Google ACE Practice Test 14 — 15 Questions

Question 1

You need to ensure that Cloud DLP scans all data uploaded to a specific Cloud Storage bucket and redacts any Social Security Numbers (SSNs) before storing the data. Which Cloud DLP feature and trigger enables this pattern?

Accepted Answer

Configure Pub/Sub notifications on the bucket to trigger a Cloud Function that calls Cloud DLP to redact SSNs before the file is readable.. Option B is correct because Cloud DLP cannot directly intercept and redact data at the point of upload to Cloud Storage. Instead, you must use Pub/Sub notifications on the bucket to trigger a Cloud Function, which calls the Cloud DLP API to inspect and redact SSNs before the file is stored or made readable. This pattern ensures redaction happens in near real-time as part of the upload pipeline.

Answer

Enable Cloud DLP auto-redaction on the Cloud Storage bucket via the GCS settings.

Answer

Use Cloud DLP's scheduled inspection job to scan the bucket daily and flag SSNs.

Answer

Apply an org policy that prevents storing SSNs in Cloud Storage.

Question 2

You are on-call and receive a PagerDuty alert: `Cloud SQL CPU utilization > 90% for 15 minutes`. Checking `pg_stat_activity`, you find 200 connections with many in `idle` state and 15 queries running for > 5 minutes each. The long queries are table scans on a 500 GB unindexed table. What should you do IMMEDIATELY to restore service, and what is the root cause fix?

Accepted Answer

Terminate the long-running table scan queries immediately, then add indexes on the frequently queried columns as the root cause fix.. Option B is correct because terminating the long-running table scans immediately stops the CPU-intensive queries, restoring service. The root cause is the missing index on the 500 GB table, which forces sequential scans and high CPU usage. Adding indexes on frequently queried columns eliminates the need for full table scans, preventing recurrence.

Answer

Restart the Cloud SQL instance to clear all connections and queries.

Answer

Increase Cloud SQL's CPU to a larger machine type to handle the current load.

Answer

Reduce `max_connections` to prevent new connections from adding load.

Question 3

You need to deploy a containerized application to GKE that stores user session data. The application has 3 replicas. Session data must not be lost if a replica is restarted. All replicas share the same session store. Which architecture handles this correctly?

Accepted Answer

Store sessions in Cloud Memorystore (Redis) shared by all replicas.. Option B is correct because Cloud Memorystore (Redis) provides a centralized, persistent, and highly available session store that all replicas can access. This ensures session data survives pod restarts and is shared across all replicas, meeting the requirement for no data loss and shared access.

Answer

Store sessions in each pod's memory; use session affinity on the load balancer to route users to the same pod.

Answer

Use an emptyDir volume shared between replicas for session storage.

Answer

Store sessions in a Cloud SQL table with a connection pool per replica.

Question 4

A team is migrating from Google Container Registry (gcr.io) to Artifact Registry. Existing automation scripts use `gcr.io/my-project/myimage`. To avoid updating all scripts immediately, which Artifact Registry feature allows gcr.io-addressed pulls to work with Artifact Registry backends?

Accepted Answer

Enable the gcr.io compatibility redirect in Artifact Registry settings so gcr.io URLs route to Artifact Registry. Option B is correct because Artifact Registry offers a gcr.io compatibility redirect feature that automatically routes requests originally targeting `gcr.io/my-project/myimage` to the corresponding Artifact Registry repository. This allows existing automation scripts to continue using the old `gcr.io` hostname without modification, while the underlying storage and image management are handled by Artifact Registry. The redirect is configured at the project level and works transparently for pull operations, eliminating the need for immediate script updates.

Answer

Artifact Registry has no gcr.io compatibility — all scripts must be updated immediately

Answer

Use a Cloud DNS private zone to redirect gcr.io to Artifact Registry

Answer

Both Container Registry and Artifact Registry can be active simultaneously with no configuration

Question 5

A new engineer joins the team and needs access to GCP. The company uses Google Workspace for identity management. The GCP admin needs to add the engineer and grant them access to one project. What is the correct order of steps?

Accepted Answer

Create the user in Google Workspace Admin Console, then grant their account IAM roles on the GCP project. Option B is correct because Google Workspace is the identity provider (IdP) for the organization, so the engineer must first be created as a user in the Google Workspace Admin Console. Once the user exists, the GCP admin can then grant IAM roles (e.g., roles/viewer, roles/editor) on the specific project, which maps the Workspace user identity to GCP permissions. This follows the principle that GCP IAM relies on existing identities from the Cloud Identity or Workspace domain, not on separate user creation within GCP.

Answer

Create a service account for the engineer in GCP, then share the key file

Answer

Create a GCP project for the engineer, then add their personal Gmail as a project owner

Answer

Create an API key for the engineer in the GCP Console and share it securely

Question 6

A startup wants to minimize egress costs for a web service that exclusively serves customers within Europe. Which network service tier is most cost-effective?

Accepted Answer

Standard Tier. Standard Tier uses Google's network with egress traffic routed over the internet, which is significantly cheaper than Premium Tier's SLA-backed, low-latency global network. Since the service exclusively serves customers within Europe, the higher cost of Premium Tier is unnecessary, making Standard Tier the most cost-effective choice for minimizing egress costs.

Answer

Premium Tier

Answer

Economy Tier

Answer

Free Tier

Question 7

A developer works across five different GCP projects daily and wants to switch their active project in the gcloud CLI without rerunning `gcloud init`. Which command should they use?

Accepted Answer

gcloud config set project [PROJECT_ID]. The `gcloud config set project [PROJECT_ID]` command updates the `core/project` property in the active gcloud CLI configuration, allowing the developer to switch the active project without re-running `gcloud init`. This is the standard method for changing the project context in the current configuration, which persists across sessions until changed again.

Answer

gcloud projects switch [PROJECT_ID]

Answer

gcloud auth set-project [PROJECT_ID]

Answer

gcloud init --project=[PROJECT_ID]

Question 8

A global web application needs HTTPS traffic routed to backend services in multiple regions, directing each user to the nearest healthy endpoint. Which load balancer type should be used?

Accepted Answer

Global external Application Load Balancer. The Global external Application Load Balancer (ALB) is the correct choice because it provides cross-regional load balancing for HTTPS traffic, routing each user to the nearest healthy backend based on anycast IP and client location. This is essential for a global web application requiring low latency and high availability across multiple regions.

Answer

Regional external Network Load Balancer

Answer

Regional internal Application Load Balancer

Answer

Regional internal TCP/UDP load balancer

Question 9

A compliance archive stores legal documents accessed at most once per quarter. Which Cloud Storage class minimizes storage cost while meeting that access pattern?

Accepted Answer

Coldline. Coldline storage is designed for data accessed less than once per quarter, offering lower storage costs than Standard or Nearline while still providing millisecond access when needed. For a compliance archive accessed at most once per quarter, Coldline minimizes storage cost without incurring the higher retrieval fees or minimum storage durations of Archive storage.

Answer

Standard

Answer

Nearline

Answer

Archive

Question 10

Which gcloud command creates a Compute Engine VM named 'web-01' using the e2-medium machine type in zone us-central1-a?

Accepted Answer

gcloud compute instances create web-01 --zone=us-central1-a --machine-type=e2-medium. Option B is correct because the `gcloud compute instances create` command is the proper syntax for creating a Compute Engine VM, and it requires the `--machine-type` flag (not `--machine`) to specify the machine type. The zone is specified with `--zone`, and the VM name is provided as a positional argument.

Answer

gcloud vm create web-01 --zone=us-central1-a --machine=e2-medium

Answer

gcloud instances create web-01 --region=us-central1 --type=e2-medium

Answer

gcloud compute create-instance web-01 --zone=us-central1-a --size=e2-medium

Question 11

A security review identifies that service account JSON key files are stored on multiple developer laptops, posing a data exfiltration risk. What is the recommended remediation?

Accepted Answer

Remove the key files and use service account impersonation or Workload Identity for workloads that need GCP access. Option C is correct because storing service account JSON key files on developer laptops creates a persistent credential that can be exfiltrated. The recommended remediation is to remove these static keys entirely and instead use service account impersonation (via the `iamcredentials.googleapis.com` API) or Workload Identity (for GKE or GCE workloads) to obtain short-lived access tokens. This eliminates the long-lived secret and follows Google's principle of using federated identity rather than distributing static keys.

Answer

Rotate the key files every 90 days and redistribute them securely

Answer

Encrypt the JSON key files using Cloud KMS before distributing

Answer

Store the key files in Secret Manager and retrieve them at application startup

Question 12

A team wants to allow inbound HTTPS traffic (TCP port 443) from the internet to instances tagged 'web-server', while blocking all other inbound traffic. What firewall configuration achieves this?

Accepted Answer

An ingress allow rule for port 443 from 0.0.0.0/0 targeting the 'web-server' tag, relying on the implied deny for other traffic. Option A is correct because Google Cloud VPC firewall rules are stateful and have an implicit deny for all traffic that is not explicitly allowed. An ingress allow rule for TCP port 443 from 0.0.0.0/0 applied to instances with the 'web-server' tag permits inbound HTTPS traffic, and the implicit deny blocks all other inbound traffic without needing additional rules.

Answer

An ingress allow rule for port 443 and a separate egress deny rule for all other ports

Answer

An ingress deny rule for all ports from 0.0.0.0/0, plus an ingress allow for port 443 with lower priority

Answer

A Cloud Armor policy allowing only HTTPS requests to port 443

Question 13

A team needs a GKE cluster named 'prod-cluster' in the us-central1 region with cluster autoscaling enabled, scaling between 3 and 10 nodes. Which command achieves this?

Accepted Answer

gcloud container clusters create prod-cluster --region=us-central1 --num-nodes=3 --enable-autoscaling --min-nodes=3 --max-nodes=10. Option A is correct because it uses the `gcloud container clusters create` command with the `--enable-autoscaling` flag, which enables cluster autoscaler for the GKE cluster. The `--min-nodes=3` and `--max-nodes=10` flags define the scaling range, while `--num-nodes=3` sets the initial node count, ensuring the cluster starts with 3 nodes and can scale up to 10 as needed. The `--region=us-central1` specifies a regional cluster, which is appropriate for production workloads requiring high availability across zones.

Answer

gcloud kubernetes clusters create prod-cluster --location=us-central1 --autoscale=3:10

Answer

gcloud container cluster create prod-cluster --zone=us-central1 --scaling=3-10

Answer

kubectl create cluster prod-cluster --region=us-central1 --autoscale --min=3 --max=10

Question 14

A managed instance group (MIG) is running 4 VMs with a CPU autoscaling target of 60%. A traffic spike drives average CPU to 90%. How does the autoscaler respond?

Accepted Answer

The autoscaler adds VMs until average CPU across the group drops to approximately 60%. The autoscaler for a managed instance group (MIG) uses a target utilization metric—here, CPU at 60%. When average CPU exceeds that target (90%), the autoscaler calculates the desired number of VMs to bring utilization back to 60% (e.g., 4 VMs * 90% / 60% = 6 VMs) and adds instances accordingly. It does not terminate, migrate, or restart VMs; it scales out horizontally.

Answer

The MIG terminates the 2 least-used VMs to trigger a restart with higher performance settings

Answer

The MIG live-migrates instances to larger machine types automatically

Answer

The MIG restarts all existing VMs to clear cached load

Question 15

A Cloud Run service needs to access a database password at runtime. Where should the password be stored according to GCP security best practices?

Accepted Answer

In Secret Manager, referenced as a mounted secret or accessed via the API at runtime. Secret Manager is the GCP-native service designed to securely store sensitive data like database passwords. It provides encryption at rest and in transit, fine-grained access control via IAM, and supports both mounting secrets as volumes and accessing them via the API at runtime. This aligns with GCP security best practices by avoiding exposure of secrets in plain text, configuration files, or container images.

Answer

As a plain-text environment variable in the Cloud Run service configuration

Answer

In a Cloud Storage bucket accessible to the service account

Answer

Baked into the container image at build time