Google ACE Practice Test 14 — 15 Questions

Question 1

An engineer needs to grant an external auditor read-only access to view IAM policies on a GCP project. The auditor should not have access to any other resources. Which IAM role should be assigned?

Accepted Answer

roles/iam.securityReviewer. The `roles/iam.securityReviewer` role grants permission to view IAM policies without granting access to other resources. It is specifically designed for security auditors.

Answer

roles/iam.roleAdmin

Answer

roles/iam.serviceAccountAdmin

Answer

roles/viewer

Question 2

A DevOps engineer needs to deploy a containerized microservice to Cloud Run that processes messages from Pub/Sub. The service must authenticate to Google Cloud APIs using a service account. Which Cloud Run deployment command should they use to ensure the service uses a specific service account?

Accepted Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --service-account my-sa@my-project.iam.gserviceaccount.com --platform managed. Cloud Run supports the --service-account flag to attach a specific service account. The --image flag specifies the container image. The other options either use incorrect flags (--account is for gcloud CLI user, not service account) or miss required flags.

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --account my-sa@my-project.iam.gserviceaccount.com

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --impersonate-service-account my-sa@my-project.iam.gserviceaccount.com

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image

Question 3

You need to create a log-based metric that counts the number of 5xx errors from your application logs. The logs are in Cloud Logging and contain a field "httpRequest.status". Which filter should you use when creating the metric?

Accepted Answer

httpRequest.status >= 500. Log-based metrics use Cloud Logging filter language to select log entries.

Answer

httpRequest.status:5*

Answer

severity=ERROR AND "5xx"

Answer

httpRequest.status = 500 OR httpRequest.status = 501 OR httpRequest.status = 502

Question 4

You are investigating high latency in your application deployed on Compute Engine. You suspect a specific API call is taking longer than expected. Which Google Cloud tool should you use to analyze the latency of individual requests?

Accepted Answer

Cloud Trace. Cloud Trace provides distributed tracing, allowing you to see the latency of individual requests and identify bottlenecks. It captures trace spans from supported frameworks and services.

Answer

Cloud Debugger

Answer

Cloud Monitoring dashboards

Answer

Cloud Logging log explorer

Question 5

Which TWO practices help ensure the reliability of a Cloud Functions deployment? (Choose two.)

Accepted Answer

Use Cloud Tasks to decouple function invocations.. Cloud Tasks decouples function invocations by queuing requests and delivering them asynchronously, which improves reliability by handling spikes in traffic without dropping requests and providing automatic retries on failure. Option E is correct because implementing retry policies for background functions (e.g., Cloud Functions triggered by Pub/Sub or Cloud Storage) ensures that transient failures are automatically retried, increasing the overall reliability of the deployment.

Answer

Deploy functions in a single region to minimize latency.

Answer

Configure a VPC connector for all functions.

Answer

Set maximum instances to 1 to avoid resource contention.

Question 6

A company wants to store event logs from multiple applications in a centralized location for future analysis. The logs are written frequently (thousands per second) and need to be retained for 90 days. The data is write-once, read-rarely. Which storage class and lifecycle rule combination is most cost-effective?

Accepted Answer

Set default storage class to Coldline and use lifecycle rule to delete after 90 days. For write-once, read-rarely data, Coldline storage class is cost-effective for data accessed less than once per 90 days. Set a lifecycle rule to delete objects after 90 days. Alternatively, use Standard for the first 30 days then move to Coldline, but the question asks for a combination. The simplest is to set the default storage class to Coldline and a lifecycle rule to delete at 90 days.

Answer

Set default storage class to Archive and use lifecycle rule to delete after 90 days

Answer

Set default storage class to Standard and use lifecycle rule to delete after 90 days

Answer

Set default storage class to Nearline and use lifecycle rule to delete after 90 days

Question 7

You have a managed instance group (MIG) with instances that need to run a startup script to configure monitoring agents. You created the instance template without a startup script. Which action should you take to add the startup script?

Accepted Answer

Create a new instance template with the startup script, then update the MIG to use the new template via a rolling update.. Instance templates are immutable; you cannot modify them. You must create a new instance template with the startup script and update the MIG to use it via rolling update or by setting the template.

Answer

Use gcloud compute instances add-metadata to add the startup script to each running instance.

Answer

Delete the MIG and recreate it with a new template; you cannot change the template of an existing MIG.

Answer

Edit the existing instance template and add the startup script under 'metadata'.

Question 8

A startup wants to create a new GCP project for development. They've already created a billing account. Which command can they use to create the project?

Accepted Answer

gcloud projects create PROJECT_ID. The 'gcloud projects create' command creates a new project. The billing association is separate, but the project can be created without billing immediately.

Answer

gcloud config set project PROJECT_ID

Answer

gcloud alpha projects create

Answer

gcloud resource-manager projects create

Question 9

You need to delete a GCP project, but the deletion fails with an error. What is the most likely cause?

Accepted Answer

The project's billing account is still linked. GCP requires that billing be disabled before a project can be deleted. If billing is still active, deletion will fail.

Answer

The project has IAM policies attached

Answer

The project still has active resources such as Compute Engine instances

Answer

The project is in a folder

Question 10

An administrator wants to set up a budget alert that triggers at 50%, 90%, and 100% of the monthly spending limit. What is the correct way to configure this?

Accepted Answer

Create one budget with three threshold rules: 50%, 90%, 100%. Budget alerts can have multiple threshold rules with different percentages. You can create a single budget with three threshold rules.

Answer

Create a budget with a single threshold of 100% and rely on Cloud Monitoring

Answer

Use Cloud Billing reports to manually track

Answer

Create three separate budgets, each with a single threshold

Question 11

You have a Cloud Run service that is experiencing high latency. You want to analyze the latency distribution of requests. Which Google Cloud tool should you use?

Accepted Answer

Cloud Trace. Cloud Trace is a distributed tracing service that collects latency data from applications and provides detailed analysis, including latency distributions and per-request traces.

Answer

Cloud Debugger

Answer

Cloud Logging Log Explorer

Answer

Cloud Monitoring Metrics Explorer

Question 12

After creating a new GCP project, an engineer attempts to delete it using `gcloud projects delete PROJECT_ID` but receives an error. What is the most likely cause?

Accepted Answer

The project is linked to a billing account that must be disabled first. A project cannot be deleted if it has a billing account attached. The billing account must be disabled (disassociated) first.

Answer

The project still has running resources (e.g., VM instances)

Answer

The IAM policy prevents deletion

Answer

The project ID is invalid

Question 13

An engineer is using Terraform to manage GCP resources. They want to store the Terraform state file remotely so that the team can collaborate. Which backend configuration should they use?

Accepted Answer

backend "gcs" { bucket = "my-terraform-state" }. Terraform supports storing state in GCS by using the 'gcs' backend. The bucket must be created before configuration. The 'local' backend stores state locally, which does not enable collaboration. 'cloud' is not a valid backend type. 'consul' is not GCP-native.

Answer

backend "cloud" { bucket = "my-terraform-state" }

Answer

backend "local" { path = "terraform.tfstate" }

Answer

backend "consul" { address = "consul.example.com" }

Question 14

Which command creates a Google-managed SSL certificate for the domain 'example.com'?

Accepted Answer

gcloud compute ssl-certificates create my-cert --domains example.com. Google-managed certificates are created with 'gcloud compute ssl-certificates create' with the '--domains' flag. The other commands are for different purposes.

Answer

gcloud compute addresses create my-cert --global

Answer

gcloud compute ssl-policies create my-policy

Answer

gcloud compute target-https-proxies create my-proxy --ssl-certificates my-cert

Question 15

An engineer needs to migrate a large on-premises database to Cloud SQL for PostgreSQL. The database is 500 GB and can tolerate a few hours of downtime. The migration must minimize manual intervention. Which approach should the engineer use?

Accepted Answer

Use Database Migration Service (DMS). Database Migration Service supports homogeneous migrations (including PostgreSQL to Cloud SQL) and automates the process. It supports continuous replication and minimal downtime. The others are not ideal: pg_dump requires manual steps and downtime; gcloud sql import is for file import; Compute Engine with pg_dump involves manual steps.

Answer

Use pg_dump to export and pg_restore to import

Answer

Use gcloud sql import to import a dump file

Answer

Set up a Compute Engine instance to run pg_dump and then gcloud sql import