Google ACE Practice Test 13 — 15 Questions

Question 1

An engineer needs to create a Cloud Storage bucket for storing archival data that will be accessed less than once a year. The data must be stored durably and cost-effectively. Which storage class should the engineer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Archive. Archive storage class is designed for data accessed less than once a year, with the lowest storage cost but higher retrieval costs and a 365-day minimum storage duration. It is ideal for long-term archival.

Answer

Coldline

Answer

Standard

Answer

Nearline

Question 2

A company has a VPC with a subnet that has Private Google Access enabled. They want their Compute Engine instances to access Google APIs and services through internal IP addresses. Which additional configuration is required?

Accepted Answer

No additional configuration is required.. Private Google Access on a subnet allows instances in that subnet to reach Google APIs and services using internal IP addresses. No additional configuration is needed if the instances are in that subnet. Cloud NAT is for outbound internet access, not for Google API access. Cloud VPN and Cloud Interconnect are for hybrid connectivity.

Answer

Configure Cloud NAT to enable access to Google APIs.

Answer

Set up Cloud VPN tunnels to Google APIs.

Answer

Create a VPC peering connection with the Google APIs VPC.

Question 3

A company wants to use Google Cloud Pricing Calculator to estimate the monthly cost of running a Compute Engine instance for a web server. They plan to use a n2-standard-4 machine with a 100 GB SSD persistent disk and commit to a 1-year term. Which discount type should they include in the estimate?

Accepted Answer

Committed use discount (1 year). Committed use discounts (CUDs) offer significant savings (up to 57% for machine types) in exchange for committing to 1 or 3 years. Sustained use discounts apply automatically for running instances >25% of the month, but CUDs are additional and can be combined. For a 1-year commitment, they should include CUD for the machine type.

Answer

No discount is needed; the price shown is final

Answer

Free tier discount

Answer

Sustained use discount only

Question 4

A company is migrating a legacy application to Google Cloud. The application requires a shared file system that can be mounted by multiple compute instances across different zones for high availability. Which two Google Cloud services can meet this requirement?

Accepted Answer

Google Cloud NetApp Volumes. Cloud Filestore and Google Cloud NetApp Volumes provide NFS-based file shares that can be mounted by multiple instances across zones. Persistent Disk cannot be attached in read-write mode to multiple instances across zones. Cloud Storage FUSE is not a POSIX-compliant shared file system. Cloud Run is a compute service, not a storage service.

Answer

Persistent Disk

Answer

Cloud Storage FUSE

Answer

Cloud Run

Question 5

A company is migrating a PostgreSQL database to Cloud SQL. They need high availability with automatic failover and a read replica for reporting queries that must not impact the primary. Which Cloud SQL configuration should they choose?

Accepted Answer

High Availability (HA) configuration with a read replica. Cloud SQL High Availability provides a synchronous standby in a different zone with automatic failover. Adding a read replica offloads reporting queries and does not affect the primary.

Answer

High Availability (HA) configuration with automatic storage increase

Answer

Single zone instance with a failover replica

Answer

Single zone instance with cross-region replication

Question 6

A company uses Cloud SQL with Customer-Managed Encryption Keys (CMEK). The security team wants to rotate the encryption key. What is the impact on the Cloud SQL instance?

Accepted Answer

The instance must be stopped and restarted after the key rotation.. When rotating a CMEK for Cloud SQL, the instance must be restarted to use the new key version. Data remains encrypted at all times.

Answer

The instance becomes unavailable until the key rotation is complete.

Answer

All data in the instance is re-encrypted immediately.

Answer

There is no impact; the instance automatically uses the new key version.

Question 7

An organization needs to run a batch analytics job daily that processes 500 GB of data stored in Cloud Storage. The job runs for 2 hours each day and can tolerate occasional failures. The team wants to minimize compute costs. Which compute option is most cost-effective?

Accepted Answer

Compute Engine with preemptible VMs. Preemptible VMs cost about 60-80% less than regular VMs and are suitable for fault-tolerant, short-lived batch jobs. Committed use discounts require a 1-year commitment and are not suitable if the job runs only 2 hours per day. Sustained use discounts apply automatically but preemptible VMs are cheaper. Standard VMs are more expensive.

Answer

Compute Engine with sole-tenant nodes

Answer

Compute Engine with standard VMs and sustained use discount

Answer

Compute Engine with committed use discount for 1 year

Question 8

A developer is deploying a Cloud Function that processes messages from a Pub/Sub topic. The function takes 10 minutes to complete each message. The developer needs to ensure that messages are not lost if the function fails. Which Cloud Function generation and configuration should they use?

Accepted Answer

Cloud Functions (2nd gen) with an event-driven trigger from Pub/Sub and retry on failure. Cloud Functions (2nd gen) supports longer timeouts (up to 60 minutes) and event-driven triggers like Pub/Sub with retries. 1st gen has a max timeout of 9 minutes. Retry on failure is configured in the subscription. Background functions are 1st gen.

Answer

Cloud Functions (1st gen) with an HTTP trigger and a Pub/Sub push subscription

Answer

Cloud Functions (2nd gen) with an HTTP trigger

Answer

Cloud Functions (1st gen) with a background function and retry on failure

Question 9

A security engineer needs to ensure that all VMs in a subnet use Private Google Access to reach Google APIs without external IP addresses. What must be enabled?

Accepted Answer

Private Google Access on the subnet.. Private Google Access on a subnet allows VMs with only internal IP addresses to reach Google APIs and services through the default internet gateway.

Answer

A firewall rule allowing egress to 0.0.0.0/0.

Answer

VPC Flow Logs on the subnet.

Answer

Cloud NAT on the VPC.

Question 10

You need to create a service account for a Compute Engine instance to allow it to access Cloud Storage objects. The service account should have minimal permissions. What is the recommended approach?

Accepted Answer

Create a service account, grant it the required roles, and specify it when creating the instance using the --service-account flag. Create a service account with only the necessary roles (e.g., roles/storage.objectViewer) and attach it to the instance at creation time. Avoid downloading service account keys; use instance metadata-based credentials instead.

Answer

Create a service account and assign it to the instance using gcloud compute instances set-service-account after creation

Answer

Use the default compute engine service account and grant it roles/storage.objectAdmin

Answer

Create a service account, download a JSON key, and store it on the instance's local disk

Question 11

You need to update a deployment in your GKE cluster from image version v1 to v2 gradually, ensuring that only a small percentage of pods run v2 initially. After the rollout, you want to verify the rollout status. Which commands should you use?

Accepted Answer

kubectl set image deployment/my-deployment my-container=gcr.io/my-project/my-image:v2 --record && kubectl rollout status deployment/my-deployment. Use kubectl set image to update the image, then kubectl rollout status to monitor the rollout. For gradual rollout, you can use kubectl rollout pause/resume or set maxSurge/maxUnavailable, but the question asks for the command to update and verify.

Answer

kubectl apply -f updated-deployment.yaml and kubectl rollout undo

Answer

kubectl edit deployment and kubectl rollout history

Answer

kubectl run my-deployment --image=gcr.io/my-project/my-image:v2 and kubectl get pods

Question 12

You are using Cloud Logging and want to export all logs from a specific Compute Engine instance to BigQuery for long-term analysis. You create a log sink with a filter for the instance's resource type and labels. What additional step is required to complete the export?

Accepted Answer

Create a BigQuery dataset and grant the log sink's service account the BigQuery Data Editor role. Log sinks require a destination. For BigQuery, the sink must be configured with the destination as a BigQuery dataset. You must create the dataset first, then specify it in the sink. The sink also needs appropriate permissions on the dataset.

Answer

Create a Cloud Pub/Sub topic and configure a push subscription

Answer

Create a Cloud Storage bucket as a staging location

Answer

Enable BigQuery's streaming buffer on the dataset

Question 13

An engineer needs to view the current IAM policy for a project in JSON format. Which gcloud command should they use?

Accepted Answer

gcloud projects get-iam-policy PROJECT_ID --format json. The gcloud projects get-iam-policy command retrieves the IAM policy for a project. The --format flag allows you to specify the output format, such as JSON. The other commands are for different purposes: set-iam-policy sets the policy, add-iam-policy-binding adds a binding, and describe-iam-policy does not exist.

Answer

gcloud iam projects describe-iam-policy PROJECT_ID --format json

Answer

gcloud projects add-iam-policy-binding PROJECT_ID --format json

Answer

gcloud projects set-iam-policy PROJECT_ID --format json

Question 14

An engineer creates a firewall rule allowing ingress on port 8080 from source range 10.0.0.0/8 with priority 1000. Another rule denies ingress on port 8080 from source range 10.0.0.0/24 with priority 500. What is the effective behavior for traffic from 10.0.0.1?

Accepted Answer

Traffic is denied because the deny rule has a higher priority (lower number).. Firewall rules are evaluated in order of priority; lower numbers have higher priority. The deny rule (priority 500) has higher priority than the allow rule (priority 1000), so traffic from 10.0.0.1 (within 10.0.0.0/24) will be denied.

Answer

Traffic is denied only if the source is exactly 10.0.0.1; otherwise allowed.

Answer

Traffic is allowed because the allow rule covers a larger range.

Answer

Traffic is allowed because both rules match and the default is to allow.

Question 15

An organization wants to deploy a containerized web application on GKE. They need the application to be accessible from the internet via a stable IP address. Which service type should they use when exposing the deployment?

Accepted Answer

LoadBalancer. A LoadBalancer service type provisions a Google Cloud TCP/UDP Load Balancer and assigns a stable external IP address. NodePort exposes on a high port but requires manual setup; ClusterIP is internal only.

Answer

ClusterIP

Answer

NodePort

Answer

ExternalName