Google ACE Practice Test 19 — 15 Questions

Question 1

A SaaS company serves 200 enterprise customers, each requiring complete data isolation in separate databases. The company needs to provision a new customer database within minutes and manage 200 databases with minimal overhead. Which GCP approach scales most efficiently?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A single Cloud SQL instance with a separate schema (database) per customer, provisioned via API automation. It uses a single Cloud SQL instance with separate schemas (databases) per customer, which allows you to achieve complete data isolation while minimizing overhead. Provisioning a new schema via API automation takes seconds, and managing 200 schemas on one instance is far more efficient than managing 200 separate instances. This approach scales efficiently because Cloud SQL supports up to 10,000 databases per instance, and you can leverage connection pooling and shared resources without sacrificing isolation.

Answer

200 separate Cloud SQL instances, one per customer

Answer

Storing all customer data in a single shared database with customer_id as a discriminator column

Answer

Using BigQuery with a separate dataset per customer

Question 2

A Go service is consuming significantly more CPU than expected. The team suspects an inefficient function but doesn't know which one. Which Cloud Operations tool identifies CPU hotspots in production code?

Accepted Answer

Cloud Profiler. Cloud Profiler is the correct tool because it continuously gathers CPU and heap usage data from production services using statistical sampling, then presents a flame graph or call tree that pinpoints which functions consume the most CPU. Unlike debugging or tracing tools, Profiler is designed specifically for identifying performance bottlenecks like CPU hotspots with minimal overhead, making it ideal for diagnosing an inefficient function in a Go service running in production.

Answer

Cloud Debugger

Answer

Cloud Trace

Answer

Cloud Monitoring custom dashboards

Question 3

A developer needs to test a Cloud Run service locally before deploying it to GCP. The service is packaged as a Docker container. Which tool allows them to run and test the container locally in a way that closely mimics the Cloud Run execution environment?

Accepted Answer

Run the container using `docker run -p 8080:8080 IMAGE` with the required environment variables.. `docker run -p 8080:8080 IMAGE` with the required environment variables directly runs the containerized Cloud Run service on your local machine, mapping port 8080 to the container's port 8080 (the default Cloud Run listens on). This approach closely mimics the Cloud Run execution environment because Cloud Run also runs containers in a Docker-like runtime, and you can replicate environment variables, memory limits, and concurrency settings locally for accurate testing before deployment.

Answer

Deploy the service to a staging Cloud Run environment using `gcloud run deploy --no-traffic`.

Answer

Use `gcloud run services describe` to simulate a local run.

Answer

Use Cloud Shell to run the container since Cloud Shell has Docker installed.

Question 4

A GKE Deployment is running 3 replicas and receiving steady traffic. A junior engineer runs `kubectl scale deployment api-service --replicas=0` to 'stop it temporarily'. What happens to traffic during and after this command?

Accepted Answer

All Pods are terminated immediately; the Service has no backends and requests fail until replicas are restored. When you scale a Deployment to 0 replicas, `kubectl` immediately terminates all Pods. The associated Kubernetes Service continues to exist but has no healthy endpoints, so any traffic directed to the Service’s ClusterIP or external load balancer will be dropped or result in a connection refusal (TCP RST) or HTTP 503. Traffic is not queued or buffered; it simply fails until new Pods are created by scaling the Deployment back up.

Answer

Traffic is paused and queued by the Service until replicas are restored

Answer

GKE detects the replica count is 0 and automatically restores it to maintain high availability

Answer

The Deployment is paused but Pods continue running until the next rollout

Question 5

An enterprise requires a private connection between its on-premises data center and Google Cloud VPC that does NOT traverse the public internet and provides dedicated 10 Gbps bandwidth. Which connectivity option meets these requirements?

Accepted Answer

Dedicated Interconnect. Dedicated Interconnect provides a direct, private physical connection between your on-premises network and Google Cloud VPC, offering bandwidth up to 10 Gbps per circuit (or 100 Gbps with multiple circuits) without traversing the public internet. This meets the requirement for a private connection with dedicated 10 Gbps bandwidth, as it uses a colocation facility and a Google-supported router.

Answer

Cloud VPN with high-availability configuration

Answer

Partner Interconnect

Answer

Direct Peering

Question 6

A Compute Engine VM's boot disk is nearly full and the application is failing. You want to snapshot the disk first (for safety), then resize it online. What is the correct sequence of gcloud commands?

Accepted Answer

Snapshot the disk, resize the disk with `gcloud compute disks resize`, then grow the filesystem within the VM.. You must snapshot the disk first to ensure data safety before making changes, then resize the disk using `gcloud compute disks resize` (which works on a running VM with live resize enabled), and finally grow the filesystem inside the VM to utilize the additional space. This sequence avoids downtime and preserves a recovery point.

Answer

Stop the VM, resize the disk, take a snapshot, restart the VM.

Answer

Resize the disk with `gcloud compute instances set-disk-auto-delete` to automatically expand the disk.

Answer

Create a new larger disk, attach it as a secondary disk, and move data using rsync.

Question 7

Your web application serves users globally. Static assets (images, JS, CSS) are stored in Cloud Storage. Users in Asia report slow load times for these assets. The application origin is in `us-central1`. What is the most cost-effective way to improve static asset performance for Asian users?

Accepted Answer

Enable Cloud CDN on the Cloud Storage bucket's load balancer backend.. Cloud CDN uses Google's global edge cache network to serve static assets from locations close to users, reducing latency for Asian users without requiring bucket replication or additional compute. It is the most cost-effective solution because it leverages existing Cloud Storage as the origin and only charges for cache egress and operations, avoiding the overhead of managing regional buckets or compute instances.

Answer

Replicate the Cloud Storage bucket to an Asia region and update DNS to route Asian users to the regional bucket.

Answer

Deploy Cloud Run instances in Asia regions to serve the static assets.

Answer

Increase the Cloud Storage bucket's replication factor to improve throughput.

Question 8

A team wants to configure a Cloud Scheduler job to invoke a Cloud Run service endpoint every hour using HTTP POST. The Cloud Run service requires authentication. How should the Scheduler job be configured to authenticate?

Accepted Answer

Configure the Cloud Scheduler job with OIDC authentication using a service account that has Cloud Run Invoker permission. Cloud Scheduler can authenticate to Cloud Run using OIDC (OpenID Connect) by attaching a service account to the job. The scheduler obtains an OIDC token for that service account and includes it as a Bearer token in the Authorization header. The service account must have the `run.invoker` IAM role on the Cloud Run service to authorize the invocation.

Answer

Include a Bearer token in the Authorization header of the scheduled HTTP request

Answer

Make the Cloud Run service publicly accessible and use Cloud Armor to restrict access to Cloud Scheduler IPs

Answer

Configure an API key for the Cloud Run service and include it in the scheduled request URL

Question 9

A Compute Engine VM with only a private IP address needs to download software updates from the internet (apt-get update). What must be configured in the VPC to enable outbound internet access for private VMs?

Accepted Answer

Configure Cloud NAT on the VPC's Cloud Router for the subnet. Cloud NAT (Network Address Translation) allows private VMs without external IP addresses to initiate outbound connections to the internet. It translates the VM's private IP to a public IP managed by Cloud NAT, enabling apt-get update to reach external repositories. This is the correct and scalable solution for outbound-only internet access from private instances.

Answer

Enable Private Google Access on the subnet

Answer

Add an external IP address to the VM temporarily for the update, then remove it

Answer

Create a VPC firewall rule allowing egress to 0.0.0.0/0 on port 80 and 443

Question 10

A team wants to roll back a GKE Deployment to its previous revision because the new version introduced a regression. Which kubectl command performs this rollback?

Accepted Answer

kubectl rollout undo deployment/my-app. `kubectl rollout undo deployment/my-app` is the standard Kubernetes command to roll back a Deployment to the previous revision. This command leverages the Deployment's revision history, which is automatically maintained by the Kubernetes controller, to revert the desired state to the prior revision without needing to manually reapply an old manifest.

Answer

kubectl revert deployment/my-app --to-previous

Answer

kubectl apply -f previous-deployment.yaml

Answer

kubectl delete deployment/my-app && kubectl create -f deployment.yaml

Question 11

A GKE team is comparing Autopilot and Standard cluster modes for a new project. They want to minimize infrastructure management overhead, automatically right-size node resources, and be billed only for Pod resource requests. Which mode matches these requirements?

Accepted Answer

GKE Autopilot — managed nodes, automatic right-sizing, and per-Pod billing. GKE Autopilot is the correct choice because it fully manages the underlying node infrastructure, automatically right-sizes node resources based on Pod resource requests, and bills only for the requested CPU and memory of Pods, not the underlying nodes. This aligns directly with the team's goals of minimizing management overhead, automatic right-sizing, and per-Pod billing.

Answer

GKE Standard — it provides more control over node configuration

Answer

GKE Standard with cluster autoscaler and node auto-provisioning enabled

Answer

Both modes are equivalent in management overhead — Autopilot is just a pricing model

Question 12

An engineer needs to grant an external auditor read-only access to a subset of Cloud Storage buckets in a project. The auditor's identity is a Google account. Which IAM approach should the engineer use?

Accepted Answer

Add the auditor's email as a member with the Storage Object Viewer role on the project, and use IAM Conditions to restrict access to specific bucket resources.. The best practice is to grant the Storage Object Viewer role at the project level and then use IAM Conditions to restrict access to specific bucket resources. This avoids managing multiple bindings per bucket while ensuring the auditor only sees the intended buckets. Granting at the bucket level is possible but less scalable; granting Storage Admin is too permissive; using ACLs is legacy and more complex to audit.

Answer

Add the auditor's email as a member with the Storage Admin role on the project.

Answer

Use a signed URL for each object the auditor needs to see.

Answer

Add the auditor's email as a member with the Storage Object Viewer role on each individual bucket.

Question 13

Your Dataflow streaming pipeline is consuming messages from Pub/Sub but the pipeline's throughput has dropped significantly. Cloud Monitoring shows the `pubsub/subscription/oldest_unacked_message_age` metric is growing. The pipeline has enough workers. What is the most likely bottleneck, and how should you address it?

Accepted Answer

Inspect Dataflow job graph metrics to identify the slow stage, then optimize that stage's logic or address data skew.. The growing `oldest_unacked_message_age` metric indicates that messages are not being processed and acknowledged quickly enough, even though the pipeline has enough workers. This points to a bottleneck within a specific stage of the Dataflow pipeline, such as a transformation or grouping operation that is slow or suffering from data skew. Option B is correct because inspecting the job graph metrics (e.g., wall time, backlog, and throughput per stage) allows you to identify the slow stage and then optimize its logic or address data skew, which directly resolves the processing delay.

Answer

Increase the number of Dataflow workers to process messages faster.

Answer

Increase the Pub/Sub subscription's ack deadline to 600 seconds.

Answer

Switch from Dataflow to Pub/Sub Lite for lower cost and higher throughput.

Question 14

A CI/CD pipeline running outside GCP (on GitHub Actions) needs to authenticate to GCP to push images to Artifact Registry, without storing any long-lived service account key files. Which authentication mechanism achieves this?

Accepted Answer

Workload Identity Federation with GitHub Actions as the identity provider. Workload Identity Federation allows a GitHub Actions workflow to exchange a GitHub-issued OIDC token for a GCP access token, enabling authentication to Artifact Registry without storing any long-lived service account keys. This is the recommended approach for non-GCP CI/CD systems because it eliminates the security risk of managing static credentials while still granting fine-grained, short-lived access to GCP resources.

Answer

Store a service account JSON key as a GitHub Actions secret and use it in the workflow

Answer

OAuth 2.0 user credentials from a developer's Google account

Answer

API keys created for the Artifact Registry service

Question 15

You need to export all Cloud Logging logs from a specific project to BigQuery for long-term analysis. What should you create?

Accepted Answer

A log sink with BigQuery as the destination. Log sinks in Cloud Logging allow you to route logs to destinations like BigQuery, Cloud Storage, or Pub/Sub. You create a sink with BigQuery as the destination.

Answer

A log-based metric with BigQuery as destination

Answer

A Pub/Sub subscription that pushes logs to BigQuery

Answer

An export job from Logging to BigQuery using gcloud logging export