Google ACE Practice Test 16 — 15 Questions

Question 1

A multinational corporation requires that all GCP resources across multiple projects are tagged with a key-value pair 'environment: production' and 'environment: development'. They want to enforce that any resource created without the appropriate label is automatically denied. How can this be achieved?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an organization policy constraint to require labels.. Organization policy constraints like 'compute.googleapis.com/requireLabels' can enforce that certain labels must be present on resources. IAM conditions can restrict access based on labels, but they don't automatically deny creation of unlabeled resources. Cloud Asset Inventory is for monitoring, not enforcement. Custom roles cannot enforce labeling.

Answer

Use Cloud Asset Inventory to monitor and alert on missing labels.

Answer

Use IAM conditions to check labels at resource creation.

Answer

Create a custom IAM role that denies creation without labels.

Question 2

A company wants to grant a contractor read-only access to all Compute Engine instances in a specific project, but no other resources. Which IAM role should be assigned?

Accepted Answer

roles/compute.viewer. Predefined roles like 'compute.viewer' provide read-only access to Compute Engine resources. The basic 'Viewer' role would also grant read access to other services, which is not desired.

Answer

roles/compute.instanceAdmin.v1

Answer

roles/viewer

Answer

roles/iam.securityReviewer

Question 3

A company wants to use Cloud Functions to process events from Cloud Storage when new objects are uploaded. They need the function to run in a specific VPC network for tight security. Which Cloud Functions generation supports VPC connectivity?

Accepted Answer

Cloud Functions (2nd gen) with VPC connector. Cloud Functions (2nd gen) is built on Cloud Run and supports VPC connectivity via connectors or direct VPC. 1st gen does not support VPC connectors for ingress/egress in the same way. 2nd gen is recommended for VPC network integration.

Answer

Cloud Functions (1st gen) with VPC connector

Answer

Cloud Functions (2nd gen) with Cloud VPN

Answer

Cloud Functions (1st gen) with Cloud NAT

Question 4

An organization wants to migrate its on-premises MySQL database to Google Cloud. The database is 2 TB and used by a critical application with read replicas for reporting. The team needs minimal downtime and the ability to fail back if needed. Which migration approach should they use?

Accepted Answer

Use Database Migration Service (DMS) to migrate to Cloud SQL. Database Migration Service (DMS) supports continuous replication with minimal downtime and can fail back. Cloud SQL import/export requires downtime. BigQuery is for analytics, not transactional DB. Compute Engine with MySQL is self-managed and more complex.

Answer

Lift and shift MySQL on Compute Engine and set up replication manually

Answer

Export the database to a Cloud Storage bucket and import into Cloud SQL

Answer

Stream data to BigQuery using Dataflow

Question 5

Refer to the exhibit. You have set up an HTTP load balancer with this health check. Your backend instances are running a web server on port 80, and the /health endpoint returns 200 OK. However, the health check marks all instances as unhealthy. What is the most likely cause?

Accepted Answer

The requestPath is /healthz but the application does not have that endpoint. The health check is configured with requestPath /healthz, but the application only serves /health. This mismatch causes the health check to receive a non-200 response, marking instances unhealthy.

Answer

The unhealthyThreshold is too low

Answer

The health check port is 80 but the web server is on port 80

Answer

The checkIntervalSec is too high

Question 6

Your organization policy at the root level sets `gcp.resourceLocations` to allow only `us-central1` and `us-east1`. A business unit needs to deploy resources in `europe-west1` for GDPR compliance. How can you grant this exception without affecting other business units?

Accepted Answer

Set a `gcp.resourceLocations` policy on the business unit's folder with `inheritFromParent: false`, allowing `us-central1`, `us-east1`, and `europe-west1`.. Organization Policies support hierarchical inheritance, and setting `inheritFromParent: false` on the business unit's folder allows you to override the root-level `gcp.resourceLocations` constraint. This enables you to define a custom list of allowed locations (including `europe-west1`) for that specific folder without affecting other business units, as the policy is scoped to that folder only.

Answer

Create a separate GCP organization for the business unit and configure its own resource location policy.

Answer

Add a `europe-west1` exception to the root org policy using the `exceptions` field.

Answer

Remove the `gcp.resourceLocations` org policy from the root and apply it to each business unit's folder individually.

Question 7

You are managing a GKE cluster that runs a mixed workload: latency-sensitive web services and batch data processing jobs. The batch jobs run for hours and consume significant CPU/memory. During batch peaks, the web services experience CPU throttling. What is the best configuration to prevent batch jobs from impacting web service latency?

Accepted Answer

Assign web service pods a higher PriorityClass and run batch jobs on a separate node pool with taints.. It uses PriorityClass to ensure web service pods are scheduled and maintained over batch pods during resource contention, while placing batch jobs on a separate node pool with taints isolates their resource consumption. This prevents batch jobs from causing CPU throttling on latency-sensitive web services by guaranteeing that web pods have priority access to CPU cycles and that batch workloads do not share nodes with web pods.

Answer

Set CPU requests and limits on batch job pods to be lower than web service pods.

Answer

Use Horizontal Pod Autoscaler for batch jobs so they scale down during peak web traffic.

Answer

Enable Cluster Autoscaler so new nodes are added when batch jobs demand more resources.

Question 8

A company needs to run a batch processing workload that processes 10 TB of data nightly. The job runs for 4 hours and can tolerate interruption with checkpointing. Cost must be minimized. Which Compute Engine pricing model is most appropriate for the batch VMs?

Accepted Answer

Spot VMs (preemptible pricing). Spot VMs (preemptible pricing) are the most cost-effective choice for batch workloads that are fault-tolerant and can handle interruptions via checkpointing. Since the job runs for only 4 hours nightly and can resume from checkpoints, Spot VMs offer up to 60-91% cost savings over on-demand pricing without requiring any commitment.

Answer

On-demand VM pricing with committed use discounts (1-year CUD)

Answer

Sustained use discounts applied automatically to long-running VMs

Answer

Standard on-demand pricing with no special configuration

Question 9

Your application running on GKE is experiencing intermittent 500 errors. You want to create an alert that fires when the 99th percentile latency exceeds 2 seconds OR when the error rate (5xx responses) exceeds 1% of all requests over a 5-minute window. You have Cloud Monitoring configured with the application exporting metrics via OpenTelemetry. What should you create in Cloud Monitoring?

Accepted Answer

A single alerting policy with two conditions (p99 latency and error rate) joined with OR logic.. Cloud Monitoring alerting policies support multiple conditions combined with AND/OR logic, allowing you to trigger a single alert when either the 99th percentile latency exceeds 2 seconds or the error rate exceeds 1% over a 5-minute window. This directly matches the requirement without needing separate policies or relying on log-based detection.

Answer

Two separate alerting policies — one for latency and one for error rate — each with their own notification channel.

Answer

A log-based alert using Cloud Logging to detect 5xx response codes in access logs.

Answer

An SLO with error budget burn rate alerts configured in Cloud Monitoring.

Question 10

Your company's compliance policy requires that all customer data stored in Cloud Storage must be encrypted using keys stored in a Hardware Security Module (HSM). The encryption keys must be managed by your security team and must not be exportable. Which configuration meets these requirements?

Accepted Answer

Use Cloud KMS HSM-backed keys (protection level: HSM) with Cloud Storage CMEK.. Cloud KMS HSM-backed keys (protection level: HSM) ensure that encryption keys are stored in a Hardware Security Module, are managed by the security team, and are non-exportable by design. When used with Cloud Storage CMEK, this configuration meets the compliance requirement for HSM-based key storage with full customer control and no key export capability.

Answer

Use Cloud KMS software keys (protection level: SOFTWARE) with Cloud Storage CMEK.

Answer

Use Customer-Supplied Encryption Keys (CSEK) managed by your security team.

Answer

Enable Google-managed encryption with HSM by selecting it in Cloud Storage settings.

Question 11

An organization wants to enforce a policy that disables the creation of VMs with external IPs across all projects. Which resource hierarchy level should the policy be attached to for maximum coverage?

Accepted Answer

Organization. Organization policies can be applied at the organization level to affect all projects and folders underneath. This ensures the policy covers all resources.

Answer

Project

Answer

Resource (VM)

Answer

Folder

Question 12

You need to prevent developers from creating Compute Engine VMs with external IP addresses in a specific folder. Developers must still be able to create VMs with internal IPs only. Which org policy constraint enforces this?

Accepted Answer

Apply the `compute.vmExternalIpAccess` org policy constraint set to deny all VMs.. The `compute.vmExternalIpAccess` organization policy constraint is specifically designed to control whether Compute Engine VMs can be assigned external IP addresses. By setting this constraint to deny all VMs in the folder, developers are prevented from creating VMs with external IPs while still being able to create VMs with only internal IPs. This is the correct, native Google Cloud mechanism for enforcing this requirement at the folder level.

Answer

Create a VPC firewall rule blocking all outbound internet traffic.

Answer

Remove the `compute.instanceAdmin` role from developers so they cannot configure network interfaces.

Answer

Configure the default VPC network to use internal-only routes.

Question 13

You are planning a Private Service Connect (PSC) configuration to allow your VPC to access a managed Cloud SQL instance over a private endpoint without exposing traffic to the public internet. What does Private Service Connect provide in this context?

Accepted Answer

PSC provides a private, internal IP endpoint in your VPC that routes to the managed service without traversing the public internet.. Private Service Connect (PSC) allows you to access Google-managed services (like Cloud SQL) by creating a private, internal IP endpoint within your VPC. This endpoint uses an internal IP address from your VPC's subnet and forwards traffic to the service without ever leaving Google's network, thus avoiding the public internet. Unlike VPC peering, PSC does not require you to manage peering relationships or worry about overlapping IP ranges.

Answer

PSC creates a VPC peering connection between your VPC and Google's service VPC.

Answer

PSC enables bidirectional private communication between your VPC and the service's VPC, similar to peering.

Answer

PSC replaces the need for a Serverless VPC Access connector when calling managed services from Cloud Run.

Question 14

A platform team wants to define a formal service level objective (SLO) for their API: 99.9% of requests must succeed (HTTP 2xx) over a 30-day rolling window. Which Cloud Monitoring feature tracks this?

Accepted Answer

Define a Cloud Monitoring SLO with a 99.9% availability target over a 30-day rolling window. Cloud Monitoring's SLO feature is specifically designed to track compliance with a formal service level objective, such as 99.9% of requests succeeding over a 30-day rolling window. It automatically calculates the success rate from the selected metric (e.g., request count or latency) and reports the SLO's performance over the defined period, including error budgets and burn rates.

Answer

Create an alerting policy with a 99.9% threshold on the request success metric

Answer

Build a BigQuery dashboard showing 30-day average success rates from exported logs

Answer

Set an uptime check target of 99.9% in Cloud Monitoring

Question 15

Your Cloud Build pipeline needs to reference environment-specific configuration: `PROJECT_ID`, `REGION`, and `IMAGE_TAG` (generated from the Git commit SHA). Where should you define these values in `cloudbuild.yaml`?

Accepted Answer

Use built-in substitutions (`$PROJECT_ID`, `$COMMIT_SHA`) and define custom substitutions (`$_REGION`) in the trigger or `--substitutions` flag.. Cloud Build provides built-in substitutions like `$PROJECT_ID` and `$COMMIT_SHA` that automatically resolve to the current project ID and the Git commit SHA, respectively. Custom substitutions like `$_REGION` can be defined in the trigger configuration or passed via the `--substitutions` flag, allowing environment-specific values to be injected without hardcoding. This approach keeps the `cloudbuild.yaml` reusable across environments and avoids exposing sensitive or variable data in the build file.

Answer

Hardcode the values directly in each build step's `args` field.

Answer

Store all values in Cloud Secret Manager and retrieve them in each build step.

Answer

Use a `.env` file committed to the repository and source it in build steps.