Google ACE Practice Test 16 — 15 Questions

Question 1

A Cloud Build pipeline needs to deploy to Cloud Run but the pipeline's service account has only minimal permissions. Rather than granting it Cloud Run Admin, the team wants it to temporarily act as a more privileged deployment service account. Which technique enables this?

Accepted Answer

Grant service account impersonation: give the Cloud Build SA the Token Creator role on the deployment SA. Option B is correct because it uses IAM service account impersonation, which allows the Cloud Build service account to temporarily assume the identity of a more privileged deployment service account by calling the iam.serviceAccounts.actAs permission. This avoids granting broad Cloud Run Admin permissions directly to the pipeline's service account, adhering to the principle of least privilege. The Token Creator role (roles/iam.serviceAccountTokenCreator) on the deployment service account enables the Cloud Build SA to generate short-lived OAuth2 tokens for impersonation, which are automatically scoped to the deployment SA's permissions.

Answer

Download the deployment service account's JSON key and store it in Cloud Build secrets

Answer

Add the Cloud Build SA as an Owner of the project

Answer

Enable service account delegation in the project's IAM settings

Question 2

A data warehouse team queries a 10 TB BigQuery table containing billions of events with a date column. Most queries filter by a date range (e.g., last 30 days). Without any partitioning, queries scan the full 10 TB every time. Which BigQuery feature eliminates unnecessary data scanning for date-range queries?

Accepted Answer

Date/timestamp partitioned table on the date column. Partitioning a BigQuery table by the date column allows the query engine to prune entire partitions that fall outside the specified date range, so only the relevant partitions (e.g., last 30 days) are scanned instead of the full 10 TB. This directly reduces data scanned and cost, making option C the correct choice for eliminating unnecessary scanning in date-range queries.

Answer

BigQuery table clustering on the date column

Answer

Creating a materialized view for the last 30 days

Answer

Increasing BigQuery slot reservations for faster full-table scans

Question 3

Two GCP projects, A and B, have VPC peering configured. Project A is peered with B, and Project B is peered with Project C. Can VMs in Project A reach VMs in Project C through Project B?

Accepted Answer

No — VPC peering is non-transitive; A and C must be directly peered to communicate. Option B is correct because VPC peering in Google Cloud is non-transitive. This means that if Project A is peered with Project B and Project B is peered with Project C, traffic from Project A cannot flow through Project B to reach Project C. Each peering connection is a direct, point-to-point link, and there is no routing of traffic across multiple peered networks unless explicitly configured with a separate mechanism like a VPN or a third-party appliance. Therefore, VMs in Project A and Project C must be directly peered to communicate.

Answer

Yes — VPC peering automatically enables transitive routing through intermediate peered networks

Answer

Yes — if Project B has IP forwarding enabled, it acts as a router between A and C

Answer

It depends on the firewall rules in Project B's VPC

Question 4

An infrastructure team uses Terraform to manage GCP resources including API enablement. Which Terraform resource enables a GCP API for a project, equivalent to `gcloud services enable`?

Accepted Answer

google_project_service with the desired service endpoint. The `google_project_service` resource is the direct Terraform equivalent of `gcloud services enable`, as it explicitly enables a specified GCP service API for a given project. This resource takes the service endpoint (e.g., `compute.googleapis.com`) and handles the enablement lifecycle, including dependency tracking and disabling on destroy.

Answer

google_project_iam_binding with the serviceusage.services.enable permission

Answer

google_service_account with enabled_services block

Answer

google_project with the services argument listing all required APIs

Question 5

A BigQuery table in a data pipeline receives daily data loads. To control storage costs, the team wants table data older than 180 days to be automatically deleted at the table level, not the dataset level. How should this be configured?

Accepted Answer

Configure partition expiration on a date-partitioned table to expire partitions after 180 days. Option C is correct because BigQuery's partition expiration feature allows you to automatically delete entire partitions from a date-partitioned table after a specified number of days. By setting the partition expiration to 180 days, all data in partitions older than 180 days is dropped at the table level, meeting the requirement without affecting other tables in the dataset.

Answer

Set a dataset-level default table expiration of 180 days in the dataset properties

Answer

Use a Cloud Scheduler job to run a DELETE statement on rows older than 180 days nightly

Answer

Set a table-level TTL using BigQuery's TTL API with a 180-day value

Question 6

A developer wants to verify which IAM roles they currently have on a specific GCP project before requesting additional access. Which gcloud command lists the IAM policy for a project?

Accepted Answer

gcloud projects get-iam-policy [PROJECT_ID]. The correct command to retrieve the IAM policy for a GCP project is `gcloud projects get-iam-policy [PROJECT_ID]`. This command returns the complete IAM policy bindings (roles and members) for the specified project, allowing the developer to see which roles they currently have. It directly queries the Cloud Resource Manager API to fetch the project-level IAM policy.

Answer

gcloud iam roles list --project=[PROJECT_ID]

Answer

gcloud auth list --project=[PROJECT_ID]

Answer

gcloud iam service-accounts get-iam-policy [PROJECT_ID]

Question 7

A network security team wants to capture metadata about all TCP flows entering and leaving VMs in a specific subnet — source IP, destination IP, port, and bytes transferred — for security analysis. Which GCP feature collects this data?

Accepted Answer

VPC Flow Logs enabled on the subnet. VPC Flow Logs capture metadata (source/destination IP, port, protocol, bytes transferred) for all TCP (and UDP/ICMP) flows entering and leaving VM instances in a subnet. This feature is specifically designed for network monitoring and security analysis, recording flow-level logs without inspecting packet payloads. Enabling VPC Flow Logs on the subnet directly meets the requirement to collect the specified metadata for all TCP flows.

Answer

Cloud Armor security policies with logging enabled

Answer

Cloud Packet Mirroring — captures all traffic for deep packet inspection

Answer

Firewall Rules Logging on each firewall rule

Question 8

A team's Cloud Storage bucket has fine-grained access control (ACLs) enabled. They want to switch to a simpler model where IAM policies alone control access, and object-level ACLs are ignored. What should they enable?

Accepted Answer

Enable Uniform Bucket-Level Access (UBLA) on the bucket. Option A is correct because enabling Uniform Bucket-Level Access (UBLA) on the bucket disables object-level ACLs and enforces IAM policies as the sole access control mechanism. This simplifies management by ignoring any existing ACLs on objects, ensuring that only bucket-level IAM permissions are evaluated for access decisions.

Answer

Delete all ACLs on each object and set them to 'authenticated-read'

Answer

Enable VPC Service Controls on the bucket

Answer

Set the bucket's default object ACL to `projectPrivate` and apply it to all objects

Question 9

A financial application requires all database transactions to be durable even if the primary Cloud SQL instance fails mid-transaction. The RPO (Recovery Point Objective) must be near-zero. Which Cloud SQL feature achieves this?

Accepted Answer

Cloud SQL High Availability with synchronous standby replica in a different zone. Cloud SQL High Availability (HA) uses a synchronous standby replica in a different zone to ensure that every write is committed to both the primary and standby before acknowledging the transaction. This provides near-zero RPO because if the primary fails mid-transaction, the standby has the exact same data and can take over without data loss.

Answer

Cloud SQL read replica with synchronous replication

Answer

Cloud SQL with automated daily backups and point-in-time recovery

Answer

Cloud Spanner — it automatically replicates synchronously across zones

Question 10

A team deploys a new version of their application using a blue-green strategy on GKE. The 'green' deployment is running but still in testing. When ready, traffic should instantly switch from 'blue' to 'green' with rollback possible in seconds. How is the instant switch implemented?

Accepted Answer

Update the Service's label selector from 'version: blue' to 'version: green'. Option B is correct because in a blue-green deployment on GKE, the Service acts as a stable network endpoint abstracting the underlying Pods. By changing the Service's label selector from 'version: blue' to 'version: green', traffic is instantly routed to the green Pods without any downtime or need to recreate resources. This allows immediate rollback by simply reverting the selector back to 'version: blue'.

Answer

Delete the blue Deployment and create the green Deployment as the replacement

Answer

Update the Deployment's container image tag — GKE automatically performs a blue-green rollout

Answer

Use kubectl patch to update the Service's ClusterIP to point to the green Deployment

Question 11

A team deploys a Cloud Run service that must access resources in a private VPC (a private Cloud SQL instance and a Redis instance on Memorystore). The Cloud Run service has no public IP connectivity requirements for these resources. What must be configured?

Accepted Answer

Configure a Serverless VPC Access connector and specify it in the Cloud Run service deployment. Cloud Run is a serverless compute platform that runs in a Google-managed VPC, not the customer's VPC. To access private resources like Cloud SQL and Memorystore (Redis) within a customer VPC, you must configure a Serverless VPC Access connector. This connector bridges the serverless environment to the specified VPC, enabling private, internal IP communication without public internet exposure.

Answer

Enable VPC Service Controls around Cloud Run to connect it to the VPC

Answer

Assign an external IP to the Cloud SQL and Memorystore instances — Cloud Run can reach them via public internet

Answer

Cloud Run automatically connects to any VPC resource in the same project via project-level networking

Question 12

A developer accidentally exposed their gcloud application default credentials (ADC) file. They need to immediately revoke these credentials. Which command revokes the active application default credentials?

Accepted Answer

gcloud auth application-default revoke. Option B is correct because `gcloud auth application-default revoke` is the specific command designed to revoke the Application Default Credentials (ADC) that were set via `gcloud auth application-default login`. This command invalidates the OAuth 2.0 refresh token stored in the ADC file, ensuring the credentials can no longer be used for authentication to Google Cloud APIs.

Answer

gcloud auth revoke [ACCOUNT_EMAIL]

Answer

Delete the ~/.config/gcloud/application_default_credentials.json file manually

Answer

gcloud config unset auth/application_default_credentials

Question 13

A security team wants to ensure that a service account created for an application cannot create new service accounts or modify IAM policies within the project. Which IAM role restriction achieves this?

Accepted Answer

Grant the service account only the specific roles its application requires — omitting IAM admin roles. Option A is correct because the principle of least privilege dictates that a service account should only be granted the specific roles required for its application's functionality. By deliberately omitting roles that include IAM administrative permissions (such as roles/iam.serviceAccountAdmin or roles/iam.serviceAccountUser with the iam.serviceAccounts.create permission, or roles/resourcemanager.projectIamAdmin), the service account is inherently restricted from creating new service accounts or modifying IAM policies. This approach avoids the complexity of deny policies and aligns with Google Cloud's recommended IAM best practices.

Answer

Create an IAM deny policy blocking iam.serviceAccounts.create and iam.projects.setIamPolicy for the service account

Answer

Set an organization policy constraint restricting service account creation to admin users only

Answer

Disable the IAM API for the project so service accounts cannot manage IAM

Question 14

Order the steps to attach a persistent disk to a running Compute Engine instance and format/mount it.

Question 15

A developer wants to see the details of a specific GKE Pod including its events, container status, and resource requests/limits. Which kubectl command provides this?

Accepted Answer

kubectl describe pod [POD_NAME]. B is correct because `kubectl describe pod` provides a comprehensive view of a pod, including its events (e.g., scheduling, pulling images), container status (e.g., waiting, running, terminated with reasons), and resource requests/limits (CPU and memory). This command aggregates detailed information from the Kubernetes API, making it the standard tool for debugging pod issues.

Answer

kubectl get pod [POD_NAME] -o wide

Answer

kubectl inspect pod [POD_NAME]

Answer

kubectl get pod [POD_NAME] -o json