Google ACE Practice Test 11 — 15 Questions

Question 1

You need to check the CPU and memory utilization of all pods running in the `production` namespace. Which command provides this information?

Accepted Answer

`kubectl top pods -n production`. The `kubectl top pods` command retrieves real-time CPU and memory utilization metrics from the metrics server for pods in a specified namespace. This is the correct tool for monitoring resource usage, as it directly queries the resource metrics API.

Answer

`kubectl describe pods -n production`

Answer

`kubectl get pods -n production -o wide`

Answer

`kubectl logs -n production --all-pods`

Question 2

A load balancer is routing traffic to a VM where the application process has crashed, but the VM itself is still running. What prevents the load balancer from continuing to send traffic to this instance?

Accepted Answer

An HTTP health check configured on the backend service. The load balancer uses an HTTP health check to periodically probe the application on the VM. When the application process crashes, the health check fails (e.g., returns a non-2xx status code or times out), and the load balancer automatically stops routing new traffic to that unhealthy instance. This is the standard mechanism in Google Cloud for detecting application-level failures, as opposed to infrastructure-level failures.

Answer

A VPC firewall rule blocking traffic to the VM

Answer

A Cloud Armor security policy blocking the crashed instance's IP

Answer

The instance group autoscaling policy detecting the failure

Question 3

A company is running a Cloud SQL for MySQL instance that experiences high read traffic. They want to offload read queries to reduce load on the primary instance. Which action should they take?

Accepted Answer

Create one or more read replicas and direct read queries to them. Creating one or more read replicas allows you to offload read queries from the primary Cloud SQL for MySQL instance. Read replicas are asynchronous replicas that can serve read traffic, reducing load on the primary and improving overall read throughput. This is the correct approach for scaling read-heavy workloads without modifying the primary instance.

Answer

Enable automatic storage increase on the primary instance

Answer

Increase the machine type of the primary instance

Answer

Change the instance to use private IP only

Question 4

Refer to the exhibit. The Terraform plan above returns the error: Error: "member" is required. What is the issue?

Accepted Answer

The member argument should be 'member' (singular) not 'members'.. The Terraform error 'Error: "member" is required' indicates that the resource block is using the plural argument 'members' instead of the singular 'member'. In the Google Cloud Terraform provider, the google_project_iam_member resource expects a single 'member' argument (e.g., 'user:email@example.com'), not a list. The correct syntax is 'member = "user:email@example.com"', not 'members = ["user:email@example.com"]'. This is a common syntax error when transitioning from other IAM resources that accept lists.

Answer

The Terraform provider version is outdated.

Answer

The project ID is incorrect.

Answer

The member argument must be a service account, not a user.

Question 5

Arrange the steps to set up a Cloud Function triggered by a Cloud Storage bucket event.

Accepted Answer

Create the Cloud Storage bucket → Write the Cloud Function code → Deploy the Cloud Function with bucket trigger → Upload a file to the bucket to test the trigger. The correct order ensures that the required infrastructure (bucket) and code are in place before deployment. The bucket must be created first so the trigger can reference it, then the function code is written, then the function is deployed with the bucket trigger, and finally a test upload verifies the function executes. Common mistakes include deploying before the bucket or code exist, or writing code after deployment.

Answer

Write the Cloud Function code → Deploy the Cloud Function with bucket trigger → Create the Cloud Storage bucket → Upload a file to the bucket to test the trigger

Answer

Create the Cloud Storage bucket → Deploy the Cloud Function with bucket trigger → Write the Cloud Function code → Upload a file to the bucket to test the trigger

Answer

Deploy the Cloud Function with bucket trigger → Write the Cloud Function code → Create the Cloud Storage bucket → Upload a file to the bucket to test the trigger

Question 6

An organization wants to manage GCP resources for multiple teams using a hierarchy of folders and projects. They need to apply a uniform policy that restricts the regions where VM instances can be created across all projects in a folder. Which approach should they use?

Accepted Answer

Set an IAM policy on the folder that denies compute.instances.create permission in disallowed regions. The correct approach uses IAM conditions to restrict resource creation based on location. While organization policies with the 'gcp.resource-locations' constraint are the recommended method, option C is the only valid choice among the given options. IAM policies on the folder with conditions can effectively deny compute.instances.create permission in disallowed regions, enforcing uniform control across all projects in the folder.

Answer

Apply an organization policy with the `compute.allowedExternalIpAccess` constraint

Answer

Apply an organization policy with the `compute.restrictResourceCreation` constraint

Answer

Use gcloud config set compute/region and enforce with a script

Question 7

A company has multiple projects under an organization. They want to enforce that all service accounts created in any project must use the naming prefix 'sa-'. Which policy should be used?

Accepted Answer

Organization policy using a custom constraint. An organization policy with a custom constraint is the correct approach because it allows you to define a specific rule (e.g., all service accounts must start with 'sa-') that is enforced across all projects in the organization. Custom constraints use the Resource Manager API's `constraints/*` format and are evaluated at resource creation time, making them ideal for naming conventions that must be applied universally.

Answer

VPC Service Controls

Answer

Project-level IAM condition

Answer

Cloud Audit Logs

Question 8

A user needs to view the list of firewall rules in a project but should not be able to create or modify them. Which predefined IAM role should you grant?

Accepted Answer

roles/compute.viewer. The roles/compute.viewer role grants read-only access to Compute Engine resources, including the ability to list firewall rules, without permitting create, update, or delete operations. This aligns with the principle of least privilege for a user who only needs to view firewall configurations.

Answer

roles/editor

Answer

roles/compute.securityAdmin

Answer

roles/owner

Question 9

A company wants to set up a hybrid network between their on-premises data center and Google Cloud. They need a highly available VPN connection with 99.99% SLA. Which VPN solution should they choose?

Accepted Answer

HA VPN. HA VPN is the only Google Cloud VPN solution that provides a 99.99% availability SLA when configured with two or more tunnels across two interfaces. It uses two or more external IP addresses on the Cloud VPN gateway, and each tunnel connects to a separate on-premises peer, enabling active-active or active-passive redundancy. Classic VPN offers only 99.9% SLA and does not support the same high-availability topology.

Answer

Classic VPN

Answer

Cloud Interconnect

Answer

Cloud NAT

Question 10

A company uses Cloud SQL with Customer-Managed Encryption Keys (CMEK). The security team wants to rotate the encryption key. What is the impact on the Cloud SQL instance?

Accepted Answer

The instance must be stopped and restarted after the key rotation.. When rotating a CMEK for Cloud SQL, the instance must be restarted to use the new key version. Data remains encrypted at all times.

Answer

The instance becomes unavailable until the key rotation is complete.

Answer

All data in the instance is re-encrypted immediately.

Answer

There is no impact; the instance automatically uses the new key version.

Question 11

An application running on Compute Engine writes logs to a local file. The operations team wants to centralize these logs in Cloud Logging with minimal code changes. What is the recommended approach?

Accepted Answer

Install and configure the Cloud Logging agent on the instance.. The Cloud Logging agent (formerly known as the Stackdriver Logging agent) is the recommended approach because it automatically tails the local log file, parses common log formats, and streams entries to Cloud Logging using the fluentd-based agent. This requires no application code changes and minimal configuration, meeting the requirement of centralizing logs with minimal code changes.

Answer

Use Cloud Scheduler to tail the log file and send entries to Logging.

Answer

Set up a scheduled cron job to upload the log file via gcloud logging write.

Answer

Modify the application to use the Cloud Logging client library.

Question 12

An engineer creates a firewall rule allowing ingress on port 8080 from source range 10.0.0.0/8 with priority 1000. Another rule denies ingress on port 8080 from source range 10.0.0.0/24 with priority 500. What is the effective behavior for traffic from 10.0.0.1?

Accepted Answer

Traffic is denied because the deny rule has a higher priority (lower number).. GCP firewall rules are evaluated by priority, where a lower number means higher priority. The deny rule has priority 500, which is lower than the allow rule's priority 1000, so the deny rule is evaluated first and matches traffic from 10.0.0.1 (which falls within 10.0.0.0/24). Therefore, the traffic is denied.

Answer

Traffic is denied only if the source is exactly 10.0.0.1; otherwise allowed.

Answer

Traffic is allowed because the allow rule covers a larger range.

Answer

Traffic is allowed because both rules match and the default is to allow.

Question 13

An organization wants to deploy a containerized web application on GKE. They need the application to be accessible from the internet via a stable IP address. Which service type should they use when exposing the deployment?

Accepted Answer

LoadBalancer. A LoadBalancer service type provisions a Google Cloud TCP/UDP Load Balancer and assigns a stable external IP address. NodePort exposes on a high port but requires manual setup; ClusterIP is internal only.

Answer

ClusterIP

Answer

NodePort

Answer

ExternalName

Question 14

An organization with multiple Google Cloud projects wants to centralize network administration by having a single VPC network that hosts shared services and allows project teams to create their own resources in separate projects that can connect to the shared VPC. Which Google Cloud feature should they use?

Accepted Answer

Shared VPC. Shared VPC allows an organization to centrally manage a host project's VPC network and share its subnets with other service projects. This enables project teams to create resources in their own projects while using the shared network, centralizing network administration. It is specifically designed for this multi-project connectivity scenario.

Answer

Cloud VPN

Answer

VPC Service Controls

Answer

VPC Network Peering

Question 15

An engineer needs to grant an external auditor read-only access to view IAM policies on a GCP project. The auditor should not have access to any other resources. Which IAM role should be assigned?

Accepted Answer

roles/iam.securityReviewer. The `roles/iam.securityReviewer` role grants permission to view IAM policies without granting access to other resources. It is specifically designed for security auditors.

Answer

roles/iam.roleAdmin

Answer

roles/iam.serviceAccountAdmin

Answer

roles/viewer