Google ACE Practice Test 19 — 15 Questions

Question 1

Your GKE cluster nodes are running an older kernel version with a known vulnerability. You need to update all nodes to use the latest node image with the patched kernel without any downtime. The cluster has a Surge Upgrade configuration of `max-surge: 1, max-unavailable: 0`. What happens during the node upgrade?

Accepted Answer

GKE provisions one new node, drains one old node, deletes it, and repeats — zero downtime.. Option B is correct because the surge upgrade configuration `max-surge: 1, max-unavailable: 0` ensures that GKE first provisions one new node (the surge node) before draining and deleting an old node. This rolling update process maintains the desired capacity at all times, resulting in zero downtime for applications.

Answer

GKE terminates all nodes simultaneously and creates new ones — brief downtime occurs.

Answer

GKE upgrades nodes in-place by applying a kernel patch without rescheduling pods.

Answer

Two nodes are upgraded simultaneously (one being the surge node and one old node going offline).

Question 2

You need to create a dashboard in Cloud Monitoring that shows: (1) Cloud Run request count per second, (2) Cloud Run p99 latency, (3) GKE pod CPU utilization, and (4) Cloud SQL query duration — all on a single screen. Which Cloud Monitoring feature enables this multi-service overview?

Accepted Answer

Create a Cloud Monitoring custom dashboard with chart widgets for each metric across the different services.. Option B is correct because Cloud Monitoring custom dashboards allow you to combine chart widgets from multiple monitored services (Cloud Run, GKE, Cloud SQL) into a single screen. This feature supports heterogeneous metric queries using the Monitoring Query Language (MQL) or metric selectors, enabling a unified view without needing separate tools or exports.

Answer

Create four separate alerting policies and pin them to a shared alerting page.

Answer

Use BigQuery to query the metrics export and build a Looker Studio dashboard.

Answer

Use Cloud Logging to create a log-based dashboard with all four metrics.

Question 3

Your Cloud SQL for MySQL primary instance in `us-central1` has failed. Cloud SQL HA automatically fails over to the standby. After the failover, your application is experiencing intermittent connection errors. What is the most likely cause and solution?

Accepted Answer

Application connection pools hold stale connections to the failed primary; configure pools to validate connections and reconnect after failure.. Option B is correct because after a Cloud SQL HA failover, the standby instance becomes the new primary with the same IP address, but existing application connections that were established to the old primary are now broken. Connection pools that do not validate connections before reuse will attempt to use these stale connections, causing intermittent errors. Configuring the pool to test connections (e.g., via `SELECT 1` or JDBC `connectionTestQuery`) and automatically reconnect resolves this by discarding dead connections and establishing fresh ones to the new primary.

Answer

The standby instance has a different IP address; update the connection string.

Answer

The standby replica must be manually promoted before it can accept connections.

Answer

The MySQL binary log is incomplete after failover; run `mysqlcheck` to repair tables.

Question 4

Which GCP service protects internet-facing applications against SQL injection, cross-site scripting (XSS), and other OWASP Top 10 attacks?

Accepted Answer

Cloud Armor WAF with preconfigured OWASP Core Rule Set. Cloud Armor WAF with the preconfigured OWASP Core Rule Set (CRS) is specifically designed to protect internet-facing applications from web application attacks, including SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. It operates at the edge of Google's network, inspecting HTTP/HTTPS traffic against a set of rules that match known attack patterns, and can be integrated with Cloud Load Balancing to filter malicious requests before they reach the backend.

Answer

Cloud Firewall (VPC firewall rules)

Answer

Security Command Center's Web Security Scanner

Answer

Cloud Identity-Aware Proxy (IAP)

Question 5

You need to grant a third-party monitoring vendor's service account `roles/monitoring.viewer` on your project, but only for the next 90 days. After 90 days, the access should automatically expire. Which IAM feature enables time-limited access?

Accepted Answer

Add an IAM Condition with a date/time expression that expires the binding after 90 days.. Option B is correct because IAM Conditions allow you to attach a time-based expression to a role binding, such as `request.time < timestamp('2025-01-01T00:00:00Z')`, which automatically revokes the binding after the specified date. This is the native, auditable, and policy-driven way to enforce time-limited access in Google Cloud without manual intervention or resource lifecycle management.

Answer

Set a session duration limit in the vendor's service account settings.

Answer

Grant the role and set a reminder to manually revoke it in 90 days.

Answer

Use a temporary service account that is automatically deleted after 90 days via a Cloud Scheduler job.

Question 6

A Cloud KMS key used to encrypt a Cloud Storage bucket's data is being destroyed. What happens to the data in the bucket when the KMS key is destroyed?

Accepted Answer

The encrypted data becomes permanently inaccessible (cryptographic erasure) since the decryption key no longer exists.. When a Cloud KMS key is destroyed, the encrypted data in Cloud Storage becomes permanently inaccessible because the cryptographic key material is irrecoverably deleted. This is known as cryptographic erasure: without the key, the ciphertext cannot be decrypted, even though the raw encrypted bytes still exist in the bucket. Cloud Storage does not store a copy of the KMS key, and there is no fallback mechanism to re-encrypt or recover the data.

Answer

The data in Cloud Storage is automatically deleted along with the key.

Answer

Cloud Storage automatically re-encrypts the data using Google-managed keys as a fallback.

Answer

The key enters a 'disabled' state where data can still be decrypted by Google support.

Question 7

A team uses Cloud Build to build Docker images and push them to Artifact Registry. The cloudbuild.yaml has a step that requires a secret API key to call an external service during build. How should the secret be provided securely?

Accepted Answer

Reference the API key from Secret Manager using the availableSecrets field in cloudbuild.yaml. Option B is correct because Cloud Build's `availableSecrets` field allows you to securely inject secrets from Secret Manager into build steps as environment variables or files, without exposing them in the build configuration or logs. This approach ensures the API key is encrypted at rest and in transit, and access can be controlled via IAM permissions, making it the only secure method among the options.

Answer

Pass the API key as a build substitution variable in the gcloud builds submit command

Answer

Store the API key in a Cloud Storage bucket and download it in a build step

Answer

Hardcode the API key in the cloudbuild.yaml and store it in the source repository

Question 8

A developer attempts to create a Cloud SQL instance but receives the error: 'API [sqladmin.googleapis.com] not enabled.' What is the correct resolution?

Accepted Answer

Enable the Cloud SQL Admin API via APIs & Services > Library in the Console. The error 'API [sqladmin.googleapis.com] not enabled' indicates that the Cloud SQL Admin API has not been activated for the project. The correct resolution is to enable the API via APIs & Services > Library in the Google Cloud Console, as this is a prerequisite for creating any Cloud SQL instance. Assigning IAM roles or requesting quota increases does not enable the underlying API service.

Answer

Assign the developer the Cloud SQL Admin IAM role

Answer

Request a quota increase for Cloud SQL in the project

Answer

Create a new project — Cloud SQL is enabled by default in new projects

Question 9

A mobile app needs a managed database to store user profiles with flexible nested structures that evolve frequently — new fields are added without schema migrations. Which GCP database service is most appropriate?

Accepted Answer

Cloud Firestore. Cloud Firestore is a NoSQL document database that supports flexible, nested data structures and automatically handles schema evolution. New fields can be added to documents at any time without requiring migrations, making it ideal for user profiles that change frequently. It also provides real-time synchronization and offline support, which are common requirements for mobile apps.

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Bigtable

Answer

Cloud Spanner

Question 10

Your organization uses VPC Service Controls to protect BigQuery and Cloud Storage. A data pipeline service account needs to read from a protected Cloud Storage bucket and write results to a protected BigQuery dataset. Both resources are in the same perimeter. The service account is outside the perimeter (it runs in a Cloud Run service in a different project). How do you grant the pipeline access?

Accepted Answer

Create an Ingress Rule in the VPC-SC perimeter that allows the service account from the external project to access the specific BigQuery and Storage resources.. Option B is correct because VPC Service Controls (VPC-SC) allow you to define ingress rules that grant access to protected resources from identities outside the perimeter. In this scenario, the service account running in Cloud Run is outside the perimeter, so an ingress rule must explicitly permit that service account to access the specific BigQuery dataset and Cloud Storage bucket. This approach maintains the security boundary while enabling the required data pipeline access.

Answer

Add the Cloud Run project to the VPC Service Controls perimeter.

Answer

Grant the service account `roles/bigquery.admin` and `roles/storage.admin` to bypass the perimeter restrictions.

Answer

Move the Cloud Run service into a VPC and set up VPC peering to the perimeter VPC.

Question 11

An application uses the S3-compatible API to interact with Cloud Storage. The team needs credentials compatible with HMAC-based S3 authentication. Which credential type does Cloud Storage support for this?

Accepted Answer

HMAC keys created for a service account in Cloud Storage settings. Cloud Storage supports HMAC keys for service accounts to provide S3-compatible authentication. These keys consist of an access key and a secret key, which are used to sign requests using the HMAC-SHA256 algorithm, matching the AWS S3 signature process. This allows applications using the S3 API to authenticate directly against Cloud Storage without needing a JSON key file or OAuth 2.0 tokens.

Answer

Service account JSON key file — it's compatible with the S3 HMAC authentication format

Answer

Cloud KMS symmetric keys configured for Cloud Storage access

Answer

An API key generated in the GCP Console for Cloud Storage

Question 12

An organization policy at the organization level sets `constraints/compute.requireOsLogin` to enforced (true) on all projects. A specific project needs an exception — VMs there should not require OS Login. How can this exception be configured?

Accepted Answer

Set a project-level organization policy overriding `compute.requireOsLogin` to not enforced (if the constraint allows override). Option B is correct because organization policies can be overridden at a lower level (project, folder) if the constraint's `inheritFromParent` setting allows it. The `compute.requireOsLogin` boolean constraint supports per-project override, so setting it to `false` at the project level exempts that project's VMs from requiring OS Login while the organization-level policy remains enforced for all other projects.

Answer

Removing the VM from the VPC will bypass the organization policy

Answer

Grant the VM's service account the OS Login Admin role to bypass the policy

Answer

Move the project to a folder that doesn't inherit the organization policy

Question 13

A platform admin creates a new GCP project for a team. The team lead's email is teamlead@company.com. The admin needs the team lead to be able to create resources in the project but not manage IAM policies or billing. Which role is most appropriate?

Accepted Answer

Editor. The Editor role (roles/editor) grants all permissions necessary to create, modify, and delete resources within a GCP project, but explicitly excludes permissions to manage IAM policies (roles/iam.securityAdmin or roles/owner) and billing (roles/billing.admin). This makes it the correct choice for a team lead who needs to deploy and manage resources without having the ability to change access controls or alter billing configurations.

Answer

Owner

Answer

Viewer

Answer

Billing Account Administrator

Question 14

A company is running a Cloud SQL for MySQL instance that experiences high read traffic. They want to offload read queries to reduce load on the primary instance. Which action should they take?

Accepted Answer

Create one or more read replicas and direct read queries to them. Creating one or more read replicas allows you to offload read queries from the primary Cloud SQL for MySQL instance. Read replicas are asynchronous replicas that can serve read traffic, reducing load on the primary and improving overall read throughput. This is the correct approach for scaling read-heavy workloads without modifying the primary instance.

Answer

Enable automatic storage increase on the primary instance

Answer

Increase the machine type of the primary instance

Answer

Change the instance to use private IP only

Question 15

You need to allow a Cloud Function to write logs to Cloud Logging. The function uses a default service account. What IAM role should you grant to the service account?

Accepted Answer

roles/logging.logWriter. The Cloud Function's default service account needs the `roles/logging.logWriter` role to write logs to Cloud Logging. This role grants the `logging.logEntries.create` permission, which is the minimum required for writing log entries. Without it, the function cannot send logs to Logging, even though it may have other permissions.

Answer

roles/cloudfunctions.serviceAgent

Answer

roles/logging.admin

Answer

roles/logging.viewer