Question 1

You are building a pipeline to process time-series data. Which Google Cloud Platform services should you put in boxes 1,2,3, and 4?

Accepted Answer

A)  Cloud Pub/Sub, Cloud Dataflow, Cloud Datastore, BigQuery 
B)  Firebase Messages, Cloud Pub/Sub, Cloud Spanner, BigQuery 
C)  Cloud Pub/Sub, Cloud Storage, BigQuery, Cloud Bigtable 
D)  Cloud Pub/Sub, Cloud Dataflow, Cloud Bigtable, BigQuery

Question 2

You are managing several Google Cloud Platform (GCP) projects and need access to all logs for the past 60 days. You want to be able to explore and quickly analyze the log contents. You want to follow Google-recommended practices to obtain the combined logs for all projects. What should you do?

Accepted Answer

A)  Navigate to Stackdriver Logging and select resource.labels.project_id="*" Navigate to Stackdriver Logging and select resource.labels.project_id="*" 
B)  Create a Stackdriver Logging Export with a Sink destination to a BigQuery dataset. Configure the table expiration to 60 days. 
C)  Create a Stackdriver Logging Export with a Sink destination to Cloud Storage. Create a lifecycle rule to delete objects after 60 days. 
D)  Configure a Cloud Scheduler job to read from Stackdriver and store the logs in BigQuery. Configure the table expiration to 60 days.

Question 3

You want to add a new auditor to a Google Cloud Platform project. The auditor should be allowed to read, but not modify, all project items. How should you configure the auditor's permissions?

Accepted Answer

A)  Create a custom role with view-only project permissions. Add the user's account to the custom role. 
B)  Create a custom role with view-only service permissions. Add the user's account to the custom role. 
C)  Select the built-in IAM project Viewer role. Add the user's account to this role. 
D)  Select the built-in IAM service Viewer role. Add the user's account to this role.

Question 4

Your company has a large quantity of unstructured data in different file formats. You want to perform ETL transformations on the data. You need to make the data accessible on Google Cloud so it can be processed by a Dataflow job. What should you do?

Accepted Answer

A)  Upload the data to BigQuery using the bq command line tool. Upload the data to BigQuery using the bq command line tool. 
B)  Upload the data to Cloud Storage using the gsutil command line tool. Upload the data to Cloud Storage using the gsutil 
C)  Upload the data into Cloud SQL using the import function in the console. 
D)  Upload the data into Cloud Spanner using the import function in the console.

Question 5

You are deploying an application to a Compute Engine VM in a managed instance group. The application must be running at all times, but only a single instance of the VM should run per GCP project. How should you configure the instance group?

Accepted Answer

A)  Set autoscaling to On, set the minimum number of instances to 1, and then set the maximum number of instances to 1. 
B)  Set autoscaling to Off, set the minimum number of instances to 1, and then set the maximum number of instances to 1. 
C)  Set autoscaling to On, set the minimum number of instances to 1, and then set the maximum number of instances to 2. 
D)  Set autoscaling to Off, set the minimum number of instances to 1, and then set the maximum number of instances to 2.

Question 6

You deployed an LDAP server on Compute Engine that is reachable via TLS through port 636 using UDP. You want to make sure it is reachable by clients over that port. What should you do?

Accepted Answer

A)  Add the network tag allow-udp-636 to the VM instance running the LDAP server. Add the network tag allow-udp-636 to the VM instance running the LDAP server. 
B)  Create a route called allow-udp-636 and set the next hop to be the VM instance running the LDAP server. Create a route called and set the next hop to be the VM instance running the LDAP server. 
C)  Add a network tag of your choice to the instance. Create a firewall rule to allow ingress on UDP port 636 for that network tag. 
D)  Add a network tag of your choice to the instance running the LDAP server. Create a firewall rule to allow egress on UDP port 636 for that network tag.

Question 7

Your management has asked an external auditor to review all the resources in a specific project. The security team has enabled the Organization Policy called Domain Restricted Sharing on the organization node by specifying only your Cloud Identity domain. You want the auditor to only be able to view, but not modify, the resources in that project. What should you do?

Accepted Answer

A)  Ask the auditor for their Google account, and give them the Viewer role on the project. 
B)  Ask the auditor for their Google account, and give them the Security Reviewer role on the project. 
C)  Create a temporary account for the auditor in Cloud Identity, and give that account the Viewer role on the project. 
D)  Create a temporary account for the auditor in Cloud Identity, and give that account the Security Reviewer role on the project.

Question 8

You built an application on Google Cloud that uses Cloud Spanner. Your support team needs to monitor the environment but should not have access to table data. You need a streamlined solution to grant the correct permissions to your support team, and you want to follow Google-recommended practices. What should you do?

Accepted Answer

A)  Add the support team group to the roles/monitoring.viewer role 
B)  Add the support team group to the roles/spanner.databaseUser role. 
C)  Add the support team group to the roles/spanner.databaseReader role. 
D)  Add the support team group to the roles/stackdriver.accounts.viewer role.

Question 9

You are working with a user to set up an application in a new VPC behind a firewall. The user is concerned about data egress. You want to configure the fewest open egress ports. What should you do?

Accepted Answer

A)  Set up a low-priority (65534) rule that blocks all egress and a high-priority rule (1000) that allows only the appropriate ports. 
B)  Set up a high-priority (1000) rule that pairs both ingress and egress ports. 
C)  Set up a high-priority (1000) rule that blocks all egress and a low-priority (65534) rule that allows only the appropriate ports. 
D)  Set up a high-priority (1000) rule to allow the appropriate ports.

Question 10

You need to run an important query in BigQuery but expect it to return a lot of records. You want to find out how much it will cost to run the query. You are using on-demand pricing. What should you do?

Accepted Answer

A)  Arrange to switch to Flat-Rate pricing for this query, then move back to on-demand. 
B)  Use the command line to run a dry run query to estimate the number of bytes read. Then convert that bytes estimate to dollars using the Pricing Calculator. 
C)  Use the command line to run a dry run query to estimate the number of bytes returned. Then convert that bytes estimate to dollars using the Pricing Calculator. 
D)  Run a select count (*) to get an idea of how many records your query will look through. Then convert that number of rows to dollars using the Pricing Calculator. Run a select count (*) to get an idea of how many records your query will look through. Then convert that number of rows to dollars using the Pricing Calculator.

Question 11

You have an application that receives SSL-encrypted TCP traffic on port 443. Clients for this application are located all over the world. You want to minimize latency for the clients. Which load balancing option should you use?

Accepted Answer

A)  HTTPS Load Balancer 
B)  Network Load Balancer 
C)  SSL Proxy Load Balancer 
D)  Internal TCP/UDP Load Balancer. Add a firewall rule allowing ingress traffic from 0.0.0.0/0 on the target instances. Internal TCP/UDP Load Balancer. Add a firewall rule allowing ingress traffic from 0.0.0.0/0 on the target instances.

Question 12

A legacy application running in premises requires a Solutions Architect to be able to open a firewall to allow access to several Amazon S3 buckets. The Architect has a VPN connection to AWS in place. How should the Architect meet this requirement?

Accepted Answer

A)  Create an IAM role that allows access from the corporate network to Amazon S3. 
B)  Configure a proxy on Amazon EC2 and use an Amazon S3 VPC endpoint. 
C)  Use Amazon API Gateway to do IP whitelisting. 
D)  Configure IP whitelisting on the customer's gateway.

Question 13

The core business of your company is to rent out construction equipment at a large scale. All the equipment that is being rented out has been equipped with multiple sensors that send event information every few seconds. These signals can vary from engine status, distance traveled, fuel level, and more. Customers are billed based on the consumption monitored by these sensors. You expect high throughput - up to thousands of events per hour per device - and need to retrieve consistent data based on the time of the event. Storing and retrieving individual signals should be atomic. What should you do?

Accepted Answer

A)  Create a file in Cloud Storage per device and append new data to that file. 
B)  Create a file in Cloud Filestore per device and append new data to that file. 
C)  Ingest the data into Datastore. Store data in an entity group based on the device. 
D)  Ingest the data into Cloud Bigtable. Create a row key based on the event timestamp.

Question 14

You want to find out when users were added to Cloud Spanner Identity Access Management (IAM) roles on your Google Cloud Platform (GCP) project. What should you do in the GCP Console?

Accepted Answer

A)  Open the Cloud Spanner console to review configurations. 
B)  Open the IAM & admin console to review IAM policies for Cloud Spanner roles. 
C)  Go to the Stackdriver Monitoring console and review information for Cloud Spanner. 
D)  Go to the Stackdriver Logging console, review admin activity logs, and filter them for Cloud Spanner IAM roles.

Question 15

Your company set up a complex organizational structure on Google Could. The structure includes hundreds of folders and projects. Only a few team members should be able to view the hierarchical structure. You need to assign minimum permissions to these team members and you want to follow Google-recommended practices. What should you do?

Accepted Answer

A)  Add the users to roles/browser role. 
B)  Add the users to roles/iam.roleViewer role. 
C)  Add the users to a group, and add this group to roles/browser role. 
D)  Add the users to a group, and add this group to roles/iam.roleViewer role.

Question 16

Your organization is a financial company that needs to store audit log files for 3 years. Your organization has hundreds of Google Cloud projects. You need to implement a cost-effective approach for log file retention. What should you do?

Accepted Answer

A)  Create an export to the sink that saves logs from Cloud Audit to BigQuery. 
B)  Create an export to the sink that saves logs from Cloud Audit to a Coldline Storage bucket. 
C)  Write a custom script that uses logging API to copy the logs from Stackdriver logs to BigQuery. 
D)  Export these logs to Cloud Pub/Sub and write a Cloud Dataflow pipeline to store logs to Cloud SQL.

Question 17

A company requires that the source, destination, and protocol of all IP packets be recorded when traversing a private subnet. What is the MOST secure and reliable method of accomplishing this goal.

Accepted Answer

A)  Create VPC flow logs on the subnet. 
B)  Enable source destination check on private Amazon EC2 instances. 
C)  Enable AWS CloudTrail logging and specify an Amazon S3 bucket for storing log files. 
D)  Create an Amazon CloudWatch log to capture packet information.

Question 18

You received a JSON file that contained a private key of a Service Account in order to get access to several resources in a Google Cloud project. You downloaded and installed the Cloud SDK and want to use this private key for authentication and authorization when performing gcloud commands. What should you do?

Accepted Answer

A)  Use the command gcloud auth login and point it to the private key. Use the command gcloud auth login and point it to the private key. 
B)  Use the command gcloud auth activate-service-account and point it to the private key. gcloud auth activate-service-account 
C)  Place the private key file in the installation directory of the Cloud SDK and rename it to "credentials.json". 
D)  Place the private key file in your home directory and rename it to "GOOGLE_APPLICATION_CREDENTIALS".

Question 19

You need to produce a list of the enabled Google Cloud Platform APIs for a GCP project using the gcloud command line in the Cloud Shell. The project name is my-project . What should you do?

Accepted Answer

A) Run gcloud projects list to get the project ID, and then run gcloud services list --project . Run gcloud projects list to get the project ID, and then run gcloud services list --project . B) Run gcloud init to set the current project to my-project , and then run gcloud services list --available . gcloud init to set the current project to , and then run gcloud services list --available C) Run gcloud info to view the account value, and then run g cloud services list --account . gcloud info to view the account value, and then run g cloud services list --account D) Run gcloud projects describe to verify the project value, and then run gcloud services list --available . gcloud projects describe to verify the project value, and then run

Question 20

You need to select and configure compute resources for a set of batch processing jobs. These jobs take around 2 hours to complete and are run nightly. You want to minimize service costs. What should you do?

Accepted Answer

A)  Select Google Kubernetes Engine. Use a single-node culster with a small instance type. 
B)  Select Google Kubernetes Engine. Use a three-node cluster with micro instance type. 
C)  Select Compute Engine. Use preemptible VM instances of the appropriate standard machine type. 
D)  Select Compute Engine. Use VM instance types that support micro bursting.

Exam 8: GSuite