Google ACE Practice Test 16 — 15 Questions

Question 1

A Compute Engine VM with only a private IP address needs to download software updates from the internet (apt-get update). What must be configured in the VPC to enable outbound internet access for private VMs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Cloud NAT on the VPC's Cloud Router for the subnet. Cloud NAT (Network Address Translation) allows private VMs without external IP addresses to initiate outbound connections to the internet. It translates the VM's private IP to a public IP managed by Cloud NAT, enabling apt-get update to reach external repositories. This is the correct and scalable solution for outbound-only internet access from private instances.

Answer

Enable Private Google Access on the subnet

Answer

Add an external IP address to the VM temporarily for the update, then remove it

Answer

Create a VPC firewall rule allowing egress to 0.0.0.0/0 on port 80 and 443

Question 2

A team wants to roll back a GKE Deployment to its previous revision because the new version introduced a regression. Which kubectl command performs this rollback?

Accepted Answer

kubectl rollout undo deployment/my-app. `kubectl rollout undo deployment/my-app` is the standard Kubernetes command to roll back a Deployment to the previous revision. This command leverages the Deployment's revision history, which is automatically maintained by the Kubernetes controller, to revert the desired state to the prior revision without needing to manually reapply an old manifest.

Answer

kubectl revert deployment/my-app --to-previous

Answer

kubectl apply -f previous-deployment.yaml

Answer

kubectl delete deployment/my-app && kubectl create -f deployment.yaml

Question 3

A GKE team is comparing Autopilot and Standard cluster modes for a new project. They want to minimize infrastructure management overhead, automatically right-size node resources, and be billed only for Pod resource requests. Which mode matches these requirements?

Accepted Answer

GKE Autopilot — managed nodes, automatic right-sizing, and per-Pod billing. GKE Autopilot is the correct choice because it fully manages the underlying node infrastructure, automatically right-sizes node resources based on Pod resource requests, and bills only for the requested CPU and memory of Pods, not the underlying nodes. This aligns directly with the team's goals of minimizing management overhead, automatic right-sizing, and per-Pod billing.

Answer

GKE Standard — it provides more control over node configuration

Answer

GKE Standard with cluster autoscaler and node auto-provisioning enabled

Answer

Both modes are equivalent in management overhead — Autopilot is just a pricing model

Question 4

Your Dataflow streaming pipeline is consuming messages from Pub/Sub but the pipeline's throughput has dropped significantly. Cloud Monitoring shows the `pubsub/subscription/oldest_unacked_message_age` metric is growing. The pipeline has enough workers. What is the most likely bottleneck, and how should you address it?

Accepted Answer

Inspect Dataflow job graph metrics to identify the slow stage, then optimize that stage's logic or address data skew.. The growing `oldest_unacked_message_age` metric indicates that messages are not being processed and acknowledged quickly enough, even though the pipeline has enough workers. This points to a bottleneck within a specific stage of the Dataflow pipeline, such as a transformation or grouping operation that is slow or suffering from data skew. Option B is correct because inspecting the job graph metrics (e.g., wall time, backlog, and throughput per stage) allows you to identify the slow stage and then optimize its logic or address data skew, which directly resolves the processing delay.

Answer

Increase the number of Dataflow workers to process messages faster.

Answer

Increase the Pub/Sub subscription's ack deadline to 600 seconds.

Answer

Switch from Dataflow to Pub/Sub Lite for lower cost and higher throughput.

Question 5

A CI/CD pipeline running outside GCP (on GitHub Actions) needs to authenticate to GCP to push images to Artifact Registry, without storing any long-lived service account key files. Which authentication mechanism achieves this?

Accepted Answer

Workload Identity Federation with GitHub Actions as the identity provider. Workload Identity Federation allows a GitHub Actions workflow to exchange a GitHub-issued OIDC token for a GCP access token, enabling authentication to Artifact Registry without storing any long-lived service account keys. This is the recommended approach for non-GCP CI/CD systems because it eliminates the security risk of managing static credentials while still granting fine-grained, short-lived access to GCP resources.

Answer

Store a service account JSON key as a GitHub Actions secret and use it in the workflow

Answer

OAuth 2.0 user credentials from a developer's Google account

Answer

API keys created for the Artifact Registry service

Question 6

A security analyst needs to retrieve all Cloud Logging entries with severity ERROR or higher across all resource types in the current project. Which log query correctly filters these entries?

Accepted Answer

severity >= "ERROR". Cloud Logging's query language supports comparison operators like `>=` for severity levels, where `ERROR` is a recognized severity level. The query `severity >= "ERROR"` retrieves all entries with severity ERROR, CRITICAL, ALERT, or EMERGENCY, as these are considered higher severity than ERROR. This matches the requirement to filter for severity ERROR or higher across all resource types without restricting the time range or resource type.

Answer

severity >= ERROR AND timestamp > now() - 24h

Answer

severity="ERROR" AND resource.type="gce_instance"

Answer

logName="projects/my-project/logs/stderr" AND severity > "WARNING"

Question 7

A team's GKE Deployment serves variable traffic — 2 Pods at night, 20 Pods at peak hours. Rather than manually changing replica counts, they want automatic scaling based on CPU utilization (target: 60%). What should they deploy?

Accepted Answer

Horizontal Pod Autoscaler (HPA) targeting 60% CPU utilization. The Horizontal Pod Autoscaler (HPA) is the correct choice because it automatically adjusts the number of Pod replicas in a Deployment based on observed CPU utilization, scaling from 2 to 20 Pods as needed to maintain the target of 60% CPU. HPA works by querying the metrics server for CPU usage and calculating the desired replica count using the formula: desiredReplicas = currentReplicas × (currentMetricValue / targetMetricValue). This directly addresses the requirement for variable traffic without manual intervention.

Answer

Vertical Pod Autoscaler (VPA) with CPU target 60%

Answer

Cluster Autoscaler with a CPU threshold of 60%

Answer

Set the Deployment replica count to 20 and rely on resource quotas to limit actual Pod scheduling

Question 8

A team needs to give a third-party vendor read-only access to specific Cloud Storage objects for 48 hours. The vendor uses an AWS account (not a Google account). What is the most secure way to grant this temporary access?

Accepted Answer

Generate a Signed URL for the specific objects with a 48-hour expiration. A Signed URL provides time-bound, read-only access to specific Cloud Storage objects without requiring the vendor to have a Google account. The URL embeds authentication information and expires after 48 hours, ensuring temporary access while maintaining security by not exposing broader permissions or credentials.

Answer

Create a GCP service account for the vendor and share the JSON key file with 48-hour expiry

Answer

Use Workload Identity Federation with AWS as the identity provider for the vendor

Answer

Make the objects publicly readable and share the direct Cloud Storage URL

Question 9

A team wants to create a consistent backup of a Compute Engine VM's boot disk before applying a major OS patch. The backup should be usable to restore the disk to a new VM if the patch fails. What is the recommended approach?

Accepted Answer

Create a persistent disk snapshot using `gcloud compute disks snapshot`. A persistent disk snapshot captures a point-in-time, crash-consistent backup of the disk, including the boot disk, without requiring the VM to be stopped. Snapshots are the recommended method for backing up persistent disks because they support incremental backups, can be used to create new disks, and are optimized for restore operations to a new VM. This approach ensures the backup is usable for disaster recovery if the OS patch fails.

Answer

Create a custom VM image from the running instance using `gcloud compute images create`

Answer

Copy all files to a Cloud Storage bucket using gsutil rsync

Answer

Enable live migration for the VM — it automatically backs up state before migrations

Question 10

A team is building a real-time multiplayer game backend requiring low-latency state synchronization between players worldwide. Session data must persist for the duration of a game (up to 2 hours) but doesn't need long-term storage. Which managed service best fits?

Accepted Answer

Cloud Memorystore for Redis. Cloud Memorystore for Redis is the best fit because it provides an in-memory data store with sub-millisecond latency, ideal for real-time state synchronization in a multiplayer game. Redis supports data structures like sets and sorted sets for leaderboards or session state, and its optional persistence (RDB/AOF) can cover the 2-hour game duration without needing long-term storage. This aligns with the requirement for low-latency, ephemeral session data that must survive only the game session.

Answer

Cloud SQL for PostgreSQL with connection pooling

Answer

Cloud Bigtable

Answer

Cloud Firestore in Native mode

Question 11

A Cloud Function (gen2) is triggered by Pub/Sub messages. The function processes each message by calling three external APIs sequentially. The total processing time is 25 seconds per message. The Pub/Sub subscription's ack deadline is 10 seconds. What will happen, and how should you fix it?

Accepted Answer

Messages will be redelivered before processing completes; extend the Pub/Sub subscription ack deadline to exceed 25 seconds.. The Pub/Sub subscription has a 10-second ack deadline, but the Cloud Function takes 25 seconds to process each message. Since the function does not acknowledge the message within the deadline, Pub/Sub considers the message unacknowledged and redelivers it, causing duplicate processing. The fix is to increase the ack deadline to exceed 25 seconds, ensuring the function has enough time to complete processing and send an acknowledgment.

Answer

Pub/Sub will wait indefinitely for the function to acknowledge; no issue occurs.

Answer

The Cloud Function will automatically extend its own ack deadline via the Pub/Sub client library.

Answer

Increase the Cloud Function's memory to process faster and complete within 10 seconds.

Question 12

A team wants to allow inbound HTTPS traffic (TCP port 443) from the internet to instances tagged 'web-server', while blocking all other inbound traffic. What firewall configuration achieves this?

Accepted Answer

An ingress allow rule for port 443 from 0.0.0.0/0 targeting the 'web-server' tag, relying on the implied deny for other traffic. Google Cloud VPC firewall rules are stateful and have an implicit deny for all traffic that is not explicitly allowed. An ingress allow rule for TCP port 443 from 0.0.0.0/0 applied to instances with the 'web-server' tag permits inbound HTTPS traffic, and the implicit deny blocks all other inbound traffic without needing additional rules.

Answer

An ingress allow rule for port 443 and a separate egress deny rule for all other ports

Answer

An ingress deny rule for all ports from 0.0.0.0/0, plus an ingress allow for port 443 with lower priority

Answer

A Cloud Armor policy allowing only HTTPS requests to port 443

Question 13

A company's application currently runs on a single Compute Engine VM with a persistent disk. The application serves read-heavy traffic and the single VM is becoming a bottleneck. The application is stateless. Which change provides the most immediate horizontal scalability improvement?

Accepted Answer

Create a Managed Instance Group from the VM and configure autoscaling with a load balancer.. Creating a Managed Instance Group (MIG) from the existing VM and configuring autoscaling with a load balancer directly addresses the read-heavy, stateless bottleneck by distributing traffic across multiple VM instances. This provides immediate horizontal scalability, as new instances are automatically provisioned or terminated based on load, without requiring any application changes.

Answer

Upgrade the existing VM to a larger machine type (vertical scaling).

Answer

Add more persistent disks to the existing VM to handle more I/O.

Answer

Enable live migration on the existing VM so it can move between hosts.

Question 14

A Cloud Identity admin needs to grant a user access to manage billing for a specific GCP project without giving them access to any other projects in the organization. Which role should be assigned at the project level?

Accepted Answer

Project Billing Manager on the specific project. The Project Billing Manager role is the correct choice because it grants permissions to manage billing for a specific GCP project, including viewing billing reports and setting budget alerts, without providing access to other projects. This role is assigned at the project level, ensuring the user's billing management scope is limited to that single project.

Answer

Billing Account Administrator at the organization level

Answer

Editor on the specific project

Answer

Billing Account User at the billing account level

Question 15

A team needs to build a CI/CD pipeline that automatically tests and deploys to GKE when code is pushed to the main branch. Which GCP-native service builds and deploys the code automatically based on source code repository events?

Accepted Answer

Cloud Build with a trigger configured on the repository's main branch. Cloud Build is the correct GCP-native service for building and deploying code automatically based on source code repository events. By configuring a Cloud Build trigger on the main branch, any push to that branch automatically initiates a build and deployment to GKE, fulfilling the CI/CD pipeline requirement without additional orchestration.

Answer

Cloud Composer with a Git polling DAG

Answer

Cloud Run jobs triggered by a Pub/Sub subscription on the repository

Answer

Cloud Functions triggered by Cloud Source Repositories push events