Google ACE Practice Test 2 — 10 Questions

Question 1

An organization wants to separate its development and production environments using Google Cloud resource hierarchy. What is the recommended approach?

Accepted Answer

Create two folders under the organization node, one for dev and one for prod.. Google Cloud resource hierarchy is Organization > Folders > Projects > Resources. Creating two folders under the organization node — one for dev and one for prod — is the recommended way to separate environments because IAM policies and organization policies applied at the folder level are inherited by all projects beneath them. This provides clean isolation and centralized governance without duplicating the organization.

Answer

Create a single project and use separate VPC networks for dev and prod.

Answer

Create two separate organizations, one for dev and one for prod.

Answer

Create two projects under the same folder and use labels to differentiate dev and prod.

Question 2

A company runs a batch job every night that processes data from a Cloud Storage bucket and writes results to BigQuery. The job runs on a Compute Engine VM. To minimize costs, what is the best practice for the VM?

Accepted Answer

Use a preemptible VM. Preemptible VMs are up to 80% cheaper and can be terminated at any time, which is acceptable for batch jobs that can be checkpointed or restarted from the beginning.

Answer

Use a VM with GPUs for faster processing

Answer

Use a VM with local SSD for temporary storage

Answer

Use a standard VM and commit to a 1-year commitment

Question 3

You need to drain a GKE node for maintenance. The node runs DaemonSet pods and pods using emptyDir volumes. Which kubectl drain command correctly handles these pods without causing disruption to critical system components?

Accepted Answer

kubectl drain NODE --ignore-daemonsets --delete-emptydir-data. The kubectl drain command evicts pods from a node. To handle DaemonSet pods (which should be ignored because they are managed by the DaemonSet controller) and pods with emptyDir volumes (which may need --delete-emptydir-data to force eviction), you use --ignore-daemonsets and --delete-emptydir-data.

Answer

kubectl drain NODE --force

Answer

kubectl drain NODE --ignore-daemonsets

Answer

kubectl drain NODE --delete-emptydir-data

Question 4

A financial services company needs to run analytics queries on transaction data that arrives in real-time. The queries must return results within 2 seconds and the dataset grows by ~100 GB per day. The company also needs to retain all data for 7 years for regulatory compliance. Which architecture best satisfies these requirements?

Accepted Answer

Stream transactions through Pub/Sub → Dataflow → BigQuery; run analytics on BigQuery.. It uses Pub/Sub for real-time ingestion, Dataflow for stream processing, and BigQuery for analytics, which can handle 100 GB/day growth and return queries within 2 seconds using BigQuery's columnar storage and automatic sharding. BigQuery's 7-year retention is supported by its time-based partitioning and long-term storage at reduced cost, meeting regulatory compliance without manual intervention.

Answer

Write transactions to Cloud Spanner; run analytics queries directly against Spanner.

Answer

Store transactions in Cloud Bigtable and use Dataproc/Spark for analytics queries.

Answer

Use Cloud SQL for storage and Cloud Dataprep for analytics transformations.

Question 5

A company organizes its GCP projects by business unit — Finance, Engineering, and Sales. Which resource is best suited to group these projects while applying shared IAM policies to all projects in each group?

Accepted Answer

Create GCP Folders for each business unit and add the relevant projects. C is correct because GCP Folders are the hierarchical resource designed to group projects under an organization node, allowing you to apply shared IAM policies at the folder level that automatically propagate to all projects within that folder. This aligns with the requirement to organize projects by business unit and enforce consistent access controls across each group.

Answer

Apply labels to each project to identify the business unit

Answer

Apply resource tags to each project for policy enforcement

Answer

Create a Shared VPC host project for each business unit

Question 6

A GKE Pod needs to call the Cloud Storage API. The team wants to avoid creating and managing service account key files. What is the recommended approach?

Accepted Answer

Enable Workload Identity on the GKE cluster and bind a Kubernetes ServiceAccount to a GCP IAM ServiceAccount. Workload Identity is the recommended approach because it allows a Kubernetes ServiceAccount in GKE to authenticate as a GCP IAM ServiceAccount without managing or storing any service account key files. This eliminates the security risk of key leakage and simplifies credential rotation. By binding the Kubernetes ServiceAccount to a GCP IAM ServiceAccount, Pods can directly call Cloud Storage APIs using the IAM permissions of the linked service account, with automatic token exchange via the GKE metadata server.

Answer

Mount a service account JSON key file as a Kubernetes Secret and set GOOGLE_APPLICATION_CREDENTIALS

Answer

Rely on the GKE node's Compute Engine service account for all Pod authentication

Answer

Grant the GKE node pool's service account the Storage Admin role to cover all Pod needs

Question 7

A Cloud KMS key used to encrypt a Cloud Storage bucket's data is being destroyed. What happens to the data in the bucket when the KMS key is destroyed?

Accepted Answer

The encrypted data becomes permanently inaccessible (cryptographic erasure) since the decryption key no longer exists.. When a Cloud KMS key is destroyed, the encrypted data in Cloud Storage becomes permanently inaccessible because the cryptographic key material is irrecoverably deleted. This is known as cryptographic erasure: without the key, the ciphertext cannot be decrypted, even though the raw encrypted bytes still exist in the bucket. Cloud Storage does not store a copy of the KMS key, and there is no fallback mechanism to re-encrypt or recover the data.

Answer

The data in Cloud Storage is automatically deleted along with the key.

Answer

Cloud Storage automatically re-encrypts the data using Google-managed keys as a fallback.

Answer

The key enters a 'disabled' state where data can still be decrypted by Google support.

Question 8

Arrange the steps to create a Cloud SQL MySQL instance, configure a database, and connect using the Cloud SQL Proxy.

Accepted Answer

Create a Cloud SQL MySQL instance → Configure a database → Connect using the Cloud SQL Proxy. The correct order is to first create the Cloud SQL instance, then configure a database (e.g., create a database and user), and finally connect using the Cloud SQL Proxy for secure access. Common mistakes include attempting to configure the database before instance creation or using the proxy before the database is ready.

Answer

Configure a database → Create a Cloud SQL MySQL instance → Connect using the Cloud SQL Proxy

Answer

Create a Cloud SQL MySQL instance → Connect using the Cloud SQL Proxy → Configure a database

Answer

Connect using the Cloud SQL Proxy → Create a Cloud SQL MySQL instance → Configure a database

Question 9

You need persistent shared file storage for a legacy application running on multiple Compute Engine VMs that requires POSIX-compliant file system access (NFS). The workload is I/O intensive with files up to 100 GB. Which GCP storage service should you use?

Accepted Answer

Cloud Filestore (NFS). Cloud Filestore provides a fully managed NFS server that supports POSIX-compliant file access, making it the correct choice for a legacy application requiring NFS. It can handle I/O-intensive workloads with large files (up to 100 GB) by offering high throughput and low-latency access from multiple Compute Engine VMs simultaneously.

Answer

Cloud Storage FUSE mounted on each VM

Answer

Persistent Disk attached in ReadWriteMany mode to all VMs

Answer

Local SSD on each VM with rsync synchronization between VMs

Question 10

You need to verify that a Compute Engine VM in `us-central1` can reach an on-premises server at IP `10.1.2.3` over a Cloud VPN connection. The VPN tunnel appears UP but you're unsure if routing is correct. Which GCP tool can test this connectivity?

Accepted Answer

Use Network Intelligence Center Connectivity Tests to analyze the path from the VM to the on-premises IP.. B is correct because Network Intelligence Center Connectivity Tests can analyze the path from a specific source (the Compute Engine VM) to a destination (the on-premises server IP 10.1.2.3) across hybrid connectivity like Cloud VPN. It validates routing, firewall rules, and tunnel health without requiring you to SSH into the VM or run live traffic, making it ideal for diagnosing routing issues when the VPN tunnel is UP but connectivity is uncertain.

Answer

SSH into the VM and run `ping 10.1.2.3` to test connectivity.

Answer

Review Cloud VPN tunnel metrics in Cloud Monitoring for packet loss.

Answer

Run `gcloud compute routes list` to verify the route to 10.1.2.3 exists.