[2025年更新]Associate-Cloud-Engineer試験問題集でテストエンジン練習テスト問題
合格できるAssociate-Cloud-Engineer試験[2025年03月01日]最新290問題
Google Associate-Cloud-Engineer認定試験は、Google Cloudプラットフォームサービスを運営および管理する候補者の能力と能力のテストに焦点を当てています。この試験は、Google Cloudプラットフォームでアプリケーションを展開、監視、維持するために必要な知識とスキルを検証するように設計されています。
質問 # 54
You want to configure autohealing for network load balancing for a group of Compute Engine instances that run in multiple zones, using the fewest possible steps. You need to configure re- creation of VMs if they are unresponsive after 3 attempts of 10 seconds each. What should you do?
- A. Create a managed instance group. Verify that the autoscaling setting is on.
- B. Create an HTTP load balancer with a backend configuration that references an existing instance group.
Define a balancing mode and set the maximum RPS to 10. - C. Create an HTTP load balancer with a backend configuration that references an existing instance group.
Set the health check to healthy (HTTP) - D. Create a managed instance group. Set the Autohealing health check to healthy (HTTP)
正解：D
解説：
Use separate health checks for load balancing and for autohealing. Health checks for load balancing detect unresponsive instances and direct traffic away from them. Health checks for autohealing detect and recreate failed instances, so they should be less aggressive than load balancing health checks. Using the same health check for these services would remove the distinction between unresponsive instances and failed instances, causing unnecessary latency and unavailability for your users.
https://cloud.google.com/compute/docs/tutorials/high-availability-autohealing
質問 # 55
You have deployed an application on a Compute Engine instance. An external consultant needs to access the Linux-based instance. The consultant is connected to your corporate network through a VPN connection, but the consultant has no Google account. What should you do?
- A. Instruct the external consultant to use the gcloud compute ssh command line tool by using Identity-Aware Proxy to access the instance.
- B. Instruct the external consultant to generate an SSH key pair, and request the private key from the consultant.Add the private key to the instance yourself, and have the consultant access the instance through SSH with their public key.
- C. Instruct the external consultant to use the gcloud compute ssh command line tool by using the public IP address of the instance to access it.
- D. Instruct the external consultant to generate an SSH key pair, and request the public key from the consultant.
Add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key.
正解：D
解説：
The best option is to instruct the external consultant to generate an SSH key pair, and request the public key from the consultant. Then, add the public key to the instance yourself, and have the consultant access the instance through SSH with their private key. This way, you can grant the consultant access to the instance without requiring a Google account or exposing the instance's public IP address. This option also follows the best practice of using user-managed SSH keys instead of service account keys for SSH access1.
Option A is not feasible because the external consultant does not have a Google account, and therefore cannot use Identity-Aware Proxy (IAP) to access the instance. IAP requires the user to authenticate with a Google account and have the appropriate IAM permissions to access the instance2. Option B is not secure because it exposes the instance's public IP address, which can increase the risk of unauthorized access or attacks. Option D is not correct because it reverses the roles of the public and private keys. The public key should be added to the instance, and the private key should be kept by the consultant. Sharing the private key with anyone else can compromise the security of the SSH connection3.
Reference:
1: https://cloud.google.com/compute/docs/instances/adding-removing-ssh-keys
2: https://cloud.google.com/iap/docs/using-tcp-forwarding
3: https://cloud.google.com/compute/docs/instances/connecting-advanced#sshbetweeninstances
質問 # 56
You have a developer laptop with the Cloud SDK installed on Ubuntu. The Cloud SDK was installed from the Google Cloud Ubuntu package repository. You want to test your application locally on your laptop with Cloud Datastore. What should you do?
- A. Install the google-cloud-sdk-datastore-emulator component using the apt get install command.
- B. Export Cloud Datastore data using gcloud datastore export.
- C. Install the cloud-datastore-emulator component using the gcloud components install command.
- D. Create a Cloud Datastore index using gcloud datastore indexes create.
正解：C
解説：
The Datastore emulator provides local emulation of the production Datastore environment. You can use the emulator to develop and test your application locally Ref: https://cloud.google.com/datastore/docs/tools/datastore-emulator
質問 # 57
Your team is building a website that handles votes from a large user population. The incoming votes will arrive at various rates. You want to optimize the storage and processing of the votes. What should you do?
- A. Save the incoming votes to Firestore. Use Cloud Scheduler to trigger a Cloud Functions instance to periodically process the votes.
- B. Use a dedicated instance to process the incoming votes. Send the votes directly to this instance.
- C. Save the incoming votes to a JSON file on Cloud Storage. Process the votes in a batch at the end of the day.
- D. Save the incoming votes to Pub/Sub. Use the Pub/Sub topic to trigger a Cloud Functions instance to process the votes.
正解：B
解説：
Pub/Sub is a scalable and reliable messaging service that can handle large volumes of data from different sources at different rates. It allows you to decouple the producers and consumers of the data, and provides a durable and persistent storage for the messages until they are delivered. Cloud Functions is a serverless platform that can execute code in response to events, such as messages published to a Pub/Sub topic. It can scale automatically based on the load, and you only pay for the resources you use. By using Pub/Sub and Cloud Functions, you can optimize the storage and processing of the votes, as you can handle the variable rates of incoming votes, process them in real time or near real time, and avoid managing servers or VMs. References:
* Pub/Sub documentation
* Cloud Functions documentation
* Choosing a messaging service for Google Cloud
質問 # 58
Your Dataproc cluster runs in a single Virtual Private Cloud (VPC) network in a single subnet with range 172.16.20.128/25. There are no private IP addresses available in the VPC network. You want to add new VMs to communicate with your cluster using the minimum number of steps. What should you do?
- A. Create a new Secondary IP Range in the VPC and configure the VMs to use that range.
- B. Create a new VPC network for the VMs. Enable VPC Peering between the VMs' VPC network and the Dataproc cluster VPC network.
- C. Modify the existing subnet range to 172.16.20.0/24.
- D. Create a new VPC network for the VMs with a subnet of 172.32.0.0/16. Enable VPC network Peering between the Dataproc VPC network and the VMs VPC network. Configure a custom Route exchange.
正解：D
解説：
/25:
CIDR to IP Range
Result
CIDR Range 172.16.20.128/25
Netmask 255.255.255.128
Wildcard Bits 0.0.0.127
First IP 172.16.20.128
First IP (Decimal) 2886734976
Last IP 172.16.20.255
Last IP (Decimal) 2886735103
Total Host 128
CIDR
172.16.20.128/25
/24:
CIDR to IP Range
Result
CIDR Range 172.16.20.128/24
Netmask 255.255.255.0
Wildcard Bits 0.0.0.255
First IP 172.16.20.0
First IP (Decimal) 2886734848
Last IP 172.16.20.255
Last IP (Decimal) 2886735103
Total Host 256
CIDR
172.16.20.128/24
質問 # 59
You are configuring service accounts for an application that spans multiple projects. Virtual machines (VMs) running in the web-applications project need access to BigQuery datasets in crm-databases-proj. You want to follow Google-recommended practices to give access to the service account in the web- applications project. What should you do?
- A. Give bigquery.dataViewer role to crm-databases-proj and appropriate roles to web-applications.
- B. Give "project owner" role to crm-databases-proj and bigquery.dataViewer role to web- applications.
- C. Give "project owner" role to crm-databases-proj and the web-applications project.
- D. Give "project owner" for web-applications appropriate roles to crm-databases- proj
正解：A
解説：
You just need read access for DB at the project.
質問 # 60
You are working on a project named amazon-ace, and want to list all the roles assigned to users in the project. Which of the following gcloud command would you use?
- A. gcloud iam get-iam-policy amazon-ace
- B. gcloud projects get-iam-policy amazon-ace
- C. gcloud projects list amazon-ace
- D. gcloud iam list amazon-ace
正解：B
質問 # 61
You are operating a Google Kubernetes Engine (GKE) cluster for your company where different teams can run non-production workloads. Your Machine Learning (ML) team needs access to Nvidia Tesla P100 GPUs to train their models. You want to minimize effort and cost. What should you do?
- A. Add a new, GPU-enabled, node pool to the GKE cluster. Ask your ML team to add the cloud.google.com/gke -accelerator: nvidia-tesla-p100 nodeSelector to their pod specification.
- B. Recreate all the nodes of the GKE cluster to enable GPUs on all of them.
- C. Ask your ML team to add the "accelerator: gpu" annotation to their pod specification.
- D. Create your own Kubernetes cluster on top of Compute Engine with nodes that have GPUs. Dedicate this cluster to your ML team.
正解：A
解説：
This is the most optimal solution. Rather than recreating all nodes, you create a new node pool with GPU enabled. You then modify the pod specification to target particular GPU types by adding node selector to your workloads Pod specification. YOu still have a single cluster so you pay Kubernetes cluster management fee for just one cluster thus minimizing the cost.
Ref: https://cloud.google.com/kubernetes-engine/docs/how-to/gpus
Ref: https://cloud.google.com/kubernetes-engine/pricing
Example:
apiVersion: v1
kind: Pod
metadata:
name: my-gpu-pod
spec:
containers:
name: my-gpu-container
image: nvidia/cuda:10.0-runtime-ubuntu18.04
command: [/bin/bash]
resources:
limits:
nvidia.com/gpu: 2
nodeSelector:
cloud.google.com/gke-accelerator: nvidia-tesla-k80 # or nvidia-tesla-p100 or nvidia-tesla-p4 or nvidia-tesla-v100 or nvidia-tesla-t4
質問 # 62
You're working for a company as a Cloud engineer. You have a managed instance group for which the autoscaling is enabled if CPU utilization is 70%. Right now there are 4 instances available in this instance group. When you connect to one of the instance, you see that the CPU utilization is 75% and there is no new instance is started in the group. What could be the possible reason for not starting another instance here?
- A. None of the above
- B. Average CPU usage of the instance group is less than 70%
- C. Autoscaling is not active
- D. It will take 60 seconds to launch a new instance
正解：B
質問 # 63
You want to configure autohealing for network load balancing for a group of Compute Engine instances that run in multiple zones, using the fewest possible steps. You need to configure re-creation of VMs if they are unresponsive after 3 attempts of 10 seconds each. What should you do?
- A. Create an HTTP load balancer with a backend configuration that references an existing instance group.
Define a balancing mode and set the maximum RPS to 10. - B. Create an HTTP load balancer with a backend configuration that references an existing instance group. Set the health check to healthy (HTTP)
- C. Create a managed instance group. Set the Autohealing health check to healthy (HTTP)
- D. Create a managed instance group. Verify that the autoscaling setting is on.
正解：D
質問 # 64
You are given a project with a single virtual private cloud (VPC) and a single subnetwork in the us-central1 region. There is a Compute Engine instance hosting an application in this subnetwork. You need to deploy a new instance in the same project in the europe-west1 region. This new instance needs access to the application. You want to follow Google-recommended practices. What should you do?
- A. 1. Create a VPC and a subnetwork in europe-west1.
2. Expose the application with an internal load balancer.
3. Create the new instance in the new subnetwork and use the load balancer's address as the endpoint. - B. 1. Create a subnetwork in the same VPC, in europe-west1.
2. Use Cloud VPN to connect the two subnetworks.
3. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint. - C. 1. Create a VPC and a subnetwork in europe-west1.
2. Peer the 2 VPCs.
3. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint. - D. 1. Create a subnetwork in the same VPC, in europe-west1.
2. Create the new instance in the new subnetwork and use the first instance's private address as the endpoint.
正解：D
質問 # 65
You are hosting an application from Compute Engine virtual machines (VMs) in us-central1-a. You want to adjust your design to support the failure of a single Compute Engine zone, eliminate downtime, and minimize cost. What should you do?
- A. - Create a Managed Instance Group and specify us-central1-a as the zone.
-Configure the Health Check with a short Health Interval. - B. - Perform regular backups of your application.
-Create a Cloud Monitoring Alert and be notified if your application becomes unavailable.
-Restore from backups when notified. - C. - Create an HTTP(S) Load Balancer.
-Create one or more global forwarding rules to direct traffic to your VMs. - D. - Create Compute Engine resources in us-central1-b.
-Balance the load across both us-central1-a and us-central1-b.
正解：D
解説：
Choosing a region and zone You choose which region or zone hosts your resources, which controls where your data is stored and used. Choosing a region and zone is important for several reasons:
Handling failures
Distribute your resources across multiple zones and regions to tolerate outages. Google designs zones to be independent from each other: a zone usually has power, cooling, networking, and control planes that are isolated from other zones, and most single failure events will affect only a single zone. Thus, if a zone becomes unavailable, you can transfer traffic to another zone in the same region to keep your services running.
Similarly, if a region experiences any disturbances, you should have backup services running in a different region. For more information about distributing your resources and designing a robust system, see Designing Robust Systems. Decreased network latency To decrease network latency, you might want to choose a region or zone that is close to your point of service.https://cloud.google.com/compute/docs/regions-zones#choosing_a_region_and_zone
質問 # 66
You have set a firewall rule that will permit inbound connections to a VM instance named whizserver-2. You want to apply this rule only if there is not another rule that would deny that traffic. What priority would you give to this rule?
- A. 0
- B. 1
- C. 2
- D. 3
正解：D
質問 # 67
You want your application hosted on a VM to fetch metadata of that instance.
Which command will help you to fetch it?
- A. curl metadata.google.internal/computeMetadata/v1/
- B. curl metadata.google.internal/compute-metadata/v1/
- C. curl <instance-private-ip>/metadata/v1/
- D. curl internal.googleapi.com/computeMetadata/v1/
正解：A
質問 # 68
You have an application that runs on Compute Engine VM instances in a custom Virtual Private Cloud (VPC).
Your company's security policies only allow the use to internal IP addresses on VM instances and do not let VM instances connect to the internet. You need to ensure that the application can access a file hosted in a Cloud Storage bucket within your project. What should you do?
- A. Add slorage.googleapis.com to the list of restricted services in a VPC Service Controls perimeter and add your project to the list to protected projects.
- B. Enable Private Service Access on the Cloud Storage Bucket.
- C. Deploy a Cloud NAT instance and route the traffic to the dedicated IP address of the Cloud Storage bucket.
- D. Enable Private Google Access on the subnet within the custom VPC.
正解：D
質問 # 69
You want to send and consume Cloud Pub/Sub messages from your App Engine application. The Cloud Pub/Sub API is currently disabled. You will use a service account to authenticate your application to the API.
You want to make sure your application can use Cloud Pub/Sub. What should you do?
- A. Enable the Cloud Pub/Sub API in the API Library on the GCP Console.
- B. Use Deployment Manager to deploy your application. Rely on the automatic enablement of all APIs used by the application being deployed.
- C. Rely on the automatic enablement of the Cloud Pub/Sub API when the Service Account accesses it.
- D. Grant the App Engine Default service account the role of Cloud Pub/Sub Admin. Have your application enable the API on the first connection to Cloud Pub/Sub.
正解：A
質問 # 70
A company wants to build an application that stores images in a Cloud Storage bucket and wants to generate thumbnails as well as resize the images. They want to use a google managed service that can scale up and scale down to zero automatically with minimal effort. You have been asked to recommend a service. Which GCP service would you suggest?
- A. Google Compute Engine
- B. Cloud Functions
- C. Google App Engine
- D. Google Kubernetes Engine
正解：B
解説：
Text Description automatically generated with low confidence
Cloud Functions is Google Cloud's event-driven serverless compute platform. It automatically scales based on the load and requires no additional configuration. You pay only for the resources used.
Ref: https://cloud.google.com/functions
While all other options i.e. Google Compute Engine, Google Kubernetes Engine, Google App Engine support autoscaling, it needs to be configured explicitly based on the load and is not as trivial as the scale up or scale down offered by Google's cloud functions.
質問 # 71
A colleague handed over a Google Cloud project for you to maintain. As part of a security checkup, you want to review who has been granted the Project Owner role. What should you do?
- A. Use the gcloud projects get-iam-policy command to view the current role assignments.
- B. In the Google Cloud console, validate which SSH keys have been stored as project-wide keys.
- C. Navigate to Identity-Aware Proxy and check the permissions for these resources.
- D. Enable Audit logs on the 1AM & admin page for all resources, and validate the results.
正解：A
解説：
The gcloud projects get-iam-policy command displays the IAM policy for a project, which includes the roles and members assigned to those roles. The Project Owner role grants full access to all resources and actions in the project. By using this command, you can review who has been granted this role and make any necessary changes. Reference:
1: Associate Cloud Engineer Certification Exam Guide | Learn - Google Cloud
2: gcloud projects get-iam-policy | Cloud SDK Documentation | Google Cloud
3: Understanding roles | Cloud IAM Documentation | Google Cloud
質問 # 72
You need to grant access for three users so that they can view and edit table data on a Cloud Spanner instance.
What should you do?
- A. Run gcloud iam roles describe roles/spanner.viewer --project my-project. Add the users to the role.
- B. Run gcloud iam roles describe roles/spanner.databaseUser. Add the users to a new group. Add the group to the role.
- C. Run gcloud iam roles describe roles/spanner.databaseUser. Add the users to the role.
- D. Run gcloud iam roles describe roles/spanner.viewer --project my-project. Add the users to a new group.
Add the group to the role.
正解：C
質問 # 73
Your company uses Cloud Storage to store application backup files for disaster recovery purposes. You want to follow Google's recommended practices. Which storage option should you use?
- A. Coldline Storage
- B. Nearline Storage
- C. Multi-Regional Storage
- D. Regional Storage
正解：A
解説：
Reference:
https://cloud.google.com/storage/docs/storage-classes#nearline
質問 # 74
Your company runs its Linux workloads on Compute Engine instances. Your company will be working with a new operations partner that does not use Google Accounts. You need to grant access to the instances to your operations partner so they can maintain the installed tooling. What should you do?
- A. Enable Cloud IAP for the Compute Engine instances, and add the operations partner as a Cloud IAP Tunnel User.
- B. Ask the operations partner to generate SSH key pairs, and add the public keys to the VM instances.
- C. Set up Cloud VPN between your Google Cloud VPC and the internal network of the operations partner.
- D. Tag all the instances with the same network tag. Create a firewall rule in the VPC to grant TCP access on port 22 for traffic from the operations partner to instances with the network tag.
正解：B
解説：
Explanation
IAP controls access to your App Engine apps and Compute Engine VMs running on Google Cloud. It leverages user identity and the context of a request to determine if a user should be allowed access. IAP is a building block toward BeyondCorp, an enterprise security model that enables employees to work from untrusted networks without using a VPN.
By default, IAP uses Google identities and IAM. By leveraging Identity Platform instead, you can authenticate users with a wide range of external identity providers, such as:
Email/password
OAuth (Google, Facebook, Twitter, GitHub, Microsoft, etc.)
SAML
OIDC
Phone number
Custom
Anonymous
This is useful if your application is already using an external authentication system, and migrating your users to Google accounts is impractical.
https://cloud.google.com/iap/docs/using-tcp-forwarding#grant-permission
質問 # 75
You have been asked to set up the billing configuration for a new Google Cloud customer. Your customer wants to group resources that share common IAM policies. What should you do?
- A. Use labels to group resources that share common IAM policies
- B. Set up a proper project naming structure to group IAM policies
- C. Set up a proper billing account structure to group IAM policies
- D. Use folders to group resources that share common IAM policies
正解：D
解説：
Folders are nodes in the Cloud Platform Resource Hierarchy. A folder can contain projects, other folders, or a combination of both. Organizations can use folders to group projects under the organization node in a hierarchy. For example, your organization might contain multiple departments, each with its own set of Google Cloud resources. Folders allow you to group these resources on a per-department basis. Folders are used to group resources that share common IAM policies. While a folder can contain multiple folders or resources, a given folder or resource can have exactly one parent. https://cloud.google.com/resource-manager/docs/creating-managing-folders
質問 # 76
You need to migrate invoice documents stored on-premises to Cloud Storage. The documents have the following storage requirements:
* Documents must be kept for five years.
* Up to five revisions of the same invoice document must be stored, to allow for corrections.
* Documents older than 365 days should be moved to lower cost storage tiers.
You want to follow Google-recommended practices to minimize your operational and development costs.
What should you do?
- A. Enable retention policies on the bucket, and use Cloud Scheduler to invoke a Cloud Function to move or delete your documents based on their metadata.
- B. Enable object versioning on the bucket, use lifecycle conditions to change the storage class of the objects, set the number of versions, and delete old files.
- C. Enable retention policies on the bucket, use lifecycle rules to change the storage classes of the objects, set the number of versions, and delete old files.
- D. Enable object versioning on the bucket, and use Cloud Scheduler to invoke a Cloud Functions instance to move or delete your documents based on their metadata.
正解：B
解説：
https://cloud.google.com/storage/docs/object-versioning
質問 # 77
Your company is moving from an on-premises environment to Google Cloud Platform (GCP). You have multiple development teams that use Cassandra environments as backend databases. They all need a development environment that is isolated from other Cassandra instances. You want to move to GCP quickly and with minimal support effort. What should you do?
- A. 1. Advise your developers to go to Cloud Marketplace.
2. Ask the developers to launch a Cassandra image for their development work. - B. 1. Build an instruction guide to install Cassandra on GCP.
2. Make the instruction guide accessible to your developers. - C. 1. Build a Cassandra Compute Engine instance and take a snapshot of it.
2. Use the snapshot to create instances for your developers. - D. 1. Build a Cassandra Compute Engine instance and take a snapshot of it.
2.Upload the snapshot to Cloud Storage and make it accessible to your developers.
3.Build instructions to create a Compute Engine instance from the snapshot so that developers can do it themselves.
正解：D
質問 # 78
A VM instance is trying to read from a Cloud Storage bucket. IAM roles assigned to the VM service account allows the VM instance to read from the bucket. But the scopes assigned to the VM deny the reading bucket. What will happen when VM tries to read from the bucket?
- A. The application performing the read will drop the read operation
- B. The read will not execute as IAM roles and scopes both determine what operations will be performed
- C. The read will succeed because the most permissive permission is allowed
- D. The read operation will execute, but a message will be sent to the Stackdriver Logging
正解：B
質問 # 79
......
GoogleのAssociate Cloud Engineer認定試験は、Associate Cloud Engineerになりたいと考えている個人向けのプロフェッショナル資格です。この認定は、Google Cloud Platform上でアプリケーションの管理と展開、運用の監視、クラウドソリューションの設定に関するスキルと知識を検証するために設計されています。
Google Associate-Cloud-Engineerリアルな2025年最新の知能問題集模擬試験問題集：https://jp.fast2test.com/Associate-Cloud-Engineer-premium-file.html
Google Associate-Cloud-Engineerリアルな問題と100%カバーリアルな試験問題：https://drive.google.com/open?id=1RTB0i5g9G2rBvqb5tW8qGoO3aGfGGA46