Google ACE Practice Test 17 — 15 Questions

Question 1

A billing report shows a Compute Engine VM has been running unused for 3 months. The team wants to stop it to save costs but needs the VM's disk data preserved for potential future use. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Stop (shut down) the VM — compute charges stop but disk storage charges continue. Stopping (shutting down) a Compute Engine VM immediately halts all compute charges (vCPU, memory, GPU) while preserving the persistent disk and its data. The disk continues to incur storage costs, which is acceptable since the team wants to retain the data for potential future use. This is the most cost-effective approach that meets the requirement of preserving disk data without paying for idle compute resources.

Answer

Delete the VM to avoid all compute charges

Answer

Snapshot the VM disk and delete the VM

Answer

Set the VM to a smaller machine type to reduce costs

Question 2

A security review identifies that service account JSON key files are stored on multiple developer laptops, posing a data exfiltration risk. What is the recommended remediation?

Accepted Answer

Remove the key files and use service account impersonation or Workload Identity for workloads that need GCP access. Storing service account JSON key files on developer laptops creates a persistent credential that can be exfiltrated. The recommended remediation is to remove these static keys entirely and instead use service account impersonation (via the `iamcredentials.googleapis.com` API) or Workload Identity (for GKE or GCE workloads) to obtain short-lived access tokens. This eliminates the long-lived secret and follows Google's principle of using federated identity rather than distributing static keys.

Answer

Rotate the key files every 90 days and redistribute them securely

Answer

Encrypt the JSON key files using Cloud KMS before distributing

Answer

Store the key files in Secret Manager and retrieve them at application startup

Question 3

You are deploying a Cloud Run service revision that should initially receive 0% of traffic (for testing via a direct URL), while the existing revision continues to serve 100% of production traffic. Which `gcloud run deploy` flag achieves this?

Accepted Answer

`--no-traffic`. The `--no-traffic` flag on `gcloud run deploy` deploys a new revision but directs 0% of traffic to it, leaving the existing revision serving 100% of production traffic. This allows you to test the new revision via its direct URL without impacting live users. It is the correct and explicit way to achieve a zero-traffic deployment in Cloud Run.

Answer

`--traffic=0`

Answer

`--revision-suffix=canary` with no traffic configuration

Answer

`--min-instances=0 --max-instances=0`

Question 4

You are deploying a stateful application to GKE that requires each pod to have its own dedicated persistent disk, and each disk must persist data even if the pod is rescheduled to a different node. Which Kubernetes object type should you use?

Accepted Answer

StatefulSet with volumeClaimTemplates to provision individual PVCs per pod.. A StatefulSet with volumeClaimTemplates is the correct choice because it automatically provisions a unique PersistentVolumeClaim (PVC) for each pod replica, ensuring each pod gets its own dedicated persistent disk. When a pod is rescheduled to a different node, the PVC remains bound to its original PersistentVolume (PV), allowing the new pod to mount the same disk and retain the data. This meets the requirement for both per-pod dedicated storage and data persistence across rescheduling events.

Answer

Deployment with a shared PersistentVolumeClaim mounted by all pods.

Answer

DaemonSet with a hostPath volume on each node.

Answer

Deployment with an emptyDir volume for each pod.

Question 5

A team needs to roll out a configuration change to a MIG (Managed Instance Group) — updating the instance template to set a new environment variable. They want to validate the change on 1 VM before rolling it out to all 20 VMs. Which MIG update type supports this?

Accepted Answer

Canary update — update 1 VM to the new template, verify, then roll out to all. A canary update in a Managed Instance Group (MIG) allows you to specify a target size (e.g., 1 VM) to update to the new instance template first. After validating the change on that single VM, you can then promote the canary to roll out the new template to the remaining 19 VMs. This matches the requirement to test on 1 VM before full rollout.

Answer

Opportunistic update — the new template applies only when VMs are naturally replaced

Answer

Recreate update — terminate all 20 VMs and recreate with the new template simultaneously

Answer

Snapshot the existing VMs and restore 1 with the new environment variable to test

Question 6

A team's application emits a custom business metric (orders per minute) via its code. They want to display this metric on a Cloud Monitoring dashboard and alert when it drops below 50 orders per minute. What must be done first?

Accepted Answer

Instrument the application to write the metric to the Cloud Monitoring API using a client library or OpenTelemetry. Cloud Monitoring requires metrics to be explicitly ingested via its API or through OpenTelemetry. Custom metrics are not automatically available; the application must be instrumented to write the metric data (e.g., using the `cloud.google.com/go/monitoring` client library or OpenTelemetry exporter) to the Cloud Monitoring API. Without this step, the metric does not exist in Cloud Monitoring for dashboards or alerts.

Answer

Enable the Custom Metrics feature flag in the GCP Console under Cloud Monitoring settings

Answer

Create a log-based metric that extracts the orders value from application logs

Answer

Custom metrics require BigQuery — store values in BigQuery and link it to Cloud Monitoring

Question 7

A security team wants to prevent authorized users from copying BigQuery query results to a dataset in a different GCP project that is outside the team's security boundary — even if the user has valid IAM permissions. Which control enforces this?

Accepted Answer

VPC Service Controls with a perimeter enclosing BigQuery. VPC Service Controls (VPC-SC) create a security perimeter around Google Cloud services, including BigQuery, that prevents data exfiltration to projects outside the perimeter regardless of IAM permissions. By configuring a service perimeter that includes BigQuery and the authorized project, any attempt to copy query results to a dataset in a project outside the perimeter is blocked, even if the user has valid IAM roles. This enforces a data boundary that overrides IAM-based access.

Answer

IAM deny policies restricting cross-project BigQuery operations

Answer

An organization policy preventing resource creation outside specific projects

Answer

Cloud Armor rules blocking outbound API requests to BigQuery in other projects

Question 8

A team deploys an application with sensitive internal APIs on GKE. The APIs should be reachable from other GKE services in the cluster and from on-premises systems via VPN, but not from the public internet. Which load balancer configuration meets this?

Accepted Answer

Internal Application Load Balancer with a VPC-private IP. An Internal Application Load Balancer (HTTP/HTTPS) with a VPC-private IP is correct because it exposes the APIs only within the VPC network, making them reachable from other GKE services in the cluster and from on-premises systems via VPN (which extends the VPC), while blocking all public internet traffic by design. This load balancer operates at Layer 7 and uses an internal IP address that is not routable from the internet, satisfying the requirement without relying on additional access controls.

Answer

Global external Application Load Balancer with Cloud Armor blocking non-VPN IPs

Answer

A ClusterIP Service with an external IP range allowlist

Answer

NodePort Service with VPC firewall rules restricting access to VPN IP ranges

Question 9

A team enables OS Login on their GKE node pool. What does OS Login provide for SSH access to GKE nodes compared to the default metadata-based SSH key approach?

Accepted Answer

OS Login links SSH access to IAM roles — access is centrally managed and revocable via IAM without updating VM metadata. OS Login links SSH access to IAM roles, so access is centrally managed and revocable via IAM without updating VM metadata. This means you can grant or revoke SSH access to GKE nodes by assigning or removing IAM roles (e.g., roles/compute.osLogin) on user or service accounts, eliminating the need to manage SSH keys in instance metadata. This provides a more secure and auditable access control mechanism compared to the default metadata-based SSH key approach.

Answer

OS Login stores SSH keys in a Cloud KMS-managed keystore for enhanced encryption

Answer

OS Login automatically generates and rotates SSH key pairs every 24 hours

Answer

OS Login restricts SSH access to connections from specific IP ranges defined in Cloud Armor

Question 10

An application receives the error 'Permission denied on resource project [PROJECT_ID] (or it may not exist)' when making an API call with a service account. The service account has the correct IAM role. What else might be missing?

Accepted Answer

The relevant GCP API is not enabled in the project. The error 'Permission denied on resource project [PROJECT_ID] (or it may not exist)' typically occurs when the service account has the correct IAM role but the API being called is not enabled for the project. Even with proper IAM permissions, GCP requires that the specific API (e.g., Compute Engine API, Cloud Storage API) be enabled in the project before any API calls can succeed. Enabling the API activates the service and allows the service account to use it.

Answer

The service account needs the Project Owner role to make any API calls

Answer

The service account needs to be in the same organization as the project

Answer

The service account email must be explicitly allow-listed in the API's configuration

Question 11

An internal web application running on GKE must be accessible only to employees who are authenticated with the company's Google Workspace account — without exposing it to the internet or using a VPN. Which GCP service provides identity-based access without a VPN?

Accepted Answer

Cloud Identity-Aware Proxy (IAP) configured on the load balancer in front of the GKE service. Cloud Identity-Aware Proxy (IAP) is the correct choice because it enforces identity-based access control at the application layer, verifying that users are authenticated via Google Workspace before allowing traffic to reach the GKE service through an HTTPS load balancer. This eliminates the need for a VPN or public internet exposure by leveraging Google's global infrastructure to authenticate and authorize each request based on the user's identity and context.

Answer

VPC Service Controls creating a perimeter around the GKE cluster

Answer

Firebase Authentication SDK integrated into the web application frontend

Answer

Cloud Armor with a Google Workspace IP allowlist

Question 12

A BigQuery table in a data pipeline receives daily data loads. To control storage costs, the team wants table data older than 180 days to be automatically deleted at the table level, not the dataset level. How should this be configured?

Accepted Answer

Configure partition expiration on a date-partitioned table to expire partitions after 180 days. BigQuery's partition expiration feature allows you to automatically delete entire partitions from a date-partitioned table after a specified number of days. By setting the partition expiration to 180 days, all data in partitions older than 180 days is dropped at the table level, meeting the requirement without affecting other tables in the dataset.

Answer

Set a dataset-level default table expiration of 180 days in the dataset properties

Answer

Use a Cloud Scheduler job to run a DELETE statement on rows older than 180 days nightly

Answer

Set a table-level TTL using BigQuery's TTL API with a 180-day value

Question 13

A startup is building a mobile app backend. Traffic is highly variable: 10 requests/second at night, peaking to 50,000 requests/second during business hours. The backend is stateless. Which compute option best handles this traffic variability with minimal cost and operational effort?

Accepted Answer

Cloud Run with concurrency and max-instances configured.. Cloud Run is the best choice because it is a fully managed serverless platform that scales from zero to thousands of requests per second automatically, handling the extreme variability from 10 to 50,000 requests/second without provisioning overhead. By configuring concurrency (e.g., 80 concurrent requests per container) and max-instances, you cap costs while Cloud Run's autoscaling adds or removes container instances based on incoming traffic, making it ideal for stateless workloads with minimal operational effort.

Answer

Compute Engine managed instance group with autoscaling.

Answer

GKE cluster with Horizontal Pod Autoscaler.

Answer

App Engine Standard environment with automatic scaling.

Question 14

Your organization uses Cloud Storage for storing backups. You want to automatically delete backup objects that are older than 30 days to control costs. You also want objects between 7 and 30 days old to use Nearline storage class for lower cost. Which Cloud Storage feature manages both requirements in a single configuration?

Accepted Answer

Configure Object Lifecycle Management rules on the bucket with `SetStorageClass` and `Delete` actions.. Object Lifecycle Management rules in Cloud Storage allow you to define conditions (e.g., object age) and actions (e.g., SetStorageClass to Nearline, Delete) in a single configuration. This automates both the transition of objects aged 7–30 days to Nearline storage and the deletion of objects older than 30 days, without custom code or manual intervention.

Answer

Write a Cloud Function that runs daily, lists objects, and deletes or moves old ones.

Answer

Set a bucket-level retention policy of 30 days and manually change storage classes.

Answer

Use Cloud Scheduler to trigger `gsutil` commands that move and delete old objects.

Question 15

Your application runs on GKE and needs to call the Cloud Translation API. You want to follow Google's recommended security practice for service-to-cloud-API authentication within GKE. Which approach should you use?

Accepted Answer

Configure Workload Identity to bind the pod's Kubernetes Service Account to a Google Service Account with Translation API access.. Workload Identity is Google's recommended approach for authenticating workloads in GKE to Google Cloud APIs. It allows you to bind a Kubernetes Service Account (KSA) to a Google Service Account (GSA), so pods can impersonate the GSA without managing or storing long-lived service account keys. This eliminates the security risk of key exposure and follows the principle of least privilege.

Answer

Download a service account key JSON and mount it as a Kubernetes Secret in the pod.

Answer

Grant the GKE node pool's service account `roles/cloudtranslate.user`.

Answer

Use the GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to a mounted key file.