Google ACE Practice Test 11 — 15 Questions

Question 1

A Cloud SQL production instance experiences a spike in connections during business hours, causing 'too many connections' errors. The application uses 50 microservices each maintaining 10 connections. What is the recommended solution to reduce connection count without rewriting the application?

Accepted Answer

Deploy a connection pooler (e.g., PgBouncer) between the microservices and Cloud SQL. Option B is correct because deploying a connection pooler like PgBouncer between the microservices and Cloud SQL allows many application connections to be multiplexed over a smaller number of actual database connections. This directly reduces the total connection count on the Cloud SQL instance without requiring any application code changes, as the pooler transparently manages the connection lifecycle and reuses idle connections.

Answer

Increase the Cloud SQL instance's max_connections database flag to 10,000

Answer

Enable Cloud SQL HA — the standby will handle the connection overflow

Answer

Add a read replica — microservices can connect to the replica instead of the primary

Question 2

Which command creates a Cloud Storage bucket named 'my-archive-bucket' in the US multi-region using the modern gcloud CLI?

Accepted Answer

gcloud storage buckets create gs://my-archive-bucket --location=US. Option B is correct because the modern gcloud CLI uses the `gcloud storage buckets create` command to create a Cloud Storage bucket, and the `--location=US` flag specifies the US multi-region. This command is part of the newer, unified `gcloud storage` command group that replaces the older `gsutil` tool for bucket management.

Answer

gcloud storage mk gs://my-archive-bucket --location=US

Answer

gcloud cloud-storage create my-archive-bucket --region=US

Answer

gsutil mk -l US gs://my-archive-bucket

Question 3

A GCP organization has 150 projects. A new security policy requires all projects to enable the Security Command Center API. What is the most efficient way to enable this API across all projects without manually visiting each project?

Accepted Answer

Use a gcloud script to iterate over all projects and enable the API for each. Option B is correct because the gcloud command-line tool allows you to script the enabling of the Security Command Center API across all projects efficiently. Using `gcloud services enable securitycenter.googleapis.com --project=<project_id>` in a loop over the list of projects automates the task without manual intervention, leveraging the Cloud SDK's programmatic access to the Service Usage API.

Answer

Manually enable the API in each of the 150 projects via the Cloud Console

Answer

Enable the API at the organization level — it inherits down to all projects

Answer

Create an organization policy enabling all APIs on all projects

Question 4

A team's Cloud SQL for PostgreSQL instance is running out of disk space. Automated storage increase is disabled. A monitoring alert fires at 90% disk usage. What is the fastest safe action to increase storage?

Accepted Answer

Increase storage capacity using `gcloud sql instances patch --storage-size=[NEW_SIZE]` without downtime. Option B is correct because Cloud SQL for PostgreSQL supports online storage resizing without downtime. Using `gcloud sql instances patch --storage-size=[NEW_SIZE]` allows you to increase the allocated disk capacity while the instance remains fully operational, making it the fastest safe action when automated storage increase is disabled.

Answer

Delete old records from the database to free space — no instance changes needed

Answer

Create a new larger Cloud SQL instance and migrate data with Cloud Database Migration Service

Answer

Enable automatic storage increase and wait — Cloud SQL will expand the disk retroactively

Question 5

A Cloud Run service has been running for weeks. A sudden spike in 5xx errors appears in Cloud Monitoring. The team wants to view the actual request logs to identify which endpoint is failing. Where should they look?

Accepted Answer

Cloud Logging Logs Explorer — filter by resource type 'cloud_run_revision'. Cloud Logging's Logs Explorer is the correct place to view actual request logs for a Cloud Run service. It allows filtering by resource type 'cloud_run_revision' and by HTTP status codes (e.g., 5xx) to identify which specific endpoint is failing. Cloud Monitoring Metrics Explorer shows aggregated metrics, not individual log entries, so it cannot pinpoint the exact endpoint.

Answer

Cloud Monitoring Metrics Explorer — filter by request_count metric with error status

Answer

Cloud Trace — filter by 5xx response code

Answer

Cloud Debugger — set a snapshot at the error handler

Question 6

A Cloud Function must execute automatically every time a new object is written to a specific Cloud Storage bucket. Which trigger type should be configured for the function?

Accepted Answer

Cloud Storage trigger (object finalized event). The Cloud Storage trigger (object finalized event) is the correct choice because Cloud Functions natively supports Cloud Storage events via the `google.storage.object.finalize` event type, which fires when a new object is created or an existing object is overwritten in a bucket. This trigger automatically invokes the function without requiring any intermediary service, directly binding the function to the bucket's notification system.

Answer

HTTP trigger

Answer

Pub/Sub trigger

Answer

Cloud Scheduler trigger

Question 7

A media company needs to serve large video files (average 2 GB) to global users with low latency. The files are stored in Cloud Storage. What combination of services delivers the best streaming performance?

Accepted Answer

Cloud Storage + Cloud CDN via a Global Load Balancer backend bucket. Cloud Storage combined with Cloud CDN via a Global Loader Balancer backend bucket is the best choice because it provides edge-caching of large video files, reducing latency for global users. The Global Load Balancer terminates HTTP(S) traffic at the closest point of presence, and Cloud CDN caches content from the multi-region bucket, minimizing origin load and improving streaming performance.

Answer

Cloud Storage in a multi-region bucket with direct public access

Answer

Upload video files to a Compute Engine VM with nginx serving them directly

Answer

Cloud Filestore with NFS-mounted streaming

Question 8

A team deploys an application with sensitive internal APIs on GKE. The APIs should be reachable from other GKE services in the cluster and from on-premises systems via VPN, but not from the public internet. Which load balancer configuration meets this?

Accepted Answer

Internal Application Load Balancer with a VPC-private IP. An Internal Application Load Balancer (HTTP/HTTPS) with a VPC-private IP is correct because it exposes the APIs only within the VPC network, making them reachable from other GKE services in the cluster and from on-premises systems via VPN (which extends the VPC), while blocking all public internet traffic by design. This load balancer operates at Layer 7 and uses an internal IP address that is not routable from the internet, satisfying the requirement without relying on additional access controls.

Answer

Global external Application Load Balancer with Cloud Armor blocking non-VPN IPs

Answer

A ClusterIP Service with an external IP range allowlist

Answer

NodePort Service with VPC firewall rules restricting access to VPN IP ranges

Question 9

A security audit found that several Cloud Storage buckets in your project have `allAuthenticatedUsers` in their IAM policy with `storage.objectViewer`. What does `allAuthenticatedUsers` grant, and why is it a security risk?

Accepted Answer

It grants read access to any person with a Google account — effectively near-public access since Google accounts are free to create.. `allAuthenticatedUsers` is a special IAM member that includes any person authenticated with a Google account, regardless of whether they belong to your organization or domain. Granting `storage.objectViewer` to this group means anyone with a free Google account (e.g., Gmail) can list and read objects in the bucket, making the data effectively public. This is a significant security risk because it exposes sensitive data to a vast, uncontrolled audience.

Answer

It grants access only to users within your Google Workspace domain — a minor risk if your domain is small.

Answer

It grants access only to Google service accounts, which is acceptable since those are controlled.

Answer

It grants access to authenticated GCP users in your organization's IAM policy — this is normal for shared resources.

Question 10

A team wants to roll back a GKE Deployment to its previous revision because the new version introduced a regression. Which kubectl command performs this rollback?

Accepted Answer

kubectl rollout undo deployment/my-app. Option B is correct because `kubectl rollout undo deployment/my-app` is the standard Kubernetes command to roll back a Deployment to the previous revision. This command leverages the Deployment's revision history, which is automatically maintained by the Kubernetes controller, to revert the desired state to the prior revision without needing to manually reapply an old manifest.

Answer

kubectl revert deployment/my-app --to-previous

Answer

kubectl apply -f previous-deployment.yaml

Answer

kubectl delete deployment/my-app && kubectl create -f deployment.yaml

Question 11

A billing report shows a Compute Engine VM has been running unused for 3 months. The team wants to stop it to save costs but needs the VM's disk data preserved for potential future use. What should they do?

Accepted Answer

Stop (shut down) the VM — compute charges stop but disk storage charges continue. Option B is correct because stopping (shutting down) a Compute Engine VM immediately halts all compute charges (vCPU, memory, GPU) while preserving the persistent disk and its data. The disk continues to incur storage costs, which is acceptable since the team wants to retain the data for potential future use. This is the most cost-effective approach that meets the requirement of preserving disk data without paying for idle compute resources.

Answer

Delete the VM to avoid all compute charges

Answer

Snapshot the VM disk and delete the VM

Answer

Set the VM to a smaller machine type to reduce costs

Question 12

A Cloud Run service handles payment processing. A monitoring alert shows the service is experiencing 3-second P99 latency, up from its normal 200ms. The team wants to find the slowest individual requests in the last hour. Which tool provides per-request latency data?

Accepted Answer

Cloud Trace — sort traces by latency in the last hour. Cloud Trace is designed to capture end-to-end latency for individual requests, allowing you to sort and identify the slowest requests in a specific time range. The P99 latency increase indicates a tail-latency problem, and Trace provides per-request granularity to pinpoint the exact slow requests. This makes it the correct tool for finding the slowest individual requests in the last hour.

Answer

Cloud Monitoring — check the request_latencies metric distribution

Answer

Cloud Logging — filter for requests with duration > 3s

Answer

Cloud Profiler — view the slowest functions in the last hour

Question 13

A batch data processing job runs nightly for 4 hours and can tolerate interruption because it saves progress checkpoints every 15 minutes. Which VM option offers the greatest cost reduction?

Accepted Answer

Spot VM. Spot VMs offer significant cost reduction (up to 60-91% discount) compared to standard VMs, making them ideal for fault-tolerant, interruptible batch workloads. Since the job saves checkpoints every 15 minutes, it can resume from the last checkpoint if preempted, fully leveraging the cost benefit of Spot VMs.

Answer

Custom machine type VM with reduced memory

Answer

Sole-tenant node VM

Answer

Shielded VM

Question 14

During a gcloud CLI session, a developer runs `gcloud config list` and sees the output shows `project = old-project`. They need to work in `new-project`. Which sequence of commands correctly switches projects and verifies the change?

Accepted Answer

gcloud config set project new-project; gcloud config list. Option B is correct because `gcloud config set project new-project` updates the active project in the local CLI configuration, and `gcloud config list` then displays the current configuration, confirming the change. This is the standard method to switch the working project for subsequent gcloud commands.

Answer

gcloud projects activate new-project; gcloud config list

Answer

gcloud auth login --project=new-project; gcloud config list

Answer

export GCLOUD_PROJECT=new-project; gcloud config list

Question 15

An application running on a Compute Engine VM needs to read objects from a Cloud Storage bucket in the same project. What is the recommended authentication approach?

Accepted Answer

Attach a service account with the Storage Object Viewer role to the VM. Option B is correct because attaching a service account with the Storage Object Viewer role to the Compute Engine VM is the recommended and secure method for authenticating to Cloud Storage. The VM automatically obtains OAuth 2.0 access tokens for the service account via the metadata server, eliminating the need to manage or embed credentials in the application code.

Answer

Embed a developer's user account credentials in the application configuration file

Answer

Create an API key and store it as an environment variable on the VM

Answer

Grant the VM's IP address access to the bucket using a VPC firewall rule