Google Updated Associate-Cloud-Engineer Exam Questions and Answers by bernie

https://cloud.google.com/vpc/docs/vpc-peering

The Vertical Pod Autoscaler (VPA) in Kubernetes automatically adjusts the CPU and memory requests and limits of the containers within a pod based on historical and real-time resource usage. In this scenario, where a single-replica stateful application needs more CPU during peak times, VPA can dynamically increase the CPU allocated to the pod when needed and potentially decrease it during off-peak periods to optimize resource utilization and cost efficiency.

Option A: Cluster autoscaling adds or removes nodes in your GKE cluster based on the resource requests of your pods. While it can help with overall cluster capacity, it oesn't directly address the need for more CPU for a specific pod.

Option C: Horizontal Pod Autoscaler (HPA) scales the number of pod replicas based on observed CPU utilization or other select metrics. Since the application can only have one replica, HPA is not suitable.

Option D: Node auto-provisioning is similar to cluster autoscaling, automatically creating and deleting node pools based on workload demands. It doesn't directly manage the resources of individual pods.

Reference to Google Cloud Certified - Associate Cloud Engineer Documents:

The functionality and use cases of the Vertical Pod Autoscaler (VPA) are detailed in the Google Kubernetes Engine documentation, specifically within the resource management and autoscaling sections. Understanding how VPA can dynamically adjust pod resources is relevant to the Associate Cloud Engineer certification.

The best practice is to use Organization Policies to enforce constraints across the organization and IAM Groups for granting resource access to minimize operational cost and administrative overhead.

Blocking non-company-issued emails: The Organization Policy Service with the constraint domains/restrictIdentityPropagation (or similar constraints like constraints/iam.allowedPolicyMemberDomains) is the Google-recommended, automated way to ensure that only specified domains (your company's domain) can be used as identities in IAM policies, thus blocking non-company issued emails and eliminating manual checks.

Department-specific access: Access should be granted using IAM roles assigned to Google Groups that represent the departments. This adheres to the principle of least privilege and simplifies management (you only manage group membership, not individual users' IAM bindings).

Minimizing operational costs/overhead: Using IAM with Google Groups and Organization Policies is the native, lowest-overhead, and most scalable solution on Google Cloud. Option D's manual checks are high-overhead and not recommended.

https://cloud.google.com/compute/docs/autoscaler#specifications

Autoscaling works independently from autohealing. If you configure autohealing for your group and an instance fails the health check, the autohealer attempts to recreate the instance. Recreating an instance can cause the number of instances in the group to fall below the autoscaling threshold (minNumReplicas) that you specify.

Since we need the application running at all times, we need a minimum 1 instance.

Only a single instance of the VM should run, we need a maximum 1 instance.

We want the application running at all times. If the VM crashes due to any underlying hardware failure, we want another instance to be added to MIG so that application can continue to serve requests. We can achieve this by enabling autoscaling. The only option that satisfies these three is Set autoscaling to On, set the minimum number of instances to 1, and then set the maximum number of instances to 1.

Ref: https://cloud.google.com/compute/docs/autoscaler