Google Updated Associate-Cloud-Engineer Exam Questions and Answers by aris

The correct answer is C because fine-tuning large language models requires scalable compute orchestration and hardware acceleration. GKE is appropriate for containerized ML workloads that need flexible scheduling, repeatability, and access to accelerator-backed nodes. Google Cloud documentation specifically supports running compute-intensive workloads such as AI workloads on GKE Standard node pools with NVIDIA GPU hardware accelerators. Dataflow is primarily for data processing pipelines, not model fine-tuning. A managed instance group with Jupyter Notebooks is less flexible and less Kubernetes-native for distributed ML execution. Cloud Run can be useful for serverless services and some GPU workloads, but large-scale training and fine-tuning are better matched to GKE with accelerators.

As part of your workload, there might be certain VM instances that are critical to running your application or services, such as an instance running a SQL server, a server used as a license manager, and so on. These VM instances might need to stay running indefinitely so you need a way to protect these VMs from being deleted. By setting the deletionProtection flag, a VM instance can be protected from accidental deletion. If a user attempts to delete a VM instance for which you have set the deletionProtection flag, the request fails. Only a user that has been granted a role with compute.instances.create permission can reset the flag to allow the resource to be deleted.

Ref: https://cloud.google.com/compute/docs/instances/preventing-accidental-vm-deletion

The correct answer is A because the application only needs to create new log objects in one specific bucket. A dedicated service account gives the workload its own identity, and granting roles/storage.objectCreator on the bucket limits access to the minimum scope. Google Cloud documents that Storage Object Creator allows object creation but does not grant permission to view, delete, or overwrite objects, and the role can be granted at the bucket level. Object Admin and Storage Admin are excessive because they allow broader object or bucket administration. Using the default Compute Engine service account at project scope is also too broad. Generating a service account key is unnecessary and weakens security.