Google ACE Practice Test 17 — 15 Questions

Question 1

A team's GKE Deployment serves variable traffic — 2 Pods at night, 20 Pods at peak hours. Rather than manually changing replica counts, they want automatic scaling based on CPU utilization (target: 60%). What should they deploy?

Accepted Answer

Horizontal Pod Autoscaler (HPA) targeting 60% CPU utilization. The Horizontal Pod Autoscaler (HPA) is the correct choice because it automatically adjusts the number of Pod replicas in a Deployment based on observed CPU utilization, scaling from 2 to 20 Pods as needed to maintain the target of 60% CPU. HPA works by querying the metrics server for CPU usage and calculating the desired replica count using the formula: desiredReplicas = currentReplicas × (currentMetricValue / targetMetricValue). This directly addresses the requirement for variable traffic without manual intervention.

Answer

Vertical Pod Autoscaler (VPA) with CPU target 60%

Answer

Cluster Autoscaler with a CPU threshold of 60%

Answer

Set the Deployment replica count to 20 and rely on resource quotas to limit actual Pod scheduling

Question 2

A platform engineer is deploying a Kubernetes Job that processes a batch of records. The Job should run 10 parallel workers, each processing a subset of records, and complete when all workers finish successfully. Which Job spec configuration achieves this?

Accepted Answer

Set parallelism: 10 and completions: 10 in the Job spec. Option B is correct because in Kubernetes, a Job's `parallelism` field specifies the number of Pods that can run concurrently, and `completions` specifies the total number of successful Pod completions required for the Job to be considered finished. Setting both to 10 ensures exactly 10 Pods run in parallel, each processing a subset of records, and the Job completes only when all 10 have succeeded.

Answer

Set replicas: 10 in the Job spec

Answer

Create 10 separate Job objects — one per worker

Answer

Set concurrency: 10 in the Job spec

Question 3

A developer needs to forward traffic from their local port 5432 to a PostgreSQL service running in GKE on port 5432, to test database queries locally without exposing the database externally. Which kubectl command achieves this?

Accepted Answer

kubectl port-forward svc/postgres-service 5432:5432. Option B is correct because `kubectl port-forward` creates a local tunnel from port 5432 on the developer's machine to the specified service's port 5432 inside the GKE cluster. This allows the developer to connect to the PostgreSQL service as if it were running locally, without exposing it to the internet via a LoadBalancer or Ingress.

Answer

kubectl expose pod postgres-pod --type=LoadBalancer --port=5432

Answer

kubectl tunnel --local=5432 --remote=postgres-service:5432

Answer

gcloud container ssh postgres-pod --port-forward=5432:5432

Question 4

A GCP project administrator needs to share read-only access to all resources in the project with an external auditor who has a Gmail account (auditor@gmail.com). What should the admin do?

Accepted Answer

Grant the Viewer role to auditor@gmail.com in the project's IAM policy. Granting the Viewer (roles/viewer) role to auditor@gmail.com in the project's IAM policy is correct because it provides read-only access to all resources in the project without requiring a Cloud Identity account. Gmail accounts are supported as Google Accounts and can be added directly to IAM policies, allowing them to authenticate and access resources via the GCP Console or APIs.

Answer

Create a service account for the auditor and share the JSON key file

Answer

Add auditor@gmail.com as a project billing admin to give them read-only access

Answer

Create a Cloud Identity account for the auditor — Gmail accounts cannot access GCP projects

Question 5

A team's GKE application is running out of memory due to a memory leak. Pods are restarting with OOMKilled status. As an immediate measure before a code fix is available, what kubectl action provides the most insight into which container is leaking?

Accepted Answer

kubectl top pods --containers -n [NAMESPACE]. Option B is correct because `kubectl top pods --containers` shows per-container CPU and memory usage for each pod in the namespace. This allows you to identify which specific container within a pod is consuming excessive memory and triggering the OOMKilled status, even before a code fix is deployed. It provides immediate, real-time insight into resource consumption at the container level, which is essential for diagnosing a memory leak in a multi-container pod.

Answer

kubectl get events --field-selector=reason=OOMKilling

Answer

kubectl delete pod [POD_NAME] -- force=true to clear the memory leak

Answer

gcloud container clusters describe [CLUSTER] --memory-usage

Question 6

A team needs to roll out a configuration change to a MIG (Managed Instance Group) — updating the instance template to set a new environment variable. They want to validate the change on 1 VM before rolling it out to all 20 VMs. Which MIG update type supports this?

Accepted Answer

Canary update — update 1 VM to the new template, verify, then roll out to all. A canary update in a Managed Instance Group (MIG) allows you to specify a target size (e.g., 1 VM) to update to the new instance template first. After validating the change on that single VM, you can then promote the canary to roll out the new template to the remaining 19 VMs. This matches the requirement to test on 1 VM before full rollout.

Answer

Opportunistic update — the new template applies only when VMs are naturally replaced

Answer

Recreate update — terminate all 20 VMs and recreate with the new template simultaneously

Answer

Snapshot the existing VMs and restore 1 with the new environment variable to test

Question 7

A team runs Apache Kafka on self-managed VMs for event streaming but wants to reduce operational overhead. Which GCP-native service is the managed alternative to Kafka for pub/sub messaging at scale?

Accepted Answer

Cloud Pub/Sub — Google's managed pub/sub messaging service. Cloud Pub/Sub is the correct answer because it is Google Cloud's fully managed, scalable pub/sub messaging service that provides at-least-once delivery and supports both push and pull subscriptions, making it the direct managed alternative to self-managed Apache Kafka. It eliminates the operational overhead of managing Kafka clusters on VMs while offering similar event streaming capabilities with automatic scaling and global availability.

Answer

Cloud Bigtable — a managed wide-column store for streaming data

Answer

Cloud Dataflow — the GCP managed streaming processing service

Answer

Cloud Storage — use GCS notification events as a message queue

Question 8

A GKE Deployment is running 3 replicas and receiving steady traffic. A junior engineer runs `kubectl scale deployment api-service --replicas=0` to 'stop it temporarily'. What happens to traffic during and after this command?

Accepted Answer

All Pods are terminated immediately; the Service has no backends and requests fail until replicas are restored. When you scale a Deployment to 0 replicas, `kubectl` immediately terminates all Pods. The associated Kubernetes Service continues to exist but has no healthy endpoints, so any traffic directed to the Service’s ClusterIP or external load balancer will be dropped or result in a connection refusal (TCP RST) or HTTP 503. Traffic is not queued or buffered; it simply fails until new Pods are created by scaling the Deployment back up.

Answer

Traffic is paused and queued by the Service until replicas are restored

Answer

GKE detects the replica count is 0 and automatically restores it to maintain high availability

Answer

The Deployment is paused but Pods continue running until the next rollout

Question 9

A GCP organization has recently experienced a credential theft incident involving a service account key. The CISO requires that all service account keys in the organization be inventoried and those older than 90 days be rotated. Which tool identifies old service account keys across all projects?

Accepted Answer

Cloud Asset Inventory querying all IAM ServiceAccountKey assets across the organization. Cloud Asset Inventory (CAI) is the correct tool because it can query all IAM ServiceAccountKey assets across the entire organization, including all projects, using a single API call or gcloud command. This allows you to filter by the `validAfterTime` field to identify keys older than 90 days, meeting the CISO's requirement for a comprehensive, automated inventory without manual per-project inspection.

Answer

Security Command Center — it audits service account key age automatically

Answer

Cloud Monitoring metric for service account key creation date

Answer

Manually check each service account in each project's IAM & Admin > Service Accounts page

Question 10

Your organization has a parent folder structure: Root Org → Division A → Team 1 → projects. You need to apply a constraint that prevents all projects in Team 1 from disabling Cloud Audit Logs, but you want Division A to be able to override this constraint for its other teams. At which resource level should you apply the `gcp.disableCloudLogging` org policy?

Accepted Answer

Team 1 folder. Option C is correct because applying the `gcp.disableCloudLogging` org policy at the Team 1 folder ensures that all projects within that folder inherit the constraint, preventing them from disabling Cloud Audit Logs. Since org policies are inherited hierarchically, Division A can override this constraint for its other teams by applying a different policy at the Division A folder level, which takes precedence over the Team 1 folder policy for those other teams.

Answer

Root organization node

Answer

Division A folder

Answer

Each individual project in Team 1

Question 11

You need to enforce that all new Cloud Storage buckets in your organization use Uniform Bucket-Level Access (UBLA) and are created in one of three approved regions: `us-central1`, `us-east1`, or `europe-west1`. What is the most efficient way to enforce both constraints?

Accepted Answer

Apply `storage.uniformBucketLevelAccess` and `gcp.resourceLocations` org policies at the organization level.. Organization policies are the most efficient way to enforce constraints across all new Cloud Storage buckets because they are evaluated at resource creation time by the Cloud Resource Manager. The `storage.uniformBucketLevelAccess` policy enforces UBLA, and `gcp.resourceLocations` restricts the allowed locations, both applied at the organization level to cover all projects without per-bucket overhead.

Answer

Write a Cloud Function triggered by bucket creation events to check and delete non-compliant buckets.

Answer

Create a custom IAM role that removes the `storage.buckets.create` permission for disallowed regions.

Answer

Use Terraform to provision all buckets and include validation in the Terraform plan step.

Question 12

Your security team requires that all service accounts in your GCP organization older than 90 days that have not been used must be automatically disabled. They want a fully managed, serverless solution with no persistent infrastructure. Which architecture best meets these requirements?

Accepted Answer

Use Cloud Scheduler to trigger a Cloud Function that queries Cloud Asset Inventory and disables stale service accounts.. Option B is correct because Cloud Scheduler can trigger a serverless Cloud Function on a schedule (e.g., nightly) to query Cloud Asset Inventory for service accounts older than 90 days with no last authentication time, then disable them via the IAM API. This meets the fully managed, serverless requirement with no persistent infrastructure (no VMs or servers to maintain).

Answer

Deploy a Compute Engine VM with a cron job that calls the IAM API nightly.

Answer

Configure an org policy that automatically expires service accounts after 90 days.

Answer

Use Security Command Center to flag and manually disable unused service accounts.

Question 13

You want to allow a vendor to upload files to a specific Cloud Storage bucket in your project without creating a GCP account for them. The upload URL should expire after 24 hours. Which mechanism should you use?

Accepted Answer

Generate a Signed URL with a 24-hour expiration for the specific bucket path.. Option B is correct because a signed URL allows time-limited, permissionless access to a specific Cloud Storage object or bucket path without requiring a GCP identity. The URL is cryptographically signed using a service account key, and the 24-hour expiration is set via the `expires` parameter. This meets the requirement of allowing the vendor to upload files without creating a GCP account.

Answer

Create a GCP service account for the vendor and share the key JSON file.

Answer

Make the Cloud Storage bucket publicly writable and share the bucket URL.

Answer

Add the vendor's email to the bucket's IAM policy with Storage Object Creator role.

Question 14

Your organization uses Cloud Storage for storing backups. You want to automatically delete backup objects that are older than 30 days to control costs. You also want objects between 7 and 30 days old to use Nearline storage class for lower cost. Which Cloud Storage feature manages both requirements in a single configuration?

Accepted Answer

Configure Object Lifecycle Management rules on the bucket with `SetStorageClass` and `Delete` actions.. Option B is correct because Object Lifecycle Management rules in Cloud Storage allow you to define conditions (e.g., object age) and actions (e.g., SetStorageClass to Nearline, Delete) in a single configuration. This automates both the transition of objects aged 7–30 days to Nearline storage and the deletion of objects older than 30 days, without custom code or manual intervention.

Answer

Write a Cloud Function that runs daily, lists objects, and deletes or moves old ones.

Answer

Set a bucket-level retention policy of 30 days and manually change storage classes.

Answer

Use Cloud Scheduler to trigger `gsutil` commands that move and delete old objects.

Question 15

You need to check the CPU and memory utilization of all pods running in the `production` namespace. Which command provides this information?

Accepted Answer

`kubectl top pods -n production`. The `kubectl top pods` command retrieves real-time CPU and memory utilization metrics from the metrics server for pods in a specified namespace. This is the correct tool for monitoring resource usage, as it directly queries the resource metrics API.

Answer

`kubectl describe pods -n production`

Answer

`kubectl get pods -n production -o wide`

Answer

`kubectl logs -n production --all-pods`