1.1 Setting up Cloud Projects and Accounts ASSOCIATE-CLOUD-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   Your application is running in production and is experiencing a sudden spike in traffic. You are concerned about hitting the API quota for a specific service. You want to automatically scale your application to handle the load, but you also want to avoid hitting the quota limit. What is the best approach?

   • AUse Cloud Monitoring to set up an alert on quota usage and have a runbook to request an increase.
   • BSet up autoscaling on your instances and monitor the quota usage.
   • CConfigure autoscaling and set up a Cloud Monitoring alert on quota usage to notify you before you hit the limit.
   • DImmediately request a quota increase for the API.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of Workforce Identity Federation in Google Cloud?

   • ATo enable single sign-on for Google Workspace users
   • BTo manage service accounts for automated workloads
   • CTo allow external users to access Google Cloud resources using their existing identity provider
   • DTo provide a backup for Cloud Identity
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   Your company uses Okta as its identity provider. You want to allow your employees to access Google Cloud resources using their existing Okta credentials, without creating a Cloud Identity account for each user. What should you configure?

   • ACreate a service account for each Okta user and grant them access.
   • BCreate a Cloud Identity account and manually add all Okta users.
   • CSet up Workforce Identity Federation to trust Okta as an identity provider.
   • DUse Google Workspace as an intermediary and sync Okta users to it.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   You have a VPC network with a subnet in `us-central1`. You have a Compute Engine instance in this subnet that needs to communicate with an on-premises network via a VPN tunnel. The on-premises network uses the CIDR block `10.0.0.0/8`. Your VPC subnet uses `10.1.0.0/16`. You have configured the VPN tunnel and the appropriate firewall rules. However, traffic from the instance to the on-premises network is not working. What is the most likely cause?

   • AThe subnet in `us-central1` is not in the same region as the VPN gateway.
   • BThe on-premises network is not advertising the `10.0.0.0/8` route to the VPC.
   • CThe instance does not have a public IP address.
   • DThe firewall rules are not allowing traffic from the instance to the VPN gateway.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a quota in Google Cloud?

   • AA billing threshold that triggers an alert when exceeded
   • BA type of virtual machine instance
   • CA permission that allows a user to access a resource
   • DA limit on the amount of a specific resource you can use in a project
   Reveal Solution Discussion Select an answer first