Google ACE Practice Test 14 — 15 Questions

Question 1

A team deploys an application with sensitive internal APIs on GKE. The APIs should be reachable from other GKE services in the cluster and from on-premises systems via VPN, but not from the public internet. Which load balancer configuration meets this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Internal Application Load Balancer with a VPC-private IP. An Internal Application Load Balancer (HTTP/HTTPS) with a VPC-private IP is correct because it exposes the APIs only within the VPC network, making them reachable from other GKE services in the cluster and from on-premises systems via VPN (which extends the VPC), while blocking all public internet traffic by design. This load balancer operates at Layer 7 and uses an internal IP address that is not routable from the internet, satisfying the requirement without relying on additional access controls.

Answer

Global external Application Load Balancer with Cloud Armor blocking non-VPN IPs

Answer

A ClusterIP Service with an external IP range allowlist

Answer

NodePort Service with VPC firewall rules restricting access to VPN IP ranges

Question 2

A team enables OS Login on their GKE node pool. What does OS Login provide for SSH access to GKE nodes compared to the default metadata-based SSH key approach?

Accepted Answer

OS Login links SSH access to IAM roles — access is centrally managed and revocable via IAM without updating VM metadata. OS Login links SSH access to IAM roles, so access is centrally managed and revocable via IAM without updating VM metadata. This means you can grant or revoke SSH access to GKE nodes by assigning or removing IAM roles (e.g., roles/compute.osLogin) on user or service accounts, eliminating the need to manage SSH keys in instance metadata. This provides a more secure and auditable access control mechanism compared to the default metadata-based SSH key approach.

Answer

OS Login stores SSH keys in a Cloud KMS-managed keystore for enhanced encryption

Answer

OS Login automatically generates and rotates SSH key pairs every 24 hours

Answer

OS Login restricts SSH access to connections from specific IP ranges defined in Cloud Armor

Question 3

An application receives the error 'Permission denied on resource project [PROJECT_ID] (or it may not exist)' when making an API call with a service account. The service account has the correct IAM role. What else might be missing?

Accepted Answer

The relevant GCP API is not enabled in the project. The error 'Permission denied on resource project [PROJECT_ID] (or it may not exist)' typically occurs when the service account has the correct IAM role but the API being called is not enabled for the project. Even with proper IAM permissions, GCP requires that the specific API (e.g., Compute Engine API, Cloud Storage API) be enabled in the project before any API calls can succeed. Enabling the API activates the service and allows the service account to use it.

Answer

The service account needs the Project Owner role to make any API calls

Answer

The service account needs to be in the same organization as the project

Answer

The service account email must be explicitly allow-listed in the API's configuration

Question 4

An internal web application running on GKE must be accessible only to employees who are authenticated with the company's Google Workspace account — without exposing it to the internet or using a VPN. Which GCP service provides identity-based access without a VPN?

Accepted Answer

Cloud Identity-Aware Proxy (IAP) configured on the load balancer in front of the GKE service. Cloud Identity-Aware Proxy (IAP) is the correct choice because it enforces identity-based access control at the application layer, verifying that users are authenticated via Google Workspace before allowing traffic to reach the GKE service through an HTTPS load balancer. This eliminates the need for a VPN or public internet exposure by leveraging Google's global infrastructure to authenticate and authorize each request based on the user's identity and context.

Answer

VPC Service Controls creating a perimeter around the GKE cluster

Answer

Firebase Authentication SDK integrated into the web application frontend

Answer

Cloud Armor with a Google Workspace IP allowlist

Question 5

A BigQuery table in a data pipeline receives daily data loads. To control storage costs, the team wants table data older than 180 days to be automatically deleted at the table level, not the dataset level. How should this be configured?

Accepted Answer

Configure partition expiration on a date-partitioned table to expire partitions after 180 days. BigQuery's partition expiration feature allows you to automatically delete entire partitions from a date-partitioned table after a specified number of days. By setting the partition expiration to 180 days, all data in partitions older than 180 days is dropped at the table level, meeting the requirement without affecting other tables in the dataset.

Answer

Set a dataset-level default table expiration of 180 days in the dataset properties

Answer

Use a Cloud Scheduler job to run a DELETE statement on rows older than 180 days nightly

Answer

Set a table-level TTL using BigQuery's TTL API with a 180-day value

Question 6

A startup is building a mobile app backend. Traffic is highly variable: 10 requests/second at night, peaking to 50,000 requests/second during business hours. The backend is stateless. Which compute option best handles this traffic variability with minimal cost and operational effort?

Accepted Answer

Cloud Run with concurrency and max-instances configured.. Cloud Run is the best choice because it is a fully managed serverless platform that scales from zero to thousands of requests per second automatically, handling the extreme variability from 10 to 50,000 requests/second without provisioning overhead. By configuring concurrency (e.g., 80 concurrent requests per container) and max-instances, you cap costs while Cloud Run's autoscaling adds or removes container instances based on incoming traffic, making it ideal for stateless workloads with minimal operational effort.

Answer

Compute Engine managed instance group with autoscaling.

Answer

GKE cluster with Horizontal Pod Autoscaler.

Answer

App Engine Standard environment with automatic scaling.

Question 7

Your organization uses Cloud Storage for storing backups. You want to automatically delete backup objects that are older than 30 days to control costs. You also want objects between 7 and 30 days old to use Nearline storage class for lower cost. Which Cloud Storage feature manages both requirements in a single configuration?

Accepted Answer

Configure Object Lifecycle Management rules on the bucket with `SetStorageClass` and `Delete` actions.. Object Lifecycle Management rules in Cloud Storage allow you to define conditions (e.g., object age) and actions (e.g., SetStorageClass to Nearline, Delete) in a single configuration. This automates both the transition of objects aged 7–30 days to Nearline storage and the deletion of objects older than 30 days, without custom code or manual intervention.

Answer

Write a Cloud Function that runs daily, lists objects, and deletes or moves old ones.

Answer

Set a bucket-level retention policy of 30 days and manually change storage classes.

Answer

Use Cloud Scheduler to trigger `gsutil` commands that move and delete old objects.

Question 8

Your application runs on GKE and needs to call the Cloud Translation API. You want to follow Google's recommended security practice for service-to-cloud-API authentication within GKE. Which approach should you use?

Accepted Answer

Configure Workload Identity to bind the pod's Kubernetes Service Account to a Google Service Account with Translation API access.. Workload Identity is Google's recommended approach for authenticating workloads in GKE to Google Cloud APIs. It allows you to bind a Kubernetes Service Account (KSA) to a Google Service Account (GSA), so pods can impersonate the GSA without managing or storing long-lived service account keys. This eliminates the security risk of key exposure and follows the principle of least privilege.

Answer

Download a service account key JSON and mount it as a Kubernetes Secret in the pod.

Answer

Grant the GKE node pool's service account `roles/cloudtranslate.user`.

Answer

Use the GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to a mounted key file.

Question 9

Your GKE cluster nodes are running an older kernel version with a known vulnerability. You need to update all nodes to use the latest node image with the patched kernel without any downtime. The cluster has a Surge Upgrade configuration of `max-surge: 1, max-unavailable: 0`. What happens during the node upgrade?

Accepted Answer

GKE provisions one new node, drains one old node, deletes it, and repeats — zero downtime.. The surge upgrade configuration `max-surge: 1, max-unavailable: 0` ensures that GKE first provisions one new node (the surge node) before draining and deleting an old node. This rolling update process maintains the desired capacity at all times, resulting in zero downtime for applications.

Answer

GKE terminates all nodes simultaneously and creates new ones — brief downtime occurs.

Answer

GKE upgrades nodes in-place by applying a kernel patch without rescheduling pods.

Answer

Two nodes are upgraded simultaneously (one being the surge node and one old node going offline).

Question 10

What is the purpose of Cloud Audit Logs' Data Access audit logs, and why are they NOT enabled by default for most services?

Accepted Answer

They log API calls that read or write user data; they are off by default due to very high log volume and associated storage costs.. Data Access audit logs record every API call that reads or writes user-provided data (e.g., reading a Cloud Storage object or updating a BigQuery table). They are disabled by default because the sheer volume of these operations can generate terabytes of logs per day, leading to significant Cloud Logging storage costs and potential budget overruns. Administrators must explicitly enable them per service or per resource to control cost and log retention.

Answer

They record authentication events; they are disabled by default due to privacy regulations.

Answer

They log VM instance creation and deletion; they are disabled by default to avoid noise.

Answer

They provide real-time threat detection; they are experimental and not yet generally available.

Question 11

A team uses Cloud Shell for all GCP CLI operations. A developer notices that files they create in Cloud Shell's home directory persist between sessions, but files in other directories do not. What explains this behavior?

Accepted Answer

Only $HOME (~) has persistent 5 GB storage; other directories use ephemeral container storage. Cloud Shell provides each user with a persistent 5 GB home directory ($HOME) backed by Cloud Storage. Files created outside this directory reside in the container's ephemeral storage, which is discarded when the Cloud Shell session ends or is restarted. This design ensures user configurations and scripts are preserved while maintaining a clean, temporary environment for other operations.

Answer

Cloud Shell saves all files to Cloud Storage automatically

Answer

Cloud Shell stores files in Firestore, which only retains home directory paths

Answer

Files outside $HOME are deleted after 24 hours automatically

Question 12

A cost-conscious team notices their GKE cluster's node pools have consistently high memory utilization (>90%) while CPU remains at 30%. Pods are occasionally OOMKilled. What should they do to balance resource efficiency and stability?

Accepted Answer

Switch node pool machine type to a memory-optimized series (e.g., m2-ultramem) and ensure Pod memory requests are accurate. The team has a memory-bound workload (high memory utilization, low CPU, OOMKills). Switching to a memory-optimized machine series (e.g., m2-ultramem) provides a higher memory-to-CPU ratio, directly addressing the memory pressure. Ensuring accurate Pod memory requests allows the scheduler to place Pods efficiently and prevents overcommitment, balancing resource efficiency with stability.

Answer

Increase CPU limits for all Pods to use the available CPU capacity

Answer

Enable vertical pod autoscaling (VPA) set to Recreate mode as the only change

Answer

Reduce the number of replica Pods to lower memory consumption

Question 13

A healthcare company stores patient data in Cloud Storage. Compliance requires that even GCP (Google) cannot decrypt this data. The company manages encryption keys entirely on their own infrastructure. Which encryption option satisfies this?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK) provided with each API request. Customer-Supplied Encryption Keys (CSEK) allow the customer to provide their own AES-256 encryption key with each API request to Cloud Storage. Google does not store the key; it is used only in memory to encrypt/decrypt the data and then discarded, ensuring that even Google cannot access the plaintext. This meets the compliance requirement that the customer retains exclusive control over the encryption keys.

Answer

Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS

Answer

Google-managed encryption keys (default) with restricted IAM policies

Answer

Shielded VM with confidential computing for the VMs that access the data

Question 14

What action does the condition in the IAM policy restrict the user from performing?

Accepted Answer

Deleting disks that do not start with 'disk-'. The condition in the IAM policy restricts the user from performing actions on disks that do not meet the specified criteria. Specifically, the condition `resource.name.startsWith('disk-')` combined with the zone constraint `us-central1-a` means that only disks whose names start with 'disk-' in that zone are allowed for the granted action (e.g., `compute.disks.delete`). Therefore, the policy restricts the user from deleting disks that do not start with 'disk-'. Option A correctly identifies this restricted action.

Answer

Performing any action on compute instances

Answer

Performing any compute.admin action on disks in us-central1-a with names starting with 'disk-'

Answer

Creating disks in any zone other than us-central1-a

Question 15

An engineering team is deciding between App Engine Standard and App Engine Flexible for a Python API. The API has unpredictable traffic, must scale to zero when idle, runs standard Python code with no custom system packages, and requires < 1 second startup time. Which environment is most suitable?

Accepted Answer

App Engine Standard — it scales to zero, starts in sub-second, and supports standard Python runtimes. App Engine Standard is the correct choice because it automatically scales to zero instances during idle periods, starts new instances in under a second, and supports standard Python runtimes without custom system packages. The requirement for sub-second startup time and scaling to zero aligns perfectly with Standard's sandboxed, pre-loaded runtime environment, whereas Flexible environment has slower startup times due to VM provisioning and cannot scale to zero.

Answer

App Engine Flexible — it supports Python with custom packages

Answer

Both are equivalent — the difference is only in supported languages

Answer

Neither — use Cloud Run instead for Python APIs