Courseiva

CCNA Manage and provision cloud infrastructure Questions

16 of 91 questions · Page 2/2 · Manage and provision cloud infrastructure · Answers revealed

Practice these questionsDomain overviewAll questions
76
MCQmedium

Refer to the exhibit. A user reports that the instance 'batch-vm' is unavailable. Based on the output, what is the most likely cause of the unavailability?

A.The VM was stopped manually by a user.
B.The preemptible VM was terminated by Google due to its preemptible nature.
C.The VM lost its external IP address.
D.The VM crashed due to an out-of-memory error.
AnswerB

Preemptible VMs run at lower cost but Google can reclaim them at any time with a 30-second warning, stopping the instance abruptly. The exhibit's terminated status and preemptible flag confirm this involuntary reclaim, not a crash or quota issue.

Why this answer

The exhibit shows the instance 'batch-vm' with a status of 'TERMINATED' and the 'preemptible' flag set to 'true'. Preemptible VMs in Google Cloud have a maximum runtime of 24 hours and can be terminated at any time by Google Compute Engine due to resource constraints. The termination reason is typically 'preemption', which matches the scenario of a user reporting unavailability without manual intervention.

Exam trap

Google Cloud often tests the distinction between 'STOPPED' (user-initiated, billable for attached resources) and 'TERMINATED' (preempted or deleted, no longer billable), and candidates confuse preemption with a manual stop or a crash.

How to eliminate wrong answers

Option A is wrong because a manual stop would show the VM status as 'STOPPED' (not 'TERMINATED') and would not be caused by Google's infrastructure; the exhibit does not indicate any user-initiated stop action. Option C is wrong because losing an external IP address does not terminate a VM; the VM would still be running (status 'RUNNING') but inaccessible via that IP, and the exhibit shows the VM as 'TERMINATED'. Option D is wrong because an out-of-memory error would cause the VM to become unresponsive or crash, but the VM would remain in a 'RUNNING' or 'STOPPING' state, not transition to 'TERMINATED'; termination is a distinct lifecycle state typically triggered by preemption, deletion, or explicit stop.

Practice this question →
77
MCQmedium

A company has Compute Engine instances in us-east1-a and us-east1-b zones. They want to allow communication between these instances with minimal latency and no additional cost. What is the best networking approach?

A.Configure VPC Network Peering between two separate VPC networks.
B.Use a single VPC network that includes both zones.
C.Create a new subnet in each zone and use Cloud NAT.
D.Set up a Cloud VPN between the zones.
AnswerB

A single VPC network spans all zones within a region, so instances in us-east1-a and us-east1-b communicate over Google's internal network using private RFC 1918 addresses. Traffic stays within the region, giving low latency with no additional egress cost.

Why this answer

A single VPC network spans all regions and zones, allowing instances in different zones (us-east1-a and us-east1-b) to communicate using internal IP addresses with low latency and no additional cost. This is because VPC networks provide flat, global networking by default, and traffic between zones within the same VPC uses Google's internal backbone without incurring egress charges.

Exam trap

The trap here is that candidates may overcomplicate the solution by thinking they need separate networks or VPNs for zone-to-zone communication, when in fact a single VPC inherently supports flat, cost-free internal connectivity across zones.

How to eliminate wrong answers

Option A is wrong because VPC Network Peering is used to connect separate VPC networks, which adds complexity and is unnecessary when instances are in the same VPC; it also does not reduce latency or cost compared to a single VPC. Option C is wrong because Cloud NAT is designed for outbound internet access from private instances, not for inter-zone communication, and it would introduce additional latency and cost. Option D is wrong because Cloud VPN is a site-to-site VPN solution for connecting on-premises networks or different VPCs across regions, not for intra-VPC zone-to-zone communication, and it adds latency and cost.

Practice this question →
78
MCQmedium

An organization is migrating a MySQL database to Cloud SQL. They require automatic failover with zero data loss in the event of a zone outage. Which configuration should they use?

A.Cloud SQL with a cross-region replica.
B.Cloud SQL with automated backups and binary logging.
C.Cloud SQL with a read replica in a different zone.
D.Cloud SQL with high availability (HA) configuration.
AnswerD

High availability configuration provisions a standby instance in a second zone with synchronous replication to the primary. Automatic failover promotes the standby during a zone outage, and synchronous replication ensures zero data loss, meeting both stated requirements.

Why this answer

Cloud SQL's high availability (HA) configuration uses a synchronous write to a standby instance in a different zone within the same region. This ensures that every transaction committed on the primary is also committed on the standby before acknowledging the client, guaranteeing zero data loss during a zone outage. Automatic failover to the standby occurs with no manual intervention, meeting both the automatic failover and zero data loss requirements.

Exam trap

The trap here is that candidates often confuse a read replica (which uses asynchronous replication and requires manual promotion) with an HA standby (which uses synchronous replication and automatic failover), leading them to incorrectly select Option C.

How to eliminate wrong answers

Option A is wrong because a cross-region replica uses asynchronous replication, which can result in data loss of up to several seconds of transactions during a failover, failing the zero data loss requirement. Option B is wrong because automated backups and binary logging provide point-in-time recovery from a backup, but they do not provide automatic failover; recovery requires manual intervention and can lose transactions committed after the last backup. Option C is wrong because a read replica in a different zone is designed for read scaling, not for automatic failover; promoting a read replica to primary is a manual process and the replica uses asynchronous replication, risking data loss.

Practice this question →
79
Multi-Selectmedium

Which TWO are required to allow on-premises hosts to access Google APIs using internal IP addresses (Private Google Access)? (Choose 2)

Select 2 answers
A.A Cloud Interconnect or Cloud VPN connection between on-premises and VPC
B.A Cloud Router instance configured in the on-premises network
C.VPC Service Controls enabled
D.Private Google Access enabled on the subnet that the on-premises traffic will use
E.A private DNS zone for googleapis.com
AnswersA, D

On-premises hosts need a private path into the VPC. Cloud Interconnect or Cloud VPN provides that hybrid connectivity, carrying traffic to the subnet where Private Google Access is enabled, so Google APIs are reachable using internal addresses.

Why this answer

Option A is correct because Private Google Access for on-premises hosts requires a hybrid connectivity path — either Cloud Interconnect or Cloud VPN — to carry traffic from the on-premises network into the VPC, where it can then reach Google APIs via internal IP addresses. Option D is correct because Private Google Access must be enabled on the specific subnet that the on-premises traffic will use; this setting allows resources in that subnet to reach Google APIs using internal IP addresses rather than external ones. Option B is incorrect because Cloud Router is a Google Cloud resource used for dynamic routing (e.g., BGP) within the VPC, not something configured in the on-premises network.

Option C is incorrect because VPC Service Controls is a security perimeter feature for mitigating data exfiltration, not a requirement for Private Google Access. Option E is incorrect because a private DNS zone for googleapis.com is not required; Google provides the necessary DNS resolution for private.googleapis.com and restricted.googleapis.com automatically when Private Google Access is configured.

Exam trap

Google Cloud often tests the misconception that a Cloud Router or DNS zone is required for Private Google Access, but the core requirement is simply the private network connectivity (Cloud Interconnect or Cloud VPN) and the subnet-level feature enablement.

Practice this question →
80
Multi-Selecteasy

A DevOps team is deploying a microservices application on Google Kubernetes Engine (GKE). They want to ensure that the pods can securely access Google Cloud APIs (e.g., Cloud Storage) without managing service account keys. Which TWO steps should they take? (Choose two.)

Select 2 answers
A.Create a dedicated GCP service account with necessary roles and bind it to Kubernetes service accounts via Workload Identity.
B.Use the Compute Engine default service account on each node.
C.Use a secrets management solution like HashiCorp Vault to store service account keys and retrieve them at runtime.
D.Enable Workload Identity on the GKE cluster.
E.Store service account keys in a Kubernetes Secret and mount them into pods.
AnswersA, D

Workload Identity federates Kubernetes service accounts to a Google Cloud service account, so pods obtain short-lived credentials from the metadata server. Creating the dedicated service account with the required roles and binding it to the Kubernetes service account removes the need for exported, long-lived keys.

Why this answer

Option A is correct because Workload Identity requires creating a dedicated Google Cloud service account with the necessary IAM roles and binding it to a Kubernetes service account (via an IAM policy binding with roles/iam.workloadIdentityUser), which lets the pod impersonate the GCP service account without keys. Option D is correct because Workload Identity must first be enabled on the GKE cluster (e.g., with gcloud container clusters update --workload-pool=PROJECT_ID.svc.id.goog), which sets up the cluster's identity pool and OIDC issuer so Kubernetes service accounts can federate to Google Cloud IAM. Option B is wrong because using the Compute Engine default service account on nodes grants broad, shared credentials to every pod and does not provide per-pod identity or keyless access.

Option C is wrong because storing service account keys in Vault still involves managing long-lived keys, which is exactly what the team wants to avoid. Option E is wrong because mounting service account keys from a Kubernetes Secret also relies on static, manually managed credentials rather than keyless Workload Identity.

Exam trap

Google Cloud often tests the misconception that storing keys in Kubernetes Secrets or using node-level default service accounts is acceptable for secure API access, when in fact Workload Identity is the recommended, keyless approach for GKE.

Practice this question →
81
MCQhard

A company is using Cloud Storage to store sensitive data. They need to enforce that objects are deleted exactly 30 days after creation. Which object lifecycle rule should they configure?

A.AbortIncompleteMultipartUpload after 30 days.
B.Delete action with condition daysFromNonCurrentTime: 30.
C.Delete action with condition age: 30.
D.SetStorageClass to Nearline after 30 days.
AnswerC

An age condition measures time since each object's creation, and the delete action removes the object once that threshold is reached. Setting age: 30 therefore deletes every object exactly 30 days after creation, matching the stated retention requirement without relying on other conditions.

Why this answer

The 'Delete action with condition age: 30' directly instructs Cloud Storage to remove objects 30 days after their creation time. The 'age' condition is measured from the object's creation timestamp, which aligns perfectly with the requirement to delete objects exactly 30 days after creation.

Exam trap

Google Cloud often tests the distinction between 'age' (based on creation time) and 'daysFromNonCurrentTime' (based on versioning status), leading candidates to confuse deletion of current objects with cleanup of older versions.

How to eliminate wrong answers

Option A is wrong because AbortIncompleteMultipartUpload is used to cancel incomplete multipart uploads after a specified number of days, not to delete completed objects. Option B is wrong because 'daysFromNonCurrentTime' applies to non-current object versions in a versioned bucket, not to the creation time of the current object. Option D is wrong because SetStorageClass to Nearline changes the storage class to a colder tier but does not delete the object; it only modifies the cost and retrieval latency.

Practice this question →
82
MCQeasy

A developer wants to deploy a stateless web application that automatically scales based on HTTP traffic. The application should be cost-effective and require minimal configuration. Which compute option is best?

A.App Engine Standard Environment
B.Cloud Functions
C.Compute Engine managed instance group
D.Cloud Run
E.Google Kubernetes Engine
AnswerD

Correct. Cloud Run scales automatically and is simple to deploy.

Why this answer

Cloud Run is the best choice because it automatically scales to zero when idle, scales up to handle HTTP traffic spikes, and requires minimal configuration—just deploy a container. It is cost-effective as you pay only for resources used during request processing, and it supports stateless web applications natively without managing servers or clusters.

Exam trap

The trap here is that candidates often confuse Cloud Run with Cloud Functions, thinking both are equivalent for web applications, but Cloud Functions is limited to event-driven triggers and cannot serve a full web app with persistent HTTP connections.

How to eliminate wrong answers

Option A is wrong because App Engine Standard Environment, while serverless, has more restrictive runtime environments and may require code modifications to fit its sandbox, whereas Cloud Run offers more flexibility with any container. Option B is wrong because Cloud Functions is designed for event-driven, short-lived functions, not for a full stateless web application that handles continuous HTTP traffic. Option C is wrong because Compute Engine managed instance groups require manual configuration of autoscaling policies, instance templates, and health checks, and do not scale to zero, leading to higher costs during idle periods.

Option E is wrong because Google Kubernetes Engine requires cluster management, node configuration, and more operational overhead, making it less minimal in configuration compared to Cloud Run's fully managed serverless container platform.

Practice this question →
83
Multi-Selecthard

A company is designing a highly available web application on Google Cloud. The application consists of stateless compute instances behind a global HTTP(S) Load Balancer. The compute instances must be able to handle sudden spikes in traffic. Which TWO strategies should the company implement? (Choose two.)

Select 2 answers
A.Use Cloud CDN to cache all responses from the application servers.
B.Use a managed instance group with autoscaling based on CPU utilization.
C.Use a single Compute Engine instance in a single zone with a large machine type.
D.Use a global HTTP(S) Load Balancer with backends in multiple regions.
E.Use vertical scaling by selecting a machine type with more vCPUs and memory.
AnswersB, D

A managed instance group with CPU-based autoscaling adds or removes instances automatically as load changes, absorbing sudden traffic spikes behind the global HTTP(S) load balancer. This satisfies the requirement that stateless compute handle rapid demand increases.

Why this answer

Option B is correct because a managed instance group (MIG) with autoscaling based on CPU utilization automatically adds or removes VM instances in response to traffic spikes, which directly satisfies the requirement that stateless compute instances handle sudden load increases. Option D is correct because a global HTTP(S) Load Balancer with backends in multiple regions distributes traffic across regional MIGs, providing high availability and resilience if one region fails, and it is the appropriate front end for stateless instances. Option A is not correct because Cloud CDN caches content at edge locations but does not by itself provide compute autoscaling or high availability for dynamic application responses, and caching all responses is not a general HA strategy.

Option C is not correct because a single instance in a single zone is a single point of failure and cannot scale horizontally. Option E is not correct because vertical scaling (larger machine type) has limits, requires downtime or restart, and does not provide the elasticity or multi-zone availability needed for sudden traffic spikes.

Exam trap

The trap here is that candidates often confuse caching (Cloud CDN) with compute scaling, or assume vertical scaling (larger machine types) is sufficient for sudden spikes, ignoring the need for horizontal elasticity and multi-zone redundancy in a highly available architecture.

Practice this question →
84
MCQeasy

A developer needs to deploy a containerized application on Google Kubernetes Engine (GKE) with minimal operational overhead. They want to automatically scale the number of pods based on CPU utilization. Which GKE feature should they use?

A.Horizontal Pod Autoscaler.
B.Node auto-repair.
C.Vertical Pod Autoscaler.
D.Cluster Autoscaler.
AnswerA

The Horizontal Pod Autoscaler adjusts the replica count of a workload based on observed CPU utilisation, satisfying the automatic scaling requirement with minimal operational overhead. It reads metrics from the metrics server and scales pods directly, unlike cluster-level node autoscaling.

Why this answer

The Horizontal Pod Autoscaler (HPA) is the correct choice because it automatically scales the number of pod replicas in a GKE deployment based on observed CPU utilization (or other custom metrics). This directly meets the requirement of scaling pods with minimal operational overhead, as HPA is a native Kubernetes resource that requires no manual intervention once configured.

Exam trap

Google Cloud often tests the distinction between horizontal scaling (HPA) and vertical scaling (VPA), where candidates mistakenly choose VPA when the question explicitly asks for scaling the number of pods based on CPU utilization.

How to eliminate wrong answers

Option B (Node auto-repair) is wrong because it automatically repairs unhealthy nodes in the node pool, not scales pods based on CPU utilization. Option C (Vertical Pod Autoscaler) is wrong because it adjusts the CPU and memory requests/limits of existing pods (vertical scaling), not the number of pod replicas (horizontal scaling). Option D (Cluster Autoscaler) is wrong because it adds or removes nodes from the cluster based on pod scheduling needs, not directly scaling pods based on CPU utilization.

Practice this question →
85
MCQhard

A global e-commerce site uses an external HTTPS load balancer with a backend service pointing to a managed instance group. Some users report 503 errors during peak traffic. The backend instances are healthy and not overloaded. What is the most likely cause?

A.The CDN cache is not warming up properly
B.The backend service's health check interval is too short
C.The SSL certificate is expired
D.The load balancer's max rate per backend is configured too low
AnswerD

The max rate per backend setting caps requests per second sent to each instance; when set too low, the load balancer sheds excess traffic and returns 503s even though instances are healthy. Raising this limit resolves the throttling-induced errors during peak load.

Why this answer

A 503 error from an external HTTPS load balancer with healthy backends typically indicates that the load balancer is throttling requests. The 'max rate per backend' setting limits the number of requests per second that the load balancer forwards to each backend instance. When this limit is exceeded, the load balancer returns 503 errors even though the instances themselves are not overloaded, which matches the scenario of peak traffic.

Exam trap

Google Cloud often tests the misconception that 503 errors always indicate backend overload or health check failures, when in fact the load balancer's rate limiting configuration can cause 503s with perfectly healthy instances.

How to eliminate wrong answers

Option A is wrong because CDN cache warming affects cache hit ratios and latency, not 503 errors from the load balancer; a cold cache would cause more origin requests but not throttling. Option B is wrong because a health check interval that is too short could cause flapping or false unhealthy status, but the question states backend instances are healthy and not overloaded, so health checks are passing. Option C is wrong because an expired SSL certificate would cause TLS handshake failures (e.g., ERR_CERT_DATE_INVALID) and 502 or connection errors, not 503 errors from the load balancer itself.

Practice this question →
86
MCQeasy

A company wants to minimize egress costs for data transferred between Compute Engine instances in the same region but different zones. What is the best practice?

A.Use a VPN connection.
B.Use internal IPs and ensure they are in the same VPC.
C.Use Cloud NAT.
D.Use external IPs for all instances.
AnswerB

Internal IP traffic within the same VPC and region is free.

Why this answer

B is correct because data transfer between Compute Engine instances in the same region but different zones uses internal IP addresses within the same VPC, which incurs no egress costs. Google Cloud does not charge for traffic between instances using internal IPs within the same region, regardless of zone, as long as they are in the same VPC network. This is the most cost-effective approach for minimizing egress costs.

Exam trap

The trap here is that candidates often confuse 'different zones' with 'different regions' and assume egress costs apply, or they mistakenly think that using external IPs or NAT is necessary for inter-instance communication, when in fact internal IPs within the same VPC and region are free and optimal.

How to eliminate wrong answers

Option A is wrong because using a VPN connection introduces additional complexity and does not reduce egress costs; VPN traffic still traverses the internet or uses Cloud VPN tunnels, which incur egress charges. Option C is wrong because Cloud NAT is used for outbound internet access from private instances and does not affect inter-instance traffic costs within the same region; it would add unnecessary overhead and potential costs. Option D is wrong because using external IPs for all instances forces traffic to go through the internet or Google's external network, incurring egress charges even within the same region, which is the opposite of minimizing costs.

Practice this question →
87
MCQeasy

An administrator is configuring firewall rules in a VPC. Two rules apply to the same traffic: rule 1 allows ingress from 0.0.0.0/0 on TCP 80, rule 2 denies ingress from 10.0.0.0/8 on TCP 80. Rule 1 has priority 1000, rule 2 has priority 500. What is the effective behavior for traffic from 10.0.0.1?

A.The result is unpredictable without knowing the rule creation order.
B.Traffic is allowed because allow rules override deny rules.
C.Traffic is denied because rule 2 has higher priority.
D.Traffic is allowed because rule 1 has a lower priority number.
AnswerC

VPC firewall rules are evaluated by priority, where the lowest numeric value wins; rule 2's priority 500 beats rule 1's 1000. Because 10.0.0.1 falls inside 10.0.0.0/8, the deny rule matches first and takes effect, so the connection is blocked despite the broader allow.

Why this answer

In Google Cloud VPC firewall rules, rules are evaluated in priority order, with lower numbers having higher priority. Rule 2 (priority 500) is evaluated before rule 1 (priority 1000), and since rule 2 explicitly denies ingress from 10.0.0.0/8 on TCP 80, traffic from 10.0.0.1 is denied. Google Cloud firewall rules are stateful, and the first matching rule determines the outcome; there is no implicit override between allow and deny.

Exam trap

Google Cloud PCA often tests the misconception that allow rules override deny rules or that rule creation order matters, but the trap here is that candidates confuse priority numbers (lower = higher priority) and assume a higher number means higher priority.

How to eliminate wrong answers

Option A is wrong because rule creation order does not affect evaluation; only the priority number matters. Option B is wrong because allow rules do not inherently override deny rules; the rule with the highest priority (lowest number) that matches the traffic is applied. Option D is wrong because a lower priority number means higher priority, not lower; rule 1 has a higher priority number (1000) and thus lower priority, so it is not evaluated before rule 2.

Practice this question →
88
MCQeasy

A service account needs to be able to start and stop Compute Engine instances in a specific project. Which IAM role should be assigned at the project level?

A.roles/iam.serviceAccountUser
B.roles/editor
C.roles/compute.viewer
D.roles/compute.instanceAdmin.v1
AnswerD

roles/compute.instanceAdmin.v1 grants permissions to start, stop, reset and manage Compute Engine instances, including instance-level operations, at the project scope. That matches the requirement precisely, unlike narrower roles such as compute.viewer or instance-specific permissions that omit start and stop.

Why this answer

Roles/compute.instanceAdmin.v1, because this role grants the necessary permissions to start, stop, and manage Compute Engine instances, including operations like instances.start and instances.stop, at the project level. This role is specifically designed for managing compute resources without granting broader project-level access like editing all resources.

Exam trap

Google Cloud often tests the distinction between primitive roles (like roles/editor) and predefined roles (like roles/compute.instanceAdmin.v1), where candidates mistakenly choose the broader role due to its apparent convenience, overlooking the principle of least privilege and the specific permissions required for the task.

How to eliminate wrong answers

Option A is wrong because roles/iam.serviceAccountUser grants permission to impersonate service accounts, not to manage Compute Engine instances; it allows attaching a service account to a resource but does not include compute.instance.start or compute.instance.stop. Option B is wrong because roles/editor is a broad, primitive role that grants full edit access to all resources in the project, including Compute Engine, but it violates the principle of least privilege by providing excessive permissions beyond what is needed for instance management. Option C is wrong because roles/compute.viewer only provides read-only permissions to view Compute Engine resources (e.g., compute.instances.list, compute.instances.get) and does not include any write or action permissions like starting or stopping instances.

Practice this question →
89
MCQmedium

A company wants to migrate on-premises workloads to Google Cloud. They need to assess the existing infrastructure, plan the migration, and track progress. Which tool should they use?

A.Cloud Endpoints.
B.Cloud Deployment Manager.
C.Cloud Foundation Toolkit.
D.Migrate for Compute Engine.
AnswerD

Provides assessment and migration capabilities.

Why this answer

Migrate for Compute Engine (formerly Velostrata) is the correct tool because it is specifically designed to assess, plan, and migrate on-premises workloads to Google Cloud. It provides discovery of existing infrastructure, generates migration plans, and tracks progress through a dashboard, directly addressing the need for assessment, planning, and tracking.

Exam trap

The trap here is that candidates may confuse Cloud Foundation Toolkit (a foundation setup tool) with a migration tool, or assume Cloud Deployment Manager can handle migration planning, when in fact only Migrate for Compute Engine provides the full assessment-to-tracking workflow.

How to eliminate wrong answers

Option A is wrong because Cloud Endpoints is an API management service for securing and monitoring APIs, not a migration assessment or planning tool. Option B is wrong because Cloud Deployment Manager is an infrastructure-as-code tool for deploying Google Cloud resources using templates, not for assessing or migrating on-premises workloads. Option C is wrong because Cloud Foundation Toolkit provides Terraform templates and best practices for setting up a Google Cloud foundation (e.g., projects, networking), but it does not include discovery, assessment, or migration tracking for existing on-premises workloads.

Practice this question →
90
MCQmedium

A web application running on Compute Engine behind a global HTTP(S) load balancer experiences high latency during traffic spikes. Which quick fix would best address this issue without changing the architecture?

A.Configure managed instance group autoscaling to add more instances.
B.Enable Cloud CDN on the load balancer.
C.Switch to a regional load balancer to reduce latency.
D.Increase the machine type of the backend instances.
AnswerA

Autoscaling the managed instance group adds Compute Engine instances when load rises, spreading traffic across more backends. This directly relieves the CPU or capacity bottleneck causing high latency during spikes, and it requires no architectural change, satisfying the stem's quick-fix constraint.

Why this answer

Managed instance group (MIG) autoscaling dynamically adds more instances when CPU utilization or other metrics exceed a threshold, directly absorbing the increased traffic during spikes. This is the quickest fix because it requires no architectural changes—just configuring autoscaling parameters on the existing MIG. By scaling out horizontally, the load balancer can distribute requests across more backends, reducing per-instance load and latency.

Exam trap

Google Cloud often tests the distinction between horizontal scaling (autoscaling) and vertical scaling (increasing machine type) or caching solutions, leading candidates to choose Cloud CDN or machine type changes as a 'quick fix' when the real issue is insufficient compute capacity to handle dynamic request spikes.

How to eliminate wrong answers

Option B is wrong because enabling Cloud CDN caches static content at edge locations, which does not help with high latency caused by dynamic request processing during traffic spikes—CDN only reduces latency for cacheable content, not for the dynamic workload that is overwhelming the backend. Option C is wrong because switching to a regional load balancer would actually increase latency for global users, as it lacks the anycast IP and global distribution of the global HTTP(S) load balancer, and it requires architectural changes (e.g., changing the load balancer type). Option D is wrong because increasing the machine type (vertical scaling) is not a quick fix—it requires instance recreation or rolling update, and it does not scale as elastically as horizontal autoscaling; it also may not handle sudden spikes as effectively as adding more instances.

Practice this question →
91
MCQeasy

A user wants to store a database password that will be used by a Compute Engine instance. What is the most secure and manageable approach?

A.Use Secret Manager and grant the instance's service account access to the secret
B.Set the password as an environment variable in instance metadata
C.Store the password in Cloud Storage bucket metadata
D.Store the password in a file on the instance's boot disk
AnswerA

Secret Manager stores the credential encrypted and versioned, and IAM on the Compute Engine service account grants retrieval at runtime, so the password never sits in instance metadata, startup scripts or source code. This satisfies the secure and manageable requirement without manual rotation.

Why this answer

Secret Manager is the most secure and manageable approach because it provides encrypted storage, automatic rotation, and fine-grained access control via IAM. By granting the Compute Engine instance's service account access to the secret, the password is never exposed in plaintext metadata, logs, or disk files, and access can be audited and revoked independently of the instance lifecycle.

Exam trap

Google Cloud often tests the misconception that instance metadata is a secure place for secrets because it is 'internal' to the project, but in reality, metadata is accessible to any process on the instance and is logged, making it unsuitable for sensitive data.

How to eliminate wrong answers

Option B is wrong because setting the password as an environment variable in instance metadata exposes it in the metadata server, which can be accessed by any process on the instance or via the metadata API, and it is logged in Cloud Audit Logs. Option C is wrong because Cloud Storage bucket metadata is not designed for secrets; it is unencrypted at rest by default, accessible via the Storage API, and lacks IAM-level access control for individual metadata entries. Option D is wrong because storing the password in a file on the instance's boot disk persists the secret in the filesystem, making it vulnerable to snapshot exports, disk cloning, and unauthorized OS-level access, and it cannot be centrally managed or rotated.

Practice this question →
← PreviousPage 2 of 2 · 91 questions total

Ready to test yourself?

Try a timed practice session using only Manage and provision cloud infrastructure questions.

Start 20-question session