Google ACE Practice Test 15 — 15 Questions

Question 1

An engineer is setting up Cloud Identity for a new domain. What is a prerequisite for creating a Cloud Identity account?

Accepted Answer

Domain verification. Cloud Identity requires domain verification to prove ownership. This is done via DNS TXT record or other methods.

Answer

A G Suite account

Answer

A billing account

Answer

An existing Google Cloud project

Question 2

You need to install the Google Cloud SDK on a Linux machine. Which command should you use to add the Cloud SDK distribution URI as a package source?

Accepted Answer

echo 'deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main' | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list. The Cloud SDK installation guide for Linux uses echo to add the URI to /etc/apt/sources.list.d/google-cloud-sdk.list.

Answer

curl https://sdk.cloud.google.com | bash

Answer

gcloud init

Answer

sudo apt-get install google-cloud-sdk

Question 3

You are managing a Cloud Functions deployment that processes messages from a Pub/Sub topic. You need to ensure the function can read messages from the topic and acknowledge them. Which IAM role should you assign to the function's service account?

Accepted Answer

roles/pubsub.subscriber. The Pub/Sub Subscriber role (roles/pubsub.subscriber) grants permission to pull messages and acknowledge them. The function's service account needs this role on the topic or subscription.

Answer

roles/pubsub.publisher

Answer

roles/pubsub.viewer

Answer

roles/iam.serviceAccountUser

Question 4

You have updated a deployment in GKE, but the new pods are crashing. You want to revert to the previous working version. What should you do?

Accepted Answer

kubectl rollout undo deployment/my-app. kubectl rollout undo reverts to the previous revision.

Answer

kubectl rollout status deployment/my-app

Answer

kubectl scale deployment/my-app --replicas=0

Answer

kubectl delete deployment/my-app and recreate

Question 5

An engineer wants to view the current IAM policy for a project in JSON format. Which command should they use?

Accepted Answer

gcloud projects get-iam-policy my-project --format json. The gcloud projects get-iam-policy command with --format json outputs the IAM policy in JSON format.

Answer

gcloud resource-manager folders get-iam-policy my-project --format json

Answer

gcloud projects describe my-project --format json

Answer

gcloud iam policies get my-project --format json

Question 6

A developer wants to create a Compute Engine instance with the container-optimized OS image in the default network. Which command should they use?

Accepted Answer

gcloud compute instances create my-instance --image-family=cos-stable --image-project=cos-cloud. The correct command uses '--image-family=cos-stable' and '--image-project=cos-cloud' to specify the Container-Optimized OS image. Option B uses 'gcloud compute instances create' with the correct flags.

Answer

gcloud compute instances create my-instance --image-family=ubuntu-2004-lts --image-project=ubuntu-os-cloud

Answer

gcloud compute instances create my-instance --image-family=cos-stable

Answer

gcloud compute instances create my-instance --image=cos-stable --image-project=cos-cloud

Question 7

Which of the following is true about Cloud Shell?

Accepted Answer

Cloud Shell has 5 GB of persistent home directory storage.. Cloud Shell provides a temporary virtual machine with 5 GB of persistent home directory storage, and the gcloud, kubectl, and terraform tools are pre-installed. The home directory persists across sessions, but the VM is ephemeral (after 20 minutes of inactivity the VM is terminated, but home directory persists).

Answer

Cloud Shell requires installation of gcloud and kubectl manually.

Answer

Cloud Shell only supports the gcloud CLI, not kubectl.

Answer

Cloud Shell provides a persistent VM that can run for hours.

Question 8

An organization uses Secret Manager to store database credentials. A new application runs on Compute Engine and needs to access a secret. The application uses the default compute engine service account. What is the most secure way to grant access to the secret?

Accepted Answer

Grant the roles/secretmanager.secretAccessor role to the compute engine default service account. The most secure approach is to grant the secretmanager.secretAccessor role to the compute engine service account. This avoids downloading keys or hardcoding secrets. The role provides access to secrets without granting broader permissions.

Answer

Hardcode the secret in the application configuration file

Answer

Create a new service account with the secretAccessor role, create a key, and store it on the instance

Answer

Grant the roles/editor role to the default compute engine service account

Question 9

A team wants to enable Compute Engine API in their project using gcloud. Which command should they run?

Accepted Answer

gcloud services enable compute.googleapis.com. The command 'gcloud services enable compute.googleapis.com' enables the Compute Engine API.

Answer

gcloud compute enable api

Answer

gcloud services list --enabled

Answer

gcloud api enable compute

Question 10

You need to set up log-based alerting in Cloud Logging to send notifications when a specific error pattern appears in your application logs. Which TWO components are required to accomplish this?

Accepted Answer

An alerting policy. To create a log-based alert, you need a log-based metric that counts the matching log entries, and an alerting policy that uses that metric. The metric is the source of the condition, and the policy defines when to notify.

Answer

A log sink

Answer

A Cloud Pub/Sub topic

Answer

An uptime check

Question 11

A company wants to ensure that a Compute Engine instance can access only a specific Cloud Storage bucket and no other resources in the project. Which TWO steps should the engineer take? (Select 2 correct answers)

Accepted Answer

Attach the service account to the Compute Engine instance at creation.. To restrict an instance to a specific bucket, create a custom service account with the Storage Object Viewer role only on that bucket (via IAM binding on the bucket), then attach that service account to the instance. Granting role at project level is too broad. Using the default service account gives broader permissions.

Answer

Grant the roles/storage.admin role at the bucket level.

Answer

Grant the roles/storage.objectViewer role at the project level to the service account.

Answer

Use the default Compute Engine service account.

Question 12

A company wants to implement a least-privilege security model for a service account that needs to read secrets from Secret Manager and publish messages to Pub/Sub. Which TWO IAM roles should be granted? (Choose TWO)

Accepted Answer

roles/pubsub.publisher. The minimum roles needed are: roles/secretmanager.secretAccessor for reading secret versions, and roles/pubsub.publisher for publishing messages. roles/secretmanager.admin is too broad, roles/pubsub.admin is too broad, and roles/secretmanager.viewer only allows viewing metadata, not accessing secret values.

Answer

roles/secretmanager.viewer

Answer

roles/pubsub.admin

Answer

roles/secretmanager.admin

Question 13

A company wants to deploy a containerized application on Google Cloud that automatically scales to zero when not in use, and they want to minimize operational overhead. They also need to avoid managing any underlying infrastructure such as Kubernetes clusters or VMs. Which service should they use?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform that can scale to zero when there is no traffic, and it abstracts away infrastructure management. GKE requires managing a cluster, Compute Engine involves managing VMs, and App Engine is also serverless but Cloud Run provides more flexibility with containers and also scales to zero.

Answer

Google Kubernetes Engine (GKE)

Answer

App Engine Standard Environment

Answer

Compute Engine with managed instance groups

Question 14

A security engineer wants to audit all attempts to access a specific Cloud Storage bucket, including successful and failed read requests. Which THREE steps should they take? (Choose THREE)

Accepted Answer

Enable Data Access audit logs for the Cloud Storage service.. To audit data access, Data Access audit logs must be enabled for the bucket. Admin Activity logs only record configuration changes. Using Log Explorer allows filtering and analyzing logs. Granting the logging viewer role is necessary to view the logs. Creating a sink is for exporting logs, not necessary for auditing.

Answer

Create a log sink to BigQuery for the bucket's admin activity logs.

Answer

Enable Admin Activity audit logs for the bucket.

Question 15

A company wants to create a Cloud Storage bucket to store archival data that is accessed infrequently (less than once a year). The data must be stored at the lowest possible cost. Which storage class should they choose?

Accepted Answer

Archive. Archive storage class is the lowest-cost option for long-term archival data accessed less than once a year. Nearline and Coldline have higher retrieval costs but are for data accessed less frequently than standard, not as low as Archive. Standard is for frequently accessed data.

Answer

Coldline

Answer

Nearline

Answer

Standard