Google ACE Practice Test 19 — 15 Questions

Question 1

An operations team wants to count how many times the string 'PaymentFailure' appears in application logs per minute and alert when it exceeds 10 occurrences. Cloud Monitoring doesn't have a native metric for this log pattern. What is the correct approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a log-based metric in Cloud Logging with a filter matching 'PaymentFailure', then alert on it in Cloud Monitoring. Cloud Logging log-based metrics allow you to define a filter (e.g., `textPayload:"PaymentFailure"`) that counts matching log entries in real time, and Cloud Monitoring can directly create an alerting policy on that metric with a threshold of 10 occurrences per minute. This approach avoids custom code, external exports, or additional services, and it leverages the native integration between Cloud Logging and Cloud Monitoring.

Answer

Create a Cloud Monitoring custom metric and write values via the application's exception handler

Answer

Export logs to BigQuery and run a scheduled query counting PaymentFailure entries

Answer

Enable Cloud Trace and look for PaymentFailure in trace annotations

Question 2

A developer needs to run an interactive shell inside a running GKE Pod named 'api-pod-7d4f9' in the 'production' namespace to investigate a runtime issue. Which kubectl command opens an interactive shell?

Accepted Answer

kubectl exec -it api-pod-7d4f9 -n production -- /bin/bash. `kubectl exec -it` attaches an interactive terminal to a running container in a Pod, with `-i` for stdin and `-t` for a TTY. The `-- /bin/bash` launches a Bash shell inside the container, allowing the developer to investigate runtime issues. This is the standard Kubernetes method for interactive shell access.

Answer

kubectl ssh api-pod-7d4f9 -n production

Answer

kubectl run debug --image=busybox --attach=api-pod-7d4f9

Answer

gcloud container exec api-pod-7d4f9 --namespace=production -- bash

Question 3

A financial application requires a relational database with automatic failover to a standby in a different zone, with minimal configuration overhead. Which Cloud SQL configuration provides this?

Accepted Answer

Cloud SQL with High Availability (HA) configuration. Cloud SQL's High Availability (HA) configuration provides automatic failover to a standby instance in a different zone using synchronous replication and a regional persistent disk. This meets the requirement for minimal configuration overhead because it is a built-in feature that requires no application-level logic or manual intervention.

Answer

Cloud SQL with a read replica in a different zone

Answer

Cloud Spanner multi-region instance

Answer

Two separate Cloud SQL instances with application-level failover logic

Question 4

A production GKE cluster is running low on node resources. Pods are in Pending state because no node has sufficient CPU or memory. Without deleting existing Pods, what is the fastest way to resolve this?

Accepted Answer

Resize the node pool to add more nodes: `gcloud container clusters resize`. Resizing the node pool with `gcloud container clusters resize` immediately adds more nodes to the cluster, providing additional CPU and memory capacity. This allows the scheduler to place pending Pods without modifying or deleting existing workloads, making it the fastest solution that preserves running Pods.

Answer

Delete existing Pods to free resources for the Pending Pods

Answer

Change the Pending Pods' resource requests to zero

Answer

Upgrade the Kubernetes control plane version

Question 5

A GCP organization has recently experienced a credential theft incident involving a service account key. The CISO requires that all service account keys in the organization be inventoried and those older than 90 days be rotated. Which tool identifies old service account keys across all projects?

Accepted Answer

Cloud Asset Inventory querying all IAM ServiceAccountKey assets across the organization. Cloud Asset Inventory (CAI) is the correct tool because it can query all IAM ServiceAccountKey assets across the entire organization, including all projects, using a single API call or gcloud command. This allows you to filter by the `validAfterTime` field to identify keys older than 90 days, meeting the CISO's requirement for a comprehensive, automated inventory without manual per-project inspection.

Answer

Security Command Center — it audits service account key age automatically

Answer

Cloud Monitoring metric for service account key creation date

Answer

Manually check each service account in each project's IAM & Admin > Service Accounts page

Question 6

A DevOps engineer needs to deploy a new GKE Pod that mounts a ConfigMap named 'app-config' as environment variables. The ConfigMap already exists in the cluster. Which YAML snippet correctly references it?

Accepted Answer

envFrom: - configMapRef: name: app-config. The `envFrom` field with a `configMapRef` allows a Pod to load all key-value pairs from a ConfigMap as environment variables. This is the standard Kubernetes syntax for injecting ConfigMap data into a container's environment without specifying individual keys.

Answer

volumes: - name: config / configMap: name: app-config

Answer

env: - name: CONFIG / valueFrom: secretKeyRef: name: app-config

Answer

envFrom: - secretRef: name: app-config

Question 7

A regulated company requires a log of all actions taken by Google support engineers when they access customer GCP environments during support cases. Which Cloud Audit Log type captures this?

Accepted Answer

Access Transparency logs. Access Transparency logs are the correct choice because they specifically capture actions taken by Google support engineers when accessing customer data or configurations in GCP. These logs provide near real-time records of Google-initiated access, which is required for regulated companies to audit support personnel activities. Admin Activity logs only record administrative actions by customers, not Google personnel, while Data Access logs with Google-initiated access filter are not a valid log type in Cloud Audit Logs.

Answer

Admin Activity audit logs

Answer

Data Access audit logs with Google-initiated access filter

Answer

System event audit logs with personnel filter

Question 8

A startup's GCP project has a project ID of 'my-startup-prod' and a project number of '123456789012'. An API call requires the project number, not the project ID. How can the project number be retrieved quickly?

Accepted Answer

Run `gcloud projects describe my-startup-prod` and look for the projectNumber field. The `gcloud projects describe` command retrieves detailed metadata about a GCP project, including the `projectNumber` field, which is a unique numeric identifier assigned by Google Cloud. This is the standard method to quickly obtain the project number when only the project ID is known, as the project number is not derivable from the project ID.

Answer

The project number is always the same as the last 12 digits of the project ID

Answer

Run `gcloud config get-value project-number`

Answer

The project number appears in the URL bar of the GCP Console — it's the number after /project/

Question 9

A developer needs to use Application Default Credentials (ADC) in a local development environment to call the Cloud Translation API. They have already run `gcloud auth login`. What additional step is required to make ADC work correctly?

Accepted Answer

Run `gcloud auth application-default login` to generate ADC credentials.. `gcloud auth application-default login` creates a special credential file (typically at `~/.config/gcloud/application_default_credentials.json`) that Application Default Credentials (ADC) uses to authenticate API calls. While `gcloud auth login` sets up user credentials for gcloud CLI commands, ADC does not use those credentials directly; it requires its own separate credential file. Running this command ensures that the local development environment can authenticate to the Cloud Translation API via ADC without additional configuration.

Answer

Set the `GOOGLE_CLOUD_PROJECT` environment variable to the project ID.

Answer

Download a service account JSON key and set `GOOGLE_APPLICATION_CREDENTIALS`.

Answer

Run `gcloud config set account` to switch to the correct account.

Question 10

A distributed database running on GKE requires stable, persistent hostnames (pod-0, pod-1, pod-2) and ordered startup/shutdown for proper cluster initialization. Pods must retain their identity across restarts. Which Kubernetes resource is designed for this?

Accepted Answer

StatefulSet with a headless Service. StatefulSet is the correct resource because it provides stable, unique network identifiers (e.g., pod-0, pod-1, pod-2) via a headless Service, ordered startup and shutdown (pod-0 starts first, pod-2 terminates first), and persistent pod identity that survives restarts. These features are essential for distributed databases like Cassandra or ZooKeeper that require consistent hostnames and initialization order.

Answer

Deployment with pod affinity rules

Answer

DaemonSet with a unique hostname label on each node

Answer

ReplicaSet with a fixed replica count

Question 11

A Cloud Run service has been running for weeks. A sudden spike in 5xx errors appears in Cloud Monitoring. The team wants to view the actual request logs to identify which endpoint is failing. Where should they look?

Accepted Answer

Cloud Logging Logs Explorer — filter by resource type 'cloud_run_revision'. Cloud Logging's Logs Explorer is the correct place to view actual request logs for a Cloud Run service. It allows filtering by resource type 'cloud_run_revision' and by HTTP status codes (e.g., 5xx) to identify which specific endpoint is failing. Cloud Monitoring Metrics Explorer shows aggregated metrics, not individual log entries, so it cannot pinpoint the exact endpoint.

Answer

Cloud Monitoring Metrics Explorer — filter by request_count metric with error status

Answer

Cloud Trace — filter by 5xx response code

Answer

Cloud Debugger — set a snapshot at the error handler

Question 12

Which gcloud command creates a Compute Engine VM named 'web-01' using the e2-medium machine type in zone us-central1-a?

Accepted Answer

gcloud compute instances create web-01 --zone=us-central1-a --machine-type=e2-medium. The `gcloud compute instances create` command is the proper syntax for creating a Compute Engine VM, and it requires the `--machine-type` flag (not `--machine`) to specify the machine type. The zone is specified with `--zone`, and the VM name is provided as a positional argument.

Answer

gcloud vm create web-01 --zone=us-central1-a --machine=e2-medium

Answer

gcloud instances create web-01 --region=us-central1 --type=e2-medium

Answer

gcloud compute create-instance web-01 --zone=us-central1-a --size=e2-medium

Question 13

A team has a Docker container image locally and wants to push it to Google Artifact Registry. They've already authenticated Docker with GCP. The registry host is 'us-central1-docker.pkg.dev'. Which commands correctly tag and push the image?

Accepted Answer

docker tag myimage us-central1-docker.pkg.dev/myproject/myrepo/myimage:v1 && docker push us-central1-docker.pkg.dev/myproject/myrepo/myimage:v1. It uses the standard Docker CLI workflow: first tagging the local image with the full Artifact Registry path (including the registry host, project, repository, and image name with tag), then pushing it. Since the team has already authenticated Docker with GCP, the `docker push` command will authenticate via the Docker credential helper and upload the image to the specified Artifact Registry repository.

Answer

gcloud artifacts docker push myimage --location=us-central1 --repository=myrepo

Answer

docker push gcr.io/myproject/myimage:v1

Answer

gcloud container images push myimage:v1 --region=us-central1

Question 14

Which gcloud command is used to deploy a Cloud Function triggered by HTTP requests?

Accepted Answer

gcloud functions deploy my-function --runtime python39 --trigger-http. The command 'gcloud functions deploy' with --trigger-http creates an HTTP-triggered function. --runtime specifies the language runtime. --trigger-topic is for Pub/Sub triggers.

Answer

gcloud functions call my-function --data '{"key":"value"}'

Answer

gcloud run deploy my-function --source . --platform managed

Answer

gcloud functions deploy my-function --runtime python39 --trigger-topic my-topic

Question 15

A team is using Terraform to manage GCP infrastructure. They want to store the state file in a Cloud Storage bucket with versioning enabled. Which backend configuration is correct?

Accepted Answer

terraform { backend "gcs" { bucket = "my-bucket" prefix = "terraform/state" } }. To use Cloud Storage as a backend, you must specify 'bucket' and optionally 'prefix' for the state file path. The provider block is for the Google provider, not state storage.

Answer

provider "google" { backend "gcs" { bucket = "my-bucket" } }

Answer

terraform { backend "gcs" { bucket = "my-bucket" versioning = true } }

Answer

terraform { backend "cloud-storage" { bucket = "my-bucket" } }