6.3. Practice Questions
Question 1 (Multiple Choice): A company wants every new VM created in the production folder to be blocked from ever having a public IP address, without relying on individual teams remembering to configure this per project.
- A. Set an IAM Deny policy on each project
- B. Apply an Organization Policy constraint at the
productionfolder level - C. Configure a custom IAM role restricting external IP creation
- D. Set a firewall rule denying inbound traffic on all projects
Correct Answer: B. Organization Policy constraints govern what configurations are allowed at all, regardless of IAM permissions, and applying it at the Folder level means it's inherited by every current and future project inside — exactly the "without relying on individual teams" requirement. IAM (A, C) controls who can act, not what configurations are structurally permitted, and firewall rules (D) control traffic, not IP address assignment.
Question 2 (Multiple Select): Which two of the following are true about Google Cloud VPC networks? (Choose two.)
- A. A VPC network is a regional resource
- B. A VPC network is a global resource
- C. Subnets within a VPC are regional resources
- D. Subnets within a VPC are global resources
Correct Answer: B, C. The VPC network itself is global, while its subnets are regional — this is one of the most heavily tested facts in the networking domain, and it directly contradicts how VPC scope works in some other cloud platforms.
Question 3 (Multiple Choice): An application needs to authenticate to Google Cloud APIs from a GKE Pod without embedding any credentials inside the container image.
- A. Store a service account key as a Kubernetes Secret
- B. Bind a Kubernetes service account to a Google Cloud service account via Workload Identity
- C. Grant the Editor role to the GKE default node service account
- D. Hardcode an API key in the application's environment variables
Correct Answer: B. Binding via Workload Identity lets the Pod authenticate as a Google Cloud service account without any downloaded key ever being present in the container or cluster — the least-privilege, key-free pattern the exam favors. A, C, and D all involve exactly the long-lived-credential exposure this pattern exists to eliminate.
Question 4 (Multiple Choice): A team needs to retain audit logs for three years to satisfy a compliance requirement, well beyond Cloud Logging's default retention.
- A. Increase the retention setting on the
_Defaultlog bucket indefinitely - B. Export the logs to BigQuery or Cloud Storage
- C. Enable Cloud Trace for long-term log storage
- D. Nothing is needed — Cloud Logging retains all logs indefinitely by default
Correct Answer: B. Default log buckets have finite retention (30 days for _Default); satisfying long-term retention requirements requires exporting to BigQuery or Cloud Storage. Cloud Trace (C) is a latency-diagnostic tool, unrelated to log retention.
Question 5 (Multiple Choice): A batch data-processing workload is fault-tolerant, can be interrupted and restarted without issue, and needs to minimize compute cost above all else.
- A. Standard Compute Engine VMs
- B. Spot VM instances
- C. A GKE Autopilot cluster
- D. Cloud Run with a minimum instance count of 1
Correct Answer: B. Spot VMs offer the steepest discount in exchange for possible reclamation with short notice — an acceptable tradeoff for a fault-tolerant, restartable batch workload, and the cheapest option among those listed for exactly this use case.
Work through these five questions without looking at the answers first, then check your reasoning against the rationale given — not just whether you picked the right letter. If your reasoning process didn't match the explanation even when your answer was correct, that's worth revisiting the relevant subsection before exam day.
