CCNA Managing and Provisioning a Solution Infrastructure Questions — Page 2 of 2

Multi-Selectmedium

A data engineering team wants to ingest streaming data from Pub/Sub, transform it using Apache Beam, and load it into BigQuery for real-time analytics. They need a fully managed solution that handles autoscaling and does not require managing servers. Which TWO Google Cloud services should they use?

Select 2 answers

A.Cloud Dataproc

B.Cloud Dataflow

C.Cloud Dataprep

D.Cloud Composer

E.Cloud Pub/Sub

AnswersB, E

Dataflow runs Beam pipelines with autoscaling and serverless processing.

Why this answer

Dataflow is the fully managed service for executing Apache Beam pipelines, with autoscaling and serverless execution. Pub/Sub is the ingestion service. Cloud Composer is Airflow, not streaming; Dataproc is for Spark/Hadoop; Dataprep is for data preparation.

Practice this question →

MCQmedium

A company uses Cloud Deploy for continuous delivery. They have a delivery pipeline with multiple targets: dev, staging, and prod. They want to require manual approval before deploying to prod. How should they configure this?

A.Add a Cloud Build trigger that pauses and waits for approval

B.Use IAM conditions to restrict deployment to prod

C.Configure an approval gate on the prod target in the delivery pipeline

D.Set up a Pub/Sub notification and a Cloud Function to approve

AnswerC

Approval gates are natively supported in Cloud Deploy delivery pipelines.

Why this answer

Approval gates in Cloud Deploy are configured as phases within a delivery pipeline, where a required approval step blocks progression until manually approved.

Practice this question →

MCQhard

A team wants to enforce that only container images signed by their CI/CD system can be deployed to GKE. They have enabled Binary Authorization with a policy that requires an attestor. What additional step must they take to bind the attestor to the image signing process?

A.Create a Container Analysis note and grant the attestor service account the containeranalysis.notes.attacher role

B.Add the attestor to the Binary Authorization policy as a required attestor

C.Create a Cloud Build step that signs the image and stores the signature in Cloud Storage

D.Configure the GKE cluster to require Binary Authorization with the --no-enforce flag

AnswerA

This binds the attestor to the Container Analysis note, allowing it to create attestations for signed images.

Why this answer

After creating the attestor, you must create an AttestationAuthority note in Container Analysis and grant the attestor service account permission to bind attestations. Configuring Cloud Build to sign images is part of the process but not the binding step.

Practice this question →

MCQhard

An organization wants to export their Cloud Logging logs to a centralized BigQuery dataset for long-term analysis. They also need to exclude logs from a specific source (e.g., a test project) to reduce costs. How should they set this up?

A.Disable logging in the test project

B.Create a log sink to BigQuery and add a log exclusion filter that excludes the test project's logs

C.Create two separate sinks: one for production logs to BigQuery and another for test logs to Cloud Storage

D.Create a log sink to BigQuery and use IAM to restrict access to the test project's logs

AnswerB

Exclusion filters can be applied to the sink or the log bucket to drop certain logs.

Why this answer

A log sink exports logs to BigQuery. To exclude logs from a test project, create a log exclusion filter that matches the test project's logs and apply it to the sink or the project's logs bucket.

Practice this question →

Multi-Selecthard

A company runs a web application on Google Kubernetes Engine (GKE) that experiences sudden spikes in traffic. They need to automatically scale the number of pods and also ensure that the cluster itself can scale by adding new nodes when needed. Which TWO components should they configure to achieve this?

Select 2 answers

A.Cluster Autoscaler

B.Vertical Pod Autoscaler (VPA)

C.Horizontal Pod Autoscaler (HPA)

D.Node Auto-Repair

E.Pod Disruption Budget (PDB)

AnswersA, C

Cluster Autoscaler adds or removes nodes as needed when pods are pending.

Why this answer

Horizontal Pod Autoscaler (HPA) automatically scales the number of pods based on CPU utilization or other metrics. Cluster Autoscaler automatically adjusts the size of the GKE cluster by adding or removing nodes when pods are unschedulable or nodes are underutilized. Together they provide pod-level and node-level scaling.

Vertical Pod Autoscaler (VPA) adjusts resource requests but does not scale pods or nodes. Node Auto-Repair handles node health, not scaling. Pod Disruption Budget (PDB) protects pods during maintenance.

Only options A and C are correct.

Exam trap

The question explicitly asks for THREE, but only two options are correct. Do not select a third incorrect option just to fill the count.

Practice this question →

Multi-Selecteasy

A cloud architect needs to implement a CI/CD pipeline for a team developing a Python-based microservice. The team uses GitHub as their source repository. The pipeline should automatically run unit tests and deploy the service to Cloud Run when changes are pushed to the main branch. Which THREE Google Cloud services should they use?

Select 3 answers

A.Artifact Registry

B.Cloud Run

C.Cloud Deploy

D.Cloud Source Repositories

E.Cloud Build

AnswersA, B, E

Artifact Registry stores the container image built by Cloud Build.

Why this answer

Cloud Build can connect to GitHub via triggers to run tests and build a container image. Artifact Registry stores the image. Cloud Run deploys the container.

Cloud Deploy is for GKE and other platforms, not Cloud Run directly. Cloud Functions is serverless but not for containers. Cloud Source Repositories is Google's own git, not GitHub.

Practice this question →

MCQmedium

A company uses Cloud Deployment Manager to manage infrastructure. They want to roll back to a previous deployment state after a failed update. What is the recommended approach?

A.Use gcloud deployment-manager deployments rollback --deployment <name>

B.Use the --update-policy=PARTIAL flag to selectively revert changes

C.Delete the deployment and recreate it from the previous template

D.Run gcloud deployment-manager deployments update --config <previous_manifest>

AnswerD

This updates the deployment to the configuration defined in the previous manifest, effectively rolling back.

Why this answer

Deployment Manager stores the deployment manifests. You can use an update with a previous manifest to revert to a known good state. Deleting and recreating is not a rollback.

Partial updates are not supported directly.

Practice this question →

Multi-Selectmedium

A team is building a CI/CD pipeline for a Java application that will run on GKE. They want to automatically build the application, run unit tests, create a Docker image, push it to Artifact Registry, and deploy to GKE. Which two GCP services should be combined? (Choose two.)

Select 2 answers

A.Cloud Functions

B.Compute Engine

C.Cloud Run

D.Cloud Deploy

E.Cloud Build

AnswersD, E

Cloud Deploy can manage delivery pipelines to deploy to GKE.

Why this answer

Cloud Build handles the build and test steps, builds the Docker image, and pushes to Artifact Registry. Cloud Deploy manages the deployment to GKE. Cloud Run is serverless; Cloud Functions is event-driven; Compute Engine is VMs.

Practice this question →

MCQhard

A company has a GKE cluster with Workload Identity enabled. A pod needs to access a BigQuery dataset in a different project. The team has created a service account in the pod's project and granted it BigQuery Data Viewer on the dataset. They also created an IAM policy binding between the Kubernetes service account and the Google service account. The pod still gets permission denied. What is missing?

A.The Google service account needs the iam.workloadIdentityUser role on itself

B.The Kubernetes service account needs the iam.workloadIdentityUser role

C.The pod needs a node pool with Workload Identity enabled

D.The BigQuery dataset must be in the same project as the cluster

AnswerA

This role allows the Kubernetes service account to impersonate the Google service account.

Why this answer

Workload Identity requires the Google service account to be granted the iam.workloadIdentityUser role on the Google service account itself, not just on the Kubernetes service account.

Practice this question →