Google ACE Practice Test 18 — 15 Questions

Question 1

A team is creating a new GCP project for a sensitive workload. They need to ensure the project is linked to the correct billing account, placed in the correct folder, and has specific APIs enabled — all reproducibly. They want to automate this via Infrastructure as Code. Which approach is most appropriate?

Accepted Answer

Use Terraform with `google_project`, `google_project_service`, and billing account linkage resources.. Option B is correct because Terraform is an Infrastructure as Code (IaC) tool that allows you to define the entire project setup—including folder placement, billing account linkage, and API enablement—in declarative configuration files. This ensures reproducibility, version control, and automation, which aligns with the requirement for a sensitive workload that must be set up consistently every time.

Answer

Use a gcloud script with `gcloud projects create`, `gcloud beta billing projects link`, and `gcloud services enable`.

Answer

Use Cloud Console to manually create the project, then document the steps in a runbook.

Answer

Use Cloud Deployment Manager with a Python template to create the project.

Question 2

You notice that your Cloud SQL for PostgreSQL instance's `pg_stat_activity` shows many connections in `idle in transaction` state, and the connection count is near the max_connections limit. Application threads are blocking waiting for connections. What is the most effective solution to manage database connections for a GKE-hosted application?

Accepted Answer

Deploy PgBouncer as a sidecar or deployment to pool connections to Cloud SQL in transaction mode.. PgBouncer is a lightweight connection pooler that can be deployed as a sidecar or separate deployment in GKE to manage connections to Cloud SQL for PostgreSQL. By operating in transaction mode, it holds database connections only for the duration of a transaction, not for the entire client session, which drastically reduces the number of concurrent connections to the database. This directly addresses the `idle in transaction` connections and the near-max_connections issue without requiring application code changes.

Answer

Increase `max_connections` in the Cloud SQL PostgreSQL instance flags.

Answer

Switch from Cloud SQL to Cloud Spanner, which has no connection limits.

Answer

Restart the Cloud SQL instance to clear idle connections.

Question 3

A developer accidentally committed a service account key JSON file to a public GitHub repository. The key was valid for a service account with broad Editor permissions. What should you do FIRST?

Accepted Answer

Immediately delete or disable the service account key in the Cloud Console or via gcloud.. Option B is correct because the immediate priority is to revoke the exposed credential to prevent unauthorized access. Deleting or disabling the service account key in the Cloud Console or via `gcloud iam service-accounts keys delete` ensures the key is invalidated within minutes, stopping any attacker from using it to authenticate with Google Cloud APIs. This aligns with the principle of least privilege and incident response best practices: contain the breach before remediation.

Answer

Remove the committed file from Git history using `git filter-branch` or BFG Repo Cleaner.

Answer

Make the GitHub repository private to hide the exposed key.

Answer

Reduce the service account's permissions to limit the blast radius.

Question 4

A GKE cluster hosts multiple teams' workloads in separate namespaces. One team's pods should not be able to make API calls to Google Cloud services (e.g., they should not call BigQuery or Cloud Storage). The pods currently use the node's service account via the Compute Engine metadata server. How do you restrict these specific pods from accessing GCP APIs while allowing other pods on the same node to continue using GCP APIs?

Accepted Answer

Apply a Kubernetes NetworkPolicy in the team's namespace blocking egress to `169.254.169.254` (the metadata server).. Option A is correct because the Compute Engine metadata server (169.254.169.254) is the endpoint that provides the node's service account credentials to pods. By applying a Kubernetes NetworkPolicy that blocks egress to this IP in the team's namespace, you prevent those pods from reaching the metadata server, thus denying them access to GCP APIs. Other pods on the same node are unaffected because NetworkPolicy is namespace-scoped and does not apply to them.

Answer

Revoke all IAM roles from the node's service account.

Answer

Set `automountServiceAccountToken: false` on the restricted team's pods.

Answer

Use a Kubernetes ResourceQuota to limit the team's namespace API access.

Question 5

Your application running on GKE is experiencing intermittent 500 errors. You want to create an alert that fires when the 99th percentile latency exceeds 2 seconds OR when the error rate (5xx responses) exceeds 1% of all requests over a 5-minute window. You have Cloud Monitoring configured with the application exporting metrics via OpenTelemetry. What should you create in Cloud Monitoring?

Accepted Answer

A single alerting policy with two conditions (p99 latency and error rate) joined with OR logic.. Option B is correct because Cloud Monitoring alerting policies support multiple conditions combined with AND/OR logic, allowing you to trigger a single alert when either the 99th percentile latency exceeds 2 seconds or the error rate exceeds 1% over a 5-minute window. This directly matches the requirement without needing separate policies or relying on log-based detection.

Answer

Two separate alerting policies — one for latency and one for error rate — each with their own notification channel.

Answer

A log-based alert using Cloud Logging to detect 5xx response codes in access logs.

Answer

An SLO with error budget burn rate alerts configured in Cloud Monitoring.

Question 6

You need to design a solution where a Cloud Function is triggered by HTTP requests from the internet, but it must also privately access a Cloud SQL instance that has no public IP. The Cloud Function should not expose the Cloud SQL instance to public traffic. Which configuration enables this?

Accepted Answer

Configure a Serverless VPC Access connector and attach it to the Cloud Function to access Cloud SQL via private IP.. Option B is correct because a Serverless VPC Access connector allows a Cloud Function to connect to a Cloud SQL instance via its private IP, enabling private network communication without exposing the database to the internet. The connector bridges the serverless environment to a VPC, and the Cloud SQL instance must have private IP enabled. This satisfies the requirement of private access while the function itself remains publicly triggerable via HTTP.

Answer

Enable a public IP on the Cloud SQL instance and restrict access using Cloud SQL authorized networks.

Answer

Use Cloud SQL Auth Proxy on a Compute Engine VM as a jump host between the function and the database.

Answer

Deploy the Cloud Function in the same project as Cloud SQL; same-project resources can access each other privately by default.

Question 7

You need to run a database migration script once before deploying a new version of an application to GKE. The migration must complete before any application pods start. Which Kubernetes feature enables this pattern?

Accepted Answer

A Kubernetes init container in the Pod spec that runs the migration script.. Init containers run sequentially before the main application containers in a Pod start, ensuring the migration script completes before any application pods become ready. This guarantees the migration runs exactly once per Pod lifecycle, which aligns with the requirement that the migration must finish before deployment.

Answer

A Kubernetes CronJob scheduled to run the migration before deployment.

Answer

A readiness probe that runs the migration script before marking the pod as ready.

Answer

A Kubernetes Job that runs the migration, with the Deployment configured to start only after the Job completes.

Question 8

Your Dataflow streaming pipeline is consuming messages from Pub/Sub but the pipeline's throughput has dropped significantly. Cloud Monitoring shows the `pubsub/subscription/oldest_unacked_message_age` metric is growing. The pipeline has enough workers. What is the most likely bottleneck, and how should you address it?

Accepted Answer

Inspect Dataflow job graph metrics to identify the slow stage, then optimize that stage's logic or address data skew.. The growing `oldest_unacked_message_age` metric indicates that messages are not being processed and acknowledged quickly enough, even though the pipeline has enough workers. This points to a bottleneck within a specific stage of the Dataflow pipeline, such as a transformation or grouping operation that is slow or suffering from data skew. Option B is correct because inspecting the job graph metrics (e.g., wall time, backlog, and throughput per stage) allows you to identify the slow stage and then optimize its logic or address data skew, which directly resolves the processing delay.

Answer

Increase the number of Dataflow workers to process messages faster.

Answer

Increase the Pub/Sub subscription's ack deadline to 600 seconds.

Answer

Switch from Dataflow to Pub/Sub Lite for lower cost and higher throughput.

Question 9

Your web application serves users globally. Static assets (images, JS, CSS) are stored in Cloud Storage. Users in Asia report slow load times for these assets. The application origin is in `us-central1`. What is the most cost-effective way to improve static asset performance for Asian users?

Accepted Answer

Enable Cloud CDN on the Cloud Storage bucket's load balancer backend.. Cloud CDN uses Google's global edge cache network to serve static assets from locations close to users, reducing latency for Asian users without requiring bucket replication or additional compute. It is the most cost-effective solution because it leverages existing Cloud Storage as the origin and only charges for cache egress and operations, avoiding the overhead of managing regional buckets or compute instances.

Answer

Replicate the Cloud Storage bucket to an Asia region and update DNS to route Asian users to the regional bucket.

Answer

Deploy Cloud Run instances in Asia regions to serve the static assets.

Answer

Increase the Cloud Storage bucket's replication factor to improve throughput.

Question 10

A project has the following IAM bindings: User A has `roles/editor` at the project level, and a folder-level policy denies `roles/editor` to User A. Which effective permission does User A have on the project?

Accepted Answer

User A is denied Editor permissions because IAM Deny policies at a parent resource override allow grants at child resources.. In Google Cloud, IAM Deny policies at a parent resource (like a folder) override allow bindings at a child resource (like a project). Even though User A has `roles/editor` granted at the project level, the folder-level Deny policy explicitly denies that role, so the effective permission is denial. This follows the principle that Deny policies are evaluated before Allow bindings and take precedence.

Answer

User A has Editor permissions because project-level IAM takes precedence over folder-level.

Answer

User A has no permissions because conflicting policies result in no access.

Answer

User A has Editor permissions because folder-level policies don't apply to individual projects.

Question 11

A project is being decommissioned. You need to delete it but want to ensure there is a 30-day window during which the deletion can be cancelled if needed. What happens when you delete a GCP project?

Accepted Answer

The project enters a 30-day pending deletion period; resources are inaccessible but the project can be restored within this window.. When you delete a GCP project, it enters a 30-day pending deletion period. During this time, all resources are inaccessible, but the project and its data can be fully restored if needed. This ensures a safety window before permanent deletion, aligning with the requirement for a 30-day cancellation window.

Answer

The project is immediately and permanently deleted along with all resources.

Answer

The project is archived but billing continues for 30 days before final deletion.

Answer

All resources are deleted immediately but the project ID is reserved for 90 days.

Question 12

Your application exposes a REST API that external partners consume. You need rate limiting per partner (API key), usage analytics, and developer portal for onboarding. Traffic is currently 1,000 requests/day but expected to grow to 10M/day within a year. Which GCP service best fits these requirements?

Accepted Answer

Apigee API Management. Apigee API Management is correct because it provides built-in rate limiting per API key (via quota policies), detailed analytics dashboards for usage tracking, and a developer portal for partner onboarding and key management. Unlike simpler API gateways, Apigee is designed for enterprise-grade API management at scale, handling growth from 1,000 to 10M requests/day with features like monetization, traffic management, and security policies.

Answer

Cloud Endpoints with Extensible Service Proxy

Answer

Cloud Armor with rate limiting rules

Answer

API Gateway with a backend Cloud Run service

Question 13

You want to use Kustomize to manage environment-specific Kubernetes configurations (dev, staging, prod) from a single base set of manifests. How does Kustomize achieve environment customization without duplicating YAML files?

Accepted Answer

Kustomize uses overlays that patch a shared base: environment-specific differences are expressed as patches without duplicating base manifests.. Kustomize uses a base set of Kubernetes manifests and applies environment-specific overlays that contain patches. These patches modify only the differences (e.g., replicas, image tags, namespaces) without copying or altering the original base YAML files. This approach avoids duplication and keeps the base clean, with each overlay representing a distinct environment.

Answer

Kustomize duplicates all YAML files per environment, then applies find-and-replace on values.

Answer

Kustomize uses Helm charts with values files per environment for templating.

Answer

Kustomize requires a separate Git branch per environment where manifests are committed.

Question 14

Your Cloud Build pipeline needs to reference environment-specific configuration: `PROJECT_ID`, `REGION`, and `IMAGE_TAG` (generated from the Git commit SHA). Where should you define these values in `cloudbuild.yaml`?

Accepted Answer

Use built-in substitutions (`$PROJECT_ID`, `$COMMIT_SHA`) and define custom substitutions (`$_REGION`) in the trigger or `--substitutions` flag.. Option B is correct because Cloud Build provides built-in substitutions like `$PROJECT_ID` and `$COMMIT_SHA` that automatically resolve to the current project ID and the Git commit SHA, respectively. Custom substitutions like `$_REGION` can be defined in the trigger configuration or passed via the `--substitutions` flag, allowing environment-specific values to be injected without hardcoding. This approach keeps the `cloudbuild.yaml` reusable across environments and avoids exposing sensitive or variable data in the build file.

Answer

Hardcode the values directly in each build step's `args` field.

Answer

Store all values in Cloud Secret Manager and retrieve them in each build step.

Answer

Use a `.env` file committed to the repository and source it in build steps.

Question 15

A GKE node pool needs to be upgraded to a new node version. The cluster has 10 nodes. You need to minimize disruption to running workloads — no more than 2 nodes should be unavailable simultaneously. Which upgrade strategy should you configure?

Accepted Answer

Configure surge upgrade with `max-surge: 0, max-unavailable: 2`.. Option A is correct because configuring `max-surge: 0` and `max-unavailable: 2` ensures that during the upgrade, no additional nodes are created (surge), and at most 2 nodes can be unavailable at any time. This directly satisfies the requirement of minimizing disruption by keeping at least 8 nodes available, while allowing the upgrade to proceed in controlled batches.

Answer

Configure surge upgrade with `max-surge: 10, max-unavailable: 10`.

Answer

Manually cordon and drain 2 nodes, upgrade them, then repeat.

Answer

Enable GKE Auto-upgrade with default settings.