You deployed a new application inside your Google Kubernetes Engine cluster using the YAML file specified below.

You check the status of the deployed pods and notice that one of them is still in PENDING status:

You want to find out why the pod is stuck in pending status. What should you do?

• A.Review details of the myapp-service Service object and check for error messages.
• B.Review details of the myapp-deploymentDeployment object and check for error messages.
• C.Review details of myapp-deployment-58ddbbb995-lp86mPod and check for warning messages.
• D.View logs of the container in myapp-deployment-58ddbbb995-lp86mpod and check for warning messages.

Comment: *

Name: *

Email: *

Verification: *

You're deploying an application to a Compute Engine instance, and it's going to need to make calls to read from Cloud Storage and Bigtable. You want to make sure you're following the principle of least privilege. What's the easiest way to ensure the code can authenticate to the required Google Cloud APIs?

• A.Register the application with the Binary Registration Service and apply the required roles.
• B.Create a new user account with the required roles. Store the credentials in Cloud Key Management Service and download them to the instance in code.
• C.Use the default Compute Engine service account and set its scopes. Let the code find the default service account using "Application Default Credentials".
• D.Create a new service account and key with the required limited permissions. Set the instance to use the new service account. Edit the code to use the service account key.

Comment: *

Name: *

Email: *

Verification: *

A VM instance is trying to read from a Cloud Storage bucket. IAM roles assigned to the VM service account allows the VM instance to read from the bucket. But the scopes assigned to the VM deny the reading bucket. What will happen when VM tries to read from the bucket?

• A.The read operation will execute, but a message will be sent to the Stackdriver Logging
• B.The read will not execute as IAM roles and scopes both determine what operations will be performed
• C.The read will succeed because the most permissive permission is allowed
• D.The application performing the read will drop the read operation

Comment: *

Name: *

Email: *

Verification: *

An application generates daily reports in a Compute Engine virtual machine (VM). The VM is in the project corp-iot-insights. Your team operates only in the project corp-aggregate-reports and needs a copy of the daily exports in the bucket corp-aggregate-reports-storage. You want to configure access so that the daily reports from the VM are available in the bucket corp-aggregate- reports-storage and use as few steps as possible while following Google-recommended practices. What should you do?

• A.Move both projects under the same folder.
• B.Grant the VM Service Account the role Storage Object Creator on corp-aggregate-reports- storage.
• C.Create a Shared VPC network between both projects.
  Grant the VM Service Account the role Storage Object Creator on corp-iot-insights.
• D.Make corp-aggregate-reports-storage public and create a folder with a pseudo-randomized suffix name.
  Share the folder with the IoT team.

Comment: *

Name: *

Email: *

Verification: *

You are using Google Kubernetes Engine with autoscaling enabled to host a new application.
You want to expose this new application to the public, using HTTPS on a public IP address. What should you do?

• A.Create a Kubernetes Service of type NodePort for your application, and a Kubernetes Ingress to expose this Service via a Cloud Load Balancer.
• B.Create a Kubernetes Service of type ClusterIP for your application. Configure the public DNS name of your application using the IP of this Service.
• C.Create a Kubernetes Service of type NodePort to expose the application on port 443 of each node of the Kubernetes cluster. Configure the public DNS name of your application with the IP of every node of the cluster to achieve load-balancing.
• D.Create a HAProxy pod in the cluster to load-balance the traffic to all the pods of the application.
  Forward the public traffic to HAProxy with an iptable rule. Configure the DNS name of your application using the public IP of the node HAProxy is running on.

Comment: *

Name: *

Email: *

Verification: *