Google ACE Practice Test 12 — 15 Questions

Question 1

A company needs to run a batch job every hour on a Compute Engine VM. The VM should be terminated after the job completes to save costs. The job is run from a script inside a custom container image stored in Container Registry. Which approach is the most cost-effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a VM with a preemptible instance setting and a startup script that runs the container, then shuts down the VM. Compute Engine preemptible VMs are up to 60-91% cheaper than regular VMs. For batch jobs that can be interrupted, they are highly cost-effective. Combining with a startup script that pulls and runs the container, and having the script shut down the VM after the job, minimizes costs.

Answer

Use a managed instance group with autoscaling and a target CPU load of 0%

Answer

Use a regular VM and stop it manually when the job finishes

Answer

Use Cloud Run with a scheduled job

Question 2

A company has multiple projects under an organization. They want to enforce that all service accounts created in any project must use the naming prefix 'sa-'. Which policy should be used?

Accepted Answer

Organization policy using a custom constraint. An organization policy with a custom constraint is the correct approach because it allows you to define a specific rule (e.g., all service accounts must start with 'sa-') that is enforced across all projects in the organization. Custom constraints use the Resource Manager API's `constraints/*` format and are evaluated at resource creation time, making them ideal for naming conventions that must be applied universally.

Answer

VPC Service Controls

Answer

Project-level IAM condition

Answer

Cloud Audit Logs

Question 3

A user needs to view the list of firewall rules in a project but should not be able to create or modify them. Which predefined IAM role should you grant?

Accepted Answer

roles/compute.viewer. The roles/compute.viewer role grants read-only access to Compute Engine resources, including the ability to list firewall rules, without permitting create, update, or delete operations. This aligns with the principle of least privilege for a user who only needs to view firewall configurations.

Answer

roles/editor

Answer

roles/compute.securityAdmin

Answer

roles/owner

Question 4

An organisation requires a managed relational database for an online transaction processing (OLTP) application with strong consistency, automated backups, and a 99.95% SLA. The database size is expected to be under 10 TB. Which service meets these requirements at the lowest cost?

Accepted Answer

Cloud SQL. Cloud SQL provides managed MySQL/PostgreSQL/SQL Server with automated backups, strong consistency, and a 99.95% SLA for zonal deployments. It is cost-effective for databases under 10 TB. Cloud Spanner is more expensive and suited for global scale.

Answer

Bare Metal Solution

Answer

Cloud Bigtable

Answer

Cloud Spanner

Question 5

A company has a VPC in auto mode and wants to create a VPN connection to an on-premises network using HA VPN. The on-premises VPN gateway supports only a single public IP address. Which configuration step is required to establish a functional HA VPN tunnel?

Accepted Answer

Configure the HA VPN gateway with only one interface and disable the second interface. HA VPN normally requires two interfaces (two public IPs) for redundancy. If the on-premises gateway supports only one IP, you can configure the Cloud VPN tunnel to use a single interface (interface 0) and disable the second interface. Alternatively, you can create a Classic VPN tunnel, but Classic VPN is not recommended. The correct approach is to use HA VPN with only one interface enabled.

Answer

Configure the HA VPN gateway with two interfaces and use BGP to load balance traffic

Answer

Use a Cloud Router with custom route advertisements to the on-premises network

Answer

Create a Classic VPN tunnel instead of HA VPN

Question 6

A company is migrating a legacy monolithic application to Google Cloud. The application has unpredictable traffic patterns and long-running connections. The team wants to minimize operational overhead and only pay for resources when the application is processing requests. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is a serverless compute platform that scales to zero when not in use, has a per-request billing model, and supports HTTP-triggered container workloads. It can handle long-running connections as long as they stay within the request timeout limit. Cloud Run minimizes operational overhead by eliminating server management and scaling automatically.

Answer

Google Kubernetes Engine (GKE) Autopilot cluster

Answer

Compute Engine with managed instance groups and autoscaling

Answer

Google Kubernetes Engine (GKE) Standard cluster with node autoscaling

Question 7

A company is migrating a legacy monolithic application to Google Cloud. The application requires persistent storage and must be highly available with automatic failover across zones. The workload has a moderate number of reads and writes. Which storage solution meets these requirements?

Accepted Answer

Cloud SQL with a regional (HA) configuration. Cloud SQL with regional (high availability) configuration replicates data synchronously to a standby instance in a different zone within the same region, providing automatic failover. It is ideal for legacy applications requiring relational database support (MySQL, PostgreSQL, SQL Server).

Answer

Compute Engine persistent disk attached to a VM in a managed instance group

Answer

Cloud Storage with object versioning

Answer

Cloud Spanner

Question 8

You manage a Google Kubernetes Engine (GKE) cluster and need to update the deployment 'web-app' to use a new container image tag 'v2'. You also want to ensure the update proceeds and, if it fails, roll back to the previous revision. Which set of commands should you use?

Accepted Answer

kubectl set image deployment/web-app web-app=gcr.io/myproject/web-app:v2; kubectl rollout status; kubectl rollout undo. kubectl set image updates the image; kubectl rollout status monitors progress; kubectl rollout undo reverts to the previous revision.

Answer

gcloud container clusters upgrade; kubectl rollout status; kubectl rollout undo

Answer

kubectl edit deployment web-app; kubectl rollout status; kubectl delete deployment web-app

Answer

kubectl apply -f web-app.yaml; kubectl rollout status; kubectl rollout undo

Question 9

A startup wants to run a small, event-driven application that processes files uploaded to Cloud Storage. The function should be triggered by object finalize events and should have a maximum execution time of 10 minutes. Which compute option is most cost-effective and easy to manage?

Accepted Answer

Cloud Functions (Gen 2). Cloud Functions (Gen 2) can be triggered by Cloud Storage events and supports longer timeouts (up to 60 minutes). It is serverless and cost-effective for event-driven workloads. Cloud Run also works but requires running a container; Cloud Functions is simpler for single-purpose functions.

Answer

Compute Engine with a startup script

Answer

App Engine Standard

Answer

Cloud Run jobs

Question 10

A company has a GKE Autopilot cluster and wants to run a stateful application that requires persistent volumes with high read/write throughput. The application is deployed in a single region and does not require multi-region redundancy. Which storage option is the best choice for the persistent volumes?

Accepted Answer

Compute Engine persistent disks (SSD) using StorageClass 'pd-ssd'. GKE Autopilot supports persistent volumes via Compute Engine persistent disks (PD) or Cloud Filestore. For high throughput, regional persistent disks (pd-balanced or pd-ssd) offer excellent performance. Cloud Storage is not a persistent volume. Filestore is file storage but is more expensive and adds network latency. Persistent disks are native and provide the best performance for stateful applications.

Answer

Cloud Filestore (NFS)

Answer

Bigtable

Answer

Cloud Storage FUSE

Question 11

An organization wants to run a stateless HTTP-based containerized application that scales to zero when not in use and charges only for request processing time. They do not want to manage any underlying infrastructure. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform for containers. It scales to zero automatically when no requests are coming in, and you pay only for the resources used during request processing. It is ideal for stateless HTTP-triggered workloads.

Answer

Compute Engine with managed instance group

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE) Standard

Question 12

An organization has a folder hierarchy with multiple projects. They want to grant a support team the ability to view all IAM policies across the entire folder. What is the most efficient way?

Accepted Answer

Grant roles/iam.securityReviewer at the folder level.. Granting the role at the folder level applies to all projects under it, which is efficient and follows best practices for hierarchical IAM.

Answer

Grant roles/iam.securityReviewer on each project individually.

Answer

Grant roles/owner at the folder level.

Answer

Grant roles/viewer at the folder level.

Question 13

An organization wants to use Cloud NAT to allow private Compute Engine instances to access the internet for updates. They have a VPC with a custom subnet and a Cloud Router configured. However, instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The Cloud NAT gateway has not been created on the Cloud Router.. Cloud NAT requires a Cloud Router and a NAT gateway configuration on the router. If the NAT gateway is not created, instances cannot use NAT. Other issues like missing routes or firewall rules are possible but less likely when Cloud NAT is set up correctly.

Answer

The instances do not have external IP addresses.

Answer

The firewall rules block egress traffic.

Answer

The subnet does not have Private Google Access enabled.

Question 14

A team is building a mobile app backend that requires real-time data synchronization across devices and offline support. The data model is simple and document-based. Which database service should they use?

Accepted Answer

Firestore. Firestore is a NoSQL document database that provides real-time synchronization, offline support, and is designed for mobile and web apps. It integrates with Firebase SDKs.

Answer

Cloud Bigtable

Answer

BigQuery

Answer

Cloud SQL

Question 15

A company wants to set up a hybrid network between their on-premises data center and Google Cloud. They need a highly available VPN connection with 99.99% SLA. Which VPN solution should they choose?

Accepted Answer

HA VPN. HA VPN offers a 99.99% SLA (with certain conditions) when configured with two interfaces and two tunnels to two on-premises VPN gateways. Classic VPN does not provide an SLA.

Answer

Classic VPN

Answer

Cloud Interconnect

Answer

Cloud NAT