Option 4 is the correct answer. Run the command `gcloud container images list --repository [repository name]` to list the metadata about existing container images in the specified repository. The repository you specify must be hosted by Google Container Registry.

Option 1 is incorrect. gcloud container show images is not a valid command. Run list instead of show.

Option 2 is incorrect. gcloud container list images is not a valid command. list must be written after images.

Option 3 is incorrect. gcloud container metadata list is not a valid command. You can display the metadata for an image by writing images list instead of metadata.

【reference】 https://cloud.google.com/sdk/gcloud/reference/container/images/list

Option 4 is the correct answer. Roles / owner is automatically assigned when you create a new project. This is a role that grants project owner rights. The user with this role has all editorial rights to the project as the owner of the project. In addition, you have the authority to manage the project and the permissions and roles of all resources within the project, as well as the authority to set billing information for the project. Basically, the user who created the project can use the project as the project owner, but it is also possible to additionally grant permissions to other users.

Option 1 is incorrect. roles / viewer is the authority as a viewer. Grants the required permissions for state-independent read-only actions, such as viewing existing resources and data (but not modifiable).

Option 2 is incorrect. roles / editor is the authority as an editor. You can perform actions that change state in addition to all viewer permissions.

Option 3 is incorrect. There is no role called roles / publisher.

【reference】 https://cloud.google.com/resource-manager/docs/access-control-proj

Option 3 is the correct answer. The data stored in the storage is written to the server in the cloud storage system based on the file name. In this case, similar file names are being written to the same server. Uploading a large number of files with similar names, such as assigning a user ID as a date, will concentrate the workload on a single server and reduce performance. This is called a hotspot. When writing data to Cloud Storage, you may be concentrating on the same server, causing hotspots.

Option 1 is incorrect. There is no fast upload feature in Cloud Storage.

Option 2 is incorrect. Multipart upload is an upload function used when uploading a large file. This makes it easier to upload data with large file sizes, but it is not a reason for upload delays for data with normal file sizes.

Option 4 is incorrect. One of the possible causes is the overhead of the encryption process. However, this is less of an impact than the concentration of workload on a single server due to filename issues, so it is not the main cause.

【reference】 https://cloud.google.com/storage/docs/best-practices

Option 3 is correct because it uses a predefined role to provide view access to BigQuery for the group of auditors. Auditors can be added or deleted from the group if job responsibilities change.

Option 1 is not correct because Google recommended practice is to assign IAM roles to groups, not individuals. Groups are easier to manage individual users and they provide high level visibility into roles and permissions.

Option 2 is not correct because it uses a basic role to give auditors view access to all resources on the project.

Option 4 is not correct because using a predefined role can accomplish the goal and requires less maintenance.

reference:

https://cloud.google.com/iam/docs/understanding-roles

Option 3 is the correct answer. Cloud Key Management Service is a single centralized cloud service. You can use it to create, import, and manage encryption keys and perform encryption operations. To set up encryption with Cloud Key Management Service, enable the Google Cloud Key Management Service (KMS) API and implement billing settings. This allows you to perform encryption. Clients can access the Cloud Key Management Service via the REST API.

【reference】 https://cloud.google.com/kms/docs/accessing-the-api

Option 1 is the correct answer. roles / appengine.deployer has the following execution permissions:

--List all services / versions / instances

--View all settings for application / service / version / instance

--Display runtime indicators such as resource usage / load information / error information

--Create, list and Delete version Therefore, by granting roles / appengine.deployer, you can read the application configuration and setting information and remove the version.

Option 2 is incorrect. The roles / appengine.deployer permissions do not have permission to deploy the new version. In order to deploy the new version, you also need to grant roles such as service account user.

Option 3 is incorrect. You cannot change the application's configuration or settings with the roles / appengine.deployer permissions.

Option 4 is incorrect. You cannot update the version of your application with the roles / appengine.deployer permissions.

【reference】

https://cloud.google.com/appengine/docs/standard/php-gen2/roles

Option 1 is the correct answer. There is no VPC ID parameter in the firewall rule. Firewall rules can set the direction of traffic, the action to take when matched, the protocol, and so on. This allows communication of a specific protocol to a specific target.

Each firewall rule consists of the following configuration components:

■ Direction of connection Ingress (inward) rules apply to inbound connections from the specified source to your Google Cloud target. Egress (outward) rules apply to connections from the target to the specified destination.

■ Numerical priority Used to determine if the rule applies. Only the highest priority (lowest priority number) rule with other components matching the traffic applies. Low priority, conflicting rules are ignored.

■ Action when matching (allow or deny) The rule determines whether the connection is allowed or blocked.

■ Firewall rule application status You can enable or disable the firewall rule without deleting it.

■ Target Defines the instance to which the rule applies (GKE cluster, App Engine flexible environment instance, and so on).

■ Source filter for up (inward) rules or destination filter for down (outward) rules.

■ Protocols (TCP, UDP, ICMP, etc.) and ports.

■ Boolean log options Log the connections that match the rule in Cloud Logging.

【reference】 https://cloud.google.com/vpc/docs/firewalls

Option 2 is the correct answer. / 22 will generate 1,022 available IP addresses. This means that 1000 IP addresses are available and you can minimize unused IP addresses.

Option 1 is incorrect. / 21 will generate 2048 available IP addresses. This is too many IP addresses to minimize unused IP addresses.

Option 3 is incorrect. / 23 will generate 512 available IP addresses, so you will run out of IP addresses.

Option 4 is incorrect. / 24 will generate 256 available IP addresses, so you will run out of IP addresses.

Option 1 is the correct answer. Parallel composite upload is one way to upload large files to Cloud Storage. With this upload method, a file is split into up to 32 chunks and uploaded in parallel to a temporary object. Temporary objects are deleted when the final object is created from these objects.

Python users who download objects must be able to use google-crc32c or crcmod to use parallel composite uploads. Or download the object but gsutil requires the user to be able to use crcmod. Therefore, using gsutil to enable parallel composite uploads is the correct answer.

Options 2 and 4 are incorrect. You cannot enable parallel composite upload in console operation. Command operation by CLI is required.

Option 3 is incorrect. The correct answer is to use the gsutil command instead of the gcloud command to enable parallel composite uploads.

【reference】 https://cloud.google.com/storage/docs/uploads-downloads#parallel-composite-uploads

Option 3 is the correct answer. Use a URL map to set up a load balancer to route requests to different backend services depending on the URL specified by the user. URL maps for load balancers allow requests to be routed to different backend services, depending on the URL specified by the user. URL maps can perform L7-based traffic distribution processing based on URLs. The Google Cloud HTTP (S) load balancer and Traffic Director use Google Cloud configuration resources called "URL maps" to route requests to back-end services or back-end buckets. An external HTTP (S) load balancer can use a single URL map to route requests to different destinations based on the rules configured in the URL map.

https://example.com/video

Requests are sent to one backend service.

https://example.com/audio

Request is sent to another backend service.

https://example.com/images

Requests are sent to your Cloud Storage backend bucket. Requests for other host and path combinations are sent to the default backend service. There are also two types of URL map resources: global and region. The type of resource you use depends on your product's load balancing scheme.

Option 1 is incorrect. For the port number, communication permission can be set according to the protocol according to the port number, but routing according to the URL cannot be performed.

Option 2 is incorrect. The IP address is used to specify the traffic distribution of the load balancer, but this alone cannot be used for routing according to the URL.

Option 4 is incorrect. There is no setting that uses the route number in the setting of the load balancer.

【reference】 https://cloud.google.com/load-balancing/docs/url-map