Google ACE Practice Test 2 — 10 Questions

Question 1

What is the purpose of creating a Cloud NAT gateway?

Accepted Answer

To enable private instances to reach the internet for updates and patches.. Cloud NAT allows instances without external IP addresses to access the internet for outbound connections, while preventing inbound connections from the internet.

Answer

To allow VPN connections to on-premises networks.

Answer

To provide a static IP address for inbound traffic.

Answer

To provide DNS resolution for VPC networks.

Question 2

An organization has multiple projects under a folder. They want to grant a network admin the ability to create firewall rules in all projects in the folder. Which IAM policy binding achieves this with least privilege?

Accepted Answer

Grant roles/compute.securityAdmin at the folder level. Grant the roles/compute.securityAdmin role at the folder level. This allows managing firewall rules across all projects under that folder. Granting at project level would require adding the role to each project individually. The compute.networkAdmin role does not include firewall rule management.

Answer

Grant roles/owner at the folder level

Answer

Grant roles/compute.admin at the project level for each project

Answer

Grant roles/compute.networkAdmin at the folder level

Question 3

A team is designing a data pipeline: Cloud Storage → Pub/Sub → Dataflow → BigQuery. They expect 50 GB of data per hour. Dataflow jobs must automatically scale workers based on pipeline backlog. Which Dataflow feature provides automatic horizontal scaling of worker VMs?

Accepted Answer

Dataflow Horizontal Autoscaling — automatically adds/removes workers based on pipeline lag. Dataflow Horizontal Autoscaling is the correct feature because it automatically adds or removes worker VMs based on the pipeline's backlog (lag), which directly matches the requirement for automatic horizontal scaling. This feature uses the Cloud Monitoring service to track the number of unprocessed elements and adjusts worker count accordingly, ensuring efficient resource usage without manual intervention.

Answer

Vertical scaling — Dataflow automatically increases worker machine types under load

Answer

GKE cluster autoscaler — Dataflow runs on GKE and inherits its autoscaling

Answer

Cloud Monitoring alerting policy that triggers worker additions via gcloud

Question 4

A company runs a batch job every night that processes data from a Cloud Storage bucket and writes results to BigQuery. The job runs on a Compute Engine VM. To minimize costs, what is the best practice for the VM?

Accepted Answer

Use a preemptible VM. Preemptible VMs are up to 80% cheaper and can be terminated at any time, which is acceptable for batch jobs that can be checkpointed or restarted from the beginning.

Answer

Use a VM with GPUs for faster processing

Answer

Use a VM with local SSD for temporary storage

Answer

Use a standard VM and commit to a 1-year commitment

Question 5

A financial services company needs to run analytics queries on transaction data that arrives in real-time. The queries must return results within 2 seconds and the dataset grows by ~100 GB per day. The company also needs to retain all data for 7 years for regulatory compliance. Which architecture best satisfies these requirements?

Accepted Answer

Stream transactions through Pub/Sub → Dataflow → BigQuery; run analytics on BigQuery.. It uses Pub/Sub for real-time ingestion, Dataflow for stream processing, and BigQuery for analytics, which can handle 100 GB/day growth and return queries within 2 seconds using BigQuery's columnar storage and automatic sharding. BigQuery's 7-year retention is supported by its time-based partitioning and long-term storage at reduced cost, meeting regulatory compliance without manual intervention.

Answer

Write transactions to Cloud Spanner; run analytics queries directly against Spanner.

Answer

Store transactions in Cloud Bigtable and use Dataproc/Spark for analytics queries.

Answer

Use Cloud SQL for storage and Cloud Dataprep for analytics transformations.

Question 6

A company organizes its GCP projects by business unit — Finance, Engineering, and Sales. Which resource is best suited to group these projects while applying shared IAM policies to all projects in each group?

Accepted Answer

Create GCP Folders for each business unit and add the relevant projects. C is correct because GCP Folders are the hierarchical resource designed to group projects under an organization node, allowing you to apply shared IAM policies at the folder level that automatically propagate to all projects within that folder. This aligns with the requirement to organize projects by business unit and enforce consistent access controls across each group.

Answer

Apply labels to each project to identify the business unit

Answer

Apply resource tags to each project for policy enforcement

Answer

Create a Shared VPC host project for each business unit

Question 7

A GKE Pod needs to call the Cloud Storage API. The team wants to avoid creating and managing service account key files. What is the recommended approach?

Accepted Answer

Enable Workload Identity on the GKE cluster and bind a Kubernetes ServiceAccount to a GCP IAM ServiceAccount. Workload Identity is the recommended approach because it allows a Kubernetes ServiceAccount in GKE to authenticate as a GCP IAM ServiceAccount without managing or storing any service account key files. This eliminates the security risk of key leakage and simplifies credential rotation. By binding the Kubernetes ServiceAccount to a GCP IAM ServiceAccount, Pods can directly call Cloud Storage APIs using the IAM permissions of the linked service account, with automatic token exchange via the GKE metadata server.

Answer

Mount a service account JSON key file as a Kubernetes Secret and set GOOGLE_APPLICATION_CREDENTIALS

Answer

Rely on the GKE node's Compute Engine service account for all Pod authentication

Answer

Grant the GKE node pool's service account the Storage Admin role to cover all Pod needs

Question 8

A Cloud KMS key used to encrypt a Cloud Storage bucket's data is being destroyed. What happens to the data in the bucket when the KMS key is destroyed?

Accepted Answer

The encrypted data becomes permanently inaccessible (cryptographic erasure) since the decryption key no longer exists.. When a Cloud KMS key is destroyed, the encrypted data in Cloud Storage becomes permanently inaccessible because the cryptographic key material is irrecoverably deleted. This is known as cryptographic erasure: without the key, the ciphertext cannot be decrypted, even though the raw encrypted bytes still exist in the bucket. Cloud Storage does not store a copy of the KMS key, and there is no fallback mechanism to re-encrypt or recover the data.

Answer

The data in Cloud Storage is automatically deleted along with the key.

Answer

Cloud Storage automatically re-encrypts the data using Google-managed keys as a fallback.

Answer

The key enters a 'disabled' state where data can still be decrypted by Google support.

Question 9

Arrange the steps to create a Cloud SQL MySQL instance, configure a database, and connect using the Cloud SQL Proxy.

Accepted Answer

Create a Cloud SQL MySQL instance → Configure a database → Connect using the Cloud SQL Proxy. The correct order is to first create the Cloud SQL instance, then configure a database (e.g., create a database and user), and finally connect using the Cloud SQL Proxy for secure access. Common mistakes include attempting to configure the database before instance creation or using the proxy before the database is ready.

Answer

Configure a database → Create a Cloud SQL MySQL instance → Connect using the Cloud SQL Proxy

Answer

Create a Cloud SQL MySQL instance → Connect using the Cloud SQL Proxy → Configure a database

Answer

Connect using the Cloud SQL Proxy → Create a Cloud SQL MySQL instance → Configure a database

Question 10

You need persistent shared file storage for a legacy application running on multiple Compute Engine VMs that requires POSIX-compliant file system access (NFS). The workload is I/O intensive with files up to 100 GB. Which GCP storage service should you use?

Accepted Answer

Cloud Filestore (NFS). Cloud Filestore provides a fully managed NFS server that supports POSIX-compliant file access, making it the correct choice for a legacy application requiring NFS. It can handle I/O-intensive workloads with large files (up to 100 GB) by offering high throughput and low-latency access from multiple Compute Engine VMs simultaneously.

Answer

Cloud Storage FUSE mounted on each VM

Answer

Persistent Disk attached in ReadWriteMany mode to all VMs

Answer

Local SSD on each VM with rsync synchronization between VMs