Google Associate Cloud Engineer Exam dumps PDF

QUESTION: 26

You need to set up permissions for a set of Compute Engine instances to enable them to write data into a particular Cloud Storage bucket. You want to follow Google-recommended practices.
What should you do?

Create a service account with an access scope. Use the access scope `https://www.googleapis.com/auth/devstorage.write_only'.
Create a service account with an access scope. Use the access scope `https://www.googleapis.com/auth/cloud-platform'.
Create a service account and add it to the IAM role `storage.objectCreator' for that bucket.
Create a service account and add it to the IAM role `storage.objectAdmin' for that bucket.

Answer(s): C

Explanation:

https://cloud.google.com/iam/docs/understanding-service- accounts#using_service_accounts_with_compute_engine https://cloud.google.com/storage/docs/access-control/iam-roles

Reveal Solution Next Question

QUESTION: 27

You have sensitive data stored in three Cloud Storage buckets and have enabled data access logging. You want to verify activities for a particular user for these buckets, using the fewest possible steps. You need to verify the addition of metadata labels and which files have been viewed from those buckets.
What should you do?

Using the GCP Console, filter the Activity log to view the information.
Using the GCP Console, filter the Stackdriver log to view the information.
View the bucket in the Storage section of the GCP Console.
Create a trace in Stackdriver to view the information.

Answer(s): A

Explanation:

https://cloud.google.com/storage/docs/audit-logs https://cloud.google.com/compute/docs/logging/audit-logging#audited_operations

Reveal Solution Next Question

QUESTION: 28

You are the project owner of a GCP project and want to delegate control to colleagues to manage buckets and files in Cloud Storage. You want to follow Google-recommended practices.
Which IAM roles should you grant your colleagues?

Project Editor
Storage Admin
Storage Object Admin
Storage Object Creator

Answer(s): B

Explanation:

Storage Admin (roles/storage.admin) Grants full control of buckets and objects.
When applied to an individual bucket, control applies only to the specified bucket and objects within the bucket.

firebase.projects.get resourcemanager.projects.get resourcemanager.projects.list storage.buckets.*
storage.objects.*
https://cloud.google.com/storage/docs/access-control/iam-roles

This role grants full control of buckets and objects.
When applied to an individual bucket, control applies only to the specified bucket and objects within the bucket. Ref: https://cloud.google.com/iam/docs/understanding-roles#storage-roles

Reveal Solution Next Question

QUESTION: 29

You have an object in a Cloud Storage bucket that you want to share with an external company. The object contains sensitive data.
You want access to the content to be removed after four hours. The external company does not have a Google account to which you can grant specific user-based access privileges. You want to use the most secure method that requires the fewest steps.
What should you do?

Create a signed URL with a four-hour expiration and share the URL with the company.
Set object access to `public' and use object lifecycle management to remove the object after four hours.
Configure the storage bucket as a static website and furnish the object's URL to the company.
Delete the object from the storage bucket after four hours.
Create a new Cloud Storage bucket specifically for the external company to access. Copy the object to that bucket. Delete the bucket after four hours have passed.

Answer(s): A

Explanation:

Signed URLs are used to give time-limited resource access to anyone in possession of the URL, regardless of whether they have a Google account. https://cloud.google.com/storage/docs/access- control/signed-urls

Reveal Solution Next Question

QUESTION: 30

You are creating a Google Kubernetes Engine (GKE) cluster with a cluster autoscaler feature enabled. You need to make sure that each node of the cluster will run a monitoring pod that sends container metrics to a third-party monitoring solution.
What should you do?

Deploy the monitoring pod in a StatefulSet object.
Deploy the monitoring pod in a DaemonSet object.
Reference the monitoring pod in a Deployment object.
Reference the monitoring pod in a cluster initializer at the GKE cluster creation time.

Answer(s): B

Explanation:

https://cloud.google.com/kubernetes-engine/docs/concepts/daemonset https://cloud.google.com/kubernetes-engine/docs/concepts/daemonset#usage_patterns

DaemonSets attempt to adhere to a one-Pod-per-node model, either across the entire cluster or a subset of nodes. As you add nodes to a node pool, DaemonSets automatically add Pods to the new nodes as needed.

In GKE, DaemonSets manage groups of replicated Pods and adhere to a one-Pod-per-node model, either across the entire cluster or a subset of nodes. As you add nodes to a node pool, DaemonSets automatically add Pods to the new nodes as needed. So, this is a perfect fit for our monitoring pod. Ref: https://cloud.google.com/kubernetes-engine/docs/concepts/daemonset DaemonSets are useful for deploying ongoing background tasks that you need to run on all or certain nodes, and which do not require user intervention. Examples of such tasks include storage daemons like ceph, log collection daemons like fluentd, and node monitoring daemons like collectd. For example, you could have DaemonSets for each type of daemon run on all of your nodes. Alternatively, you could run multiple DaemonSets for a single type of daemon, but have them use different configurations for different hardware types and resource needs.

Reveal Solution Next Question

Google Google Associate Cloud Engineer Exam (page: 6) Google Associate Cloud Engineer Updated on: 24-Mar-2026

QUESTION: 26

Explanation:

QUESTION: 27

Explanation:

QUESTION: 28

Explanation:

QUESTION: 29

Explanation:

QUESTION: 30

Explanation:

Google Google Associate Cloud Engineer Exam (page: 6)
Google Associate Cloud Engineer
Updated on: 24-Mar-2026