Google ACE Practice Test 10 — 10 Questions

Question 1

A company wants to set up a cost-effective disaster recovery solution for a critical application running on Compute Engine. The primary region is us-east1. The recovery point objective (RPO) is 1 hour, and recovery time objective (RTO) is 4 hours. Which strategy is most cost-effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cross-region replica of persistent disks using snapshot schedules every hour. The most cost-effective because it uses snapshot schedules to create cross-region replicas of persistent disks every hour, meeting the 1-hour RPO without requiring always-on compute resources. This approach minimizes costs by only storing incremental snapshots in Cloud Storage, while automated restore procedures can spin up instances in the secondary region within the 4-hour RTO.

Answer

Regular backups to Cloud Storage with automated scripts to restore in a different region

Answer

Use managed instance groups in two regions with autoscaling

Answer

Active-active multi-region deployment with HTTP load balancer

Question 2

Your organization has multiple GCP projects and wants to implement least privilege access for operations teams. Each operations team manages a specific set of projects. You have created custom roles that grant permissions to start and stop Compute Engine instances, view logs, and monitor resources. You are using Google Groups to assign roles to users. Recently, a user from the network operations team was able to modify firewall rules in a project managed by the compute operations team, causing a security incident. During the root cause analysis, you discover that the user is a member of both the network operations group and the compute operations group. The compute operations group is assigned a custom role that does not include firewall permissions. The network operations group is assigned a role that includes firewall admin permissions. How should you redesign the IAM structure to prevent cross-team access while maintaining required permissions?

Accepted Answer

Use IAM conditions to restrict the network operations role to only the network team's projects.. IAM conditions allow you to restrict the network operations team's firewall admin permissions to only their designated projects, preventing a user who is a member of both groups from using those permissions in the compute operations team's projects. This enforces least privilege by scoping the role's effectiveness based on resource attributes, without requiring project-level separation or removing the user from necessary groups.

Answer

Create a separate project for each team and use VPC Service Controls to isolate.

Answer

Implement organization policies to deny firewall modifications unless a specific condition is met.

Answer

Remove the user from the network operations group.

Question 3

A developer accidentally grants the Owner role to a test service account on the production project. The team wants to remove only this specific IAM binding without affecting other members' access. Which gcloud command achieves this?

Accepted Answer

gcloud projects remove-iam-policy-binding [PROJECT] --member=serviceAccount:[SA_EMAIL] --role=roles/owner. `gcloud projects remove-iam-policy-binding` is the precise command to remove a single IAM binding (member-role pair) from a project's policy without affecting other bindings. It takes the project ID, member (service account email), and role as parameters, ensuring only the specified binding is removed. This command modifies the existing policy by removing only that specific entry, leaving all other IAM bindings intact.

Answer

gcloud projects set-iam-policy [PROJECT] --member=serviceAccount:[SA] --role=roles/owner

Answer

gcloud iam remove-binding --project=[PROJECT] --member=[SA] --role=owner

Answer

gcloud projects delete-member [PROJECT] --member=serviceAccount:[SA_EMAIL]

Question 4

A company wants to monitor the CPU utilization of their Compute Engine instances and receive an alert if utilization exceeds 80% for 5 minutes. Which services should they combine?

Accepted Answer

Cloud Monitoring and Cloud Pub/Sub.. Cloud Monitoring collects CPU utilization metrics from Compute Engine instances and can evaluate them against a threshold-based alerting policy. When the condition (CPU > 80% for 5 minutes) is met, the alert fires and sends a notification to a Cloud Pub/Sub topic, which can then trigger downstream actions such as sending emails or invoking serverless functions. This combination provides the metric ingestion, alert evaluation, and event-driven notification pipeline required for the use case.

Answer

Cloud Functions and Cloud Tasks.

Answer

Cloud Audit Logs and Cloud Storage.

Answer

Cloud Logging and Cloud Functions.

Question 5

What is the correct order of the Google Cloud resource hierarchy from highest to lowest level?

Accepted Answer

Organization → Folder → Project → Resources. The Google Cloud resource hierarchy is structured from highest to lowest as Organization, Folder, Project, and Resources. The Organization node is the root, allowing centralized policy management; Folders group projects under departments or teams; Projects are the base-level containers for services and APIs; Resources (like Compute Engine instances) reside within projects. Option B correctly reflects this top-down inheritance of IAM policies and access control.

Answer

Folder → Organization → Project → Resources

Answer

Project → Folder → Organization → Resources

Answer

Organization → Project → Folder → Resources

Question 6

A security team wants to restrict access to a Google Cloud project such that only virtual machines with a specific tag 'web' can connect to a Compute Engine instance on port 443. Which configuration is required?

Accepted Answer

Create a firewall rule allowing ingress from instances with tag 'web' to the target instance on port 443.. Firewall rules in Google Cloud are stateful and control ingress traffic at the network level. To allow only VMs with tag 'web' to connect to the target instance on port 443, you must create an ingress firewall rule that specifies the source tag 'web', the target instance (or its network tag), and the protocol/port tcp:443. This rule permits incoming HTTPS traffic from any VM that has the 'web' tag, regardless of its IP address.

Answer

Create a firewall rule allowing egress from instances with tag 'web' to the target instance on port 443.

Answer

Set an IAM condition on the instance to only allow calls from instances with tag 'web'.

Answer

Use Cloud Armor to filter traffic based on tags.

Question 7

Your organization uses Cloud Functions to process messages from a Pub/Sub topic. Each function processes a single message and writes results to BigQuery. Recently, the function has been timing out and the Pub/Sub subscription's unacknowledged message count is growing rapidly. The function's memory is set to 256 MB and timeout is 60 seconds. The function logs show occasional 'memory limit exceeded' errors. You suspect that the function is leaking memory when processing large messages. What should you do to resolve the issue while minimizing cost and complexity?

Accepted Answer

Increase the function's memory to 512 MB and timeout to 120 seconds.. The function is timing out and running out of memory due to large messages. Increasing memory to 512 MB provides more headroom for processing, and raising the timeout to 120 seconds gives the function enough time to complete without unnecessary cost. This directly addresses the memory leak and timeout issues while keeping complexity low.

Answer

Increase the function's memory to 1 GB and timeout to 540 seconds.

Answer

Set up a retry policy on the Pub/Sub subscription to dead-letter undelivered messages.

Answer

Increase the function's timeout to 120 seconds and reduce the batch size.

Question 8

A company has a Compute Engine instance that needs to read files from a Cloud Storage bucket. The instance is running a custom application. What is the recommended way to grant the instance access to the bucket?

Accepted Answer

Create a service account with Storage Object Viewer role and associate it with the instance.. Associating a service account with a Compute Engine instance and granting it the Storage Object Viewer role is the recommended IAM-based approach for granting least-privilege access to Cloud Storage. The instance retrieves short-lived OAuth 2.0 access tokens from the metadata server, which the application can use to authenticate API calls without embedding long-lived credentials.

Answer

Generate a signed URL for the bucket and embed it in the application.

Answer

Use the default Compute Engine service account with Storage Admin role.

Answer

Store the bucket credentials in the instance metadata.

Question 9

You need to monitor the CPU utilization across all instances in a managed instance group. What is the most efficient way to create an alerting policy?

Accepted Answer

Create an alerting policy in Cloud Monitoring for the metric 'compute.googleapis.com/instance/cpu/utilization'.. Cloud Monitoring provides a pre-built metric, 'compute.googleapis.com/instance/cpu/utilization', which directly measures CPU usage for VM instances. Creating an alerting policy based on this metric is the most efficient approach, as it requires no custom scripting or external scheduling, and integrates natively with managed instance groups to aggregate data across all instances.

Answer

Create an alerting policy using the Logs Explorer to parse instance logs.

Answer

Use Cloud Scheduler to call the monitoring API periodically.

Answer

Set up a cron job to run gcloud compute instances list and check CPU.

Question 10

Refer to the exhibit. A user 'admin@example.com' attempts to create a Compute Engine instance but fails with a permission error. Which permission is missing?

Accepted Answer

iam.serviceAccounts.actAs. The error occurs because when a user creates a Compute Engine instance with a service account, they need the `iam.serviceAccounts.actAs` permission on that service account. This permission allows the user to impersonate the service account and delegate its identity to the instance. Without it, the creation fails even if the user has `compute.instances.create`.

Answer

compute.instances.get

Answer

compute.instances.create

Answer

compute.instances.setServiceAccount