Google ACE Practice Test 17 — 15 Questions

Question 1

A Cloud Storage bucket contains sensitive PII data. You need to ensure that objects in this bucket are encrypted using a key that your security team controls, and that the key can be revoked if needed to render all data inaccessible. Which encryption option should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS.. Customer-Managed Encryption Keys (CMEK) allow you to control and manage the key used for encrypting Cloud Storage objects via Cloud KMS. This enables key revocation, which immediately renders all data encrypted with that key inaccessible, meeting the security team's requirement for revocable control.

Answer

Use Google-managed encryption keys (default).

Answer

Enable Cloud Storage's built-in server-side encryption with AES-256.

Answer

Use Customer-Supplied Encryption Keys (CSEK) by embedding the key in each API request.

Question 2

A GCP organization mandates that all new Cloud SQL instances must require SSL/TLS for connections. No exceptions are allowed. Which enforcement mechanism ensures this across all projects in the organization?

Accepted Answer

Apply the org policy constraint `constraints/sql.requireSsl` at the organization level to enforce SSL on all Cloud SQL instances. The organization policy constraint `constraints/sql.requireSsl` is a native, enforceable policy that can be applied at the organization level in GCP. Once set, it prevents the creation of any Cloud SQL instance that does not require SSL/TLS, and it also blocks any attempt to disable SSL on existing instances. This ensures 100% compliance across all projects without relying on manual intervention or reactive detection.

Answer

Rely on database administrators to manually enable SSL on each new Cloud SQL instance

Answer

Use Security Command Center to detect SSL-disabled instances and alert the team

Answer

Set a Cloud Monitoring alert for new Cloud SQL instances and auto-remediate via Cloud Functions

Question 3

A team's Cloud Build pipeline must: (1) run unit tests, (2) build a Docker image only if tests pass, (3) push the image to Artifact Registry. Which cloudbuild.yaml structure correctly enforces this sequential dependency?

Accepted Answer

Define all three steps in a single `steps` list — they run sequentially by default and stop on failure. Cloud Build executes steps in a `steps` list sequentially by default, and any step that exits with a non-zero status (e.g., test failure) immediately stops the entire pipeline. This enforces the required dependency: unit tests must pass before the Docker image is built, and the image must be built before it is pushed to Artifact Registry.

Answer

Use `waitFor` with step IDs to create a dependency graph between all three steps

Answer

Define the steps in three separate cloudbuild.yaml files and chain them with Cloud Composer

Answer

Set `parallel: false` at the top level of cloudbuild.yaml to enforce sequential execution

Question 4

Your security team wants to prevent any user or service account from creating firewall rules that allow ingress from `0.0.0.0/0` (the internet) to any VM in your organization. Which approach enforces this without requiring per-project IAM changes?

Accepted Answer

Apply a hierarchical firewall policy at the organization level with a deny rule for ingress from 0.0.0.0/0, set to take precedence over project rules.. Hierarchical firewall policies at the organization level can include a deny rule for ingress from `0.0.0.0/0` with a priority that takes precedence over any project-level firewall rules. This enforces the restriction globally without requiring per-project IAM changes, as the policy is inherited by all projects in the organization.

Answer

Grant IAM deny policies that prevent the `compute.firewalls.create` permission across the organization.

Answer

Use Security Command Center to detect and alert when 0.0.0.0/0 firewall rules are created.

Answer

Set the `compute.skipDefaultNetworkCreation` org policy constraint across the organization.

Question 5

A team uses Cloud Build to build Docker images and push them to Artifact Registry. The cloudbuild.yaml has a step that requires a secret API key to call an external service during build. How should the secret be provided securely?

Accepted Answer

Reference the API key from Secret Manager using the availableSecrets field in cloudbuild.yaml. Cloud Build's `availableSecrets` field allows you to securely inject secrets from Secret Manager into build steps as environment variables or files, without exposing them in the build configuration or logs. This approach ensures the API key is encrypted at rest and in transit, and access can be controlled via IAM permissions, making it the only secure method among the options.

Answer

Pass the API key as a build substitution variable in the gcloud builds submit command

Answer

Store the API key in a Cloud Storage bucket and download it in a build step

Answer

Hardcode the API key in the cloudbuild.yaml and store it in the source repository

Question 6

A team's GCP project is approaching its monthly budget. They want to receive an email alert when spending reaches 80% and 100% of the $500 monthly budget. Which GCP feature sends these budget alerts?

Accepted Answer

Cloud Billing budget with alert thresholds set at 80% and 100%. Cloud Billing budgets are the native GCP feature designed to monitor spending against a budget and send email alerts when actual or forecasted costs exceed user-defined thresholds (e.g., 80% and 100% of $500). This feature is configured directly in the Cloud Console or via the Billing API and automatically triggers notifications without requiring custom code or additional services.

Answer

Cloud Monitoring alerting policy on the billing/cost metric

Answer

A Cloud Scheduler job that queries the Billing API and sends an email when cost exceeds thresholds

Answer

Cloud Logging alert on billing cost log entries

Question 7

You have a Kubernetes Deployment running 5 replicas. You need to update the container image with zero downtime, ensuring that at least 4 replicas are always available during the update, and no more than 6 replicas exist at any time. Which Deployment strategy and settings achieve this?

Accepted Answer

RollingUpdate with `maxUnavailable: 1` and `maxSurge: 1`.. A RollingUpdate strategy with `maxUnavailable: 1` and `maxSurge: 1` ensures that during the update, at most one replica is taken down (so at least 4 remain available) and at most one extra replica is created above the desired 5 (so no more than 6 exist at any time). This satisfies both constraints while achieving zero downtime.

Answer

Recreate strategy with `minReadySeconds: 30`.

Answer

RollingUpdate with `maxUnavailable: 0` and `maxSurge: 2`.

Answer

RollingUpdate with `maxUnavailable: 2` and `maxSurge: 1`.

Question 8

A Cloud SQL instance's disk is at 95% capacity. The application is experiencing write failures. You need to resolve this immediately with no downtime. What should you do?

Accepted Answer

Increase the disk size via the Cloud SQL console or `gcloud sql instances patch` — this occurs with no instance restart.. Cloud SQL supports dynamic disk resizing without requiring an instance restart. When you increase the disk size via the console or `gcloud sql instances patch`, the change takes effect immediately, allowing the database to continue serving writes without downtime. This directly resolves the write failures caused by disk-full conditions.

Answer

Take a snapshot of the instance, create a new larger instance from the snapshot, then update the connection string.

Answer

Delete old database tables to free up space.

Answer

Switch the instance to SSD storage, which has higher throughput and allows more writes.

Question 9

An application uses the S3-compatible API to interact with Cloud Storage. The team needs credentials compatible with HMAC-based S3 authentication. Which credential type does Cloud Storage support for this?

Accepted Answer

HMAC keys created for a service account in Cloud Storage settings. Cloud Storage supports HMAC keys for service accounts to provide S3-compatible authentication. These keys consist of an access key and a secret key, which are used to sign requests using the HMAC-SHA256 algorithm, matching the AWS S3 signature process. This allows applications using the S3 API to authenticate directly against Cloud Storage without needing a JSON key file or OAuth 2.0 tokens.

Answer

Service account JSON key file — it's compatible with the S3 HMAC authentication format

Answer

Cloud KMS symmetric keys configured for Cloud Storage access

Answer

An API key generated in the GCP Console for Cloud Storage

Question 10

A media company needs to serve large video files (average 2 GB) to global users with low latency. The files are stored in Cloud Storage. What combination of services delivers the best streaming performance?

Accepted Answer

Cloud Storage + Cloud CDN via a Global Load Balancer backend bucket. Cloud Storage combined with Cloud CDN via a Global Loader Balancer backend bucket is the best choice because it provides edge-caching of large video files, reducing latency for global users. The Global Load Balancer terminates HTTP(S) traffic at the closest point of presence, and Cloud CDN caches content from the multi-region bucket, minimizing origin load and improving streaming performance.

Answer

Cloud Storage in a multi-region bucket with direct public access

Answer

Upload video files to a Compute Engine VM with nginx serving them directly

Answer

Cloud Filestore with NFS-mounted streaming

Question 11

You run `kubectl get pods` and see a pod in `ImagePullBackOff` state. What are the two most common causes of this error?

Accepted Answer

Incorrect image name/tag, or missing pull credentials for a private registry.. The `ImagePullBackOff` state indicates that the kubelet is unable to pull the container image from the registry. The two most common causes are an incorrect image name or tag (e.g., a typo or a non-existent tag), which results in a `404 Not Found` from the registry, and missing or invalid pull credentials for a private registry, which results in a `401 Unauthorized` or `403 Forbidden` response. Both prevent the image from being downloaded, causing the pod to enter a backoff loop.

Answer

Insufficient CPU/memory on the node, or the pod's resource requests are too high.

Answer

The pod's liveness probe is failing, causing the container to restart.

Answer

The container's entrypoint command is failing, causing the image pull to abort.

Question 12

A startup's application uses both GCP services and an existing on-premises Kubernetes cluster. They want a single control plane to manage Kubernetes clusters across both environments with consistent policy enforcement. Which Google service provides this?

Accepted Answer

Anthos (Google Distributed Cloud) for hybrid multi-cluster management. Anthos (Google Distributed Cloud) is the correct answer because it provides a unified control plane for managing Kubernetes clusters across on-premises and GCP environments, enabling consistent policy enforcement, configuration, and observability. Anthos uses GKE on-prem and GKE in the cloud, with a centralized Anthos Config Management and Service Mesh for policy and security consistency, directly addressing the hybrid multi-cluster management requirement.

Answer

GKE Hub (Fleet management)

Answer

Cloud Interconnect — connects on-premises clusters to GCP so they share a control plane

Answer

Cloud Composer — a managed Kubernetes workflow across environments

Question 13

A developer accidentally committed a service account key JSON file to a public GitHub repository. The key was valid for a service account with broad Editor permissions. What should you do FIRST?

Accepted Answer

Immediately delete or disable the service account key in the Cloud Console or via gcloud.. The immediate priority is to revoke the exposed credential to prevent unauthorized access. Deleting or disabling the service account key in the Cloud Console or via `gcloud iam service-accounts keys delete` ensures the key is invalidated within minutes, stopping any attacker from using it to authenticate with Google Cloud APIs. This aligns with the principle of least privilege and incident response best practices: contain the breach before remediation.

Answer

Remove the committed file from Git history using `git filter-branch` or BFG Repo Cleaner.

Answer

Make the GitHub repository private to hide the exposed key.

Answer

Reduce the service account's permissions to limit the blast radius.

Question 14

A company is extending its on-premises network to Google Cloud using a Cloud VPN tunnel with dynamic routing (BGP). They have set up a Cloud Router in the VPN region. Which additional step is required for the Cloud Router to exchange routes with the on-premises router?

Accepted Answer

Configure a BGP session on the Cloud Router with the on-premises router's ASN and IP address. For a Cloud VPN with dynamic routing (BGP), the Cloud Router must have a BGP session configured with the on-premises router. This session requires the on-premises router's ASN and its BGP peer IP address to exchange routes. Without this explicit BGP session configuration, the Cloud Router cannot establish a peering relationship or advertise/learn routes dynamically.

Answer

Create a static route for the on-premises network on the VPC

Answer

Assign an external IP address to the Cloud Router

Answer

Enable the IP forwarding feature on the VPN gateway

Question 15

Your organization mandates that all service-to-service communication within a GKE cluster must be encrypted in transit using mutual TLS (mTLS). The team does not want to manage certificates or modify application code. Which solution meets these requirements?

Accepted Answer

Enable Anthos Service Mesh with mTLS policy set to STRICT mode.. Anthos Service Mesh (ASM) with mTLS set to STRICT mode enforces mutual TLS between all services in the mesh without requiring any application code changes or manual certificate management. ASM automatically injects Envoy sidecar proxies that handle certificate issuance, rotation, and encryption, meeting the requirement for encrypted service-to-service communication with mTLS.

Answer

Configure Kubernetes TLS Secrets and mount them as volumes in each pod.

Answer

Use Cloud Armor to enforce TLS between services within the cluster.

Answer

Enable GKE node-to-node encryption to encrypt all traffic between nodes.