GCP VMs

You need to create an autoscaling managed instance group for an HTTPS web application. You want to make sure that unhealthy VMs are recreated. What should you do?

• Create a health check on port 443 and use that when creating the Managed Instance Group.

• Select Multi-Zone instead of Single-Zone when creating the Managed Instance Group.

• In the Instance Template, add the label 'health-check'.

• In the Instance Template, add a startup script that sends a heartbeat to the metadata server.

Answer explanation

To ensure that unhealthy VMs are recreated, a health check should be created to monitor the instances in the managed instance group. This health check should be configured to check the appropriate endpoint for the web application, which in this case would be port 443 for HTTPS. If an instance is determined to be unhealthy, the instance group will automatically recreate it.

An application generates daily reports in a Compute Engine virtual machine (VM). The VM is in the project corp-iot-insights. Your team operates only in the project corp-aggregate-reports and needs a copy of the daily exports in the bucket corp-aggregate-reports-storage. You want to configure access so that the daily reports from the VM are available in the bucket corp-aggregate-reports-storage and use as few steps as possible while following Google-recommended practices. What should you do?

• Move both projects under the same folder.

• Grant the VM Service Account the role Storage Object Creator on corp-aggregate-reports-storage.

• Create a Shared VPC network between both projects. Grant the VM Service Account the role Storage Object Creator on corp-iot-insights.

• Make corp-aggregate-reports-storage public and create a folder with a pseudo-randomized suffix name. Share the folder with the IoT team.

Answer explanation

Correct Answer is (B): Predefined roles The following table describes Identity and Access Management (IAM) roles that are associated with Cloud Storage and lists the permissions that are contained in each role. Unless otherwise noted, these roles can be applied either to entire projects or specific buckets. Storage Object Creator (roles/storage.objectCreator) Allows users to create objects. Does not give permission to view, delete, or overwrite objects. https://cloud.google.com/storage/docs/access-control/iam-roles#standard-roles

Basically, you are giving the permissions to the VM Service Account to create a copy of the daily report on the bucket that the other team has access.

You are monitoring an application and receive user feedback that a specific error is spiking. You notice that the error is caused by a Service Account having insufficient permissions. You are able to solve the problem but want to be notified if the problem recurs. What should you do?

• In the Log Viewer, filter the logs on severity 'Error' and the name of the Service Account.

• Create a sink to BigQuery to export all the logs. Create a Data Studio dashboard on the exported logs.

• Create a custom log-based metric for the specific error to be used in an Alerting Policy.

• Grant Project Owner access to the Service Account.

Answer explanation

C is the correct answer, Since the problem is resolved, We need to monitor if the error recurs, hence we create a custom log based metrics to monitor only the particular service account.

The keyword here is "want to be notified" that means an alert.

You have a virtual machine that is currently configured with 2 vCPUs and 4 GB of memory. It is running out of memory. You want to upgrade the virtual machine to have 8 GB of memory. What should you do?

• Rely on live migration to move the workload to a machine with more memory.

•  Use gcloud to add metadata to the VM. Set the key to required-memory-size and the value to 8 GB.

• Stop the VM, change the machine type to n1-standard-8, and start the VM.

• Stop the VM, increase the memory to 8 GB, and start the VM.

Answer explanation

ANSWER D is correct because it is the correct process to follow to increase the memory of a virtual machine in the Google Cloud Platform. To increase the memory of a virtual machine, you need to first stop the VM, since it is not possible to modify the memory of a running VM. Then, you can increase the memory of the VM by editing the machine type and selecting a machine type with more memory. Once you have made the change, you can start the VM again.

You want to run a single caching HTTP reverse proxy on GCP for a latency-sensitive website. This specific reverse proxy consumes almost no CPU. You want to have a 30-GB in-memory cache, and need an additional 2 GB of memory for the rest of the processes. You want to minimize cost. How should you run this reverse proxy?

• Create a Cloud Memorystore for Redis instance with 32-GB capacity.

• Run it on Compute Engine, and choose a custom instance type with 6 vCPUs and 32 GB of memory.

• Package it in a container image, and run it on Kubernetes Engine, using n1-standard-32 instances as nodes.

• Run it on Compute Engine, choose the instance type n1-standard-1, and add an SSD persistent disk of 32 GB.

Answer explanation

ANSWER A is the most cost-effective solution for running a caching HTTP reverse proxy on GCP. Cloud Memorystore for Redis is a managed service that provides an in-memory cache for your applications. It offers a high throughput and low latency access to the Redis protocol. Cloud Memorystore offers an SLA of 99.9% availability and automatic failover for Redis instances. In this case, a 32-GB Redis instance is sufficient to accommodate the 30-GB cache and the additional 2 GB of memory required for the rest of the processes. This solution is highly scalable and allows you to increase the size of the Redis instance as your needs grow.

You need to manage a third-party application that will run on a Compute Engine instance. Other Compute Engine instances are already running with default configuration. Application installation files are hosted on Cloud Storage. You need to access these files from the new instance without allowing other virtual machines (VMs) to access these files. What should you do?

• Create the instance with the default Compute Engine service account. Grant the service account permissions on Cloud Storage.

• Create the instance with the default Compute Engine service account. Add metadata to the objects on Cloud Storage that matches the metadata on the new instance.

• Create a new service account and assign this service account to the new instance. Grant the service account permissions on Cloud Storage.

• Create a new service account and assign this service account to the new instance. Add metadata to the objects on Cloud Storage that matches the metadata on the new instance.

Answer explanation

C https://cloud.google.com/iam/docs/best-practices-for-using-and-managing-service-accounts If an application uses third-party or custom identities and needs to access a resource, such as a BigQuery dataset or a Cloud Storage bucket, it must perform a transition between principals. Because Google Cloud APIs don't recognize third-party or custom identities, the application can't propagate the end-user's identity to BigQuery or Cloud Storage. Instead, the application has to perform the access by using a different Google identity.

You will have several applications running on different Compute Engine instances in the same project. You want to specify at a more granular level the service account each instance uses when calling Google Cloud APIs. What should you do?

• When creating the instances, specify a Service Account for each instance.

• When creating the instances, assign the name of each Service Account as instance metadata.

• After starting the instances, use gcloud compute instances update to specify a Service Account for each instance.

• After starting the instances, use gcloud compute instances update to assign the name of the relevant Service Account as instance metadata.

Answer explanation

A. When creating the instances, specify a Service Account for each instance. To specify a more granular level of service account for each Compute Engine instance, you should specify a Service Account for each instance when you create it. This can be done through the Compute Engine API or the Cloud Console. By doing so, the specified Service Account will be used when calling Google Cloud APIs from that instance.

Option B, assigning the name of each Service Account as instance metadata, is not the best solution as metadata can be accessed by anyone with access to the instance, which could potentially lead to security issues. Options C and D, using gcloud compute instances update to specify a Service Account or assign the name of a Service Account as instance metadata after starting the instances, can also be done, but it is a less efficient approach as it requires additional steps and can lead to human error if not properly documented.

You have deployed multiple Linux instances on Compute Engine. You plan on adding more instances in the coming weeks. You want to be able to access all of these instances through your SSH client over the internet without having to configure specific access on the existing and new instances. You do not want theCompute Engine instances to have a public IP. What should you do?

• Configure Cloud Identity-Aware Proxy for HTTPS resources.

• Configure Cloud Identity-Aware Proxy for SSH and TCP resources

• Create an SSH keypair and store the public key as a project-wide SSH Key.

• Create an SSH keypair and store the private key as a project-wide SSH Key.

Answer explanation

B is correct, With TCP forwarding, IAP can protect SSH and RDP access to your VMs hosted on Google Cloud. Your VM instances don't even need public IP addresses.

Use IAP TCP to enable access to VM instances that do not have external IP addresses or do not permit direct access over the internet. https://cloud.google.com/iap/docs/using-tcp-forwarding

You are about to deploy a new Enterprise Resource Planning (ERP) system on Google Cloud. The application holds the full database in-memory for fast data access, and you need to configure the most appropriate resources on Google Cloud for this application. What should you do?

• Provision preemptible Compute Engine instances.

• Provision Compute Engine instances with GPUs attached.

• Provision Compute Engine instances with local SSDs attached.

• Provision Compute Engine instances with M1 machine type.

Answer explanation

D is the correct answer, M1 machine series Medium in-memory databases such as SAP HANA Tasks that require intensive use of memory with higher memory-to-vCPU ratios than the general-purpose high-memory machine types. In-memory databases and in-memory analytics, business warehousing (BW) workloads, genomics analysis, SQL analysis services. Microsoft SQL Server and similar databases.

keyword "Full database in-memory "

https://cloud.google.com/compute/docs/machine-types

Your company has workloads running on Compute Engine and on-premises. The Google Cloud Virtual Private Cloud (VPC) is connected to your WAN over aVirtual Private Network (VPN). You need to deploy a new Compute Engine instance and ensure that no public Internet traffic can be routed to it. What should you do?

• Create the instance without a public IP address.

• Create the instance with Private Google Access enabled.

• Create a deny-all egress firewall rule on the VPC network.

• Create a route on the VPC to route all traffic to the instance over the VPN tunnel.

Answer explanation

VMs cannot communicate over the internet without a public IP address. Private Google Access permits access to Google APIs and services in Google's production infrastructure. https://cloud.google.com/vpc/docs/private-google-access