GCP Associate Cloud Engineer - Cloud IAM, Compute Engine & Networking Flashcards

Question 1

What are VPC Subnets?

Accepted Answer

VPC Subnets are regional resources within a VPC network that define IP address ranges for your resources (e.g., VMs, GKE clusters). Each subnet is associated with a specific region and can span multiple zones within that region.

Question 2

What are the three types of IAM roles in GCP?

Accepted Answer

The three types of IAM roles in GCP are Primitive, Predefined, and Custom roles.

Question 3

Describe GCP Primitive Roles.

Accepted Answer

Primitive Roles are broad, project-level roles (Owner, Editor, Viewer, Billing Account User) that grant permissions across all services in a project. They are generally not recommended for fine-grained access control.

Question 4

Describe GCP Predefined Roles.

Accepted Answer

Predefined Roles are granular, service-specific roles created and maintained by Google (e.g., `compute.admin`, `storage.objectViewer`). They are recommended for implementing the principle of least privilege.

Question 5

Describe GCP Custom Roles.

Accepted Answer

Custom Roles are user-defined roles created to meet specific permission requirements not covered by predefined roles. They allow combining specific permissions to create highly tailored access policies.

Question 6

What is the principle of least privilege in IAM?

Accepted Answer

The principle of least privilege dictates that users and service accounts should only be granted the minimum necessary permissions to perform their job functions, thereby reducing potential security risks.

Question 7

How do you grant an IAM role to a user using `gcloud`?

Accepted Answer

To grant an IAM role, use the `gcloud projects add-iam-policy-binding` command:
```bash
gcloud projects add-iam-policy-binding PROJECT_ID \
    --member='user:USER_EMAIL' \
    --role='ROLE_ID'
```
Example: `gcloud projects add-iam-policy-binding my-project-123 --member='user:john.doe@example.com' --role='roles/compute.viewer'`

Question 8

What is a Google Compute Engine (GCE) instance?

Accepted Answer

A Google Compute Engine (GCE) instance is a virtual machine (VM) running on Google's infrastructure, offering various machine types, operating systems, and storage options. It's a core IaaS component.

Question 9

How do you create a GCE VM instance using `gcloud`?

Accepted Answer

To create a GCE VM instance, use the `gcloud compute instances create` command:
```bash
gcloud compute instances create INSTANCE_NAME \
    --zone=ZONE \
    --machine-type=MACHINE_TYPE \
    --image-family=IMAGE_FAMILY \
    --image-project=IMAGE_PROJECT
```
Example: `gcloud compute instances create my-web-server --zone=us-central1-a --machine-type=e2-medium --image-family=debian-11 --image-project=debian-cloud`

Question 10

What are instance templates in GCE?

Accepted Answer

Instance templates are global resources that define the configuration (machine type, image, disk, network, metadata, etc.) for VM instances. They are used for creating identical VMs or managed instance groups efficiently.

Question 11

What is a Managed Instance Group (MIG)?

Accepted Answer

A Managed Instance Group (MIG) is a collection of identical VM instances that can be managed as a single entity. MIGs offer features like autohealing, autoscaling, load balancing, and rolling updates, ensuring high availability and scalability.

Question 12

How do you SSH into a GCE instance using `gcloud`?

Accepted Answer

To SSH into a GCE instance, use the `gcloud compute ssh` command:
```bash
gcloud compute ssh INSTANCE_NAME --zone=ZONE
```
Example: `gcloud compute ssh my-web-server --zone=us-central1-a`

Question 13

What is a Virtual Private Cloud (VPC) network in GCP?

Accepted Answer

A Virtual Private Cloud (VPC) network in GCP is a global, software-defined network that provides networking functionality for your GCP resources. It includes IP addresses, routing, and firewall rules, enabling secure and isolated communication.

Question 14

Explain the purpose of VPC Firewall Rules.

Accepted Answer

VPC Firewall Rules control ingress (inbound) and egress (outbound) traffic to and from VM instances within a VPC network. They are based on specified protocols, ports, IP ranges, and target tags/service accounts, acting as a virtual firewall.

Question 15

How do you create a VPC firewall rule to allow HTTP traffic?

Accepted Answer

To create a VPC firewall rule allowing HTTP traffic, use the `gcloud compute firewall-rules create` command:
```bash
gcloud compute firewall-rules create allow-http \
    --network=NETWORK_NAME \
    --action=ALLOW \
    --rules=tcp:80 \
    --source-ranges=0.0.0.0/0 \
    --target-tags=http-server
```
This allows HTTP (port 80) from any IP to instances with the `http-server` tag.

Question 16

What is VPC Network Peering?

Accepted Answer

VPC Network Peering is a networking connection that allows two separate VPC networks (even in different projects or organizations) to communicate privately using internal IP addresses, as if they were on the same network.

Question 17

What are the benefits of VPC Network Peering?

Accepted Answer

Benefits of VPC Network Peering include private connectivity (traffic stays within Google's network), low latency, high bandwidth, and no egress costs for traffic between peered networks, making it ideal for microservices or shared services.

Question 18

What is Google Kubernetes Engine (GKE)?

Accepted Answer

Google Kubernetes Engine (GKE) is a managed service for deploying, managing, and scaling containerized applications using Kubernetes on Google Cloud. It abstracts away much of the underlying infrastructure management.

Question 19

What are the main components of a GKE cluster?

Accepted Answer

The main components of a GKE cluster are the **control plane** (master), which is managed by Google and runs Kubernetes services like the API server, scheduler, and controller manager, and **worker nodes** (VM instances), which run your containerized applications.

Question 20

How do you create a GKE cluster using `gcloud`?

Accepted Answer

To create a GKE cluster, use the `gcloud container clusters create` command:
```bash
gcloud container clusters create CLUSTER_NAME \
    --zone=ZONE \
    --num-nodes=NUM_NODES
```
Example: `gcloud container clusters create my-gke-cluster --zone=us-central1-a --num-nodes=2`

Question 21

How do you get credentials for a GKE cluster to use with `kubectl`?

Accepted Answer

To get credentials for a GKE cluster, allowing `kubectl` to interact with it, use the `gcloud container clusters get-credentials` command:
```bash
gcloud container clusters get-credentials CLUSTER_NAME --zone=ZONE
```
Example: `gcloud container clusters get-credentials my-gke-cluster --zone=us-central1-a`

Question 22

What is a Pod in Kubernetes?

Accepted Answer

A Pod is the smallest deployable unit in Kubernetes, representing a single instance of a running process in your cluster. A Pod can contain one or more tightly coupled containers that share network and storage resources.

Question 23

What is a Deployment in Kubernetes?

Accepted Answer

A Deployment is a Kubernetes object that manages a set of identical Pods, ensuring a specified number of replicas are running. It enables declarative updates to Pods and ReplicaSets, providing features like rolling updates and rollbacks.

Question 24

How do you deploy an application to GKE using `kubectl`?

Accepted Answer

To deploy an application to GKE using `kubectl`, you can use the `kubectl create deployment` command:
```bash
kubectl create deployment DEPLOYMENT_NAME --image=IMAGE_NAME
```
Example: `kubectl create deployment nginx-app --image=nginx:latest`

Question 25

How do you expose a GKE deployment to the internet?

Accepted Answer

To expose a GKE deployment to the internet, you can create a Service of type `LoadBalancer` using `kubectl`:
```bash
kubectl expose deployment DEPLOYMENT_NAME --type=LoadBalancer --port=80
```
This will provision a Google Cloud Load Balancer to route external traffic to your Pods.

GCP Associate Cloud Engineer - Cloud IAM, Compute Engine & Networking

Cards in this deck

Related Flashcard Sets

MONASH MTH2010 - Multivariable Calculus & Vector Calculus

SYDNEY CHEM1111 - Chemical Bonding, Thermochemistry & Chemical Equilibrium

JLPT N4 - Intermediate Japanese Grammar, Particles & High-Frequency Kanji

Classical Mechanics - Newtonian Dynamics & Lagrangian Mechanics