Google ACE Practice Test 20 — 15 Questions

Question 1

A developer needs to create a zonal GKE cluster with 3 nodes of type e2-standard-4 in zone us-central1-a. Which command should they use?

Accepted Answer

gcloud container clusters create my-cluster --zone=us-central1-a --num-nodes=3 --machine-type=e2-standard-4. The correct command creates a zonal cluster (single zone) with specified node count and machine type. The --region flag creates a regional cluster, which is not required.

Answer

gcloud compute instances create my-cluster --zone=us-central1-a --machine-type=e2-standard-4 --num-nodes=3

Answer

gcloud container clusters create my-cluster --zone=us-central1-a --num-nodes=1 --machine-type=e2-standard-4

Answer

gcloud container clusters create my-cluster --region=us-central1 --num-nodes=3 --machine-type=e2-standard-4

Question 2

A company wants to allow unauthenticated HTTP invocations of a container deployed on Cloud Run. Which flag should be included in the 'gcloud run deploy' command?

Accepted Answer

--allow-unauthenticated. The '--allow-unauthenticated' flag allows unauthenticated invocations. By default, Cloud Run requires authentication.

Answer

--public

Answer

--no-authentication

Answer

--auth-type public

Question 3

An engineer needs to view the logs generated by a Cloud Run service to troubleshoot a recent deployment. Which service should they use?

Accepted Answer

Cloud Logging. Cloud Logging (formerly Stackdriver Logging) is the unified logging service for Google Cloud. Cloud Run logs are automatically sent to Cloud Logging.

Answer

Cloud Monitoring

Answer

Error Reporting

Answer

Cloud Trace

Question 4

A developer has a Kubernetes Deployment manifest in a file named 'api-deployment.yaml'. Which command creates the Deployment if it doesn't exist, or updates it if it does?

Accepted Answer

kubectl apply -f api-deployment.yaml. `kubectl apply -f api-deployment.yaml` uses a declarative approach: it creates the Deployment if it does not exist, or performs a rolling update if it already exists, by applying the desired state defined in the YAML manifest. This command leverages the Kubernetes API's server-side apply logic, merging changes without requiring the resource to be deleted first.

Answer

kubectl create -f api-deployment.yaml

Answer

kubectl run api-deployment.yaml

Answer

kubectl deploy -f api-deployment.yaml

Question 5

A compliance team needs a log of every time a user or service account accessed data in a BigQuery dataset — specifically read operations. Which Cloud Audit Log type captures this?

Accepted Answer

Data Access audit logs. Data Access audit logs record API calls that read or modify user-provided data, including BigQuery read operations like SELECT queries. Since the requirement is specifically for read operations on user data, Data Access logs are the correct type. Admin Activity logs cover configuration changes, not data reads, and System Event logs cover Google-managed actions, not user-initiated reads.

Answer

System event audit logs

Answer

Admin Activity audit logs

Answer

VPC flow logs

Question 6

A security audit found that several Cloud Storage buckets in your project have `allAuthenticatedUsers` in their IAM policy with `storage.objectViewer`. What does `allAuthenticatedUsers` grant, and why is it a security risk?

Accepted Answer

It grants read access to any person with a Google account — effectively near-public access since Google accounts are free to create.. `allAuthenticatedUsers` is a special IAM member that includes any person authenticated with a Google account, regardless of whether they belong to your organization or domain. Granting `storage.objectViewer` to this group means anyone with a free Google account (e.g., Gmail) can list and read objects in the bucket, making the data effectively public. This is a significant security risk because it exposes sensitive data to a vast, uncontrolled audience.

Answer

It grants access only to users within your Google Workspace domain — a minor risk if your domain is small.

Answer

It grants access only to Google service accounts, which is acceptable since those are controlled.

Answer

It grants access to authenticated GCP users in your organization's IAM policy — this is normal for shared resources.

Question 7

You need to resize a Compute Engine instance from n1-standard-4 to n1-highmem-8. The instance has a local SSD attached. What must you do before changing the machine type?

Accepted Answer

Stop the instance, change the machine type, then start the instance. To change the machine type, the instance must be stopped. Local SSDs preserve data only if the instance is not stopped or terminated; however, when you stop the instance, local SSD data is lost. The correct procedure is to stop the instance, change the machine type, and then start it. Data on local SSDs will be lost.

Answer

Take a snapshot of the local SSD

Answer

Change the machine type without stopping

Answer

Detach the local SSD

Question 8

Your company recently migrated to GCP and you are the new cloud administrator. You need to ensure that only specific members of the DevOps team can perform administrative actions on Compute Engine instances, such as starting, stopping, and resetting instances, but not creating or deleting them. You also want to prevent them from modifying firewall rules or other network settings. The team consists of 10 members. You have already created a custom role with the necessary permissions and assigned it to a Google Group that contains all team members. However, you receive a report that a team member was able to accidentally delete a production instance. Upon investigation, you find that the team member had been granted the roles/compute.instanceAdmin role in addition to your custom role by another administrator. What should be the best course of action to prevent this from happening again while still allowing the team to perform their intended tasks?

Accepted Answer

Remove the compute.instanceAdmin role from the team member and audit all user assignments for role conflicts.. The core issue is that the team member had an additional, more permissive role (roles/compute.instanceAdmin) that overrode the restrictions of your custom role. Removing that conflicting role from the specific user and auditing all assignments ensures that only the intended permissions are applied, preventing accidental deletions while preserving the team's ability to start, stop, and reset instances.

Answer

Create an organization policy to block deletion of compute instances.

Answer

Remove the custom role from the team member and keep only the compute.instanceAdmin role.

Answer

Use IAM conditions on the custom role to enforce that instances can only be stopped during business hours.

Question 9

A company has two on-premises data centers connected via a redundant network. They want to extend their Google Cloud VPC to on-premises using Cloud VPN with dynamic routing (BGP). They need to ensure traffic from on-premises to Google Cloud can fail over to the secondary tunnel if the primary tunnel fails. The VPC has a single region. What should they configure?

Accepted Answer

Create two Cloud VPN gateways in the VPC, each with a BGP session to its own on-prem VPN device, both using the same Cloud Router with separate BGP sessions.. It provides true active/passive failover for on-premises to Google Cloud traffic. By creating two Cloud VPN gateways, each with a BGP session to its own on-premises VPN device, and attaching both sessions to the same Cloud Router, you enable BGP to advertise the same VPC prefixes over both tunnels. The Cloud Router uses BGP path selection (e.g., MED or AS path prepending) to prefer one tunnel as primary; if that tunnel fails, BGP withdraws the route and traffic automatically switches to the secondary tunnel. This satisfies the requirement for failover without relying on a single gateway or tunnel.

Answer

Use a single Cloud VPN gateway and create two tunnels to separate on-prem VPN devices, each with BGP.

Answer

Use Cloud Interconnect as the primary and Cloud VPN as the backup.

Answer

Use a Cloud Router in global dynamic routing mode and set up a single VPN tunnel with BGP.

Question 10

An organization requires that all Compute Engine instances be created with a specific service account that has minimal permissions. They also want to prevent users from creating instances with a different service account. Which IAM policy should they implement?

Accepted Answer

Organization policy with constraint compute.setServiceAccount. The organization policy constraint `compute.setServiceAccount` is the correct choice because it allows administrators to restrict which service accounts can be used when creating Compute Engine instances. By setting this constraint to only permit a specific service account, users are prevented from launching instances with any other service account, ensuring minimal permissions are enforced at the organization level.

Answer

Organization policy with constraint compute.disableUserServiceAccountCreation

Answer

IAM condition that restricts instances to only use the authorized service account

Answer

Custom role with permission compute.instances.setServiceAccount only for authorized users

Question 11

A GKE pod's container is frequently crashing and restarting. You need to view the logs from the previous container instance (before the last crash) to diagnose the crash cause. Which command retrieves these logs?

Accepted Answer

`kubectl logs POD_NAME --previous`. The `--previous` flag in `kubectl logs` retrieves logs from the previous instance of a container in a pod, which is exactly what you need when the current container has crashed and restarted. This allows you to see the logs that led to the crash, even though the container is now running a new instance.

Answer

`kubectl logs POD_NAME`

Answer

`kubectl describe pod POD_NAME`

Answer

`kubectl get events --field-selector reason=OOMKilled`

Question 12

A platform team needs to categorize GCP resources for policy enforcement (e.g., applying IAM conditions only to resources tagged 'environment:production'). Labels exist but don't support IAM conditions. What feature provides policy-tag-based enforcement?

Accepted Answer

Resource Manager Tags — attach a tag with key 'environment' and value 'production' and reference it in IAM conditions. Resource Manager Tags are the GCP feature specifically designed to support IAM conditions for policy enforcement. Unlike resource labels, which are simple key-value pairs used for metadata and billing, Resource Manager Tags can be referenced in IAM condition expressions using the `resource.matchTag` function, enabling fine-grained access control based on tag values such as 'environment:production'.

Answer

Resource labels — set environment=production on each resource and reference in IAM conditions

Answer

Cloud Asset Inventory metadata fields — query by label and apply policies

Answer

Pub/Sub event-driven policy application triggered by label changes

Question 13

A company wants to run a stateless HTTP web application that experiences highly variable traffic, including periods of zero traffic. The application is packaged as a Docker container. The team wants to minimize operational overhead and pay only for resources consumed during request processing. Which Google Cloud compute service is the best fit?

Accepted Answer

Cloud Run. Cloud Run is serverless, scales to zero, charges per request, and runs containers from container images. Cloud Functions is for event-driven functions, not full web apps. GKE Standard and Compute Engine require managing servers and do not scale to zero.

Answer

Cloud Functions

Answer

GKE Standard

Answer

Compute Engine with managed instance group

Question 14

You need to change the machine type of a running Compute Engine instance from n1-standard-4 to n1-standard-8. What is the correct procedure?

Accepted Answer

Stop the instance, run gcloud compute instances set-machine-type, then start the instance.. Changing machine type requires stopping the instance first.

Answer

Delete the instance and recreate it with the new machine type.

Answer

Run gcloud compute instances set-machine-type while the instance is running.

Answer

Take a snapshot, create a new instance, and attach the disk.

Question 15

A startup is building a web application using Cloud Run. They want to deploy multiple independent services that can communicate with each other internally, but each service should be deployed and scaled independently. Which deployment strategy should they use?

Accepted Answer

Create multiple Cloud Run services and use internal endpoints for communication. Cloud Run natively supports deploying multiple independent services, each with its own URL and scaling configuration. Internal communication between these services can be achieved using Cloud Run's built-in internal endpoints (e.g., using the `run.app` domain with internal traffic routing), which avoids exposing services to the public internet. This approach allows each service to scale independently based on its own request load, meeting the startup's requirement for independent deployment and scaling.

Answer

Deploy the application to App Engine Standard Environment

Answer

Use a single GKE cluster with multiple deployments and services

Answer

Deploy a single Cloud Run service with multiple containers