search resources across an entire organization with a single command. Scripting loops through hundreds of projects is inefficient and hits API limits, whereas Deployment Manager only tracks resources it deployed.

Answer: C. Create one HA VPN Gateway in Google Cloud. Configure four tunnels: Interface 0 to on-prem IP 1, Interface 0 to on-prem IP 2, Interface 1 to on-prem IP 1, and Interface 1 to on-prem IP 2.

Configuring a full mesh of four tunnels provides the required 99.99 percent uptime SLA for an HA VPN. A two-tunnel configuration only provides a 99.9 percent SLA, because losing one path leaves no redundancy for subsequent failures.

Answer: A. Apply Clustering to the table on the customer_id column.

Applying clustering to the table on the customer ID column physically sorts data within partitions to speed up filtered queries. Partitioning by a high cardinality column like customer ID exceeds the maximum partition limit, making clustering the correct optimization.

Answer: A. Create a Scheduled Query in the BigQuery console that runs the SQL query.

Scheduled Queries handle SQL-to-SQL transformations with minimal operational overhead. Dataflow is for complex ETL pipelines, while Cloud Run functions require writing custom code and managing multiple resources for a simple scheduled task.

Answer: A. Instruct them to use the –dry_run flag in the CLI or view the 'Query Validator' estimate in the Console before running.

Using the dry run flag or Query Validator in BigQuery calculates exact data processing volumes without executing the job. Adding a LIMIT clause is a common trap because BigQuery still scans the full column before applying the limit.

Answer: D. Create a Custom Machine Type with 6 vCPUs and 20 GB of RAM.

Creating a Custom Machine Type provisions the exact hardware needed. For the exam, remember that billing relies on provisioned resources, so startup scripts masking CPUs won't lower costs, and CUDs merely discount existing configurations rather than eliminating waste.

Answer: C. Configure the Cloud Run Function with a Pub/Sub Trigger (Push Subscription). Ensure the function returns a 200 OK status only upon success and a 500 error on failure.

Using a Pub/Sub trigger with a push subscription natively handles retries. If the function returns a non-200 status code, Pub/Sub automatically redelivers the message. Avoid pulling messages manually inside an ephemeral Cloud Run Function, as it introduces complex lifecycle management.

Answer: C. Attach a Regional Persistent Disk to the primary instance.

Attaching a Regional Persistent Disk synchronously replicates data across two zones, achieving a zero Recovery Point Objective. You can force attach the disk to a standby instance in the secondary zone during an outage. Standard snapshots or local SSDs cannot provide immediate, zero-loss failover.