Google Associate Cloud Engineer (ACE) — Questions 76–150

The command `gcloud iam service-accounts list` is the correct and canonical way to list all service accounts in the active project. It returns a table of service account emails, display names, and unique IDs by querying the IAM Service Accounts API. You can specify a non-default project with `--project` or `--filter` to narrow results, making it a reliable and standard administrative operation.

This is correct because VPC networks include an implicit deny-all rule for inbound traffic, so the only rule needed is an explicit allow for HTTP traffic (TCP port 80) from all source IP addresses (0.0.0.0/0) to instances tagged with 'web-server'. Target tags let you apply the rule selectively, ensuring only web server VMs accept inbound HTTP while all other instances remain blocked by the implicit deny. No additional deny rule is required or advisable.

Cloud Trace is the Google Cloud service specifically designed for distributed tracing: it captures spans from instrumented applications or via OpenTelemetry, groups them into traces for each request, and renders a waterfall view showing where time is spent across microservices. It supports latency distribution analysis, allows comparison of recent traces, and can identify bottleneck services and anomalously slow requests. Thus it directly answers the need to collect and analyze latency traces.

Cloud Run is Google's serverless container platform that executes containerized applications in a fully managed environment, with automatic scaling based on incoming HTTP requests. When there is no traffic, Cloud Run scales the number of instances to zero, completely shutting down the service and charging you nothing for idle resources. This makes it the only option among the four that truly supports scale-to-zero for a containerized app.

Cloud NAT is a managed source network address translation service that enables instances without external IP addresses to make outbound connections to the internet while allowing only corresponding return traffic. It works with Cloud Router to automatically configure NAT for a VPC network and supports mapping of private IPs to a set of external IP addresses, making it the correct solution for this requirement.

Cloud Asset Inventory is the correct tool because it supports organization-scoped queries for the `iam.googleapis.com/ServiceAccountKey` asset type, returning every service account key with its creation timestamp. For example, `gcloud asset search-all-resources --asset-types=iam.googleapis.com/ServiceAccountKey --scope=organizations/ORG_ID` lists all keys, and you can filter by age using `--query` or post-process with `jq` to identify keys older than your rotation policy. This approach provides a complete, auditable, and automated way to detect stale keys across all projects.

Cloud Spanner is the only Google Cloud database that natively combines SQL semantics, ACID transactions with external consistency (linearizable), and horizontal write scalability across regions, all backed by a 99.999% availability SLA. Its TrueTime API synchronizes globally distributed replicas so that transactions appear in a single, globally consistent order, which is exactly what a financial trading platform needs for order book updates, ledger entries, and risk management. This unique blend of relational structure, global consistency, and virtually unlimited write scaling makes Spanner the correct choice for mission-critical transactional systems.

Cloud Shell is a web-based terminal that launches directly from the Google Cloud Console, giving you authenticated command-line access to your GCP environment without needing to install the Google Cloud SDK locally. It automatically authenticates you using the same credentials as the console, and it also sets the current project so you can immediately run gcloud commands. This integration makes it the quickest way to test API calls, run kubectl against GKE clusters, or inspect resources while staying in the browser.

Cloud Run is a fully managed serverless platform that runs stateless HTTP-triggered containers directly from a container image. It automatically scales down to zero when there are no incoming requests, so you incur no charges while idle, and bills only for request duration (CPU, memory, and concurrency metered during request handling). You can deploy any container that listens on HTTP, making it the ideal low-overhead choice for a containerized web application. Unlike GKE or Compute Engine, there is no infrastructure to manage or minimum charge for a running VM.

CMEK lets you create and manage encryption keys in Cloud KMS, and Cloud Storage uses them to encrypt your objects server-side. You control the key lifecycle, including automatic rotation periods, and can grant or revoke access through IAM identities and conditions. This provides a central audit trail and the ability to disable or destroy keys instantly, which is exactly what the organization needs for sensitive data.

ImagePullBackOff means the kubelet could not successfully fetch the container image from the registry. An incorrect image name or tag causes a 404 Not Found response from the registry, while missing or invalid pull credentials for a private registry result in a 403 Forbidden response. Both failure modes prevent the image from being downloaded, so the kubelet enters ImagePullBackOff and retries with an exponential backoff. To resolve this, correct the image reference or create an imagePullSecret and attach it to the Pod.

When physical memory is exhausted, the Linux kernel moves cold pages to swap space on the attached persistent disk. Every swapped-in/out page causes block I/O, while the CPU idles waiting on disk, so overall CPU utilization stays low even though the job crawls. Combined with high disk I/O, this pattern is a classic signature of memory thrashing, not a CPU shortage.

VPC Service Controls is the only option that enforces context-aware access at the BigQuery API layer by placing the API inside a service perimeter. Any request to BigQuery from outside that perimeter, or any attempt by an internal client to access a resource outside the perimeter, is denied regardless of IAM roles, because the perimeter uses a deny-by-default egress/ingress model. This directly prevents an authorized user from copying BigQuery data to an external project, since the destination project is outside the perimeter and the API call is blocked even if the user has permissions in both projects.

Create a service account, grant it the required IAM roles (for example, roles/storage.objectViewer for Cloud Storage read access), and attach it to the instance using the --service-account flag at instance creation time. The instance then automatically authenticates to Google Cloud APIs through the instance's metadata server, which provides OAuth 2.0 access tokens on behalf of the service account without storing any secret material on the disk. This is the standard, secure pattern for granting a Compute Engine instance access to other GCP resources, as it leverages the cloud-native identity and avoids managing static credentials.

Folders allow grouping projects per department.

Cloud SQL Viewer (roles/cloudsql.viewer) is the exact least-privilege role for read-only inspection of Cloud SQL instances. It grants the ability to list and get instance details, including machine configuration, IP addresses, and connection information, without permitting any write operations, deletions, or modifications. This role satisfies the requirement to view instance details while preventing changes, making it the correct choice.

Cloud Build provides built-in substitutions like $PROJECT_ID and $COMMIT_SHA that are automatically populated for every build, while custom substitutions such as $_REGION are defined in the trigger configuration or passed via the --substitutions flag. This allows a single cloudbuild.yaml to remain environment-agnostic, with environment-specific values injected at build runtime, enabling the same pipeline to promote across dev/staging/prod without code changes. Because these substitutions are a native Cloud Build feature, they are evaluated before each step executes, making them reliable and auditable.

IAM deny policies are evaluated with higher precedence than allow policies, so a deny rule on Folder A explicitly blocks any inherited editor grant from reaching resources below that folder. Project 1, being a child of Folder A, inherits both the organization-level editor role and the folder-level deny, but deny rules win. As a result, even though the user was granted editor at the organization, the user's effective permissions in Project 1 do not include editor; the deny policy specifically prevents that role from being granted.

Using a custom image with pre-installed dependencies is the correct approach because it directly reduces node initialization time. A custom image can bake in the container runtime, required OS packages, and even pre-cached application container images, avoiding the typical runtime download and configuration steps when a new node is added. When the cluster autoscaler triggers a scale-out, these nodes become schedulable faster, so pending pods are scheduled more quickly.

Attaching an IAM Condition with a date/time expression such as `request.time < timestamp('2025-08-01T00:00:00Z')` to the role binding makes the permission valid only until that timestamp. When a service account attempts to access a resource after the expiry, Cloud IAM evaluates the condition and returns `PERMISSION_DENIED` because the condition is false. This enforces the 90-day limit automatically at authorization time, without manual steps or separate cleanup jobs.

Data Access audit logs capture every API call that reads or writes user data, such as when a BigQuery job reads table contents or a Cloud Storage object is downloaded. They are disabled by default because on heavily used services the sheer volume of these calls can generate terabytes of logs, making storage costs prohibitive. Administrators can selectively enable them per bucket, project, or folder to balance compliance needs against cost and performance impact.

Assigning Storage Object Viewer at the project level grants read-only access to all objects in all buckets by default, but binding that grant with an IAM Condition that checks the resource name (e.g., resource.name.startsWith("projects/_/buckets/audit-")) restricts the access to exactly the intended buckets at access time. The auditor can then list and read objects only within those matches, while the project-level policy remains a single, centrally managed binding that can be audited and adjusted without touching each bucket. This delivers the least-privilege read-only guarantee the auditor needs while keeping operations scalable and governance clean.

Folders are dedicated nodes in the GCP resource hierarchy (Organization → Folders → Projects) designed for grouping projects under a common administrative boundary. IAM policies, Organization Policies, and other settings bound to a Folder are inherited by every project in that subtree, enabling uniform access control and regulatory constraints for a business unit. Using Folders also supports delegated administration, such as granting a Project Creator role scoped to that Folder, and is the only mechanism that provides genuine hierarchical policy inheritance across multiple projects.

bq query --use_legacy_sql=false --dry_run 'SELECT ...' sends the query to BigQuery's planner, which validates the SQL and returns the estimated number of bytes that would be read from storage, without actually executing the query or consuming slots. The --use_legacy_sql=false flag ensures your statement is parsed as standard SQL, not the older legacy dialect, which matters for syntax compatibility. This is exactly the right tool when a query is slow and you want to quickly see how much data it touches before investing time in optimization or running it.

This is the correct command to import a SQL dump file into a Cloud SQL MySQL instance. The `gcloud sql import sql` command takes the instance name, the Cloud Storage URI of the dump, and the `--database` flag to specify the target database. The Cloud SQL instance's service account must have `storage.objectViewer` permission on the bucket, and the database must already exist. This is the supported, asynchronous import method for managed Cloud SQL.

Cloud Trace is the correct choice because it is a distributed tracing system that records each incoming request as a trace, composed of individual spans for every operation within that request. The Trace list view allows you to filter by a specific time range, such as the last hour, and directly sort traces by total latency. This surface immediately surfaces the slowest end-to-end requests, and you can click into a trace to see a detailed waterfall breakdown of where time is spent in the request path.

Correct: `gcloud config set project [PROJECT_ID]` modifies the `project` property inside the current gcloud configuration. This persistently changes the default project for subsequent commands without rerunning the interactive `gcloud init` wizard. The change takes effect immediately, and it can be verified with `gcloud config get-value project` or overridden per-command using the `--project` flag.

Cloud Profiler is the correct choice because it continuously samples production applications with low overhead, recording call stacks and generating flame graphs. Those flame graphs visually rank functions by CPU utilization, letting you identify exactly which code paths consume the most CPU even in a distributed environment.

IAM & Admin > Roles is the correct page because it is the dedicated console surface for managing both predefined and custom roles within a project, folder, or organization. From this page you can click "Create Role" to assign a title, description, ID, and select specific permissions to build a custom role, or you can clone and edit existing roles that you own. This page directly supports the lifecycle of custom IAM roles, including editing role permissions, deleting custom roles, and managing role bindings.

Object Lifecycle Management is the native Cloud Storage mechanism for automatically deleting objects when they reach a specific age. A lifecycle rule with a Delete action after 90 days triggers the deletion of all current objects that have existed for more than 90 days, without requiring manual intervention or further scripted processes. This precisely matches the requirement to remove sensitive data after the 90-day retention window.

gcloud auth login is the correct command because it launches an OAuth 2.0 authorization flow, typically opening a browser where the developer signs in with their Google account and grants consent to GCP scopes. Upon successful authentication, it saves the resulting user credentials in the credentials directory and sets them as the active account for subsequent gcloud CLI operations. This is the standard, direct way for a human developer to authenticate the gcloud command-line tool with their personal or Google Workspace user identity from a local machine.

Enable graceful decommissioning so Dataproc marks a preempted node as decommissioning before shutting it down. YARN then stops placing new containers on that node and waits up to `dataproc:yarn.preemptible.graceful-decommission.timeout` for in-flight tasks to finish or spill shuffle data elsewhere. This prevents sudden task loss because YARN's NodeManager is given time to complete ongoing work instead of being killed immediately.

The Dataflow monitoring UI's job graph exposes per-stage counted metrics (element counts, throughput, and execution time). Pinpointing the stage with the highest processing lag or a hot key reveals whether the slowness comes from a transform's computational cost, external API latency, or data skew, enabling a targeted fix like partitioning by key or batching I/O calls instead of a blind capacity change.

The IAM policy grants the compute.disks.delete permission only when the condition `resource.name.startsWith('disk-')` evaluates to true. For a disk with a name that does not begin with 'disk-', the condition fails and the delete request is implicitly denied. This means the effect is exactly restricting deletion only to disks with the 'disk-' prefix, so any disk not matching that prefix cannot be deleted. That is the action the condition restricts.

This is the correct command because `kubectl port-forward` creates a direct, temporary tunnel from the developer's localhost port 5432 to the postgres Service's port 5432 inside the cluster. It does not expose the Service externally, does not create any Service or Ingress resource, and the bind is to localhost by default, so only the developer's machine can reach it. This matches the requirement for a secure, private way to connect to the database without altering the cluster's networking. The command is also the standard way to debug or access a private Kubernetes resource from a workstation.

VPC Service Controls set a security perimeter around Google Cloud APIs, but they only evaluate requests authenticated via Google identity credentials. Signed URLs are an alternative access method that authorizes access through time-limited query parameter signatures embedded in the URL, so the request never triggers VPC SC context. Therefore, VPC SC simply does not apply to signed URLs.

Store sessions in Google Cloud Memorystore for Redis, a fully managed, in-memory data store that provides sub-millisecond read/write latency. By keeping session data in a single shared Redis instance external to the pods, all replicas can read and write the same session state without coupling to a specific pod. Because the data lives outside the pod, rolling updates, autoscaling, and pod restarts do not invalidate user sessions. Memorystore also supports native TTL expiration for session keys and can be configured with persistence or high availability to protect against cache loss.

`gcloud run services update-traffic` is the correct command to split traffic between two or more existing revisions of a Cloud Run service. It accepts flags like `--to-revisions=rev1=50,rev2=50` to assign precise percentages, or `--to-latest` to route all traffic to the latest revision. This command directly modifies the route resource, making it the appropriate tool for controlled canary rollouts or rollbacks.

Cloud SQL with CMEK uses the customer-managed key for every data-plane operation, including reads and writes to the database, logs, and system tables. When the key is disabled, the instance loses access to the key material, causing the database engine to fail all I/O requests immediately. Consequently, the instance becomes unavailable and cannot be started or used until the key is re-enabled in Cloud KMS; re-enabling the key automatically restores normal operation without manual intervention.

Cloud Functions (2nd gen) is built on Cloud Run and supports a Serverless VPC Access connector that makes the function a first-class citizen inside your VPC. With 2nd gen you can attach a VPC connector and set egress settings to route all outbound traffic through it, so the function can reach private resources using internal IPs. This also enables private inbound triggers, meaning the function can be invoked internally within the VPC, which is exactly what is needed to process events from a private resource.

Enabling deletion protection prevents accidental deletion of the instance, which is critical for production workloads.

Billing must be enabled for the project to create any resources that incur costs; this is a necessary step.

kubectl rollout undo deployment/my-app is the correct command because it reverts the deployment to the previous revision, restoring the prior pod template spec and container image. Kubernetes retains rollout history for each change to the pod template, and undo automatically scales down the current ReplicaSet and scales up the previous one, seamlessly rolling back the application without manual image specification.

Pub/Sub is the correct notification channel type for this use case because Cloud Monitoring can send alert notifications to a Pub/Sub topic, and a separate subscriber (such as a Cloud Function or Cloud Run service) can then forward those messages to Slack using an incoming webhook. Unlike email or PagerDuty, Pub/Sub is not a direct end-user notification mechanism; instead it acts as a highly scalable, event-driven integration bus that decouples alert generation from downstream delivery. This pattern is the officially recommended way to connect Cloud Monitoring alerts to Slack, since Slack has no native notification channel in Cloud Monitoring.

`gcloud projects get-iam-policy my-project --format json` is the correct command for viewing the current IAM policy of a project. It retrieves the full policy, including all role bindings, conditions, and the etag, and returns it in a structured JSON format. The `--format json` flag ensures the output is machine-readable, which is useful for auditing, scripting, or feeding into other tools like `jq`. This command performs no mutation and is the standard way to inspect IAM policy state.

This is correct because a preemptible VM costs significantly less than a standard VM and is ideal for fault-tolerant batch processing. The startup script automatically runs the container when the VM boots, and once the job completes, the script shuts down the VM to stop compute billing. Although preemptible VMs can be reclaimed by Google at any time, a job running hourly can simply retry on the next scheduled run. You still pay for the persistent disk while the VM exists, but the compute cost savings far outweigh that.

A log-based metric in Cloud Logging lets you define a filter, such as 'jsonPayload.message="PaymentFailure"', and Cloud Logging automatically counts matching entries as a time-series metric with minimal latency. This metric appears directly in Cloud Monitoring, where you can set an alerting policy to trigger when the count crosses a threshold. Because it uses the log stream the application already writes, it requires no code changes and monitors all services that emit matching logs, making it the correct solution for real-time error rate alerting.

Google Cloud requires the BigQuery API (bigquery.googleapis.com) to be explicitly enabled on the project where the Cloud Function runs. Even if the function's service account has BigQuery Data Viewer or Admin permissions, calls to bigquery.googleapis.com will fail with an error such as 'API has not been used in project X before or it is disabled' when the API is off. Enabling the API in the Cloud Functions project is a prerequisite that developers often overlook when debugging 'permission denied' messages.

Cloud Billing Budget is the purpose-built feature for monitoring spend: it lets you set a budget amount and define multiple percentage-based alert thresholds (50%, 80%, 100%) that trigger notifications when actual or forecasted costs cross each threshold. Alerts are delivered either to billing account contacts via email or programmatically through Pub/Sub, enabling immediate, low-cost monitoring without custom tooling. Importantly, the budget itself never stops spending; it only notifies you, which is exactly what the question asks for.

Partitioning by a DATE/TIMESTAMP column physically organizes the table into discrete segments (e.g., per day, month, or year). A query that filters on that column with a range predicate triggers partition pruning, so BigQuery scans only the segments that match the filter rather than the entire table. This directly cuts the number of bytes billed, which is the primary cost driver in BigQuery, making it the most effective solution for frequent date-range analysis.

Cloud Firestore is a serverless, document-oriented NoSQL database that stores data as flexible JSON-like documents with nested fields. It supports schema evolution automatically—new fields can be added without migrations or downtime—and its real-time listeners and client SDKs are purpose-built for mobile/web app backends. Firestore also provides ACID transactions at the document level and auto-scaling, making it the ideal choice for storing app user profiles that change shape frequently.

A Kubernetes NetworkPolicy with an ingress rule that selects Pods carrying the web app label provides exactly the required Pod-level isolation, filtering traffic at the source and destination Pod regardless of node placement. Because the policy's podSelector matches only those web app Pods, all other Pods are denied by default, and GKE enforces this via its network policy engine (e.g., Dataplane V2 or Calico), making it the correct solution.

A log sink configured in the Log Router provides a managed, continuous export path: every matching log entry is streamed to the specified BigQuery dataset in near-real-time, with no further manual steps or custom code required. Because the sink is evaluated at ingestion time, all future logs are automatically routed as they are written, including newly created log streams and resource types. This is the recommended and only fully managed way to achieve ongoing, low-latency Cloud Logging export to BigQuery.

Preemptible instances are subject to termination by Compute Engine at any time (within 24 hours) but cost up to 60-91% less than standard VMs, making them ideal for idempotent or restartable batch work that runs only 30 minutes per day. A custom machine type with 4 vCPUs and 8 GB memory precisely matches your workload's resource requirements, avoiding the cost of the unused 8 GB included in a standard machine. This combination delivers the lowest effective cost while still being fault-tolerant: if a preemptible instance is reclaimed mid-job, you simply retry on a newly created instance.

Setting a folder-level policy with inheritFromParent:false replaces the inherited root policy entirely for that folder, so the business unit's projects can explicitly allow us-central1, us-east1, and europe-west1 without changing the restriction for other business units. This is the native org-policy mechanism for granting location exceptions, because the folder becomes the effective enforcement point for its descendants. The root policy remains in place as the default for all other resources, maintaining a secure baseline.

This is the correct way to configure remote state storage for Google Cloud using Terraform. The `terraform` block wraps the backend declaration, the type is `gcs` for Google Cloud Storage, and the `bucket` and `prefix` arguments accurately define the bucket name and the object key within that bucket. Using a distinct prefix like `"prod"` allows multiple environments or components to share the same bucket while keeping their state files isolated and easily retrievable.

Cloud Trace is purpose-built for latency analysis. It collects latency data from Cloud Run and other GCP services, then generates distributed traces with spans that show the duration of each operation—such as receiving the request, calling downstream dependencies, and returning the response. Trace features like waterfall views, latency distributions, and per-trace breakdowns let you identify exactly which service or API call is the bottleneck, making it the correct tool for high-latency issues.

This metric tracks the maximum age of the oldest message that has not yet been acknowledged by any subscriber for the subscription. It directly reflects backlog depth and consumer lag: when a subscription is accumulating a backlog, this value grows steadily because messages sit unacked for longer periods. It is the ideal signal for alerting on message processing delays because it captures the time dimension of the backlog, not just its size.

This is the correct command because it uses --region us-central1 to designate a regional cluster, which GKE deploys across multiple zones within that region for redundancy and high availability. The --num-nodes 3 flag sets the number of nodes per zone in the default node pool, ensuring each zone gets three nodes. Together, these flags meet the requirement for a regional GKE cluster named my-cluster.

The `kubectl set image` command imperatively updates the container image reference in the Deployment's pod template, and `--record` writes the change to the rollout history (stored in the `kubernetes.io/change-cause` annotation). Chaining `kubectl rollout status` polls the Deployment's status and returns successfully only when the new ReplicaSet has fully scaled up and the old one is scaled down, providing direct verification that the update completed. This combination is exactly the right way to update an image and confirm the rollout reached a ready state.

Archive is the correct choice because it is the lowest-cost Cloud Storage class for data that is accessed less than once a year, offering the cheapest per-gigabyte monthly price for long-term retention. It does incur retrieval fees and a 365-day minimum storage duration, but for true archival data with infrequent access these trade-offs are acceptable. This class also has no availability SLA, which is fine for this access pattern but means it should only be used for durable, rarely accessed data.

Dedicated Interconnect is the only option that provides a direct physical connection from your enterprise data center to Google's network. You must contract with a colocation provider like Equinix or Digital Realty, and Google installs a cross-connect in that facility to your router. It is available in 10 Gbps or 100 Gbps increments, offers a 99.99% uptime SLA, and allows you to access private VPC resources (e.g., Compute Engine instances) without traversing the public internet, making it ideal for high-throughput, low-latency hybrid workloads.

This is correct because Data Access audit logs are controlled by the auditConfig field of the project's IAM policy. You retrieve the policy, add an auditConfig specifying the services and log types (ADMIN_READ, DATA_READ, DATA_WRITE), then set it back with gcloud projects set-iam-policy. After that, Cloud Audit Logs will start recording data access operations for the enabled services.

The M1 and M2 machine families are the correct choice because they are explicitly engineered for high-memory workloads like SAP HANA, large in-memory databases, and real-time analytics. M1 offers m1-megamem (up to 1.75 TB) and m1-ultramem (up to 3.75 TB), while M2 adds m2-hypermem with up to 12 TB of RAM, all using Intel Xeon Scalable processors with twice the memory bandwidth of general-purpose families. These machines are priced per GB of memory at a lower rate than custom N2 or C2 configurations, making them the most cost-effective option when you need hundreds of GB to terabytes of RAM. Additionally, M-series VMs support live migration and sole-tenant nodes, giving you the same operational flexibility as other families while delivering the required 768 GB+ capacity.

For Cloud NAT to work, the VPC network must contain a default route (0.0.0.0/0) whose next hop is the default internet gateway. This route is what causes outbound packets from instances to be sent to the gateway, where Cloud NAT performs the source IP translation. Without this route, packets destined for the internet have no valid next hop and are dropped, so the instances cannot reach the internet at all—Cloud NAT alone does not create routing logic.

The `--previous` flag (or `-p`) instructs kubectl to fetch the log output of the last, now-terminated container instance in the pod, rather than the current (possibly restarting) one. This is precisely the right tool when a container crashes before it can be readied, because its startup error output is preserved in the terminated instance's logs. For pods with multiple containers, combine it with `-c <container-name>` to isolate the right container, and it works for both regular and init containers.

Cloud Monitoring is the correct starting point because it provides time-series metrics for Compute Engine, such as CPU utilization, memory usage, disk I/O, and network throughput. You can build custom dashboards and alerts to correlate intermittent latency spikes with resource saturation, helping you determine whether the cause is a bottleneck in the VM, disk, or network. This metric-centric view is essential for seeing the pattern of when slowdowns occur.

Cloud Identity Free provides a standalone managed identity directory for your domain, so contractors receive Google accounts that your organization fully controls—without paying for Google Workspace licenses or email. From the Admin console you can enforce 2-Step Verification, password length, and session settings, and you can suspend or delete a contractor's account at contract end to instantly revoke access across all Google Cloud projects. These accounts can also be integrated with an external SAML/OIDC identity provider, and because they exist within your organization's Cloud Identity service, they follow your resource hierarchy and org policies.

Cloud NAT (Network Address Translation) is the correct Google Cloud service for enabling outbound internet access from Compute Engine instances that have only private IP addresses. When you configure Cloud NAT on a Cloud Router for a specific region and subnet, it provides a set of external IP addresses that are used to translate the private source IPs of outbound packets. This allows the instances to reach the internet while remaining private and secure, without the need for individual external IPs. Cloud NAT is also region-scoped, so configuring it for the same region and subnet as the instances is both necessary and sufficient for this VPC requirement.

The correct approach is to set a project-level organization policy for `compute.requireOsLogin` with the 'not enforced' status, provided the constraint's inheritance allows per-project overrides. This creates an exception that overrides the inherited org-level policy, allowing new VM instances in that project to be created without OS Login enabled. However, the org policy must still permit the override; if the constraint is locked with a custom value, the org administrator may need to adjust the policy hierarchy.

Use IAM conditions to restrict the network operations role to only the network team's projects. In the IAM policy binding that grants the role to the network operations group, add a condition using Common Expression Language (CEL), such as resource.name.startsWith("projects/network-team-project") or resource.tag for a specific project tag. This ensures the role is only effective when the request targets resources within the allowed projects, directly preventing the user from using the role in unrelated projects while preserving legitimate access.

This is the correct diagnostic. A log sink only forwards entries that match its inclusion filter, and an overly narrow filter—such as one restricted to a single resource type or severity level—will silently exclude the rest of the log stream before it reaches BigQuery. Check the sink's filter in the Logs Explorer to confirm it matches the actual log entries you expect to export, and note that any exclusion filters are applied after the inclusion filter and can further reduce the data routed.

A firewall rule that allows egress traffic to the internet is mandatory for any outbound connectivity, even when Cloud NAT is used. Cloud NAT only translates the source IP, but the VPC firewall still evaluates all traffic and drops it unless a rule permits traffic to destination 0.0.0.0/0 with a source tag or service account you apply to the instance. Without an egress allow rule, the NAT translation never gets the chance to send packets, because the firewall is applied before the packet leaves the instance's VPC network.

'kubectl get pods' is the canonical command to list pods in the current namespace. It queries the Kubernetes API and returns a table with columns such as NAME, READY, STATUS, RESTARTS, and AGE, one row per pod. This is the expected answer because the question asks for a command that lists pods, and 'get' is the standard verb for retrieving resource lists.

This is the correct approach because it fully specifies the Artifact Registry destination in the Docker image tag. The format `[REGION]-docker.pkg.dev/[PROJECT]/[REPO]/[IMAGE]:[TAG]` tells Docker exactly which regional Artifact Registry repository to use. First `docker tag` creates a new tag pointing to the local image, then `docker push` uploads the image to that fully-qualified repository path. This is the required pattern for pushing images to Artifact Registry.