Free GCP-ACE flashcards

How do Cloud Run and Compute Engine differ in who maintains the host operating system?

Cloud Run is a fully managed platform where Google patches and maintains the underlying infrastructure and OS. Compute Engine is infrastructure-as-a-service: it hands you a VM whose guest operating system you must patch and maintain yourself.

Does Cloud Run make you size and patch worker VMs like Compute Engine, just billed per request?

No. Fully managed Cloud Run exposes no worker VMs for you to size or patch, so the operational overhead is not the same as Compute Engine. Google operates the hosts and you manage only the container image and its configuration.

In a GKE Standard cluster, what does a node pool provide, and how does it support mixed hardware such as GPU and general-purpose nodes?

A node pool is a subset of nodes that all share one configuration, including machine type. A cluster can hold several pools, so a GPU pool and a general-purpose pool can coexist side by side and the scheduler places each workload on suitable nodes.

True or false: a node pool is a single Compute Engine VM whose machine type every workload must share, so mixed hardware means resizing that one VM.

False. A node is backed by a VM, but a node pool is a set of nodes rather than one VM, and a cluster can hold several pools, so mixed hardware is served by separate pools instead of resizing a single VM.

If a boolean organisation policy is enforced on a folder, is it enforced on a project created inside that folder afterwards?

Yes. Resource Manager computes an effective policy for each node by combining its own policy with those inherited from ancestor folders and the organisation, so a folder-level constraint reaches every descendant project, including ones created later.

Do organisation policies attach only to the organisation and folders, stopping above the project level so they never reach a project?

It sounds plausible if you assume policies protect only higher tiers, but organisation policies attach to and are enforced at organisation, folder and project nodes alike, so the folder constraint does reach the project.

How do the three IAM role types (basic, predefined, and custom) differ from one another?

Basic roles (Owner, Editor, Viewer) grant broad legacy access. Predefined roles are granular, Google-maintained permission sets scoped to a particular service. Custom roles let an administrator combine exactly the permissions a task requires.

Are the basic IAM roles the granular per-service roles and Owner, Editor, Viewer the predefined ones?

No, this swaps the definitions. Owner, Editor, and Viewer are the basic roles, while the granular per-service roles maintained by Google are the predefined ones.