[2024年01月14日] 手に入れよう！最新Associate-Cloud-Engineer認定された有効な試験問題集解答
100%合格率保証付きの素晴らしいAssociate-Cloud-Engineer試験問題PDF
Google Associate Cloud Engineer認定試験は、個人がキャリアの見通しを高め、収益の可能性を高めるのに役立つ貴重な認定です。認証は世界的に認識されており、クラウドコンピューティング業界で非常に尊敬されています。この認定を取得することにより、専門家はGoogleクラウドプラットフォームでクラウドソリューションを設計、開発、管理する能力を実証できます。これにより、さまざまな業界で多くの雇用機会が開かれます。全体として、Google Associate Cloud Engineer認定試験は、スキルを向上させ、クラウドコンピューティングのキャリアを促進したい専門家にとって優れた選択肢です。
質問 # 133
Your company implemented BigQuery as an enterprise data warehouse. Users from multiple business units run queries on this data warehouse. However, you notice that query costs for BigQuery are very high, and you need to control costs. Which two methods should you use? (Choose two.)
- A. Split your BigQuery data warehouse into multiple data warehouses for each business unit.
- B. Create separate copies of your BigQuery data warehouse for each business unit.
- C. Split the users from business units to multiple projects.
- D. Change your BigQuery query model from on-demand to flat rate. Apply the appropriate number of slots to each Project.
- E. Apply a user- or project-level custom query quota for BigQuery data warehouse.
正解：D、E
解説：
Explanation
https://cloud.google.com/bigquery/docs/custom-quotas
https://cloud.google.com/bigquery/pricing#flat_rate_pricing
質問 # 134
You need a dynamic way of provisioning VMs on Compute Engine. The exact specifications will be in a dedicated configuration file. You want to follow Google's recommended practices. Which method should you use?
- A. Managed Instance Group
- B. Deployment Manager
- C. Unmanaged Instance Group
- D. Cloud Composer
正解：A
解説：
Explanation
Explanation/Reference: https://cloud.google.com/compute/docs/instances/
質問 # 135
You need to create a copy of a custom Compute Engine virtual machine (VM) to facilitate an expected increase in application traffic due to a business acquisition. What should you do?
- A. Create a custom Compute Engine image from a snapshot. Create your images from that image.
- B. Create a Compute Engine snapshot of your base VM. Create your instances from that snapshot.
- C. Create a Compute Engine snapshot of your base VM. Create your images from that snapshot.
- D. Create a custom Compute Engine image from a snapshot. Create your instances from that image.
正解：D
解説：
A custom image belongs only to your project. To create an instance with a custom image, you must first have a custom image.
質問 # 136
You have been asked to set up Object Lifecycle Management for objects stored in storage buckets. The objects are written once and accessed frequently for 30 days. After 30 days, the objects are not read again unless there is a special need. The object should be kept for three years, and you need to minimize cost.
What should you do?
- A. Set up a policy that uses Nearline storage for 30 days, then moves the Coldline for one year, and then moves to Archive storage for two years.
- B. Set up a policy that uses Standard storage for 30 days and then moves to Archive storage for three years.
- C. Set up a policy that uses Nearline storage for 30 days and then moves to Archive storage for three years.
- D. Set up a policy that uses Standard storage for 30 days, then moves to Coldline for one year, and then moves to Archive storage for two years.
正解：B
解説：
The key to understand the requirement is: "The objects are written once and accessed frequently for 30 days" Standard Storage Standard Storage is best for data that is frequently accessed ("hot" data) and/or stored for only brief periods of time.
Archive Storage
Archive Storage is the lowest-cost, highly durable storage service for data archiving, online backup, and disaster recovery. Unlike the "coldest" storage services offered by other Cloud providers, your data is available within milliseconds, not hours or days. Archive Storage is the best choice for data that you plan to access less than once a year.
https://cloud.google.com/storage/docs/storage-classes#standard
質問 # 137
You have a project for your App Engine application that serves a development environment. The required testing has succeeded and you want to create a new project to serve as your production environment.
What should you do?
- A. Create a Deployment Manager configuration file that copies the current App Engine deployment into a new project.
- B. Use gcloud to create the new project, and then deploy your application to the new project.
- C. Deploy your application again using gcloud and specify the project parameter with the new project name to create the new project.
- D. Use gcloud to create the new project and to copy the deployed application to the new project.
正解：B
解説：
gcloud can be used to create a new project and the gcloud app deploy can point to the new project.
質問 # 138
You have an instance group that you want to load balance. You want the load balancer to terminate the client SSL session. The instance group is used to serve a public web application over HTTPS. You want to follow Google-recommended practices. What should you do?
- A. Configure an external TCP proxy load balancer.
- B. Configure an internal TCP load balancer.
- C. Configure an HTTP(S) load balancer.
- D. Configure an external SSL proxy load balancer.
正解：C
解説：
For HTTP(s) Load balancer, the client SSL session terminates at the load balancer.
質問 # 139
You are using Google Kubernetes Engine with autoscaling enabled to host a new application. You want to expose this new application to the public, using HTTPS on a public IP address. What should you do?
- A. Create a HAProxy pod in the cluster to load-balance the traffic to all the pods of the application. Forward the public traffic to HAProxy with an iptable rule. Configure the DNS name of your application using the public IP of the node HAProxy is running on.
- B. Create a Kubernetes Service of type NodePort for your application, and a Kubernetes Ingress to expose this Service via a Cloud Load Balancer.
- C. Create a Kubernetes Service of type NodePort to expose the application on port 443 of each node of the Kubernetes cluster. Configure the public DNS name of your application with the IP of every node of the cluster to achieve load-balancing.
- D. Create a Kubernetes Service of type ClusterIP for your application. Configure the public DNS name of your application using the IP of this Service.
正解：B
解説：
Explanation/Reference: https://cloud.google.com/kubernetes-engine/docs/tutorials/http-balancer
質問 # 140
You are building a new version of an application hosted in an App Engine environment. You want to test the new version with 1% of users before you completely switch your application over to the new version. What should you do?
- A. Deploy a new version of your application in App Engine. Then go to App Engine settings in GCP Console and split traffic between the current version and newly deployed versions accordingly.
- B. Deploy a new version of your application in Google Kubernetes Engine instead of App Engine and then use GCP Console to split traffic.
- C. Deploy a new version as a separate app in App Engine. Then configure App Engine using GCP Console to split traffic between the two apps.
- D. Deploy a new version of your application in a Compute Engine instance instead of App Engine and then use GCP Console to split traffic.
正解：A
解説：
GCP App Engine natively offers traffic splitting functionality between versions. You can use traffic splitting to specify a percentage distribution of traffic across two or more of the versions within a service. Splitting traffic allows you to conduct A/B testing between your versions and provides control over the pace when rolling out features.
Ref: https://cloud.google.com/appengine/docs/standard/python/splitting-traffic
質問 # 141
You manage an App Engine Service that aggregates and visualizes data from BigQuery. The application is deployed with the default App Engine Service account. The data that needs to be visualized resides in a different project managed by another team. You do not have access to this project, but you want your application to be able to read data from the BigQuery dataset. What should you do?
- A. In Cloud IAM of your project, ensure that the default App Engine service account has the role of BigQuery Data Viewer.
- B. Ask the other team to grant your default App Engine Service account the role of BigQuery Data Viewer.
- C. In Cloud IAM of your project, grant a newly created service account from the other team the role of BigQuery Job User in your project.
- D. Ask the other team to grant your default App Engine Service account the role of BigQuery Job User.
正解：B
解説：
The resource that you need to get access is in the other project.
roles/bigquery.dataViewer BigQuery Data Viewer
When applied to a table or view, this role provides permissions to:
Read data and metadata from the table or view.
This role cannot be applied to individual models or routines.
When applied to a dataset, this role provides permissions to:
Read the dataset's metadata and list tables in the dataset.
Read data and metadata from the dataset's tables.
When applied at the project or organization level, this role can also enumerate all datasets in the project. Additional roles, however, are necessary to allow the running of jobs.
質問 # 142
Your auditor wants to view your organization's use of data in Google Cloud. The auditor is most interested in auditing who accessed data in Cloud Storage buckets. You need to help the auditor access the data they need. What should you do?
- A. Assign the appropriate permissions, and then create a Data Studio report on Admin Activity Audit Logs
- B. Assign the appropriate permissions, and then use Cloud Monitoring to review metrics
- C. Use the export logs API to provide the Admin Activity Audit Logs in the format they want
- D. Turn on Data Access Logs for the buckets they want to audit, and Then build a query in the log viewer that filters on Cloud Storage
正解：D
解説：
Types of audit logs Cloud Audit Logs provides the following audit logs for each Cloud project, folder, and organization: Admin Activity audit logs Data Access audit logs System Event audit logs Policy Denied audit logs ***Data Access audit logs contain API calls that read the configuration or metadata of resources, as well as user-driven API calls that create, modify, or read user-provided resource data. https://cloud.google.com/logging/docs/audit#types
https://cloud.google.com/logging/docs/audit#data-access Cloud Storage: When Cloud Storage usage logs are enabled, Cloud Storage writes usage data to the Cloud Storage bucket, which generates Data Access audit logs for the bucket. The generated Data Access audit log has its caller identity redacted.
質問 # 143
Users of your application are complaining of slowness when loading the application. You realize the slowness is because the App Engine deployment serving the application is deployed in us-central whereas all users of this application are closest to europe-west3. You want to change the region of the App Engine application to europe-west3 to minimize latency. What's the best way to change the App Engine region?
- A. Create a new project and create an App Engine instance in europe-west3
- B. From the console, under the App Engine page, click edit, and change the region drop-down.
- C. Use the gcloud app region set command and supply the name of the new region.
- D. Contact Google Cloud Support and request the change.
正解：A
解説：
Explanation
App engine is a regional service, which means the infrastructure that runs your app(s) is located in a specific region and is managed by Google to be redundantly available across all the zones within that region. Once an app engine deployment is created in a region, it cant be changed. The only way is to create a new project and create an App Engine instance in europe-west3, send all user traffic to this instance and delete the app engine instance in us-central.
Ref: https://cloud.google.com/appengine/docs/locations
質問 # 144
A team of data scientists infrequently needs to use a Google Kubernetes Engine (GKE) cluster that you manage. They require GPUs for some long-running, non-restartable jobs. You want to minimize cost. What should you do?
- A. Create a VerticalPodAutscaler for those workloads.
- B. Create a node pool of instances with GPUs, and enable autoscaling on this node pool with a minimum size of 1.
- C. Enable node auto-provisioning on the GKE cluster.
- D. Create a node pool with preemptible VMs and GPUs attached to those VMs.
正解：C
解説：
auto-provisioning = Attaches and deletes node pools to cluster based on the requirements. Hence creating a GPU node pool, and auto-scaling would be better https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning
質問 # 145
A Solutions Architect is designing a photo application on AWS. Every time a user uploads a photo to Amazon S3, the Architect must insert a new item to a DynamoDB table.
Which AWS-managed service is the BEST fit to insert the item?
- A. Lambda@Edge
- B. AWS Lambda
- C. Amazon API Gateway
- D. Amazon EC2 instances
正解：B
解説：
Explanation/Reference:
Reference https://aws.amazon.com/blogs/machine-learning/build-your-own-face-recognition-service-using- amazon-rekognition/
質問 # 146
You have experimented with Google Cloud using your own credit card and expensed the costs to your company. Your company wants to streamline the billing process and charge the costs of your projects to their monthly invoice. What should you do?
- A. Grant the financial team the IAM role of ג€Billing Account Userג€ on the billing account linked to your credit card.
- B. Create a ticket with Google Billing Support to ask them to send the invoice to your company.
- C. Set up BigQuery billing export and grant your financial department IAM access to query the data.
- D. Change the billing account of your projects to the billing account of your company.
正解：D
質問 # 147
Your management has asked an external auditor to review all the resources in a specific project.
The security team has enabled the Organization Policy called Domain Restricted Sharing on the organization node by specifying only your Cloud Identity domain. You want the auditor to only be able to view, but not modify, the resources in that project. What should you do?
- A. Ask the auditor for their Google account, and give them the Viewer role on the project.
- B. Create a temporary account for the auditor in Cloud Identity, and give that account the Security Reviewer role on the project.
- C. Create a temporary account for the auditor in Cloud Identity, and give that account the Viewer role on the project.
- D. Ask the auditor for their Google account, and give them the Security Reviewer role on the project.
正解：C
解説：
roles/viewer Read access to all resources. Get and list access for all resources.
Using primitive roles
The following table lists the primitive roles that you can grant to access a project, the description of what the role does, and the permissions bundled within that role. Avoid using primitive roles except when absolutely necessary. These roles are very powerful, and include a large number of permissions across all Google Cloud services. For more details on when you should use primitive roles, see the Identity and Access Management FAQ.
IAM predefined roles are much more granular, and allow you to carefully manage the set of permissions that your users have access to. See Understanding Roles for a list of roles that can be granted at the project level. Creating custom roles can further increase the control you have over user permissions.
https://cloud.google.com/resource-manager/docs/access-control-proj#using_primitive_roles
質問 # 148
You are using Google Kubernetes Engine with autoscaling enabled to host a new application. You want to expose this new application to the public, using HTTPS on a public IP address. What should you do?
- A. Create a HAProxy pod in the cluster to load-balance the traffic to all the pods of the application. Forward the public traffic to HAProxy with an iptable rule. Configure the DNS name of your application using the public IP of the node HAProxy is running on.
- B. Create a Kubernetes Service of type NodePort for your application, and a Kubernetes Ingress to expose this Service via a Cloud Load Balancer.
- C. Create a Kubernetes Service of type NodePort to expose the application on port 443 of each node of the Kubernetes cluster. Configure the public DNS name of your application with the IP of every node of the cluster to achieve load-balancing.
- D. Create a Kubernetes Service of type ClusterIP for your application. Configure the public DNS name of your application using the IP of this Service.
正解：B
解説：
Reference:
Create a Kubernetes Service of type ClusterIP for your application. Configure the public DNS name of your application using the IP of this Service. is not right.
Kubernetes Service of type ClusterIP exposes the Service on a cluster-internal IP. Choosing this value makes the Service only reachable from within the cluster so you can not route external traffic to this IP.
Ref: https://kubernetes.io/docs/concepts/services-networking/service/
質問 # 149
You are using Container Registry to centrally store your company's container images in a separate project. In another project, you want to create a Google Kubernetes Engine (GKE) cluster. You want to ensure that Kubernetes can download images from Container Registry. What should you do?
- A. When you create the GKE cluster, choose the Allow full access to all Cloud APIsoption under
'Access scopes'. - B. In the project where the images are stored, grant the Storage Object Viewer IAM role to the service account used by the Kubernetes nodes.
- C. Configure the ACLs on each image in Cloud Storage to give read-only access to the default Compute Engine service account.
- D. Create a service account, and give it access to Cloud Storage. Create a P12 key for this service account and use it as an imagePullSecrets in Kubernetes.
正解：D
解説：
Explanation
質問 # 150
Your organization has a dedicated person who creates and manages all service accounts for Google Cloud projects. You need to assign this person the minimum role for projects. What should you do?
- A. Add the user to roles/iam.serviceAccountAdmin role.
- B. Add the user to roles/iam.securityAdmin role.
- C. Add the user to roles/iam.roleAdmin role.
- D. Add the user to roles/iam.serviceAccountUser role.
正解：D
解説：
Explanation/Reference: https://cloud.google.com/iam/docs/creating-managing-service-accounts
質問 # 151
You are running multiple VPC-native Google Kubernetes Engine clusters in the same subnet. The IPs available for the nodes are exhausted, and you want to ensure that the clusters can grow in nodes when needed.
What should you do?
- A. Expand the CIDR range of the relevant subnet for the cluster.
- B. Create a new subnet in the same region as the subnet being used.
- C. Add an alias IP range to the subnet used by the GKE clusters.
- D. Create a new VPC, and set up VPC peering with the existing VPC.
正解：A
解説：
Explanation
gcloud compute networks subnets expand-ip-range NAME gcloud compute networks subnets expand-ip-range
- expand the IP range of a Compute Engine subnetwork
https://cloud.google.com/sdk/gcloud/reference/compute/networks/subnets/expand-ip-range
質問 # 152
You are hosting an application from Compute Engine virtual machines (VMs) in us-central1-a. You want to adjust your design to support the failure of a single Compute Engine zone, eliminate downtime, and minimize cost. What should you do?
- A. - Create Compute Engine resources in us-central1-b.
-Balance the load across both us-central1-a and us-central1-b. - B. - Create a Managed Instance Group and specify us-central1-a as the zone.
-Configure the Health Check with a short Health Interval. - C. - Create an HTTP(S) Load Balancer.
-Create one or more global forwarding rules to direct traffic to your VMs. - D. - Perform regular backups of your application.
-Create a Cloud Monitoring Alert and be notified if your application becomes unavailable.
-Restore from backups when notified.
正解：A
解説：
Explanation
Choosing a region and zone You choose which region or zone hosts your resources, which controls where your data is stored and used. Choosing a region and zone is important for several reasons:
Handling failures
Distribute your resources across multiple zones and regions to tolerate outages. Google designs zones to be independent from each other: a zone usually has power, cooling, networking, and control planes that are isolated from other zones, and most single failure events will affect only a single zone. Thus, if a zone becomes unavailable, you can transfer traffic to another zone in the same region to keep your services running.
Similarly, if a region experiences any disturbances, you should have backup services running in a different region. For more information about distributing your resources and designing a robust system, see Designing Robust Systems. Decreased network latency To decrease network latency, you might want to choose a region or zone that is close to your point of service.
https://cloud.google.com/compute/docs/regions-zones#choosing_a_region_and_zone
質問 # 153
You need to set up a policy so that videos stored in a specific Cloud Storage Regional bucket are moved to Coldline after 90 days, and then deleted after one year from their creation.
How should you set up the policy?
- A. Use gsutil rewrite and set the Delete action to 275 days (365-90).
- B. Use Cloud Storage Object Lifecycle Management using Age conditions with SetStorageClass and Delete actions.
Set the SetStorageClass action to 90 days and the Delete action to 275 days (365-90) - C. Use Cloud Storage Object Lifecycle Management using Age conditions with SetStorageClass and Delete actions.
Set the SetStorageClass action to 90 days and the Delete action to 365 days. - D. Use gsutil rewrite and set the Delete action to 365 days.
正解：B
質問 # 154
For analysis purposes, you need to send all the logs from all of your Compute Engine instances to a BigQuery dataset called platform-logs. You have already installed the Stackdriver Logging agent on all the instances. You want to minimize cost. What should you do?
- A. 1. Create a Cloud Function that has the BigQuery User role on the platform-logsdataset.
2. Configure this Cloud Function to create a BigQuery Job that executes this query:
INSERT INTO dataset.platform-logs (timestamp, log)
SELECT timestamp, log FROM compute.logs
WHERE timestamp > DATE_SUB(CURRENT_DATE(), INTERVAL 1 DAY)
3. Use Cloud Scheduler to trigger this Cloud Function once a day. - B. 1. In Stackdriver Logging, create a filter to view only Compute Engine logs.
2. Click Create Export.
3. Choose BigQuery as Sink Service, and the platform-logsdataset as Sink Destination. - C. 1. In Stackdriver Logging, create a logs export with a Cloud Pub/Sub topic called logsas a sink.
2. Create a Cloud Function that is triggered by messages in the logstopic.
3. Configure that Cloud Function to drop logs that are not from Compute Engine and to insert Compute Engine logs in the platform-logsdataset. - D. 1. Give the BigQuery Data Editor role on the platform-logsdataset to the service accounts used by your instances.
2. Update your instances' metadata to add the following value: logs-destination:
bq://platform-logs.
正解：B
解説：
https://cloud.google.com/logging/docs/export/configure_export_v2
質問 # 155
Your company set up a complex organizational structure on Google Could Platform. The structure includes hundreds of folders and projects. Only a few team members should be able to view the hierarchical structure. You need to assign minimum permissions to these team members and you want to follow Google-recommended practices. What should you do?
- A. Add the users to roles/browser role.
- B. Add the users to roles/iam.roleViewer role.
- C. Add the users to a group, and add this group to roles/browser role.
- D. Add the users to a group, and add this group to roles/iam.roleViewer role.
正解：C
解説：
We need to apply the GCP Best practices. roles/browser Browser Read access to browse the hierarchy for a project, including the folder, organization, and IAM policy. This role doesn't include permission to view resources in the project. https://cloud.google.com/iam/docs/understanding-roles
質問 # 156
......
無料Associate-Cloud-Engineer別格な問題集をダウンロード：https://www.goshiken.com/Google/Associate-Cloud-Engineer-mondaishu.html
Associate-Cloud-Engineer問題集で2024年最新のGoogle試験問題：https://drive.google.com/open?id=10svqZDnho3GYwevtd4sEWLLZdYswwr6z