Google ACE Practice Test 13 — 15 Questions

Question 1

You are managing a GKE cluster that runs a mixed workload: latency-sensitive web services and batch data processing jobs. The batch jobs run for hours and consume significant CPU/memory. During batch peaks, the web services experience CPU throttling. What is the best configuration to prevent batch jobs from impacting web service latency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign web service pods a higher PriorityClass and run batch jobs on a separate node pool with taints.. It uses PriorityClass to ensure web service pods are scheduled and maintained over batch pods during resource contention, while placing batch jobs on a separate node pool with taints isolates their resource consumption. This prevents batch jobs from causing CPU throttling on latency-sensitive web services by guaranteeing that web pods have priority access to CPU cycles and that batch workloads do not share nodes with web pods.

Answer

Set CPU requests and limits on batch job pods to be lower than web service pods.

Answer

Use Horizontal Pod Autoscaler for batch jobs so they scale down during peak web traffic.

Answer

Enable Cluster Autoscaler so new nodes are added when batch jobs demand more resources.

Question 2

A company needs to run a batch processing workload that processes 10 TB of data nightly. The job runs for 4 hours and can tolerate interruption with checkpointing. Cost must be minimized. Which Compute Engine pricing model is most appropriate for the batch VMs?

Accepted Answer

Spot VMs (preemptible pricing). Spot VMs (preemptible pricing) are the most cost-effective choice for batch workloads that are fault-tolerant and can handle interruptions via checkpointing. Since the job runs for only 4 hours nightly and can resume from checkpoints, Spot VMs offer up to 60-91% cost savings over on-demand pricing without requiring any commitment.

Answer

On-demand VM pricing with committed use discounts (1-year CUD)

Answer

Sustained use discounts applied automatically to long-running VMs

Answer

Standard on-demand pricing with no special configuration

Question 3

Your application running on GKE is experiencing intermittent 500 errors. You want to create an alert that fires when the 99th percentile latency exceeds 2 seconds OR when the error rate (5xx responses) exceeds 1% of all requests over a 5-minute window. You have Cloud Monitoring configured with the application exporting metrics via OpenTelemetry. What should you create in Cloud Monitoring?

Accepted Answer

A single alerting policy with two conditions (p99 latency and error rate) joined with OR logic.. Cloud Monitoring alerting policies support multiple conditions combined with AND/OR logic, allowing you to trigger a single alert when either the 99th percentile latency exceeds 2 seconds or the error rate exceeds 1% over a 5-minute window. This directly matches the requirement without needing separate policies or relying on log-based detection.

Answer

Two separate alerting policies — one for latency and one for error rate — each with their own notification channel.

Answer

A log-based alert using Cloud Logging to detect 5xx response codes in access logs.

Answer

An SLO with error budget burn rate alerts configured in Cloud Monitoring.

Question 4

Your company's compliance policy requires that all customer data stored in Cloud Storage must be encrypted using keys stored in a Hardware Security Module (HSM). The encryption keys must be managed by your security team and must not be exportable. Which configuration meets these requirements?

Accepted Answer

Use Cloud KMS HSM-backed keys (protection level: HSM) with Cloud Storage CMEK.. Cloud KMS HSM-backed keys (protection level: HSM) ensure that encryption keys are stored in a Hardware Security Module, are managed by the security team, and are non-exportable by design. When used with Cloud Storage CMEK, this configuration meets the compliance requirement for HSM-based key storage with full customer control and no key export capability.

Answer

Use Cloud KMS software keys (protection level: SOFTWARE) with Cloud Storage CMEK.

Answer

Use Customer-Supplied Encryption Keys (CSEK) managed by your security team.

Answer

Enable Google-managed encryption with HSM by selecting it in Cloud Storage settings.

Question 5

You need to prevent developers from creating Compute Engine VMs with external IP addresses in a specific folder. Developers must still be able to create VMs with internal IPs only. Which org policy constraint enforces this?

Accepted Answer

Apply the `compute.vmExternalIpAccess` org policy constraint set to deny all VMs.. The `compute.vmExternalIpAccess` organization policy constraint is specifically designed to control whether Compute Engine VMs can be assigned external IP addresses. By setting this constraint to deny all VMs in the folder, developers are prevented from creating VMs with external IPs while still being able to create VMs with only internal IPs. This is the correct, native Google Cloud mechanism for enforcing this requirement at the folder level.

Answer

Create a VPC firewall rule blocking all outbound internet traffic.

Answer

Remove the `compute.instanceAdmin` role from developers so they cannot configure network interfaces.

Answer

Configure the default VPC network to use internal-only routes.

Question 6

You are planning a Private Service Connect (PSC) configuration to allow your VPC to access a managed Cloud SQL instance over a private endpoint without exposing traffic to the public internet. What does Private Service Connect provide in this context?

Accepted Answer

PSC provides a private, internal IP endpoint in your VPC that routes to the managed service without traversing the public internet.. Private Service Connect (PSC) allows you to access Google-managed services (like Cloud SQL) by creating a private, internal IP endpoint within your VPC. This endpoint uses an internal IP address from your VPC's subnet and forwards traffic to the service without ever leaving Google's network, thus avoiding the public internet. Unlike VPC peering, PSC does not require you to manage peering relationships or worry about overlapping IP ranges.

Answer

PSC creates a VPC peering connection between your VPC and Google's service VPC.

Answer

PSC enables bidirectional private communication between your VPC and the service's VPC, similar to peering.

Answer

PSC replaces the need for a Serverless VPC Access connector when calling managed services from Cloud Run.

Question 7

A platform team wants to define a formal service level objective (SLO) for their API: 99.9% of requests must succeed (HTTP 2xx) over a 30-day rolling window. Which Cloud Monitoring feature tracks this?

Accepted Answer

Define a Cloud Monitoring SLO with a 99.9% availability target over a 30-day rolling window. Cloud Monitoring's SLO feature is specifically designed to track compliance with a formal service level objective, such as 99.9% of requests succeeding over a 30-day rolling window. It automatically calculates the success rate from the selected metric (e.g., request count or latency) and reports the SLO's performance over the defined period, including error budgets and burn rates.

Answer

Create an alerting policy with a 99.9% threshold on the request success metric

Answer

Build a BigQuery dashboard showing 30-day average success rates from exported logs

Answer

Set an uptime check target of 99.9% in Cloud Monitoring

Question 8

Your Cloud Build pipeline needs to reference environment-specific configuration: `PROJECT_ID`, `REGION`, and `IMAGE_TAG` (generated from the Git commit SHA). Where should you define these values in `cloudbuild.yaml`?

Accepted Answer

Use built-in substitutions (`$PROJECT_ID`, `$COMMIT_SHA`) and define custom substitutions (`$_REGION`) in the trigger or `--substitutions` flag.. Cloud Build provides built-in substitutions like `$PROJECT_ID` and `$COMMIT_SHA` that automatically resolve to the current project ID and the Git commit SHA, respectively. Custom substitutions like `$_REGION` can be defined in the trigger configuration or passed via the `--substitutions` flag, allowing environment-specific values to be injected without hardcoding. This approach keeps the `cloudbuild.yaml` reusable across environments and avoids exposing sensitive or variable data in the build file.

Answer

Hardcode the values directly in each build step's `args` field.

Answer

Store all values in Cloud Secret Manager and retrieve them in each build step.

Answer

Use a `.env` file committed to the repository and source it in build steps.

Question 9

A billing report shows a Compute Engine VM has been running unused for 3 months. The team wants to stop it to save costs but needs the VM's disk data preserved for potential future use. What should they do?

Accepted Answer

Stop (shut down) the VM — compute charges stop but disk storage charges continue. Stopping (shutting down) a Compute Engine VM immediately halts all compute charges (vCPU, memory, GPU) while preserving the persistent disk and its data. The disk continues to incur storage costs, which is acceptable since the team wants to retain the data for potential future use. This is the most cost-effective approach that meets the requirement of preserving disk data without paying for idle compute resources.

Answer

Delete the VM to avoid all compute charges

Answer

Snapshot the VM disk and delete the VM

Answer

Set the VM to a smaller machine type to reduce costs

Question 10

A security review identifies that service account JSON key files are stored on multiple developer laptops, posing a data exfiltration risk. What is the recommended remediation?

Accepted Answer

Remove the key files and use service account impersonation or Workload Identity for workloads that need GCP access. Storing service account JSON key files on developer laptops creates a persistent credential that can be exfiltrated. The recommended remediation is to remove these static keys entirely and instead use service account impersonation (via the `iamcredentials.googleapis.com` API) or Workload Identity (for GKE or GCE workloads) to obtain short-lived access tokens. This eliminates the long-lived secret and follows Google's principle of using federated identity rather than distributing static keys.

Answer

Rotate the key files every 90 days and redistribute them securely

Answer

Encrypt the JSON key files using Cloud KMS before distributing

Answer

Store the key files in Secret Manager and retrieve them at application startup

Question 11

You are deploying a Cloud Run service revision that should initially receive 0% of traffic (for testing via a direct URL), while the existing revision continues to serve 100% of production traffic. Which `gcloud run deploy` flag achieves this?

Accepted Answer

`--no-traffic`. The `--no-traffic` flag on `gcloud run deploy` deploys a new revision but directs 0% of traffic to it, leaving the existing revision serving 100% of production traffic. This allows you to test the new revision via its direct URL without impacting live users. It is the correct and explicit way to achieve a zero-traffic deployment in Cloud Run.

Answer

`--traffic=0`

Answer

`--revision-suffix=canary` with no traffic configuration

Answer

`--min-instances=0 --max-instances=0`

Question 12

You are deploying a stateful application to GKE that requires each pod to have its own dedicated persistent disk, and each disk must persist data even if the pod is rescheduled to a different node. Which Kubernetes object type should you use?

Accepted Answer

StatefulSet with volumeClaimTemplates to provision individual PVCs per pod.. A StatefulSet with volumeClaimTemplates is the correct choice because it automatically provisions a unique PersistentVolumeClaim (PVC) for each pod replica, ensuring each pod gets its own dedicated persistent disk. When a pod is rescheduled to a different node, the PVC remains bound to its original PersistentVolume (PV), allowing the new pod to mount the same disk and retain the data. This meets the requirement for both per-pod dedicated storage and data persistence across rescheduling events.

Answer

Deployment with a shared PersistentVolumeClaim mounted by all pods.

Answer

DaemonSet with a hostPath volume on each node.

Answer

Deployment with an emptyDir volume for each pod.

Question 13

A team needs to roll out a configuration change to a MIG (Managed Instance Group) — updating the instance template to set a new environment variable. They want to validate the change on 1 VM before rolling it out to all 20 VMs. Which MIG update type supports this?

Accepted Answer

Canary update — update 1 VM to the new template, verify, then roll out to all. A canary update in a Managed Instance Group (MIG) allows you to specify a target size (e.g., 1 VM) to update to the new instance template first. After validating the change on that single VM, you can then promote the canary to roll out the new template to the remaining 19 VMs. This matches the requirement to test on 1 VM before full rollout.

Answer

Opportunistic update — the new template applies only when VMs are naturally replaced

Answer

Recreate update — terminate all 20 VMs and recreate with the new template simultaneously

Answer

Snapshot the existing VMs and restore 1 with the new environment variable to test

Question 14

A team's application emits a custom business metric (orders per minute) via its code. They want to display this metric on a Cloud Monitoring dashboard and alert when it drops below 50 orders per minute. What must be done first?

Accepted Answer

Instrument the application to write the metric to the Cloud Monitoring API using a client library or OpenTelemetry. Cloud Monitoring requires metrics to be explicitly ingested via its API or through OpenTelemetry. Custom metrics are not automatically available; the application must be instrumented to write the metric data (e.g., using the `cloud.google.com/go/monitoring` client library or OpenTelemetry exporter) to the Cloud Monitoring API. Without this step, the metric does not exist in Cloud Monitoring for dashboards or alerts.

Answer

Enable the Custom Metrics feature flag in the GCP Console under Cloud Monitoring settings

Answer

Create a log-based metric that extracts the orders value from application logs

Answer

Custom metrics require BigQuery — store values in BigQuery and link it to Cloud Monitoring

Question 15

A security team wants to prevent authorized users from copying BigQuery query results to a dataset in a different GCP project that is outside the team's security boundary — even if the user has valid IAM permissions. Which control enforces this?

Accepted Answer

VPC Service Controls with a perimeter enclosing BigQuery. VPC Service Controls (VPC-SC) create a security perimeter around Google Cloud services, including BigQuery, that prevents data exfiltration to projects outside the perimeter regardless of IAM permissions. By configuring a service perimeter that includes BigQuery and the authorized project, any attempt to copy query results to a dataset in a project outside the perimeter is blocked, even if the user has valid IAM roles. This enforces a data boundary that overrides IAM-based access.

Answer

IAM deny policies restricting cross-project BigQuery operations

Answer

An organization policy preventing resource creation outside specific projects

Answer

Cloud Armor rules blocking outbound API requests to BigQuery in other projects