[2025年04月03日] Associate-Cloud-Engineerテストエンジンお試しセット、Associate-Cloud-Engineer問題集PDF
最新のGoogle Associate-Cloud-EngineerのPDFと問題集で（2025）無料試験問題解答
この試験では、クラウドソリューション環境のセットアップ、クラウドソリューションの展開と実装、アクセスとセキュリティの構成、クラウド操作の監視と記録、クラウドリソースの管理など、さまざまなトピックをカバーしています。これは、Google Cloud Technologiesとそのアプリケーションを強く理解する必要がある包括的な試験です。
Google Associate-Cloud-Engineer認定を獲得するには、候補者は、複数選択と複数選択の質問で構成される2時間のオンライン試験に合格する必要があります。この試験では、クラウドコンピューティング、ネットワーキング、セキュリティ、ストレージ、データベース管理など、さまざまなトピックをカバーしています。候補者は、コンピューティングエンジン、Kubernetesエンジン、アプリエンジン、クラウドストレージなど、Google Cloud Platformの主要なコンポーネントの理解を示す必要があります。この認定により、個人はGoogle Cloud Platformの専門知識を紹介し、業界の他のクラウドプロフェッショナルの中で際立っています。
質問 # 24
A Solutions Architect needs to design a centralized logging solution for a group of web applications running on Amazon EC2 instances. The solution requires minimal development effort due to budget constraints.
Which of the following should the Architect recommend?
- A. Install and configure Amazon CloudWatch Logs agent in the Amazon EC2 instances.
- B. Enable AWS CloudTrail to map all API calls invoked by the applications.
- C. Create a crontab job script in each instance to push the logs regularly to Amazon S3.
- D. Enable Amazon CloudWatch Events in the AWS Management Console.
正解：A
質問 # 25
You have an application that looks for its licensing server on the IP 10.0.3.21. You need to deploy the licensing server on Compute Engine. You do not want to change the configuration of the application and want the application to be able to reach the licensing server. What should you do?
- A. Reserve the IP 10.0.3.21 as a static public IP address using gcloud and assign it to the licensing server.
- B. Start the licensing server with an automatic ephemeral IP address, and then promote it to a static internal IP address.
- C. Reserve the IP 10.0.3.21 as a static internal IP address using gcloud and assign it to the licensing server.
- D. Use the IP 10.0.3.21 as a custom ephemeral IP address and assign it to the licensing server.
正解：C
解説：
IP 10.0.3.21 is internal by default, and to ensure that it will be static non-changing it should be selected as static internal ip address.
質問 # 26
You recently discovered that your developers are using many service account keys during their development process. While you work on a long term improvement, you need to quickly implement a process to enforce short-lived service account credentials in your company. You have the following requirements:
* All service accounts that require a key should be created in a centralized project called pj-sa.
* Service account keys should only be valid for one day.
You need a Google-recommended solution that minimizes cost. What should you do?
- A. Enforce an org policy constraint allowing the lifetime of service account keys to be 24 hours. Enforce an org policy constraint denying service account key creation with an exception on pj-sa.
- B. Enforce a DENY org policy constraint over the lifetime of service account keys for 24 hours. Disable attachment of service accounts to resources in all projects with an exception to pj-sa.
- C. Implement a Kubernetes Cronjob to rotate all service account keys periodically. Disable attachment of service accounts to resources in all projects with an exception to pj-sa.
- D. Implement a Cloud Run job to rotate all service account keys periodically in pj-sa. Enforce an org policy to deny service account key creation with an exception to pj-sa.
正解：D
解説：
According to the Google Cloud documentation, you can use organization policy constraints to control the creation and expiration of service account keys. The constraints are:
* constraints/iam.allowServiceAccountKeyCreation: This constraint allows you to specify which projects or folders can create service account keys. You can set the value to true or false, or use a condition to apply the constraint to specific service accounts. By setting this constraint to false for the organization and adding an exception for the pj-sa project, you can prevent developers from creating service account keys in other projects.
* constraints/iam.serviceAccountKeyMaxLifetime: This constraint allows you to specify the maximum lifetime of service account keys. You can set the value to a duration in seconds, such as 86400 for one day. By setting this constraint to 86400 for the organization, you can ensure that all service account keys expire after one day.
These constraints are recommended by Google Cloud as best practices to minimize the risk of service account key misuse or compromise. They also help you reduce the cost of managing service account keys, as you do not need to implement a custom solution to rotate or delete them.
References:
* 1: Associate Cloud Engineer Certification Exam Guide | Learn - Google Cloud
* 5: Create and delete service account keys - Google Cloud
* Organization policy constraints for service accounts
質問 # 27
You want to select and configure a cost-effective solution for relational data on Google Cloud Platform. You are working with a small set of operational data in one geographic location. You need to support point- in-time recovery. What should you do?
- A. Select Cloud SQL (MySQL). Verify that the enable binary logging option is selected.
- B. Select Cloud Spanner. Set up your instance as multi-regional.
- C. Select Cloud Spanner. Set up your instance with 2 nodes.
- D. Select Cloud SQL (MySQL). Select the create failover replicas option.
正解：A
解説：
You must enable binary logging to use point-in-time recovery. Enabling binary logging causes a slight reduction in write performance. https://cloud.google.com/sql/docs/mysql/backup- recovery/backups
質問 # 28
You need to create a copy of a custom Compute Engine virtual machine (VM) to facilitate an expected increase in application traffic due to a business acquisition. What should you do?
- A. Create a custom Compute Engine image from a snapshot.
Create your instances from that image. - B. Create a Compute Engine snapshot of your base VM.
Create your images from that snapshot. - C. Create a Compute Engine snapshot of your base VM.
Create your instances from that snapshot. - D. Create a custom Compute Engine image from a snapshot.
Create your images from that image.
正解：A
解説：
A custom image belongs only to your project. To create an instance with a custom image, you must first have a custom image.
Reference: https://cloud.google.com/compute/docs/instances/create-start-instance
質問 # 29
You have a web application deployed as a managed instance group. You have a new version of the application to gradually deploy. Your web application is currently receiving live web traffic. You want to ensure that the available capacity does not decrease during the deployment. What should you do?
- A. Create a new instance template with the new application version. Update the existing managed instance group with the new instance template. Delete the instances in the managed instance group to allow the managed instance group to recreate the instance using the new instance template.
- B. Create a new managed instance group with an updated instance template. Add the group to the backend service for the load balancer. When all instances in the new managed instance group are healthy, delete the old managed instance group.
- C. Perform a rolling-action start-update with maxSurge set to 0 and maxUnavailable set to 1.
- D. Perform a rolling-action start-update with maxSurge set to 1 and maxUnavailable set to 0.
正解：D
解説：
https://cloud.google.com/compute/docs/instance-groups/rolling-out-updates-to-managed-instance-groups#max_u
質問 # 30
You are hosting an application from Compute Engine virtual machines (VMs) in us-central1-a. You want to adjust your design to support the failure of a single Compute Engine zone, eliminate downtime, and minimize cost. What should you do?
- A. - Create Compute Engine resources in us-central1-b.
-Balance the load across both us-central1-a and us-central1-b. - B. - Create a Managed Instance Group and specify us-central1-a as the zone.
-Configure the Health Check with a short Health Interval. - C. - Perform regular backups of your application.
-Create a Cloud Monitoring Alert and be notified if your application becomes unavailable.
-Restore from backups when notified. - D. - Create an HTTP(S) Load Balancer.
-Create one or more global forwarding rules to direct traffic to your VMs.
正解：A
解説：
Choosing a region and zone You choose which region or zone hosts your resources, which controls where your data is stored and used. Choosing a region and zone is important for several reasons:
Handling failures
Distribute your resources across multiple zones and regions to tolerate outages. Google designs zones to be independent from each other: a zone usually has power, cooling, networking, and control planes that are isolated from other zones, and most single failure events will affect only a single zone. Thus, if a zone becomes unavailable, you can transfer traffic to another zone in the same region to keep your services running.
Similarly, if a region experiences any disturbances, you should have backup services running in a different region. For more information about distributing your resources and designing a robust system, see Designing Robust Systems. Decreased network latency To decrease network latency, you might want to choose a region or zone that is close to your point of service.
https://cloud.google.com/compute/docs/regions-zones#choosing_a_region_and_zone
質問 # 31
You are about to deploy a new Enterprise Resource Planning (ERP) system on Google Cloud.
The application holds the full database in-memory for fast data access, and you need to configure the most appropriate resources on Google Cloud for this application. What should you do?
- A. Provision Compute Engine instances with local SSDs attached.
- B. Provision Compute Engine instances with M1 machine type.
- C. Provision Compute Engine instances with GPUs attached.
- D. Provision preemptible Compute Engine instances.
正解：B
解説：
M1 machine type is the one of two Memory-Optimized machine types in GCP.
https://cloud.google.com/compute/docs/machine-types
質問 # 32
You want to add a new auditor to a Google Cloud Platform project. The auditor should be allowed to read, but not modify, all project items.
How should you configure the auditor's permissions?
- A. Select the built-in IAM service Viewer role. Add the user's account to this role.
- B. Create a custom role with view-only project permissions. Add the user's account to the custom role.
- C. Select the built-in IAM project Viewer role. Add the user's account to this role.
- D. Create a custom role with view-only service permissions. Add the user's account to the custom role.
正解：C
解説：
roles/Viewer role provides access to all resources under the projects but do not alter the state of these resources.
https://cloud.google.com/resource-manager/docs/access-control-proj
質問 # 33
Your company has workloads running on Compute Engine and on-premises. The Google Cloud Virtual Private Cloud (VPC) is connected to your WAN over a Virtual Private Network (VPN). You need to deploy a new Compute Engine instance and ensure that no public Internet traffic can be routed to it. What should you do?
- A. Create the instance with Private Google Access enabled.
- B. Create the instance without a public IP address.
- C. Create a route on the VPC to route all traffic to the instance over the VPN tunnel.
- D. Create a deny-all egress firewall rule on the VPC network.
正解：B
解説：
Explanation
VMs cannot communicate over the internet without a public IP address. Private Google Access permits access to Google APIs and services in Google's production infrastructure.
https://cloud.google.com/vpc/docs/private-google-access
質問 # 34
You create a Deployment with 2 replicas in a Google Kubernetes Engine cluster that has a single preemptible node pool. After a few minutes, you use kubectl to examine the status of your Pod and observe that one of them is still in Pending status:
What is the most likely cause?
- A. The node pool is configured with a service account that does not have permission to pull the container image used by the pending Pod.
- B. The pending Pod was originally scheduled on a node that has been preempted between the creation of the Deployment and your verification of the Pods' status. It is currently being rescheduled on a new node.
- C. The pending Pod's resource requests are too large to fit on a single node of the cluster.
- D. Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod.
正解：D
解説：
* The pending Pods resource requests are too large to fit on a single node of the cluster. Too many Pods are already running in the cluster, and there are not enough resources left to schedule the pending Pod. is the right answer.
* When you have a deployment with some pods in running and other pods in the pending state, more often than not it is a problem with resources on the nodes. Heres a sample output of this use case. We see that the problem is with insufficient CPU on the Kubernetes nodes so we have to either enable auto-scaling or manually scale up the nodes.
質問 # 35
You are building a pipeline to process time-series data.
Which Google Cloud Platform services should you put in boxes 1,2,3, and 4?
- A. Cloud Pub/Sub, Cloud Dataflow, Cloud Datastore, BigQuery
- B. Cloud Pub/Sub, Cloud Dataflow, Cloud Bigtable, BigQuery
- C. Cloud Pub/Sub, Cloud Storage, BigQuery, Cloud Bigtable
- D. Firebase Messages, Cloud Pub/Sub, Cloud Spanner, BigQuery
正解：B
解説：
Correct answer is D as Cloud Pub/Sub for data ingestion, Dataflow for data handling and transformation, Bigtable for storage to provide low latency data access and BigQuery for analytics Whenever we want to process timeseries data look for BigTable.
Also you want to perform analystics in Box 4 ..look for BigQuery
質問 # 36
You have a Compute Engine instance hosting a production application. You want to receive an email if the instance consumes more than 90% of its CPU resources for more than 15 minutes. You want to use Google services. What should you do?
- A. 1. Create a consumer Gmail account.
2.Write a script that monitors the CPU usage.
3.When the CPU usage exceeds the threshold, have that script send an email using the Gmail account and smtp.gmail.com on port 25 as SMTP server. - B. 1. Create a Stackdriver Workspace, and associate your Google Cloud Platform (GCP) project with it.
2.Create an Alerting Policy in Stackdriver that uses the threshold as a trigger condition.
3.Configure your email address in the notification channel. - C. 1. Create a Stackdriver Workspace, and associate your GCP project with it.
2.Write a script that monitors the CPU usage and sends it as a custom metric to Stackdriver.
3.Create an uptime check for the instance in Stackdriver. - D. 1. In Stackdriver Logging, create a logs-based metric to extract the CPU usage by using this regular expression: CPU Usage: ([0-9] {1,3}) %
2.In Stackdriver Monitoring, create an Alerting Policy based on this metric.
3.Configure your email address in the notification channel.
正解：B
解説：
Specifying conditions for alerting policies This page describes how to specify conditions for alerting policies.
The conditions for an alerting policy define what is monitored and when to trigger an alert. For example, suppose you want to define an alerting policy that emails you if the CPU utilization of a Compute Engine VM instance is above 80% for more than 3 minutes. You use the conditions dialog to specify that you want to monitor the CPU utilization of a Compute Engine VM instance, and that you want an alerting policy to trigger when that utilization is above 80% for 3 minutes. https://cloud.google.com/monitoring/alerts/ui-conditions-ga
https://cloud.google.com/monitoring/alerts/using-alerting-ui https://cloud.google.com/monitoring/support
/notification-options
質問 # 37
You have been asked to create robust Virtual Private Network (VPN) connectivity between a new Virtual Private Cloud (VPC) and a remote site. Key requirements include dynamic routing, a shared address space of
10.19.0.1/22, and no overprovisioning of tunnels during a failover event. You want to follow Google-recommended practices to set up a high availability Cloud VPN. What should you do?
- A. Use a custom mode VPC network, configure static routes, and use active/passive routing
- B. Use an automatic mode VPC network, configure static routes, and use active/active routing
- C. Use a custom mode VPC network use Cloud Router border gateway protocol (86P) routes, and use active/passive routing
- D. Use an automatic mode VPC network, use Cloud Router border gateway protocol (BGP) routes and configure policy-based routing
正解：D
質問 # 38
Your security team has asked you to present them some numbers based on the logs that are exported to BigQuery. Due to the team structure, your manager has asked you to determine how much the query will cost.
What's the best way to determine the cost?
- A. Create the query and use the dry-run option to determine the amount of data read, then use the price calculator to determine the cost.
- B. Use the BigQuery index viewer to determine how many records you'll be reading.
- C. It's not possible to estimate the cost of a query.
- D. Create the query and execute the query in "cost estimation mode"
正解：A
質問 # 39
Your management has asked an external auditor to review all the resources in a specific project. The security team has enabled the Organization Policy called Domain Restricted Sharing on the organization node by specifying only your Cloud Identity domain. You want the auditor to only be able to view, but not modify, the resources in that project. What should you do?
- A. Create a temporary account for the auditor in Cloud Identity, and give that account the Viewer role on the project.
- B. Ask the auditor for their Google account, and give them the Security Reviewer role on the project.
- C. Ask the auditor for their Google account, and give them the Viewer role on the project.
- D. Create a temporary account for the auditor in Cloud Identity, and give that account the Security Reviewer role on the project.
正解：A
解説：
Using primitive roles The following table lists the primitive roles that you can grant to access a project, the description of what the role does, and the permissions bundled within that role. Avoid using primitive roles except when absolutely necessary. These roles are very powerful, and include a large number of permissions across all Google Cloud services. For more details on when you should use primitive roles, see the Identity and Access Management FAQ. IAM predefined roles are much more granular, and allow you to carefully manage the set of permissions that your users have access to. See Understanding Roles for a list of roles that can be granted at the project level. Creating custom roles can further increase the control you have over user permissions. https://cloud.google.com/resource-manager/docs/access-control-proj#using_primitive_roles
https://cloud.google.com/iam/docs/understanding-custom-roles
質問 # 40
Your organization is a financial company that needs to store audit log files for 3 years. Your organization has hundreds of Google Cloud projects. You need to implement a cost-effective approach for log file retention.
What should you do?
- A. Export these logs to Cloud Pub/Sub and write a Cloud Dataflow pipeline to store logs to Cloud SQL.
- B. Create an export to the sink that saves logs from Cloud Audit to BigQuery.
- C. Write a custom script that uses logging API to copy the logs from Stackdriver logs to BigQuery.
- D. Create an export to the sink that saves logs from Cloud Audit to a Coldline Storage bucket.
正解：B
質問 # 41
You've created a Pod using the kubectl run command. Now you're attempting to remove the Pod, and it keeps being recreated. Which command might help you as you attempt to remove the pod?
- A. kubectl get secrets
- B. kubectl get deployments
- C. gcloud container describe pods
- D. kubectl get pods
正解：B
質問 # 42
You have a VM instance running in a VPC with single-stack subnets. You need to ensure that the VM instance has a fixed IP address so that other services hosted in the same VPC can communicate with the VM. You want to follow Google-recommended practices while minimizing cost. What should you do?
- A. Promote the existing IP address of the VM to become a static internal IP address.
- B. Reserve a new static external IPv6 address and assign the new IP address to the VM.
- C. Promote the existing IP address of the VM to become a static external IP address.
- D. Reserve a new static external IP address and assign the new IP address to the VM.
正解：C
質問 # 43
......
あなたを合格させるGoogle Cloud Certified Associate-Cloud-Engineer試験問題集で2025年04月03日には290問あります：https://jp.fast2test.com/Associate-Cloud-Engineer-premium-file.html
Associate-Cloud-Engineer無料試験学習ガイド！（更新された290問あります)：https://drive.google.com/open?id=19YvprlWXXSPkFpKrvxzkgfqPBs6xYLv9