Google ACE Practice Test 13 — 15 Questions

Question 1

A DevOps team deploys a MIG (Managed Instance Group) with autohealing configured. The health check probes `/health` on port 8080 with a 30-second initial delay. After deployment, new VMs are failing the health check and being immediately recreated — causing a restart loop. What is the most likely cause?

Accepted Answer

The initial delay is too short — the application hasn't finished starting before the health check probes begin. Option B is correct because the 30-second initial delay is too short for the application to complete its startup sequence. When the health check begins probing before the application is ready, it immediately fails, causing the MIG autohealing mechanism to treat the VM as unhealthy and recreate it, leading to a restart loop. The initial delay must be set to a value that exceeds the application's typical startup time.

Answer

The health check HTTP path `/health` doesn't exist — the application uses `/healthz`

Answer

Autohealing is incompatible with autoscaling — they cannot be used together

Answer

The MIG does not support HTTP health checks — TCP checks must be used instead

Question 2

You are designing an environment where a CI/CD pipeline running in GitHub Actions needs to deploy Cloud Run services without storing any long-lived service account keys. Your organization's security policy prohibits downloading SA keys. Which approach meets these requirements?

Accepted Answer

Use Workload Identity Federation to allow GitHub Actions to impersonate a service account using OIDC tokens.. Workload Identity Federation allows GitHub Actions to exchange OIDC tokens from GitHub's identity provider for Google Cloud service account impersonation, eliminating the need to download and store long-lived service account keys. This approach satisfies the security policy by using short-lived, automatically rotated tokens that are valid for only one hour, and it integrates directly with GitHub's OIDC provider without requiring any secret key material.

Answer

Create a service account key, base64-encode it, and store it as a GitHub Actions secret.

Answer

Grant the GitHub Actions runner VM's default service account the necessary roles.

Answer

Use Cloud Build triggers instead of GitHub Actions to avoid key management.

Question 3

A developer needs to use Application Default Credentials (ADC) in a local development environment to call the Cloud Translation API. They have already run `gcloud auth login`. What additional step is required to make ADC work correctly?

Accepted Answer

Run `gcloud auth application-default login` to generate ADC credentials.. Option A is correct because `gcloud auth application-default login` creates a special credential file (typically at `~/.config/gcloud/application_default_credentials.json`) that Application Default Credentials (ADC) uses to authenticate API calls. While `gcloud auth login` sets up user credentials for gcloud CLI commands, ADC does not use those credentials directly; it requires its own separate credential file. Running this command ensures that the local development environment can authenticate to the Cloud Translation API via ADC without additional configuration.

Answer

Set the `GOOGLE_CLOUD_PROJECT` environment variable to the project ID.

Answer

Download a service account JSON key and set `GOOGLE_APPLICATION_CREDENTIALS`.

Answer

Run `gcloud config set account` to switch to the correct account.

Question 4

You run `kubectl get pods` and see a pod in `ImagePullBackOff` state. What are the two most common causes of this error?

Accepted Answer

Incorrect image name/tag, or missing pull credentials for a private registry.. The `ImagePullBackOff` state indicates that the kubelet is unable to pull the container image from the registry. The two most common causes are an incorrect image name or tag (e.g., a typo or a non-existent tag), which results in a `404 Not Found` from the registry, and missing or invalid pull credentials for a private registry, which results in a `401 Unauthorized` or `403 Forbidden` response. Both prevent the image from being downloaded, causing the pod to enter a backoff loop.

Answer

Insufficient CPU/memory on the node, or the pod's resource requests are too high.

Answer

The pod's liveness probe is failing, causing the container to restart.

Answer

The container's entrypoint command is failing, causing the image pull to abort.

Question 5

A startup is building a mobile app backend. Traffic is highly variable: 10 requests/second at night, peaking to 50,000 requests/second during business hours. The backend is stateless. Which compute option best handles this traffic variability with minimal cost and operational effort?

Accepted Answer

Cloud Run with concurrency and max-instances configured.. Cloud Run is the best choice because it is a fully managed serverless platform that scales from zero to thousands of requests per second automatically, handling the extreme variability from 10 to 50,000 requests/second without provisioning overhead. By configuring concurrency (e.g., 80 concurrent requests per container) and max-instances, you cap costs while Cloud Run's autoscaling adds or removes container instances based on incoming traffic, making it ideal for stateless workloads with minimal operational effort.

Answer

Compute Engine managed instance group with autoscaling.

Answer

GKE cluster with Horizontal Pod Autoscaler.

Answer

App Engine Standard environment with automatic scaling.

Question 6

Your security team wants to prevent any user or service account from creating firewall rules that allow ingress from `0.0.0.0/0` (the internet) to any VM in your organization. Which approach enforces this without requiring per-project IAM changes?

Accepted Answer

Apply a hierarchical firewall policy at the organization level with a deny rule for ingress from 0.0.0.0/0, set to take precedence over project rules.. Option B is correct because hierarchical firewall policies at the organization level can include a deny rule for ingress from `0.0.0.0/0` with a priority that takes precedence over any project-level firewall rules. This enforces the restriction globally without requiring per-project IAM changes, as the policy is inherited by all projects in the organization.

Answer

Grant IAM deny policies that prevent the `compute.firewalls.create` permission across the organization.

Answer

Use Security Command Center to detect and alert when 0.0.0.0/0 firewall rules are created.

Answer

Set the `compute.skipDefaultNetworkCreation` org policy constraint across the organization.

Question 7

Your team uses Cloud Build to build and push Docker images to Artifact Registry. A new security requirement mandates that only images signed by Cloud Build (using Binary Authorization with attestors) can be deployed to your GKE cluster. Which sequence of steps correctly implements this?

Accepted Answer

Create a Cloud KMS key and attestor, configure Cloud Build to create attestations post-build, then set a BinAuthz policy requiring the attestation on the GKE cluster.. Option B is correct because it follows the required workflow: you must first create a Cloud KMS key and an attestor in Binary Authorization, then configure Cloud Build to generate an attestation (signed by the attestor) after each successful build. Finally, you set a Binary Authorization policy on the GKE cluster that enforces the attestation, ensuring only signed images are deployed. Cloud Build does not automatically sign images when BinAuthz is enabled; the attestation must be explicitly created.

Answer

Enable BinAuthz on the GKE cluster; Cloud Build automatically signs images when BinAuthz is enabled.

Answer

Use Artifact Registry vulnerability scanning; images that pass scanning are automatically trusted by GKE.

Answer

Add a Cloud Build step that runs `gcloud container binauthz attestations sign-and-create` without additional configuration.

Question 8

You need to monitor a Cloud Run service for errors and receive a PagerDuty notification when the number of 5xx errors exceeds 10 in any 5-minute window. Which Cloud Monitoring feature should you use?

Accepted Answer

Create a log-based metric on Cloud Run error logs, then create an alerting policy on that metric with a PagerDuty notification channel.. A log-based metric extracts a numeric counter from Cloud Run error logs (e.g., HTTP 5xx status codes). An alerting policy can then evaluate that metric over a sliding 5-minute window, triggering a PagerDuty notification via a configured notification channel when the count exceeds 10. This is the native, serverless approach that requires no additional infrastructure.

Answer

Configure Cloud Run to send error emails directly to the PagerDuty email integration.

Answer

Use Cloud Pub/Sub to stream Cloud Run logs to a custom application that pages PagerDuty.

Answer

Enable Cloud Run's built-in alerting feature in the service configuration.

Question 9

A team wants to deploy a container image at 'gcr.io/myproject/api:v2' as a Cloud Run service named 'api-service' in us-east1, accessible without authentication. Which command is correct?

Accepted Answer

gcloud run deploy api-service --image=gcr.io/myproject/api:v2 --region=us-east1 --allow-unauthenticated. Option A is correct because it uses the `gcloud run deploy` command with the `--image` flag to specify the container image, `--region=us-east1` to target the correct region, and `--allow-unauthenticated` to make the service publicly accessible without authentication. This matches the exact requirements for deploying a Cloud Run service with public access.

Answer

gcloud run create api-service --image=gcr.io/myproject/api:v2 --zone=us-east1 --public

Answer

gcloud cloud-run deploy api-service --container=gcr.io/myproject/api:v2 --region=us-east1

Answer

gcloud run deploy --name=api-service --image=gcr.io/myproject/api:v2 --region=us-east1 --no-auth

Question 10

You need to deploy a new version of an App Engine standard environment application. The new version should receive 10% of traffic while the current version continues to receive 90%. Which command achieves this?

Accepted Answer

`gcloud app services set-traffic default --splits v1=0.9,v2=0.1`. Option B is correct because the `gcloud app services set-traffic` command explicitly splits traffic between versions of an App Engine service. By specifying `--splits v1=0.9,v2=0.1`, you direct 90% of requests to version v1 and 10% to version v2, without deploying a new version or promoting it. This is the standard method for gradual traffic migration in App Engine standard environment.

Answer

`gcloud app deploy --version=v2 --no-promote`

Answer

`gcloud app versions migrate v2`

Answer

`gcloud app deploy --version=v2 --promote --stop-previous-version`

Question 11

You need to tag all Compute Engine VMs in your organization with a `cost-center` tag for billing allocation reports. The tag values must be controlled centrally — only predefined values should be allowed. Which GCP feature enables this?

Accepted Answer

Create Resource Manager Tag keys and values at the org level, then attach tags to VMs.. Resource Manager Tags (formerly 'tags' in the Resource Manager API) allow you to create tag keys and predefined tag values at the organization level, then attach those tags to resources like Compute Engine VMs. This ensures that only centrally controlled values can be used, meeting the requirement for controlled billing allocation. Labels, by contrast, are free-form key-value pairs and cannot have their values restricted natively by an org policy.

Answer

Use Compute Engine labels — configure label keys and restrict values using an org policy.

Answer

Use network tags on VMs and enforce allowed values via a custom org policy constraint.

Answer

Require teams to apply specific label values using a Terraform module, and enforce this via code review.

Question 12

Your organization policy at the root level sets `gcp.resourceLocations` to allow only `us-central1` and `us-east1`. A business unit needs to deploy resources in `europe-west1` for GDPR compliance. How can you grant this exception without affecting other business units?

Accepted Answer

Set a `gcp.resourceLocations` policy on the business unit's folder with `inheritFromParent: false`, allowing `us-central1`, `us-east1`, and `europe-west1`.. Option B is correct because Organization Policies support hierarchical inheritance, and setting `inheritFromParent: false` on the business unit's folder allows you to override the root-level `gcp.resourceLocations` constraint. This enables you to define a custom list of allowed locations (including `europe-west1`) for that specific folder without affecting other business units, as the policy is scoped to that folder only.

Answer

Create a separate GCP organization for the business unit and configure its own resource location policy.

Answer

Add a `europe-west1` exception to the root org policy using the `exceptions` field.

Answer

Remove the `gcp.resourceLocations` org policy from the root and apply it to each business unit's folder individually.

Question 13

You have pushed a new container image to Artifact Registry. The image is tagged `us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0`. You need to deploy this specific image version to Cloud Run in production. Which command deploys this exact image?

Accepted Answer

`gcloud run deploy app --image us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0 --region us-central1`. Option A is correct because the `gcloud run deploy` command with the `--image` flag explicitly specifies the exact container image URI from Artifact Registry, including the tag `v2.0`. This ensures that Cloud Run deploys that precise version of the image, and the `--region` flag targets the correct regional service. The full URI is required because Cloud Run must pull the image from the exact repository path and tag.

Answer

`gcloud run services update app --tag v2.0 --region us-central1`

Answer

`docker push us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0` followed by a Cloud Run auto-deploy.

Answer

`gcloud run deploy app --image app:v2.0 --region us-central1`

Question 14

You have an Artifact Registry repository for Python packages (`format: python`). A developer needs to publish a new Python package to this repository. Which tool and configuration allows them to publish?

Accepted Answer

Use `twine upload` with the Artifact Registry Python repository URL as the repository target.. B is correct because `twine` is the standard tool for uploading Python packages to package indices, and Artifact Registry's Python repositories are compatible with the PyPI API. By specifying the Artifact Registry repository URL as the `--repository-url` target in `twine upload`, the developer can authenticate via a service account or OAuth token and publish the package directly.

Answer

Use `pip install` pointing to the Artifact Registry URL to upload the package.

Answer

Use `docker push` to push the Python package as a container layer.

Answer

Use `gsutil cp` to copy the wheel file to the Artifact Registry bucket.

Question 15

Your application is deployed on GKE and experiencing increased latency. You suspect a memory leak causing the JVM to run frequent garbage collection cycles. Cloud Monitoring shows high memory usage but you need to understand the garbage collection behavior over time. Which GCP tool provides JVM-level profiling including memory allocation data?

Accepted Answer

Cloud Profiler with heap profiling enabled for the JVM application.. Cloud Profiler with heap profiling enabled captures JVM-level memory allocation data and garbage collection behavior over time, allowing you to identify memory leaks and GC frequency. Unlike generic memory monitoring, it provides per-method allocation snapshots and GC pause analysis specific to the JVM.

Answer

Cloud Trace

Answer

Cloud Monitoring with JVM MBeans metrics exported via the Ops Agent.

Answer

Error Reporting filtered for OutOfMemoryError exceptions.