Google ACE Practice Test 15 — 15 Questions

Question 1

A team builds a GKE application that processes healthcare data. Regulatory requirements mandate that data in transit between GKE nodes must be encrypted. GKE is running on GCP. What provides encrypted node-to-node traffic within the cluster?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GCP automatically encrypts all VM-to-VM traffic in transit within its network. GCP automatically encrypts all VM-to-VM traffic in transit at the network layer, including traffic between GKE nodes, using a combination of MACsec (IEEE 802.1AE) and IPsec. This encryption is enabled by default for all traffic within a VPC and between VPCs, without any configuration required. Therefore, node-to-node traffic within a GKE cluster is already encrypted, satisfying the regulatory requirement.

Answer

GKE node traffic is unencrypted by default — mTLS must be manually configured on every Pod

Answer

Enable VPC Flow Logs — they activate encryption for logged traffic

Answer

Install a TLS termination proxy on each GKE node — it encrypts intranode traffic

Question 2

Your team uses Cloud Build to build and push Docker images to Artifact Registry. A new security requirement mandates that only images signed by Cloud Build (using Binary Authorization with attestors) can be deployed to your GKE cluster. Which sequence of steps correctly implements this?

Accepted Answer

Create a Cloud KMS key and attestor, configure Cloud Build to create attestations post-build, then set a BinAuthz policy requiring the attestation on the GKE cluster.. It follows the required workflow: you must first create a Cloud KMS key and an attestor in Binary Authorization, then configure Cloud Build to generate an attestation (signed by the attestor) after each successful build. Finally, you set a Binary Authorization policy on the GKE cluster that enforces the attestation, ensuring only signed images are deployed. Cloud Build does not automatically sign images when BinAuthz is enabled; the attestation must be explicitly created.

Answer

Enable BinAuthz on the GKE cluster; Cloud Build automatically signs images when BinAuthz is enabled.

Answer

Use Artifact Registry vulnerability scanning; images that pass scanning are automatically trusted by GKE.

Answer

Add a Cloud Build step that runs `gcloud container binauthz attestations sign-and-create` without additional configuration.

Question 3

You need to tag all Compute Engine VMs in your organization with a `cost-center` tag for billing allocation reports. The tag values must be controlled centrally — only predefined values should be allowed. Which GCP feature enables this?

Accepted Answer

Create Resource Manager Tag keys and values at the org level, then attach tags to VMs.. Resource Manager Tags (formerly 'tags' in the Resource Manager API) allow you to create tag keys and predefined tag values at the organization level, then attach those tags to resources like Compute Engine VMs. This ensures that only centrally controlled values can be used, meeting the requirement for controlled billing allocation. Labels, by contrast, are free-form key-value pairs and cannot have their values restricted natively by an org policy.

Answer

Use Compute Engine labels — configure label keys and restrict values using an org policy.

Answer

Use network tags on VMs and enforce allowed values via a custom org policy constraint.

Answer

Require teams to apply specific label values using a Terraform module, and enforce this via code review.

Question 4

A company runs a stable production workload on 20 n2-standard-8 VMs that run continuously year-round. Which pricing commitment maximizes cost savings on these VMs?

Accepted Answer

3-year committed use discount (CUD). The 3-year committed use discount (CUD) offers the highest discount rate (up to 57% for compute-optimized machine types) compared to 1-year CUDs (up to 20%) or sustained use discounts (up to 30% for running a VM the entire month). Since the workload runs 20 n2-standard-8 VMs continuously year-round, a 3-year CUD locks in the maximum savings for this predictable, steady-state usage.

Answer

Sustained use discounts (automatically applied)

Answer

1-year committed use discount (CUD)

Answer

Switching to Spot VMs

Question 5

A data analytics team runs Apache Spark jobs to process large datasets. They need a managed cluster that provisions quickly, scales dynamically, and integrates with Cloud Storage and BigQuery. Which service should they use?

Accepted Answer

Cloud Dataproc. Cloud Dataproc is the correct choice because it is a managed Spark and Hadoop service that provisions clusters in under 90 seconds, supports autoscaling, and natively integrates with Cloud Storage (via the gs:// connector) and BigQuery (via the BigQuery Storage API and Spark BigQuery connector). This makes it ideal for teams needing fast, dynamic, and integrated Spark job execution.

Answer

Cloud Dataflow

Answer

Cloud Composer

Answer

Cloud Run with a custom Spark container

Question 6

A startup builds a serverless REST API using Cloud Functions (2nd gen). Each function invocation runs for 200ms on average, processes 5 million requests per day, and uses 256 MB memory. Approximately how should they estimate monthly Cloud Functions costs?

Accepted Answer

Estimate based on invocation count, compute time (memory × duration), and networking costs beyond the free tier. Cloud Functions (2nd gen) pricing is based on three components: invocation count, compute time (measured in GB-seconds, which is memory multiplied by duration), and networking egress beyond the free tier. With 5 million requests per day at 200ms each and 256 MB memory, the monthly compute time is approximately 5,000,000 × 0.2 seconds × (256/1024) GB = 250,000 GB-seconds per day, or 7.5 million GB-seconds per month, which far exceeds the free tier of 400,000 GB-seconds per month, so costs will accrue. Additionally, the 150 million invocations per month exceed the free tier of 2 million invocations, and egress traffic will also incur charges beyond the 1 GB free tier.

Answer

Approximately $0 — all invocations fall within the free tier

Answer

Approximately the same as a continuously-running e2-medium VM — Cloud Functions and VMs are priced equivalently

Answer

Fixed monthly rate based on the number of deployed functions, not invocation count

Question 7

A team is migrating a stateful application with local disk writes to GKE. The application requires a dedicated persistent disk that follows the Pod if it's rescheduled to a different node. Which Kubernetes resource provides this?

Accepted Answer

A PersistentVolumeClaim backed by a GCE persistent disk StorageClass. A PersistentVolumeClaim (PVC) backed by a GCE persistent disk StorageClass is the correct choice because it provides a durable, network-attached block storage volume that persists independently of the Pod's lifecycle. When the Pod is rescheduled to a different node, the PVC ensures the GCE persistent disk is detached from the old node and reattached to the new node, preserving the application's state. This meets the requirement for a dedicated persistent disk that follows the Pod across rescheduling events.

Answer

A HostPath volume pointing to a directory on the node

Answer

A ConfigMap mounted as a volume

Answer

An emptyDir volume scoped to the Pod

Question 8

A SaaS company serves 200 enterprise customers, each requiring complete data isolation in separate databases. The company needs to provision a new customer database within minutes and manage 200 databases with minimal overhead. Which GCP approach scales most efficiently?

Accepted Answer

A single Cloud SQL instance with a separate schema (database) per customer, provisioned via API automation. It uses a single Cloud SQL instance with separate schemas (databases) per customer, which allows you to achieve complete data isolation while minimizing overhead. Provisioning a new schema via API automation takes seconds, and managing 200 schemas on one instance is far more efficient than managing 200 separate instances. This approach scales efficiently because Cloud SQL supports up to 10,000 databases per instance, and you can leverage connection pooling and shared resources without sacrificing isolation.

Answer

200 separate Cloud SQL instances, one per customer

Answer

Storing all customer data in a single shared database with customer_id as a discriminator column

Answer

Using BigQuery with a separate dataset per customer

Question 9

A Go service is consuming significantly more CPU than expected. The team suspects an inefficient function but doesn't know which one. Which Cloud Operations tool identifies CPU hotspots in production code?

Accepted Answer

Cloud Profiler. Cloud Profiler is the correct tool because it continuously gathers CPU and heap usage data from production services using statistical sampling, then presents a flame graph or call tree that pinpoints which functions consume the most CPU. Unlike debugging or tracing tools, Profiler is designed specifically for identifying performance bottlenecks like CPU hotspots with minimal overhead, making it ideal for diagnosing an inefficient function in a Go service running in production.

Answer

Cloud Debugger

Answer

Cloud Trace

Answer

Cloud Monitoring custom dashboards

Question 10

A developer needs to test a Cloud Run service locally before deploying it to GCP. The service is packaged as a Docker container. Which tool allows them to run and test the container locally in a way that closely mimics the Cloud Run execution environment?

Accepted Answer

Run the container using `docker run -p 8080:8080 IMAGE` with the required environment variables.. `docker run -p 8080:8080 IMAGE` with the required environment variables directly runs the containerized Cloud Run service on your local machine, mapping port 8080 to the container's port 8080 (the default Cloud Run listens on). This approach closely mimics the Cloud Run execution environment because Cloud Run also runs containers in a Docker-like runtime, and you can replicate environment variables, memory limits, and concurrency settings locally for accurate testing before deployment.

Answer

Deploy the service to a staging Cloud Run environment using `gcloud run deploy --no-traffic`.

Answer

Use `gcloud run services describe` to simulate a local run.

Answer

Use Cloud Shell to run the container since Cloud Shell has Docker installed.

Question 11

A GKE Deployment is running 3 replicas and receiving steady traffic. A junior engineer runs `kubectl scale deployment api-service --replicas=0` to 'stop it temporarily'. What happens to traffic during and after this command?

Accepted Answer

All Pods are terminated immediately; the Service has no backends and requests fail until replicas are restored. When you scale a Deployment to 0 replicas, `kubectl` immediately terminates all Pods. The associated Kubernetes Service continues to exist but has no healthy endpoints, so any traffic directed to the Service’s ClusterIP or external load balancer will be dropped or result in a connection refusal (TCP RST) or HTTP 503. Traffic is not queued or buffered; it simply fails until new Pods are created by scaling the Deployment back up.

Answer

Traffic is paused and queued by the Service until replicas are restored

Answer

GKE detects the replica count is 0 and automatically restores it to maintain high availability

Answer

The Deployment is paused but Pods continue running until the next rollout

Question 12

An enterprise requires a private connection between its on-premises data center and Google Cloud VPC that does NOT traverse the public internet and provides dedicated 10 Gbps bandwidth. Which connectivity option meets these requirements?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google Cloud VPC, offering bandwidth up to 10 Gbps per circuit (or 100 Gbps with multiple circuits) without traversing the public internet. This meets the requirement for a private connection with dedicated 10 Gbps bandwidth, as it uses a colocation facility and a Google-supported router.

Answer

Cloud VPN with high-availability configuration

Answer

Partner Interconnect

Answer

Direct Peering

Question 13

A Compute Engine VM's boot disk is nearly full and the application is failing. You want to snapshot the disk first (for safety), then resize it online. What is the correct sequence of gcloud commands?

Accepted Answer

Snapshot the disk, resize the disk with `gcloud compute disks resize`, then grow the filesystem within the VM.. You must snapshot the disk first to ensure data safety before making changes, then resize the disk using `gcloud compute disks resize` (which works on a running VM with live resize enabled), and finally grow the filesystem inside the VM to utilize the additional space. This sequence avoids downtime and preserves a recovery point.

Answer

Stop the VM, resize the disk, take a snapshot, restart the VM.

Answer

Resize the disk with `gcloud compute instances set-disk-auto-delete` to automatically expand the disk.

Answer

Create a new larger disk, attach it as a secondary disk, and move data using rsync.

Question 14

Your web application serves users globally. Static assets (images, JS, CSS) are stored in Cloud Storage. Users in Asia report slow load times for these assets. The application origin is in `us-central1`. What is the most cost-effective way to improve static asset performance for Asian users?

Accepted Answer

Enable Cloud CDN on the Cloud Storage bucket's load balancer backend.. Cloud CDN uses Google's global edge cache network to serve static assets from locations close to users, reducing latency for Asian users without requiring bucket replication or additional compute. It is the most cost-effective solution because it leverages existing Cloud Storage as the origin and only charges for cache egress and operations, avoiding the overhead of managing regional buckets or compute instances.

Answer

Replicate the Cloud Storage bucket to an Asia region and update DNS to route Asian users to the regional bucket.

Answer

Deploy Cloud Run instances in Asia regions to serve the static assets.

Answer

Increase the Cloud Storage bucket's replication factor to improve throughput.

Question 15

A team wants to configure a Cloud Scheduler job to invoke a Cloud Run service endpoint every hour using HTTP POST. The Cloud Run service requires authentication. How should the Scheduler job be configured to authenticate?

Accepted Answer

Configure the Cloud Scheduler job with OIDC authentication using a service account that has Cloud Run Invoker permission. Cloud Scheduler can authenticate to Cloud Run using OIDC (OpenID Connect) by attaching a service account to the job. The scheduler obtains an OIDC token for that service account and includes it as a Bearer token in the Authorization header. The service account must have the `run.invoker` IAM role on the Cloud Run service to authorize the invocation.

Answer

Include a Bearer token in the Authorization header of the scheduled HTTP request

Answer

Make the Cloud Run service publicly accessible and use Cloud Armor to restrict access to Cloud Scheduler IPs

Answer

Configure an API key for the Cloud Run service and include it in the scheduled request URL