Google ACE Practice Test 12 — 15 Questions

Question 1

A DevOps engineer needs to deploy a containerized microservice to Cloud Run that processes messages from Pub/Sub. The service must authenticate to Google Cloud APIs using a service account. Which Cloud Run deployment command should they use to ensure the service uses a specific service account?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --service-account my-sa@my-project.iam.gserviceaccount.com --platform managed. Cloud Run supports the --service-account flag to attach a specific service account. The --image flag specifies the container image. The other options either use incorrect flags (--account is for gcloud CLI user, not service account) or miss required flags.

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --account my-sa@my-project.iam.gserviceaccount.com

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --impersonate-service-account my-sa@my-project.iam.gserviceaccount.com

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image

Question 2

Which TWO practices help ensure the reliability of a Cloud Functions deployment? (Choose two.)

Accepted Answer

Use Cloud Tasks to decouple function invocations.. Cloud Tasks decouples function invocations by queuing requests and delivering them asynchronously, which improves reliability by handling spikes in traffic without dropping requests and providing automatic retries on failure. Option E is correct because implementing retry policies for background functions (e.g., Cloud Functions triggered by Pub/Sub or Cloud Storage) ensures that transient failures are automatically retried, increasing the overall reliability of the deployment.

Answer

Deploy functions in a single region to minimize latency.

Answer

Configure a VPC connector for all functions.

Answer

Set maximum instances to 1 to avoid resource contention.

Question 3

A startup wants to create a new GCP project for development. They've already created a billing account. Which command can they use to create the project?

Accepted Answer

gcloud projects create PROJECT_ID. The 'gcloud projects create' command creates a new project. The billing association is separate, but the project can be created without billing immediately.

Answer

gcloud config set project PROJECT_ID

Answer

gcloud alpha projects create

Answer

gcloud resource-manager projects create

Question 4

You need to delete a GCP project, but the deletion fails with an error. What is the most likely cause?

Accepted Answer

The project's billing account is still linked. GCP requires that billing be disabled before a project can be deleted. If billing is still active, deletion will fail.

Answer

The project has IAM policies attached

Answer

The project still has active resources such as Compute Engine instances

Answer

The project is in a folder

Question 5

An administrator wants to set up a budget alert that triggers at 50%, 90%, and 100% of the monthly spending limit. What is the correct way to configure this?

Accepted Answer

Create one budget with three threshold rules: 50%, 90%, 100%. Budget alerts can have multiple threshold rules with different percentages. You can create a single budget with three threshold rules.

Answer

Create a budget with a single threshold of 100% and rely on Cloud Monitoring

Answer

Use Cloud Billing reports to manually track

Answer

Create three separate budgets, each with a single threshold

Question 6

You have a Cloud Run service that is experiencing high latency. You want to analyze the latency distribution of requests. Which Google Cloud tool should you use?

Accepted Answer

Cloud Trace. Cloud Trace is a distributed tracing service that collects latency data from applications and provides detailed analysis, including latency distributions and per-request traces.

Answer

Cloud Debugger

Answer

Cloud Logging Log Explorer

Answer

Cloud Monitoring Metrics Explorer

Question 7

After creating a new GCP project, an engineer attempts to delete it using `gcloud projects delete PROJECT_ID` but receives an error. What is the most likely cause?

Accepted Answer

The project is linked to a billing account that must be disabled first. A project cannot be deleted if it has a billing account attached. The billing account must be disabled (disassociated) first.

Answer

The project still has running resources (e.g., VM instances)

Answer

The IAM policy prevents deletion

Answer

The project ID is invalid

Question 8

An engineer is using Terraform to manage GCP resources. They want to store the Terraform state file remotely so that the team can collaborate. Which backend configuration should they use?

Accepted Answer

backend "gcs" { bucket = "my-terraform-state" }. Terraform supports storing state in GCS by using the 'gcs' backend. The bucket must be created before configuration. The 'local' backend stores state locally, which does not enable collaboration. 'cloud' is not a valid backend type. 'consul' is not GCP-native.

Answer

backend "cloud" { bucket = "my-terraform-state" }

Answer

backend "local" { path = "terraform.tfstate" }

Answer

backend "consul" { address = "consul.example.com" }

Question 9

Which command creates a Google-managed SSL certificate for the domain 'example.com'?

Accepted Answer

gcloud compute ssl-certificates create my-cert --domains example.com. Google-managed certificates are created with 'gcloud compute ssl-certificates create' with the '--domains' flag. The other commands are for different purposes.

Answer

gcloud compute addresses create my-cert --global

Answer

gcloud compute ssl-policies create my-policy

Answer

gcloud compute target-https-proxies create my-proxy --ssl-certificates my-cert

Question 10

An engineer needs to migrate a large on-premises database to Cloud SQL for PostgreSQL. The database is 500 GB and can tolerate a few hours of downtime. The migration must minimize manual intervention. Which approach should the engineer use?

Accepted Answer

Use Database Migration Service (DMS). Database Migration Service supports homogeneous migrations (including PostgreSQL to Cloud SQL) and automates the process. It supports continuous replication and minimal downtime. The others are not ideal: pg_dump requires manual steps and downtime; gcloud sql import is for file import; Compute Engine with pg_dump involves manual steps.

Answer

Use pg_dump to export and pg_restore to import

Answer

Use gcloud sql import to import a dump file

Answer

Set up a Compute Engine instance to run pg_dump and then gcloud sql import

Question 11

An engineer is setting up Cloud Identity for a new domain. What is a prerequisite for creating a Cloud Identity account?

Accepted Answer

Domain verification. Cloud Identity requires domain verification to prove ownership. This is done via DNS TXT record or other methods.

Answer

A G Suite account

Answer

A billing account

Answer

An existing Google Cloud project

Question 12

You need to install the Google Cloud SDK on a Linux machine. Which command should you use to add the Cloud SDK distribution URI as a package source?

Accepted Answer

echo 'deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main' | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list. The Cloud SDK installation guide for Linux uses echo to add the URI to /etc/apt/sources.list.d/google-cloud-sdk.list.

Answer

curl https://sdk.cloud.google.com | bash

Answer

gcloud init

Answer

sudo apt-get install google-cloud-sdk

Question 13

You are managing a Cloud Functions deployment that processes messages from a Pub/Sub topic. You need to ensure the function can read messages from the topic and acknowledge them. Which IAM role should you assign to the function's service account?

Accepted Answer

roles/pubsub.subscriber. The Pub/Sub Subscriber role (roles/pubsub.subscriber) grants permission to pull messages and acknowledge them. The function's service account needs this role on the topic or subscription.

Answer

roles/pubsub.publisher

Answer

roles/pubsub.viewer

Answer

roles/iam.serviceAccountUser

Question 14

You have updated a deployment in GKE, but the new pods are crashing. You want to revert to the previous working version. What should you do?

Accepted Answer

kubectl rollout undo deployment/my-app. kubectl rollout undo reverts to the previous revision.

Answer

kubectl rollout status deployment/my-app

Answer

kubectl scale deployment/my-app --replicas=0

Answer

kubectl delete deployment/my-app and recreate

Question 15

Your organization policy at the root level sets `gcp.resourceLocations` to allow only `us-central1` and `us-east1`. A business unit needs to deploy resources in `europe-west1` for GDPR compliance. How can you grant this exception without affecting other business units?

Accepted Answer

Set a `gcp.resourceLocations` policy on the business unit's folder with `inheritFromParent: false`, allowing `us-central1`, `us-east1`, and `europe-west1`.. Organization Policies support hierarchical inheritance, and setting `inheritFromParent: false` on the business unit's folder allows you to override the root-level `gcp.resourceLocations` constraint. This enables you to define a custom list of allowed locations (including `europe-west1`) for that specific folder without affecting other business units, as the policy is scoped to that folder only.

Answer

Create a separate GCP organization for the business unit and configure its own resource location policy.

Answer

Add a `europe-west1` exception to the root org policy using the `exceptions` field.

Answer

Remove the `gcp.resourceLocations` org policy from the root and apply it to each business unit's folder individually.