Google ACE Practice Test 10 — 10 Questions

Question 1

An engineer is designing a VPC for a multi-tier application. The application has web servers that need direct internet access, and a private database tier that must not have public IP addresses. The database tier needs outbound internet access to download updates. Which network configuration should the engineer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place web servers in a subnet with public IPs, and database servers in a separate subnet with Cloud NAT and no public IP. Web servers should be in a subnet with public IPs or a Cloud NAT for outbound. The database tier must be in a private subnet without public IP, but needs outbound internet via Cloud NAT. This allows secure outbound without public exposure.

Answer

Place web servers in a subnet with Cloud NAT, and database servers in the same subnet without public IP

Answer

Place both tiers in the same subnet with no public IPs and use Cloud NAT for all outbound traffic

Answer

Place web servers in a subnet with Cloud NAT, and database servers in a subnet with public IPs and firewall rules to restrict inbound

Question 2

A managed instance group (MIG) is running 4 VMs with a CPU autoscaling target of 60%. A traffic spike drives average CPU to 90%. How does the autoscaler respond?

Accepted Answer

The autoscaler adds VMs until average CPU across the group drops to approximately 60%. The autoscaler for a managed instance group (MIG) uses a target utilization metric—here, CPU at 60%. When average CPU exceeds that target (90%), the autoscaler calculates the desired number of VMs to bring utilization back to 60% (e.g., 4 VMs * 90% / 60% = 6 VMs) and adds instances accordingly. It does not terminate, migrate, or restart VMs; it scales out horizontally.

Answer

The MIG terminates the 2 least-used VMs to trigger a restart with higher performance settings

Answer

The MIG live-migrates instances to larger machine types automatically

Answer

The MIG restarts all existing VMs to clear cached load

Question 3

A platform admin creates a new GCP project for a team. The team lead's email is teamlead@company.com. The admin needs the team lead to be able to create resources in the project but not manage IAM policies or billing. Which role is most appropriate?

Accepted Answer

Editor. The Editor role (roles/editor) grants all permissions necessary to create, modify, and delete resources within a GCP project, but explicitly excludes permissions to manage IAM policies (roles/iam.securityAdmin or roles/owner) and billing (roles/billing.admin). This makes it the correct choice for a team lead who needs to deploy and manage resources without having the ability to change access controls or alter billing configurations.

Answer

Owner

Answer

Viewer

Answer

Billing Account Administrator

Question 4

Which gcloud CLI command authenticates a developer's local environment with their Google account?

Accepted Answer

gcloud auth login. `gcloud auth login`, is correct because it initiates the OAuth 2.0 flow to authenticate the gcloud CLI with a user's Google account, storing the resulting credentials locally for subsequent API calls. This command is the standard way to authorize a developer's local environment for the first time or when switching users.

Answer

gcloud config set account [EMAIL]

Answer

gcloud init --authenticate

Answer

gcloud accounts activate

Question 5

Your security team requires that all service accounts in your GCP organization older than 90 days that have not been used must be automatically disabled. They want a fully managed, serverless solution with no persistent infrastructure. Which architecture best meets these requirements?

Accepted Answer

Use Cloud Scheduler to trigger a Cloud Function that queries Cloud Asset Inventory and disables stale service accounts.. Cloud Scheduler can trigger a serverless Cloud Function on a schedule (e.g., nightly) to query Cloud Asset Inventory for service accounts older than 90 days with no last authentication time, then disable them via the IAM API. This meets the fully managed, serverless requirement with no persistent infrastructure (no VMs or servers to maintain).

Answer

Deploy a Compute Engine VM with a cron job that calls the IAM API nightly.

Answer

Configure an org policy that automatically expires service accounts after 90 days.

Answer

Use Security Command Center to flag and manually disable unused service accounts.

Question 6

A startup needs to send transactional emails (order confirmations, password resets) from their GCP-hosted application. Which GCP service handles high-volume email delivery?

Accepted Answer

A third-party email delivery service such as SendGrid or Mailgun, integrated via API. B is correct because GCP does not provide a native high-volume transactional email service. Third-party email delivery services like SendGrid or Mailgun are designed specifically for this purpose, offering dedicated SMTP relays, APIs, and reputation management to ensure reliable delivery of transactional emails such as order confirmations and password resets.

Answer

Cloud Tasks with an email delivery queue

Answer

Cloud Pub/Sub with an email topic subscriber

Answer

Cloud Functions triggered by Gmail API webhooks

Question 7

An organization has a VPC with subnets in us-central1 and europe-west1. They want to allow traffic from a specific on-premises IP range to reach a Compute Engine instance in europe-west1, but only through a single Cloud VPN tunnel attached to the us-central1 gateway. What configuration is required?

Accepted Answer

Create a route in us-central1 with the on-premises range and next hop set to the VPN tunnel. Add a firewall rule allowing the traffic.. The VPN tunnel is attached to the us-central1 gateway, and a static route in us-central1 with the on-premises IP range as the destination and the VPN tunnel as the next hop directs traffic from the on-premises network to the VPC. Since the VPC is global, the route applies to all regions, and the Compute Engine instance in europe-west1 is reachable as long as the traffic enters the VPC through the us-central1 tunnel. A firewall rule is required to allow the inbound traffic from the on-premises range to the instance.

Answer

Use policy-based routing on the Cloud VPN gateway to route the traffic to europe-west1.

Answer

Create a static route for the on-premises range in the europe-west1 subnet pointing to the VPN tunnel in us-central1.

Answer

Configure the VPN tunnel with BGP to advertise the on-premises range to both regions.

Question 8

A company wants to set up a cost-effective disaster recovery solution for a critical application running on Compute Engine. The primary region is us-east1. The recovery point objective (RPO) is 1 hour, and recovery time objective (RTO) is 4 hours. Which strategy is most cost-effective?

Accepted Answer

Cross-region replica of persistent disks using snapshot schedules every hour. The most cost-effective because it uses snapshot schedules to create cross-region replicas of persistent disks every hour, meeting the 1-hour RPO without requiring always-on compute resources. This approach minimizes costs by only storing incremental snapshots in Cloud Storage, while automated restore procedures can spin up instances in the secondary region within the 4-hour RTO.

Answer

Regular backups to Cloud Storage with automated scripts to restore in a different region

Answer

Use managed instance groups in two regions with autoscaling

Answer

Active-active multi-region deployment with HTTP load balancer

Question 9

Your organization has multiple GCP projects and wants to implement least privilege access for operations teams. Each operations team manages a specific set of projects. You have created custom roles that grant permissions to start and stop Compute Engine instances, view logs, and monitor resources. You are using Google Groups to assign roles to users. Recently, a user from the network operations team was able to modify firewall rules in a project managed by the compute operations team, causing a security incident. During the root cause analysis, you discover that the user is a member of both the network operations group and the compute operations group. The compute operations group is assigned a custom role that does not include firewall permissions. The network operations group is assigned a role that includes firewall admin permissions. How should you redesign the IAM structure to prevent cross-team access while maintaining required permissions?

Accepted Answer

Use IAM conditions to restrict the network operations role to only the network team's projects.. IAM conditions allow you to restrict the network operations team's firewall admin permissions to only their designated projects, preventing a user who is a member of both groups from using those permissions in the compute operations team's projects. This enforces least privilege by scoping the role's effectiveness based on resource attributes, without requiring project-level separation or removing the user from necessary groups.

Answer

Create a separate project for each team and use VPC Service Controls to isolate.

Answer

Implement organization policies to deny firewall modifications unless a specific condition is met.

Answer

Remove the user from the network operations group.

Question 10

A developer accidentally grants the Owner role to a test service account on the production project. The team wants to remove only this specific IAM binding without affecting other members' access. Which gcloud command achieves this?

Accepted Answer

gcloud projects remove-iam-policy-binding [PROJECT] --member=serviceAccount:[SA_EMAIL] --role=roles/owner. `gcloud projects remove-iam-policy-binding` is the precise command to remove a single IAM binding (member-role pair) from a project's policy without affecting other bindings. It takes the project ID, member (service account email), and role as parameters, ensuring only the specified binding is removed. This command modifies the existing policy by removing only that specific entry, leaving all other IAM bindings intact.

Answer

gcloud projects set-iam-policy [PROJECT] --member=serviceAccount:[SA] --role=roles/owner

Answer

gcloud iam remove-binding --project=[PROJECT] --member=[SA] --role=owner

Answer

gcloud projects delete-member [PROJECT] --member=serviceAccount:[SA_EMAIL]