Google ACE Practice Test 20 — 15 Questions

Question 1

A security analyst needs to retrieve all Cloud Logging entries with severity ERROR or higher across all resource types in the current project. Which log query correctly filters these entries?

Accepted Answer

severity >= "ERROR". Cloud Logging's query language supports comparison operators like `>=` for severity levels, where `ERROR` is a recognized severity level. The query `severity >= "ERROR"` retrieves all entries with severity ERROR, CRITICAL, ALERT, or EMERGENCY, as these are considered higher severity than ERROR. This matches the requirement to filter for severity ERROR or higher across all resource types without restricting the time range or resource type.

Answer

severity >= ERROR AND timestamp > now() - 24h

Answer

severity="ERROR" AND resource.type="gce_instance"

Answer

logName="projects/my-project/logs/stderr" AND severity > "WARNING"

Question 2

A team's GKE Deployment serves variable traffic — 2 Pods at night, 20 Pods at peak hours. Rather than manually changing replica counts, they want automatic scaling based on CPU utilization (target: 60%). What should they deploy?

Accepted Answer

Horizontal Pod Autoscaler (HPA) targeting 60% CPU utilization. The Horizontal Pod Autoscaler (HPA) is the correct choice because it automatically adjusts the number of Pod replicas in a Deployment based on observed CPU utilization, scaling from 2 to 20 Pods as needed to maintain the target of 60% CPU. HPA works by querying the metrics server for CPU usage and calculating the desired replica count using the formula: desiredReplicas = currentReplicas × (currentMetricValue / targetMetricValue). This directly addresses the requirement for variable traffic without manual intervention.

Answer

Vertical Pod Autoscaler (VPA) with CPU target 60%

Answer

Cluster Autoscaler with a CPU threshold of 60%

Answer

Set the Deployment replica count to 20 and rely on resource quotas to limit actual Pod scheduling

Question 3

A team needs to give a third-party vendor read-only access to specific Cloud Storage objects for 48 hours. The vendor uses an AWS account (not a Google account). What is the most secure way to grant this temporary access?

Accepted Answer

Generate a Signed URL for the specific objects with a 48-hour expiration. A Signed URL provides time-bound, read-only access to specific Cloud Storage objects without requiring the vendor to have a Google account. The URL embeds authentication information and expires after 48 hours, ensuring temporary access while maintaining security by not exposing broader permissions or credentials.

Answer

Create a GCP service account for the vendor and share the JSON key file with 48-hour expiry

Answer

Use Workload Identity Federation with AWS as the identity provider for the vendor

Answer

Make the objects publicly readable and share the direct Cloud Storage URL

Question 4

A team wants to create a consistent backup of a Compute Engine VM's boot disk before applying a major OS patch. The backup should be usable to restore the disk to a new VM if the patch fails. What is the recommended approach?

Accepted Answer

Create a persistent disk snapshot using `gcloud compute disks snapshot`. A persistent disk snapshot captures a point-in-time, crash-consistent backup of the disk, including the boot disk, without requiring the VM to be stopped. Snapshots are the recommended method for backing up persistent disks because they support incremental backups, can be used to create new disks, and are optimized for restore operations to a new VM. This approach ensures the backup is usable for disaster recovery if the OS patch fails.

Answer

Create a custom VM image from the running instance using `gcloud compute images create`

Answer

Copy all files to a Cloud Storage bucket using gsutil rsync

Answer

Enable live migration for the VM — it automatically backs up state before migrations

Question 5

A team is building a real-time multiplayer game backend requiring low-latency state synchronization between players worldwide. Session data must persist for the duration of a game (up to 2 hours) but doesn't need long-term storage. Which managed service best fits?

Accepted Answer

Cloud Memorystore for Redis. Cloud Memorystore for Redis is the best fit because it provides an in-memory data store with sub-millisecond latency, ideal for real-time state synchronization in a multiplayer game. Redis supports data structures like sets and sorted sets for leaderboards or session state, and its optional persistence (RDB/AOF) can cover the 2-hour game duration without needing long-term storage. This aligns with the requirement for low-latency, ephemeral session data that must survive only the game session.

Answer

Cloud SQL for PostgreSQL with connection pooling

Answer

Cloud Bigtable

Answer

Cloud Firestore in Native mode

Question 6

A Cloud Function (gen2) is triggered by Pub/Sub messages. The function processes each message by calling three external APIs sequentially. The total processing time is 25 seconds per message. The Pub/Sub subscription's ack deadline is 10 seconds. What will happen, and how should you fix it?

Accepted Answer

Messages will be redelivered before processing completes; extend the Pub/Sub subscription ack deadline to exceed 25 seconds.. The Pub/Sub subscription has a 10-second ack deadline, but the Cloud Function takes 25 seconds to process each message. Since the function does not acknowledge the message within the deadline, Pub/Sub considers the message unacknowledged and redelivers it, causing duplicate processing. The fix is to increase the ack deadline to exceed 25 seconds, ensuring the function has enough time to complete processing and send an acknowledgment.

Answer

Pub/Sub will wait indefinitely for the function to acknowledge; no issue occurs.

Answer

The Cloud Function will automatically extend its own ack deadline via the Pub/Sub client library.

Answer

Increase the Cloud Function's memory to process faster and complete within 10 seconds.

Question 7

A team wants to allow inbound HTTPS traffic (TCP port 443) from the internet to instances tagged 'web-server', while blocking all other inbound traffic. What firewall configuration achieves this?

Accepted Answer

An ingress allow rule for port 443 from 0.0.0.0/0 targeting the 'web-server' tag, relying on the implied deny for other traffic. Google Cloud VPC firewall rules are stateful and have an implicit deny for all traffic that is not explicitly allowed. An ingress allow rule for TCP port 443 from 0.0.0.0/0 applied to instances with the 'web-server' tag permits inbound HTTPS traffic, and the implicit deny blocks all other inbound traffic without needing additional rules.

Answer

An ingress allow rule for port 443 and a separate egress deny rule for all other ports

Answer

An ingress deny rule for all ports from 0.0.0.0/0, plus an ingress allow for port 443 with lower priority

Answer

A Cloud Armor policy allowing only HTTPS requests to port 443

Question 8

A company's application currently runs on a single Compute Engine VM with a persistent disk. The application serves read-heavy traffic and the single VM is becoming a bottleneck. The application is stateless. Which change provides the most immediate horizontal scalability improvement?

Accepted Answer

Create a Managed Instance Group from the VM and configure autoscaling with a load balancer.. Creating a Managed Instance Group (MIG) from the existing VM and configuring autoscaling with a load balancer directly addresses the read-heavy, stateless bottleneck by distributing traffic across multiple VM instances. This provides immediate horizontal scalability, as new instances are automatically provisioned or terminated based on load, without requiring any application changes.

Answer

Upgrade the existing VM to a larger machine type (vertical scaling).

Answer

Add more persistent disks to the existing VM to handle more I/O.

Answer

Enable live migration on the existing VM so it can move between hosts.

Question 9

A Cloud Identity admin needs to grant a user access to manage billing for a specific GCP project without giving them access to any other projects in the organization. Which role should be assigned at the project level?

Accepted Answer

Project Billing Manager on the specific project. The Project Billing Manager role is the correct choice because it grants permissions to manage billing for a specific GCP project, including viewing billing reports and setting budget alerts, without providing access to other projects. This role is assigned at the project level, ensuring the user's billing management scope is limited to that single project.

Answer

Billing Account Administrator at the organization level

Answer

Editor on the specific project

Answer

Billing Account User at the billing account level

Question 10

A team needs to build a CI/CD pipeline that automatically tests and deploys to GKE when code is pushed to the main branch. Which GCP-native service builds and deploys the code automatically based on source code repository events?

Accepted Answer

Cloud Build with a trigger configured on the repository's main branch. Cloud Build is the correct GCP-native service for building and deploying code automatically based on source code repository events. By configuring a Cloud Build trigger on the main branch, any push to that branch automatically initiates a build and deployment to GKE, fulfilling the CI/CD pipeline requirement without additional orchestration.

Answer

Cloud Composer with a Git polling DAG

Answer

Cloud Run jobs triggered by a Pub/Sub subscription on the repository

Answer

Cloud Functions triggered by Cloud Source Repositories push events

Question 11

A Cloud Storage bucket contains sensitive PII data. You need to ensure that objects in this bucket are encrypted using a key that your security team controls, and that the key can be revoked if needed to render all data inaccessible. Which encryption option should you use?

Accepted Answer

Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS.. Customer-Managed Encryption Keys (CMEK) allow you to control and manage the key used for encrypting Cloud Storage objects via Cloud KMS. This enables key revocation, which immediately renders all data encrypted with that key inaccessible, meeting the security team's requirement for revocable control.

Answer

Use Google-managed encryption keys (default).

Answer

Enable Cloud Storage's built-in server-side encryption with AES-256.

Answer

Use Customer-Supplied Encryption Keys (CSEK) by embedding the key in each API request.

Question 12

A GCP organization mandates that all new Cloud SQL instances must require SSL/TLS for connections. No exceptions are allowed. Which enforcement mechanism ensures this across all projects in the organization?

Accepted Answer

Apply the org policy constraint `constraints/sql.requireSsl` at the organization level to enforce SSL on all Cloud SQL instances. The organization policy constraint `constraints/sql.requireSsl` is a native, enforceable policy that can be applied at the organization level in GCP. Once set, it prevents the creation of any Cloud SQL instance that does not require SSL/TLS, and it also blocks any attempt to disable SSL on existing instances. This ensures 100% compliance across all projects without relying on manual intervention or reactive detection.

Answer

Rely on database administrators to manually enable SSL on each new Cloud SQL instance

Answer

Use Security Command Center to detect SSL-disabled instances and alert the team

Answer

Set a Cloud Monitoring alert for new Cloud SQL instances and auto-remediate via Cloud Functions

Question 13

A team's Cloud Build pipeline must: (1) run unit tests, (2) build a Docker image only if tests pass, (3) push the image to Artifact Registry. Which cloudbuild.yaml structure correctly enforces this sequential dependency?

Accepted Answer

Define all three steps in a single `steps` list — they run sequentially by default and stop on failure. Cloud Build executes steps in a `steps` list sequentially by default, and any step that exits with a non-zero status (e.g., test failure) immediately stops the entire pipeline. This enforces the required dependency: unit tests must pass before the Docker image is built, and the image must be built before it is pushed to Artifact Registry.

Answer

Use `waitFor` with step IDs to create a dependency graph between all three steps

Answer

Define the steps in three separate cloudbuild.yaml files and chain them with Cloud Composer

Answer

Set `parallel: false` at the top level of cloudbuild.yaml to enforce sequential execution

Question 14

Your security team wants to prevent any user or service account from creating firewall rules that allow ingress from `0.0.0.0/0` (the internet) to any VM in your organization. Which approach enforces this without requiring per-project IAM changes?

Accepted Answer

Apply a hierarchical firewall policy at the organization level with a deny rule for ingress from 0.0.0.0/0, set to take precedence over project rules.. Hierarchical firewall policies at the organization level can include a deny rule for ingress from `0.0.0.0/0` with a priority that takes precedence over any project-level firewall rules. This enforces the restriction globally without requiring per-project IAM changes, as the policy is inherited by all projects in the organization.

Answer

Grant IAM deny policies that prevent the `compute.firewalls.create` permission across the organization.

Answer

Use Security Command Center to detect and alert when 0.0.0.0/0 firewall rules are created.

Answer

Set the `compute.skipDefaultNetworkCreation` org policy constraint across the organization.

Question 15

A team uses Cloud Build to build Docker images and push them to Artifact Registry. The cloudbuild.yaml has a step that requires a secret API key to call an external service during build. How should the secret be provided securely?

Accepted Answer

Reference the API key from Secret Manager using the availableSecrets field in cloudbuild.yaml. Cloud Build's `availableSecrets` field allows you to securely inject secrets from Secret Manager into build steps as environment variables or files, without exposing them in the build configuration or logs. This approach ensures the API key is encrypted at rest and in transit, and access can be controlled via IAM permissions, making it the only secure method among the options.

Answer

Pass the API key as a build substitution variable in the gcloud builds submit command

Answer

Store the API key in a Cloud Storage bucket and download it in a build step

Answer

Hardcode the API key in the cloudbuild.yaml and store it in the source repository