Google ACE Practice Test 18 — 15 Questions

Question 1

A team wants logs from their Python application running on a Compute Engine VM to appear in Cloud Logging. What must be installed on the VM?

Accepted Answer

Ops Agent (Google Cloud's combined logging and monitoring agent). The Ops Agent is Google Cloud's unified agent for both logging and monitoring, and it is required to stream custom application logs from a Compute Engine VM to Cloud Logging. While the VM itself sends basic platform logs (e.g., serial console output), application-level logs (e.g., from a Python app) require the Ops Agent to collect, parse, and forward them to the Cloud Logging API.

Answer

Cloud Trace SDK for the Python application

Answer

Cloud Monitoring agent only

Answer

No installation needed — GCE VMs automatically stream logs to Cloud Logging

Question 2

A company wants to manage multiple Google Cloud projects and enforce consistent security policies across all of them. Which TWO resources should they use? (Choose two.)

Accepted Answer

Organization policies. Organization policies (B) are correct because they let you centrally define and enforce constraints on GCP resources—such as restricting allowed locations, disabling service account key creation, or enforcing uniform bucket-level access—and these constraints are inherited down the resource hierarchy, giving consistent security policy across many projects. Folders (D) are correct because they provide the hierarchical grouping layer beneath the organization and above projects, so you can organize projects into logical groups and apply IAM and organization policies at the folder level, with inheritance ensuring every project under the folder receives the same controls. Together, folders supply the grouping structure and organization policies supply the enforced constraints, which is exactly what managing multiple projects with consistent security requires. Cloud Audit Logs (A) only record and surface activity for auditing and monitoring; they do not enforce policy. Shared VPC (C) centralizes network administration by letting projects share subnets, but it addresses network topology rather than broad security policy enforcement. Labels (E) are metadata for organizing, filtering, and billing reporting, and they carry no enforcement or policy capability.

Answer

Cloud Audit Logs

Answer

Shared VPC

Answer

Labels

Question 3

A Cloud Build pipeline builds a container image and pushes it to Artifact Registry. The next step needs to deploy the image to Cloud Run. The pipeline runs as the Cloud Build service account. What minimum permission does the Cloud Build SA need for the deployment step?

Accepted Answer

`roles/run.admin` and `roles/iam.serviceAccountUser` on the Cloud Run runtime service account.. The Cloud Build service account needs `roles/run.admin` to deploy services to Cloud Run, but it also requires `roles/iam.serviceAccountUser` on the Cloud Run runtime service account (the identity the Cloud Run service runs as) because the deployment step impersonates that runtime service account to create or update the service. Without the `iam.serviceAccountUser` permission, the deployment fails with a permission denied error, even if the Cloud Build SA has full Cloud Run admin rights.

Answer

`roles/run.admin` only.

Answer

`roles/owner` to ensure all necessary permissions are covered.

Answer

`roles/cloudbuild.builds.editor` on the Cloud Run project.

Question 4

A developer frequently switches between three GCP projects and accounts throughout the day. They want to avoid rerunning `gcloud init` each time. Which gcloud feature lets them save and switch between pre-configured project/account/region combinations?

Accepted Answer

gcloud named configurations created with `gcloud config configurations create`. `gcloud config configurations` allow a developer to create, save, and switch between named sets of gcloud properties (project, account, region, zone) without re-running `gcloud init`. Each configuration stores its own active account, project ID, and default compute region/zone, and can be activated instantly with `gcloud config configurations activate <name>`, making it ideal for frequent context switching between multiple GCP projects and accounts.

Answer

gcloud environments — a built-in workspace manager

Answer

Separate gcloud installations — one per project

Answer

A .gcloudrc file in each project directory that gcloud reads automatically

Question 5

A team deploys a new version of their application using a blue-green strategy on GKE. The 'green' deployment is running but still in testing. When ready, traffic should instantly switch from 'blue' to 'green' with rollback possible in seconds. How is the instant switch implemented?

Accepted Answer

Update the Service's label selector from 'version: blue' to 'version: green'. In a blue-green deployment on GKE, the Service acts as a stable network endpoint abstracting the underlying Pods. By changing the Service's label selector from 'version: blue' to 'version: green', traffic is instantly routed to the green Pods without any downtime or need to recreate resources. This allows immediate rollback by simply reverting the selector back to 'version: blue'.

Answer

Delete the blue Deployment and create the green Deployment as the replacement

Answer

Update the Deployment's container image tag — GKE automatically performs a blue-green rollout

Answer

Use kubectl patch to update the Service's ClusterIP to point to the green Deployment

Question 6

A team wants to grant three developers access to view Cloud SQL instance details and connection strings, but not create, delete, or modify any Cloud SQL instances. Which predefined IAM role is the most appropriate?

Accepted Answer

Cloud SQL Viewer. The Cloud SQL Viewer role (roles/cloudsql.viewer) grants read-only permissions to view Cloud SQL instance details, including connection strings, without allowing any create, delete, or modify operations. This matches the requirement precisely, as it provides the necessary visibility while preventing any changes to the instances.

Answer

Cloud SQL Editor

Answer

Cloud SQL Client

Answer

Project Viewer

Question 7

A healthcare company uses GCP to store sensitive patient data in Cloud Storage buckets. Their security policy requires that all data access be logged and that any attempt to access data from outside the corporate network is blocked. They have implemented VPC Service Controls to create a service perimeter around the projects containing the buckets. They have also enabled Data Access audit logs. However, during an audit, they find that a few access attempts from an IP address outside the corporate network succeeded. The logs show that the requests were made using service account credentials. The service account has the storage.objectViewer role on the bucket. The VPC Service Controls perimeter is configured to block all access from outside the perimeter, but the logs show that some requests were allowed. What is the most likely reason?

Accepted Answer

The VPC Service Controls perimeter was configured with an access level that permits certain IP ranges.. VPC Service Controls can be configured with access levels that define allowed client IP ranges. If the access level permits the IP addresses from which the service account requests originated, those requests would be allowed even though they come from outside the corporate network. The logs confirm that the requests used service account credentials, and the storage.objectViewer role grants read access, so the only remaining control that could have been bypassed is the VPC Service Controls perimeter — and an overly permissive access level is the most likely cause.

Answer

The bucket is outside the service perimeter.

Answer

The service account is a member of the perimeter.

Answer

The VPC Service Controls perimeter does not block requests made by service accounts.

Question 8

A developer wants to deploy a Cloud Function that processes images uploaded to a Cloud Storage bucket. The function should be triggered automatically when an object is created. What is the best practice for setting up this trigger?

Accepted Answer

Create a Cloud Function with a Cloud Storage trigger and specify the bucket and event type. Cloud Functions natively supports Cloud Storage triggers via the `google.storage.object.finalize` event type, which fires when a new object is created in the specified bucket. This is the simplest and most reliable approach, as it eliminates the need for intermediate services and ensures low-latency, event-driven invocation directly from the storage layer.

Answer

Use a Pub/Sub topic and a push subscription to invoke the Cloud Function

Answer

Use a Compute Engine instance to watch the bucket and call the function

Answer

Set up a Cloud Scheduler job to periodically scan the bucket and invoke the function

Question 9

Based on the exhibit, which type of traffic will successfully reach the instance?

Accepted Answer

HTTP traffic from the internet (port 80). The exhibit shows a firewall rule allowing inbound HTTP traffic (port 80) from 0.0.0.0/0, which permits any source on the internet to reach the instance on that port. Firewall rules in Google Cloud are stateful, so the corresponding outbound return traffic is automatically allowed. No other rule permits HTTPS or all traffic, and the implicit deny-all rule blocks anything not explicitly allowed.

Answer

HTTPS traffic (port 443) from the internet

Answer

All inbound traffic

Answer

No traffic; the deny-all rule takes effect

Question 10

A DevOps engineer creates a service account for a CI/CD pipeline. The pipeline needs to push container images to Artifact Registry. Which role grants the minimum required permission?

Accepted Answer

Artifact Registry Writer. The Artifact Registry Writer role provides the minimal permissions needed to push container images to Artifact Registry, specifically the `artifactregistry.writer` permission. This role allows writing artifacts without granting broader administrative or read-only access, aligning with the principle of least privilege.

Answer

Artifact Registry Administrator

Answer

Storage Object Creator on the underlying Cloud Storage bucket

Answer

Artifact Registry Reader

Question 11

A startup processes uploaded videos — each video upload triggers transcoding that takes 5–30 minutes. Users should get an immediate response after upload, not wait for transcoding. The transcoding system must handle burst uploads. Which architecture fits?

Accepted Answer

Publish a transcoding job to Cloud Pub/Sub after upload; respond immediately; workers consume and process jobs asynchronously. It decouples the upload from the transcoding process using Cloud Pub/Sub, allowing the API to respond immediately to the user while workers asynchronously process the transcoding jobs. This pattern handles burst uploads by buffering messages in Pub/Sub and scaling workers independently, ensuring no upload is lost even under high load.

Answer

Upload the video and synchronously wait for transcoding to complete before responding

Answer

Use Cloud Spanner to store video metadata and transcode synchronously in a Cloud SQL stored procedure

Answer

Deploy the transcoding directly in the API server and scale the API server horizontally for bursts

Question 12

A platform team is deploying a multi-tier application on GKE: a frontend Deployment, a backend Deployment, and a Redis StatefulSet. The backend must be reachable by name from the frontend, but not from outside the cluster. Which Kubernetes resource enables internal name-based service discovery?

Accepted Answer

A ClusterIP Service for the backend. A ClusterIP Service exposes the backend Pods on a stable, internal IP address that is only reachable from within the GKE cluster. The frontend can resolve the backend by the Service's DNS name (e.g., `backend.default.svc.cluster.local`) using the cluster's internal DNS (CoreDNS), enabling name-based service discovery without exposing the backend to external traffic.

Answer

A NodePort Service for the backend

Answer

A LoadBalancer Service for the backend

Answer

A Kubernetes Ingress resource for the backend

Question 13

You need to grant a user the ability to view audit logs for a project but not modify any resources. Which predefined IAM role should you assign?

Accepted Answer

roles/logging.viewer. The roles/logging.viewer role provides read-only access to logs, including audit logs. roles/iam.securityReviewer provides read access to IAM policies but not logs. roles/viewer is too broad. roles/owner is administrative.

Answer

roles/iam.securityReviewer

Answer

roles/owner

Answer

roles/viewer

Question 14

A security team wants to centrally identify misconfigured GCP resources across their organization — such as publicly accessible Cloud Storage buckets, unencrypted disks, and overly permissive firewall rules. Which GCP service provides these findings?

Accepted Answer

Security Command Center (SCC) with Security Health Analytics enabled. Security Command Center (SCC) with Security Health Analytics enabled is the correct service because it provides built-in, automated scanning for common misconfigurations such as publicly accessible Cloud Storage buckets, unencrypted disks, and overly permissive firewall rules. Security Health Analytics uses a set of pre-defined detectors (e.g., `PUBLIC_BUCKET_ACL`, `DISK_ENCRYPTION_DISABLED`, `FIREWALL_RULE_OPEN`) to continuously assess resources and surface findings in the SCC dashboard, without requiring custom code or manual queries.

Answer

Cloud Asset Inventory — query for all resources and write custom checks

Answer

Cloud Monitoring alert policies with metric conditions for firewall rule changes

Answer

Cloud Logging audit log analysis for admin activity changes

Question 15

A payment service publishes an event to a message queue every time a transaction completes. Multiple downstream services (inventory, analytics, email) must each process every event independently. Which messaging pattern and GCP service best supports this?

Accepted Answer

Cloud Pub/Sub with one subscription per downstream service on a shared topic. Cloud Pub/Sub with a single topic and one subscription per downstream service is the correct pattern because it implements a fan-out messaging model where each subscriber receives an independent copy of every published message. This ensures that inventory, analytics, and email services each process every transaction event without interference, while Pub/Sub handles at-least-once delivery and automatic scaling.

Answer

Cloud Tasks with one queue per downstream service

Answer

Cloud Storage event notifications with three separate buckets

Answer

Directly calling each downstream service's API synchronously from the payment service