Google ACE Practice Test 18 — 15 Questions

Question 1

Your GKE cluster nodes are running an older kernel version with a known vulnerability. You need to update all nodes to use the latest node image with the patched kernel without any downtime. The cluster has a Surge Upgrade configuration of `max-surge: 1, max-unavailable: 0`. What happens during the node upgrade?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GKE provisions one new node, drains one old node, deletes it, and repeats — zero downtime.. The surge upgrade configuration `max-surge: 1, max-unavailable: 0` ensures that GKE first provisions one new node (the surge node) before draining and deleting an old node. This rolling update process maintains the desired capacity at all times, resulting in zero downtime for applications.

Answer

GKE terminates all nodes simultaneously and creates new ones — brief downtime occurs.

Answer

GKE upgrades nodes in-place by applying a kernel patch without rescheduling pods.

Answer

Two nodes are upgraded simultaneously (one being the surge node and one old node going offline).

Question 2

What is the purpose of Cloud Audit Logs' Data Access audit logs, and why are they NOT enabled by default for most services?

Accepted Answer

They log API calls that read or write user data; they are off by default due to very high log volume and associated storage costs.. Data Access audit logs record every API call that reads or writes user-provided data (e.g., reading a Cloud Storage object or updating a BigQuery table). They are disabled by default because the sheer volume of these operations can generate terabytes of logs per day, leading to significant Cloud Logging storage costs and potential budget overruns. Administrators must explicitly enable them per service or per resource to control cost and log retention.

Answer

They record authentication events; they are disabled by default due to privacy regulations.

Answer

They log VM instance creation and deletion; they are disabled by default to avoid noise.

Answer

They provide real-time threat detection; they are experimental and not yet generally available.

Question 3

A team uses Cloud Shell for all GCP CLI operations. A developer notices that files they create in Cloud Shell's home directory persist between sessions, but files in other directories do not. What explains this behavior?

Accepted Answer

Only $HOME (~) has persistent 5 GB storage; other directories use ephemeral container storage. Cloud Shell provides each user with a persistent 5 GB home directory ($HOME) backed by Cloud Storage. Files created outside this directory reside in the container's ephemeral storage, which is discarded when the Cloud Shell session ends or is restarted. This design ensures user configurations and scripts are preserved while maintaining a clean, temporary environment for other operations.

Answer

Cloud Shell saves all files to Cloud Storage automatically

Answer

Cloud Shell stores files in Firestore, which only retains home directory paths

Answer

Files outside $HOME are deleted after 24 hours automatically

Question 4

A developer wants to deploy a containerized application on Google Cloud that automatically scales to zero when not in use and charges only for request processing time. The application is stateless and can be triggered by HTTP requests. Which compute option meets these requirements?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform that scales to zero and charges per request. It is ideal for stateless HTTP-triggered containers. Compute Engine and GKE do not scale to zero (idle resources incur cost). Cloud Functions is also serverless but is for event-driven code, not containerized apps.

Answer

Compute Engine with managed instance groups

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE) with cluster autoscaling

Question 5

A cost-conscious team notices their GKE cluster's node pools have consistently high memory utilization (>90%) while CPU remains at 30%. Pods are occasionally OOMKilled. What should they do to balance resource efficiency and stability?

Accepted Answer

Switch node pool machine type to a memory-optimized series (e.g., m2-ultramem) and ensure Pod memory requests are accurate. The team has a memory-bound workload (high memory utilization, low CPU, OOMKills). Switching to a memory-optimized machine series (e.g., m2-ultramem) provides a higher memory-to-CPU ratio, directly addressing the memory pressure. Ensuring accurate Pod memory requests allows the scheduler to place Pods efficiently and prevents overcommitment, balancing resource efficiency with stability.

Answer

Increase CPU limits for all Pods to use the available CPU capacity

Answer

Enable vertical pod autoscaling (VPA) set to Recreate mode as the only change

Answer

Reduce the number of replica Pods to lower memory consumption

Question 6

A healthcare company stores patient data in Cloud Storage. Compliance requires that even GCP (Google) cannot decrypt this data. The company manages encryption keys entirely on their own infrastructure. Which encryption option satisfies this?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK) provided with each API request. Customer-Supplied Encryption Keys (CSEK) allow the customer to provide their own AES-256 encryption key with each API request to Cloud Storage. Google does not store the key; it is used only in memory to encrypt/decrypt the data and then discarded, ensuring that even Google cannot access the plaintext. This meets the compliance requirement that the customer retains exclusive control over the encryption keys.

Answer

Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS

Answer

Google-managed encryption keys (default) with restricted IAM policies

Answer

Shielded VM with confidential computing for the VMs that access the data

Question 7

What action does the condition in the IAM policy restrict the user from performing?

Accepted Answer

Deleting disks that do not start with 'disk-'. The condition in the IAM policy restricts the user from performing actions on disks that do not meet the specified criteria. Specifically, the condition `resource.name.startsWith('disk-')` combined with the zone constraint `us-central1-a` means that only disks whose names start with 'disk-' in that zone are allowed for the granted action (e.g., `compute.disks.delete`). Therefore, the policy restricts the user from deleting disks that do not start with 'disk-'. Option A correctly identifies this restricted action.

Answer

Performing any action on compute instances

Answer

Performing any compute.admin action on disks in us-central1-a with names starting with 'disk-'

Answer

Creating disks in any zone other than us-central1-a

Question 8

An engineering team is deciding between App Engine Standard and App Engine Flexible for a Python API. The API has unpredictable traffic, must scale to zero when idle, runs standard Python code with no custom system packages, and requires < 1 second startup time. Which environment is most suitable?

Accepted Answer

App Engine Standard — it scales to zero, starts in sub-second, and supports standard Python runtimes. App Engine Standard is the correct choice because it automatically scales to zero instances during idle periods, starts new instances in under a second, and supports standard Python runtimes without custom system packages. The requirement for sub-second startup time and scaling to zero aligns perfectly with Standard's sandboxed, pre-loaded runtime environment, whereas Flexible environment has slower startup times due to VM provisioning and cannot scale to zero.

Answer

App Engine Flexible — it supports Python with custom packages

Answer

Both are equivalent — the difference is only in supported languages

Answer

Neither — use Cloud Run instead for Python APIs

Question 9

A team builds a GKE application that processes healthcare data. Regulatory requirements mandate that data in transit between GKE nodes must be encrypted. GKE is running on GCP. What provides encrypted node-to-node traffic within the cluster?

Accepted Answer

GCP automatically encrypts all VM-to-VM traffic in transit within its network. GCP automatically encrypts all VM-to-VM traffic in transit at the network layer, including traffic between GKE nodes, using a combination of MACsec (IEEE 802.1AE) and IPsec. This encryption is enabled by default for all traffic within a VPC and between VPCs, without any configuration required. Therefore, node-to-node traffic within a GKE cluster is already encrypted, satisfying the regulatory requirement.

Answer

GKE node traffic is unencrypted by default — mTLS must be manually configured on every Pod

Answer

Enable VPC Flow Logs — they activate encryption for logged traffic

Answer

Install a TLS termination proxy on each GKE node — it encrypts intranode traffic

Question 10

Your team uses Cloud Build to build and push Docker images to Artifact Registry. A new security requirement mandates that only images signed by Cloud Build (using Binary Authorization with attestors) can be deployed to your GKE cluster. Which sequence of steps correctly implements this?

Accepted Answer

Create a Cloud KMS key and attestor, configure Cloud Build to create attestations post-build, then set a BinAuthz policy requiring the attestation on the GKE cluster.. It follows the required workflow: you must first create a Cloud KMS key and an attestor in Binary Authorization, then configure Cloud Build to generate an attestation (signed by the attestor) after each successful build. Finally, you set a Binary Authorization policy on the GKE cluster that enforces the attestation, ensuring only signed images are deployed. Cloud Build does not automatically sign images when BinAuthz is enabled; the attestation must be explicitly created.

Answer

Enable BinAuthz on the GKE cluster; Cloud Build automatically signs images when BinAuthz is enabled.

Answer

Use Artifact Registry vulnerability scanning; images that pass scanning are automatically trusted by GKE.

Answer

Add a Cloud Build step that runs `gcloud container binauthz attestations sign-and-create` without additional configuration.

Question 11

You need to tag all Compute Engine VMs in your organization with a `cost-center` tag for billing allocation reports. The tag values must be controlled centrally — only predefined values should be allowed. Which GCP feature enables this?

Accepted Answer

Create Resource Manager Tag keys and values at the org level, then attach tags to VMs.. Resource Manager Tags (formerly 'tags' in the Resource Manager API) allow you to create tag keys and predefined tag values at the organization level, then attach those tags to resources like Compute Engine VMs. This ensures that only centrally controlled values can be used, meeting the requirement for controlled billing allocation. Labels, by contrast, are free-form key-value pairs and cannot have their values restricted natively by an org policy.

Answer

Use Compute Engine labels — configure label keys and restrict values using an org policy.

Answer

Use network tags on VMs and enforce allowed values via a custom org policy constraint.

Answer

Require teams to apply specific label values using a Terraform module, and enforce this via code review.

Question 12

A company runs a stable production workload on 20 n2-standard-8 VMs that run continuously year-round. Which pricing commitment maximizes cost savings on these VMs?

Accepted Answer

3-year committed use discount (CUD). The 3-year committed use discount (CUD) offers the highest discount rate (up to 57% for compute-optimized machine types) compared to 1-year CUDs (up to 20%) or sustained use discounts (up to 30% for running a VM the entire month). Since the workload runs 20 n2-standard-8 VMs continuously year-round, a 3-year CUD locks in the maximum savings for this predictable, steady-state usage.

Answer

Sustained use discounts (automatically applied)

Answer

1-year committed use discount (CUD)

Answer

Switching to Spot VMs

Question 13

A data analytics team runs Apache Spark jobs to process large datasets. They need a managed cluster that provisions quickly, scales dynamically, and integrates with Cloud Storage and BigQuery. Which service should they use?

Accepted Answer

Cloud Dataproc. Cloud Dataproc is the correct choice because it is a managed Spark and Hadoop service that provisions clusters in under 90 seconds, supports autoscaling, and natively integrates with Cloud Storage (via the gs:// connector) and BigQuery (via the BigQuery Storage API and Spark BigQuery connector). This makes it ideal for teams needing fast, dynamic, and integrated Spark job execution.

Answer

Cloud Dataflow

Answer

Cloud Composer

Answer

Cloud Run with a custom Spark container

Question 14

A startup builds a serverless REST API using Cloud Functions (2nd gen). Each function invocation runs for 200ms on average, processes 5 million requests per day, and uses 256 MB memory. Approximately how should they estimate monthly Cloud Functions costs?

Accepted Answer

Estimate based on invocation count, compute time (memory × duration), and networking costs beyond the free tier. Cloud Functions (2nd gen) pricing is based on three components: invocation count, compute time (measured in GB-seconds, which is memory multiplied by duration), and networking egress beyond the free tier. With 5 million requests per day at 200ms each and 256 MB memory, the monthly compute time is approximately 5,000,000 × 0.2 seconds × (256/1024) GB = 250,000 GB-seconds per day, or 7.5 million GB-seconds per month, which far exceeds the free tier of 400,000 GB-seconds per month, so costs will accrue. Additionally, the 150 million invocations per month exceed the free tier of 2 million invocations, and egress traffic will also incur charges beyond the 1 GB free tier.

Answer

Approximately $0 — all invocations fall within the free tier

Answer

Approximately the same as a continuously-running e2-medium VM — Cloud Functions and VMs are priced equivalently

Answer

Fixed monthly rate based on the number of deployed functions, not invocation count

Question 15

A team is migrating a stateful application with local disk writes to GKE. The application requires a dedicated persistent disk that follows the Pod if it's rescheduled to a different node. Which Kubernetes resource provides this?

Accepted Answer

A PersistentVolumeClaim backed by a GCE persistent disk StorageClass. A PersistentVolumeClaim (PVC) backed by a GCE persistent disk StorageClass is the correct choice because it provides a durable, network-attached block storage volume that persists independently of the Pod's lifecycle. When the Pod is rescheduled to a different node, the PVC ensures the GCE persistent disk is detached from the old node and reattached to the new node, preserving the application's state. This meets the requirement for a dedicated persistent disk that follows the Pod across rescheduling events.

Answer

A HostPath volume pointing to a directory on the node

Answer

A ConfigMap mounted as a volume

Answer

An emptyDir volume scoped to the Pod