Google ACE Practice Test 12 — 15 Questions

Question 1

A microservices application has intermittent high latency. The team wants to identify which specific service-to-service call in the request chain is causing the slowdown. Which Cloud Operations tool is designed for this?

Accepted Answer

Cloud Trace. Cloud Trace is designed to capture latency data for individual service-to-service calls in a distributed request chain. It provides end-to-end tracing by collecting trace spans from each microservice, allowing you to pinpoint which specific call is causing the slowdown. This makes it the correct tool for identifying the exact service-to-service latency bottleneck.

Answer

Cloud Monitoring Metrics Explorer

Answer

Cloud Logging log viewer

Answer

Cloud Profiler

Question 2

A GKE node pool has an autoscaler configured with min=2, max=10 nodes. After a sustained traffic surge, the cluster scaled to 10 nodes. Traffic drops overnight to its normal level, but the cluster remains at 10 nodes after 4 hours. What is the most likely reason?

Accepted Answer

Pods have a PodDisruptionBudget preventing eviction, or nodes are still within the scale-down cooldown period. Option B is correct because the cluster autoscaler will not scale down nodes that are hosting pods protected by a PodDisruptionBudget (PDB) that prevents eviction, or if the nodes are still within the scale-down cooldown period (default 10 minutes after a scale-up). Since the cluster scaled up to 10 nodes during the traffic surge, the autoscaler must wait for the cooldown to expire and for all pods to be safely evictable before removing nodes. If any pods have a PDB that blocks eviction (e.g., requiring at least 3 replicas), the autoscaler cannot terminate the underlying nodes, keeping the cluster at 10 nodes even after traffic drops.

Answer

Cluster autoscaler only scales down once per day

Answer

The max node count prevents scale-down — setting max=10 locks the cluster at 10 nodes

Answer

Cloud Monitoring alerts are pausing the autoscaler to investigate the traffic drop

Question 3

A media company ingests 500,000 events per second from IoT sensors and needs to store them for time-series analytics queries that scan billions of rows. Which storage service is most appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is the most appropriate service because it is a fully managed, scalable NoSQL database designed for high-throughput, low-latency workloads like IoT sensor data ingestion at 500,000 events per second. It supports time-series analytics queries scanning billions of rows via its wide-column storage model and integration with BigQuery for complex analytics, while providing sub-10ms latency for point lookups and efficient range scans.

Answer

Cloud Firestore

Answer

Cloud SQL for MySQL

Answer

BigQuery streaming inserts

Question 4

A developer needs to run an interactive shell inside a running GKE Pod named 'api-pod-7d4f9' in the 'production' namespace to investigate a runtime issue. Which kubectl command opens an interactive shell?

Accepted Answer

kubectl exec -it api-pod-7d4f9 -n production -- /bin/bash. Option B is correct because `kubectl exec -it` attaches an interactive terminal to a running container in a Pod, with `-i` for stdin and `-t` for a TTY. The `-- /bin/bash` launches a Bash shell inside the container, allowing the developer to investigate runtime issues. This is the standard Kubernetes method for interactive shell access.

Answer

kubectl ssh api-pod-7d4f9 -n production

Answer

kubectl run debug --image=busybox --attach=api-pod-7d4f9

Answer

gcloud container exec api-pod-7d4f9 --namespace=production -- bash

Question 5

A deployment pipeline runs `kubectl logs` to capture output from a crashed Pod's previous container instance. Which flag retrieves logs from the previous (terminated) container instance rather than the current one?

Accepted Answer

kubectl logs api-pod --previous. The `--previous` flag in `kubectl logs` retrieves logs from the previous (terminated) container instance of a Pod. This is essential for debugging crashes where the current container has restarted, as the logs from the failed instance are preserved and accessible only with this flag.

Answer

kubectl logs api-pod --terminated

Answer

kubectl logs api-pod --all-containers --since-crash

Answer

kubectl describe pod api-pod | grep -A 50 'Last State'

Question 6

An engineering team is deciding between App Engine Standard and App Engine Flexible for a Python API. The API has unpredictable traffic, must scale to zero when idle, runs standard Python code with no custom system packages, and requires < 1 second startup time. Which environment is most suitable?

Accepted Answer

App Engine Standard — it scales to zero, starts in sub-second, and supports standard Python runtimes. App Engine Standard is the correct choice because it automatically scales to zero instances during idle periods, starts new instances in under a second, and supports standard Python runtimes without custom system packages. The requirement for sub-second startup time and scaling to zero aligns perfectly with Standard's sandboxed, pre-loaded runtime environment, whereas Flexible environment has slower startup times due to VM provisioning and cannot scale to zero.

Answer

App Engine Flexible — it supports Python with custom packages

Answer

Both are equivalent — the difference is only in supported languages

Answer

Neither — use Cloud Run instead for Python APIs

Question 7

A distributed database running on GKE requires stable, persistent hostnames (pod-0, pod-1, pod-2) and ordered startup/shutdown for proper cluster initialization. Pods must retain their identity across restarts. Which Kubernetes resource is designed for this?

Accepted Answer

StatefulSet with a headless Service. StatefulSet is the correct resource because it provides stable, unique network identifiers (e.g., pod-0, pod-1, pod-2) via a headless Service, ordered startup and shutdown (pod-0 starts first, pod-2 terminates first), and persistent pod identity that survives restarts. These features are essential for distributed databases like Cassandra or ZooKeeper that require consistent hostnames and initialization order.

Answer

Deployment with pod affinity rules

Answer

DaemonSet with a unique hostname label on each node

Answer

ReplicaSet with a fixed replica count

Question 8

A GKE Deployment runs a web application with 6 replicas across a 3-node cluster. To ensure no two replicas land on the same node (maximizing availability), which Pod spec configuration should be applied?

Accepted Answer

Set podAntiAffinity with requiredDuringSchedulingIgnoredDuringExecution and topologyKey: kubernetes.io/hostname. Option A is correct because `podAntiAffinity` with `requiredDuringSchedulingIgnoredDuringExecution` and `topologyKey: kubernetes.io/hostname` forces the scheduler to place each replica on a different node. This ensures that no two pods of the same Deployment run on the same Kubernetes node, maximizing availability by preventing a single node failure from taking down more than one replica.

Answer

Set podAffinity with requiredDuringSchedulingIgnoredDuringExecution and topologyKey: kubernetes.io/hostname

Answer

Set topologySpreadConstraints with maxSkew: 1 and topologyKey: kubernetes.io/hostname

Answer

Set nodeSelector to a specific node for each replica

Question 9

A team stores application log archives in a Cloud Storage bucket. Logs older than 90 days should automatically move to Coldline storage, and logs older than 365 days should be deleted. Which feature automates this?

Accepted Answer

Cloud Storage Object Lifecycle Management rules on the bucket. Option B is correct because Cloud Storage Object Lifecycle Management rules allow you to automatically transition objects to Coldline storage after 90 days and delete them after 365 days based on object age conditions. This is a native, serverless feature that requires no external compute or scheduling, making it the most efficient and reliable approach for automating tiering and deletion of log archives.

Answer

Cloud Scheduler jobs that run gsutil rewrite and gsutil rm commands nightly

Answer

Cloud Pub/Sub notifications triggering a Cloud Function on each object creation

Answer

Retention policies that lock objects in Coldline after 90 days

Question 10

A monitoring alert fires at 3 AM — the team's GKE Pods are being evicted. Investigation shows node memory is at 98%. Pods without resource requests are being evicted first. What is the long-term fix to prevent evictions?

Accepted Answer

Add explicit memory requests (and optionally limits) to all Pod specs. B is correct because setting explicit memory requests ensures the Kubernetes scheduler can accurately place Pods on nodes with sufficient resources, preventing the node from being overcommitted. Without requests, Pods are treated as burstable or best-effort, making them the first candidates for eviction under the kubelet's Quality of Service (QoS) classes when node memory pressure hits 98%. This is a long-term fix because it enforces proper resource governance at the scheduling level, not just a reactive measure.

Answer

Set higher memory limits on the Pods being evicted

Answer

Disable node-level eviction by modifying kubelet configuration

Answer

Add more nodes to the cluster to increase available memory

Question 11

A security auditor needs to check whether a specific user (user@company.com) currently has sufficient permissions to delete a Cloud SQL instance in project 'prod-db'. Without making any changes, which tool simulates this check?

Accepted Answer

Use the IAM Policy Troubleshooter (Policy Simulator) to check if the permission is granted. The IAM Policy Troubleshooter (Policy Simulator) is the correct tool because it allows you to check whether a specific user has a particular permission (e.g., cloudsql.instances.delete) on a given resource (the Cloud SQL instance in project 'prod-db') without making any changes. It evaluates the effective IAM policy, including all inherited roles and policies, and returns a result indicating whether the permission is granted. This directly addresses the auditor's need to simulate a permission check without executing any action.

Answer

Run the delete command with `--dry-run` flag to simulate without executing

Answer

Inspect the IAM policy with `gcloud projects get-iam-policy` and manually trace inheritance

Answer

Grant the user the permission temporarily, test the delete, then revoke it

Question 12

A team needs to create a Compute Engine VM but the `gcloud compute instances create` command is failing with 'insufficient permissions'. The team lead says the service account has the Compute Engine Default role. What is the minimal IAM role that allows creating VM instances?

Accepted Answer

Compute Instance Admin (v1). The Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) provides the necessary permissions to create, modify, and delete Compute Engine VM instances. The Compute Engine Default service account lacks the required permissions for instance creation, and this role is the minimal predefined IAM role that includes compute.instances.create.

Answer

Compute Viewer

Answer

Compute Network Admin

Answer

Project Editor

Question 13

An e-commerce platform sees a 20x traffic spike every Black Friday. The rest of the year traffic is low and stable. The team wants to minimize costs during normal periods while handling the annual peak without manual intervention. Which architecture achieves this?

Accepted Answer

Managed instance group with autoscaling + scheduled scaling pre-warming before Black Friday. Option B is correct because it combines managed instance group autoscaling for normal low-cost operation with scheduled scaling to pre-warm capacity before the Black Friday spike, ensuring seamless handling of the 20x traffic surge without manual intervention. This approach uses the 'autoscaler' and 'scheduled scaling' features in Google Cloud to dynamically adjust resources based on load, while pre-warming prevents cold-start latency during the peak.

Answer

Pre-provision 20x capacity year-round to guarantee Black Friday performance

Answer

Deploy on Cloud SQL — it scales compute automatically for traffic spikes

Answer

Add 20 manual VMs on Black Friday and delete them afterward each year

Question 14

A team uses Terraform to manage GCP infrastructure. After running `terraform plan`, they see 15 resources to be created. They want to apply only the Cloud SQL instance (resource name: `google_sql_database_instance.main`) without applying all 15 changes. Which Terraform command targets a specific resource?

Accepted Answer

terraform apply -target=google_sql_database_instance.main. Option B is correct because Terraform uses the `-target` flag to limit the operation to a specific resource address, allowing you to apply only the `google_sql_database_instance.main` resource without affecting the other 14 resources in the plan. This is the standard Terraform syntax for targeting a single resource during `apply` or `destroy` operations.

Answer

terraform apply --resource=google_sql_database_instance.main

Answer

terraform apply -only=google_sql_database_instance.main

Answer

terraform plan --filter=google_sql_database_instance.main && terraform apply

Question 15

A developer reports that a Cloud Function is failing with '403 Forbidden' when calling the BigQuery API. The function's service account has the BigQuery Data Viewer role. What is a likely additional requirement that may be missing?

Accepted Answer

The BigQuery API may not be enabled in the Cloud Functions' project. The 403 Forbidden error indicates that the Cloud Function's service account lacks the necessary permissions to call the BigQuery API. Even with the correct IAM role (BigQuery Data Viewer), the BigQuery API must be explicitly enabled in the project where the Cloud Function is running, as Google Cloud requires APIs to be activated per project before they can be used. Without enabling the API, any API call from the function will be rejected with a 403, regardless of IAM roles.

Answer

The Cloud Function must be deployed in the same region as the BigQuery dataset

Answer

Cloud Functions cannot call BigQuery — it must use Dataflow or BigQuery scheduled queries instead

Answer

The service account needs the BigQuery Admin role instead of Data Viewer to make API calls