Free Access to Google.Associate-Cloud-Engineer.v2026-09-07.q249 with Valid Practice Test (Page 40)

Question 191

You have an application that runs on Compute Engine VM instances in a custom Virtual Private Cloud (VPC).
Your company's security policies only allow the use to internal IP addresses on VM instances and do not let VM instances connect to the internet. You need to ensure that the application can access a file hosted in a Cloud Storage bucket within your project. What should you do?

A.Enable Private Service Access on the Cloud Storage Bucket.
B.Enable Private Google Access on the subnet within the custom VPC.
C.Deploy a Cloud NAT instance and route the traffic to the dedicated IP address of the Cloud Storage bucket.
D.Add slorage.googleapis.com to the list of restricted services in a VPC Service Controls perimeter and add your project to the list to protected projects.

Question 192

You are using Google Kubernetes Engine with autoscaling enabled to host a new application. You want to expose this new application to the public, using HTTPS on a public IP address. What should you do?

A.Create a Kubernetes Service of type NodePort for your application, and a Kubernetes Ingress to expose this Service via a Cloud Load Balancer.
B.Create a Kubernetes Service of type ClusterIP for your application. Configure the public DNS name of your application using the IP of this Service.
C.Create a Kubernetes Service of type NodePort to expose the application on port 443 of each node of the Kubernetes cluster. Configure the public DNS name of your application with the IP of every node of the cluster to achieve load-balancing.
D.Create a HAProxy pod in the cluster to load-balance the traffic to all the pods of the application. Forward the public traffic to HAProxy with an iptable rule. Configure the DNS name of your application using the public IP of the node HAProxy is running on.

Question 193

Your company is seeking a scalable solution to retain and explore application logs hosted on Compute Engine. You must be able to analyze your logs with SQL queries, and you want to be able to create charts to identify patterns and trends in your logs over time. You want to follow Google-recommended practices and minimize your operational costs. What should you do?

A.Use a custom script to push your application logs to Cloud SQL for exploration.
B.Ingest your application logs to Cloud Logging by using Ops Agent, and explore your logs with Log Analytics.
C.Use a custom script to push your application logs to BigQuery for exploration.
D.Ingest your application logs to Cloud Logging by using Ops Agent, and explore your logs in Logs Explorer.

Question 194

You have an application that uses Cloud Spanner as a database backend to keep current state information about users. Cloud Bigtable logs all events triggered by users. You export Cloud Spanner data to Cloud Storage during daily backups. One of your analysts asks you to join data from Cloud Spanner and Cloud Bigtable for specific users. You want to complete this ad hoc request as efficiently as possible. What should you do?

A.Create a dataflow job that copies data from Cloud Bigtable and Cloud Storage for specific users.
B.Create a dataflow job that copies data from Cloud Bigtable and Cloud Spanner for specific users.
C.Create a Cloud Dataproc cluster that runs a Spark job to extract data from Cloud Bigtable and Cloud Storage for specific users.
D.Create two separate BigQuery external tables on Cloud Storage and Cloud Bigtable. Use the BigQuery console to join these tables through user fields, and apply appropriate filters.

Question 195

You assist different engineering teams in deploying their infrastructure on Google Cloud. Your company has defined certain practices required for all workloads. You need to provide the engineering teams with a solution that enables teams to deploy their infrastructure independently without having to know all implementation details of the company ' s required practices. What should you do?

A.Create a service account per team, and grant the service account the Project Editor role. Ask the teams to provision their infrastructure through the Google Cloud CLI (gcloud CLI), while impersonating their dedicated service account.
B.Provide training for all engineering teams you work with to understand the company's required practices. Allow the engineering teams to provision the infrastructure to best meet their needs.
C.Configure organization policies to enforce your company's required practices. Ask the teams to provision their infrastructure by using the Google Cloud console.
D.Write Terraform modules for each component that are compliant with the company's required practices, and ask teams to implement their infrastructure through these modules.

Correct Answer: D

The goal is to enable teams to deploy infrastructure independently while ensuring compliance with company practices, without requiring teams to understand the underlying details of those practices.
Option A provides deployment capability but doesn ' t enforce practices. The Editor role is overly broad, and using the gcloud CLI directly requires knowledge of how to configure resources compliantly.
Option B requires teams to learn all the practices, contradicting the requirement that they don ' t need to know the implementation details.
Option C (Organization Policies) is useful for setting constraints (e.g., disallowing public IPs, restricting regions), but it doesn ' t provide pre-configured, deployable components that embody best practices. Teams still need to figure out how to build compliant resources within the policy constraints.
Option D (Terraform Modules): This approach encapsulates the company ' s required practices within reusable infrastructure-as-code modules. Engineering teams can then use these modules as building blocks, providing only the necessary input parameters (like application name orsize). The module handles the compliant implementation details internally. This allows teams to deploy independently and ensures compliance without needing deep knowledge of every practice.
Using standardized, compliant modules is a common pattern for enabling self-service infrastructure deployment while maintaining standards and governance.
References:
Terraform Modules: " Modules are containers for multiple resources that are used together... Modules allow complex resources to be abstracted away behind a clean interface. " - https://developer.hashicorp.com
/terraform/language/modules
Google Cloud Architecture Framework - Security, privacy, and compliance: Recommends using IaC and pre- approved templates/modules to enforce security configurations. - https://cloud.google.com/architecture
/framework/security-privacy-compliance/define-and-enforce-security-configurations Organization Policy Service: " The Organization Policy Service gives you centralized and programmatic control over your organization ' s cloud resources... define constraints... " (Focuses on constraints, not providing deployable components). - https://cloud.google.com/resource-manager/docs/organization-policy
/overview

Question 191

Question 192

Question 193

Question 194

Question 195

Download PDF File