Refer to the Exhibit Practice Questions

The user lacks IAM permissions to create firewall rules.

Why it fails: An IAM permission gap produces an authorisation or 403 error, not a conflict stating the resource already exists; that message means the firewall rule is already present in the project or was created outside the deployment. It is tempting because permission failures are common in deployments, but the specific 'already exists' text points to a naming collision, not access rights.

The network reference in the firewall rule is incorrect.

Why it fails: An incorrect network reference would surface as a validation or reference-resolution error, not an 'already exists' conflict. It tempts because firewall rules do reference networks, and misconfiguration is a common deployment failure, but the specific error indicates a naming collision with a resource outside the deployment's management.

The deployment does not include a 'delete' policy for existing resources.

Why it fails: Deployment Manager does not reconcile pre-existing resources unless the config declares them as existing via an 'action: acquire' or the resource is imported; a delete policy governs teardown, not creation conflicts. It tempts because deletion policies matter for cleanup scenarios, but the error stems from an unmanaged resource occupying the name.

The user has been granted roles/compute.admin.

Why it fails: roles/compute.admin does include compute.networks.create, so it would permit VPC creation; however, the question asks what to verify first, and the exhibit shows the user already holds this role, making it the wrong starting point for diagnosis.

The user has the project owner role.

Why it fails: roles/owner grants full project control including network creation, so it would work; but the exhibit indicates the user's existing bindings, and verifying an already-satisfied condition wastes effort. It is tempting as the broadest role, yet it is not the first thing to check.

The user has the roles/storage.admin role.

Why it fails: roles/storage.admin governs Cloud Storage buckets and objects, granting no permission over Compute Engine networks. It is tempting because storage roles appear in IAM listings, but creating a VPC requires compute.networks.create, which this role does not include.

The prod target's applyManifest has a higher replica count than staging, which violates a cluster quota.

Why it fails: A replica count exceeding cluster quota fails at apply time with a quota or admission error, not MANIFEST_INVALID, which indicates the manifest itself cannot be parsed or rendered. Quota limits are tempting because they do block rollouts, but they yield a distinct error.

The prod cluster does not have the necessary permissions to pull the container image.

Why it fails: MANIFEST_INVALID signals a malformed or unrenderable manifest, not an image-pull authorisation failure, which surfaces as ImagePullBackOff or a permission error. Image-pull permissions are tempting because they block deployments, but they produce a different failure signature.

The release was not approved for the prod target.

Why it fails: Approval gating blocks a rollout before it starts, producing a pending-approval state rather than MANIFEST_INVALID, which Cloud Deploy raises when the rendered manifest fails schema or API validation against the target cluster. Approval is the right control when you need a human gate between staging and prod.

The firewall rule allowing traffic on port 5432 is missing or misconfigured.

Why it fails: A missing or misconfigured firewall rule on port 5432 blocks the connection, and the correct answer here is the database service not listening on that port. Firewall rules are the right focus when traffic is silently dropped rather than actively refused.

The instance is using an outdated SSL certificate.

Why it fails: An outdated certificate would cause TLS handshake or validation failures, not the immediate TCP refusal logged here. Certificate renewal is the right fix when clients report expired or untrusted certificate errors, but a refused connection means nothing is listening on that port.

The VPC network has no route to the database subnet.

Why it fails: A missing route produces a no-route-to-host or timeout error, not an immediate connection refusal. Route configuration is the correct focus when packets cannot reach the destination subnet at all, whereas refusal means the host was reached but the port rejected the connection.

Older versions of objects are automatically transferred to a different storage class.

Why it fails: Object Versioning must be enabled for noncurrent versions to exist; without it, lifecycle rules acting on noncurrent versions have nothing to transition. Versioning plus a noncurrent-age transition rule is correct when retaining and tiering superseded object versions.

Data is replicated to another region for disaster recovery.

Why it fails: Cross-region replication requires dual-region or multi-region bucket placement; a single-region bucket with lifecycle rules replicates nothing. It is tempting because replication genuinely serves disaster recovery, and would be correct where the bucket's location setting spans two regions.

Objects older than 30 days will be automatically deleted.

Why it fails: Lifecycle rules with an age condition and a Delete action remove objects after the specified days; the exhibit's rule instead specifies a storage-class transition, so nothing is deleted. Deletion rules are correct when the requirement is expiry rather than cost-tiering.

Faster instance startup time due to optimized kernel.

Why it fails: The `--preemptible` flag controls instance scheduling and pricing, not kernel behaviour, so it cannot affect startup time. It is tempting because preemptible VMs are short-lived and cheap, making them attractive for batch workloads; however, they are reclaimed after 24 hours, which is the actual trade-off, not kernel optimisation.

Higher availability through automatic restart on failure.

Why it fails: Preemptible instances are terminated by Compute Engine after 24 hours or on demand, so they cannot guarantee availability; no automatic restart is provided. They are chosen for fault-tolerant, interruption-tolerant batch workloads where low cost outweighs continuity.

Access to specialized hardware like GPUs at no extra cost.

Why it fails: Preemptible VMs offer the same hardware options as standard instances, including GPUs, but at a discount, not free of charge, and availability is not guaranteed. They suit interruptible batch jobs, not workloads needing guaranteed specialised hardware.

The BigQuery dataset requires domain-wide delegation.

Why it fails: Domain-wide delegation applies to service accounts acting on behalf of Workspace users, not to granting BigQuery roles to an external identity. It tempts because delegation is used when a service account must impersonate users across a domain, which would be correct for accessing user data without individual consent.

The user does not have the resourcemanager.projects.setIamPolicy permission.

Why it fails: The administrator is granting a role, so the missing permission would be on their own account, not the external user's; the recipient's permissions are irrelevant to the failure. It tempts because setIamPolicy is genuinely required to modify a project's IAM policy, and that would be the cause if the administrator themselves lacked it.

The external user must first be added to a Google Group.

Why it fails: Google Cloud grants IAM roles directly to external identities; group membership is not a prerequisite, so this does not explain the error. It tempts because groups are a common way to manage access at scale, and adding the user to a group would be the right approach when centralising permissions across many principals.

Change the metadata key enable-oslogin to FALSE.

Why it fails: enable-oslogin controls SSH authentication method, not external IP allocation, so the instance retains its public address regardless of the value. Disabling OS Login is tempting when troubleshooting SSH access, and would be correct for switching to metadata-based SSH keys, not for removing public connectivity.

Set access_config = [] instead of leaving it empty.

Why it fails: An empty access_config block still requests an ephemeral external IP; omitting the block entirely is what prevents one being assigned. Setting it to an empty list is tempting because it looks like declaring no access config, but it remains a present block, so the instance keeps its public address.

Set the network to a custom VPC that does not have external internet access.

Why it fails: A VPC without internet access still assigns an ephemeral external IP unless access_config is removed, because the public address comes from the instance's network interface configuration, not the VPC's routing. Choosing a private VPC is tempting for isolation, and would be correct for controlling egress, not for suppressing the external IP itself.

The node auto-scaler has not created additional nodes yet, but the other nodes are present.

Why it fails: Autoscaler lag would delay new nodes, yet the stem states other nodes already exist, so scheduling could spread pods across them. That rules out capacity as the cause; an affinity or selector constraint pinning pods to default-pool-1 explains the concentration.

The pods have a nodeSelector that matches only default-pool-1.

Why it fails: A nodeSelector matching only default-pool-1 would indeed pin pods there, but the exhibit shows other nodes present and schedulable, so the constraint is not the observed cause. Node selectors are correct when workloads must target specific hardware or labelled pools deliberately.

The resource requests are too high, so the scheduler packed pods onto one node due to resource constraints on the others.

Why it fails: Incorrect: The total requests for 5 pods are 2500m CPU and 5Gi memory, which would easily fit on one e2-standard-2 node (2 vCPU, 8GB RAM), but the other nodes also have capacity. The scheduler would spread by default.

Change `allUsers` to `allAuthenticatedUsers` to allow only authenticated users.

Why it fails: allAuthenticatedUsers still grants read access to anyone with a Google account, so the bucket remains publicly readable; it merely excludes anonymous callers. The binding must instead be scoped to specific principals, such as named service accounts or a Google Group, to close the exposure.

Enable uniform bucket-level access and update the IAM policy.

Why it fails: Uniform bucket-level access disables object ACLs, so it cannot fix a policy granting public access through bucket IAM bindings; the recommendation should instead remove or restrict the public principal. It is tempting as an access-control hardening step, and would be correct when consolidating ACL-based permissions into IAM.

Remove the `roles/storage.objectViewer` role binding entirely.

Why it fails: Removing the binding strips legitimate read access from every principal, including the service accounts and users who need it, rather than narrowing the allUsers grant that exposes the bucket publicly. The recommendation is to delete only the allUsers member, not the role binding itself.

The instance is using a custom machine type.

Why it fails: A custom machine type appears as machineType referencing a custom-* name with explicit vCPU and memory values; this output shows a standard predefined type instead. It tempts because custom machine types are a frequent Compute Engine exam topic, and they would be correct where the instance specifies non-standard vCPU or memory sizing.

The instance is using committed use discounts.

Why it fails: Committed use discounts are billing constructs recorded in the project's commitments, not in an instance's describe output; the instance JSON shows no commitment reference. It tempts because CUDs reduce compute cost and are commonly examined, but they would be the answer when the stem asks about a purchased commitment or its discount coverage.

The instance has a GPU attached.

Why it fails: A GPU attachment appears in the instance's guestAccelerators field, which is absent here, so no accelerator is configured. It tempts because GPU-enabled instances are a common Compute Engine topic, and a describe output would list accelerators if present; that field would be the correct evidence for a GPU-backed workload.

The machine type e2-medium does not support public IP addresses.

Why it fails: Machine type determines vCPU and memory only; any Compute Engine machine type can receive an external IP. The instance likely lacks an access config or firewall rule. Machine type selection matters for workload sizing, not network reachability.

The instance is not attached to a VPC network.

Why it fails: Every Compute Engine instance is always attached to a VPC network; attachment is mandatory, so this cannot be the cause. External reachability instead depends on an external IP address, firewall rules permitting ingress, and routing. The option tempts because VPC selection matters for subnet and route configuration, but its absence is impossible in practice.

The boot disk size is too small to run the operating system.

Why it fails: A small boot disk prevents the instance from booting at all, producing a startup failure rather than a running instance unreachable from the internet. Disk sizing is the correct consideration when the chosen image or workload exceeds the default 10 GB.

Modify the instance to use a network tag 'restricted-ssh' and update the firewall rule target_tags accordingly.

Why it fails: Introducing a new tag creates a rule the existing firewall does not match, so the original 0.0.0.0/0 rule still permits SSH from anywhere. Retagging is correct when deliberately reassigning an instance between separate firewall policies, not when merely restricting source ranges.

Add a new firewall rule with higher priority allowing SSH from 203.0.113.0/24, and keep the existing rule but change its priority to 100.

Why it fails: Incorrect: This would still allow SSH from all IPs because the existing rule with lower priority (100) would still apply. Lower priority number means higher priority, so the new rule would take precedence only if it has higher priority (lower number). But the existing rule would still match traffic from 0.0.0.0/0 and allow it.

Update the 'source_ranges' in the firewall rule to ['203.0.113.0/24'] and remove the 'ssh-allowed' tag from the instance.

Why it fails: Removing the tag while leaving the firewall rule's target_tags unchanged detaches the rule from the instance, so no firewall applies and SSH stays open to 0.0.0.0/0. Tag removal is right when decommissioning an instance from a rule entirely, not when narrowing permitted source ranges.

The VM was stopped manually by a user.

Why it fails: The exhibit's status shows the instance terminated or stopped by the system or a scheduled operation, not a manual user action; manual stops appear differently. It tempts because users commonly stop batch VMs, but the displayed reason indicates an automated or policy-driven shutdown.

The VM lost its external IP address.

Why it fails: Losing an external IP affects inbound connectivity, not the instance's reported state; the exhibit shows the VM itself not running. It tempts because unreachable instances often stem from networking, but the status field here points to the instance lifecycle rather than address assignment.

The VM crashed due to an out-of-memory error.

Why it fails: The exhibit shows the instance stopped or terminated, not memory exhaustion; an OOM crash would leave the VM running or show a host error. OOM is tempting because batch workloads consume memory heavily, but the displayed status indicates an administrative stop instead.

The service account is not attached to the instance

Why it fails: If no service account is attached, the instance uses the default Compute Engine service account, which may lack Storage Object Viewer on the bucket, causing reads to fail. Attaching the intended service account and granting it bucket IAM roles resolves this. This option is correct whenever the instance genuinely lacks an attached service account.

The tags http-server and https-server block outbound traffic

Why it fails: The http-server and https-server tags are network tags that enable inbound firewall rules for web traffic; they do not restrict outbound traffic to Cloud Storage. Egress to Google APIs is governed by IAM permissions and access scopes. These tags would be relevant when configuring inbound HTTP or HTTPS access to the web server itself.

The boot disk type is SSD, which is not compatible with Cloud Storage

Why it fails: Boot disk type is unrelated to Cloud Storage access; SSD and standard persistent disks both support the same network and IAM permissions. The failure stems from the instance's identity or scopes, not its disk. SSD would be the correct choice when the requirement is higher disk throughput for the boot volume, not storage bucket access.