Google ACE Practice Exam 1 — 20 Questions

Question 1

An organization policy at the organization level sets `constraints/compute.requireOsLogin` to enforced (true) on all projects. A specific project needs an exception — VMs there should not require OS Login. How can this exception be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set a project-level organization policy overriding `compute.requireOsLogin` to not enforced (if the constraint allows override). Organization policies can be overridden at a lower level (project, folder) if the constraint's `inheritFromParent` setting allows it. The `compute.requireOsLogin` boolean constraint supports per-project override, so setting it to `false` at the project level exempts that project's VMs from requiring OS Login while the organization-level policy remains enforced for all other projects.

Answer

Removing the VM from the VPC will bypass the organization policy

Answer

Grant the VM's service account the OS Login Admin role to bypass the policy

Answer

Move the project to a folder that doesn't inherit the organization policy

Question 2

Order the steps to set up a VPC network with a subnet, firewall rule allowing SSH, and a Compute Engine instance in that subnet.

Accepted Answer

Create VPC network and subnet first, then create firewall rule allowing SSH, then create Compute Engine instance in the subnet.. The correct sequence is to first create the VPC network and subnet, then create the firewall rule allowing SSH, and finally create the Compute Engine instance. This ensures that the network infrastructure is ready before the instance is launched, and SSH access is available immediately.

Answer

Create VPC network and subnet first, then create Compute Engine instance, then create firewall rule allowing SSH.

Answer

Create firewall rule allowing SSH first, then create VPC network and subnet, then create Compute Engine instance.

Answer

Create VPC network and subnet first, then create Compute Engine instance in the default subnet, then create a firewall rule allowing SSH for that subnet.

Question 3

You need to enforce that all new Cloud Storage buckets in your organization use Uniform Bucket-Level Access (UBLA) and are created in one of three approved regions: `us-central1`, `us-east1`, or `europe-west1`. What is the most efficient way to enforce both constraints?

Accepted Answer

Apply `storage.uniformBucketLevelAccess` and `gcp.resourceLocations` org policies at the organization level.. Organization policies are the most efficient way to enforce constraints across all new Cloud Storage buckets because they are evaluated at resource creation time by the Cloud Resource Manager. The `storage.uniformBucketLevelAccess` policy enforces UBLA, and `gcp.resourceLocations` restricts the allowed locations, both applied at the organization level to cover all projects without per-bucket overhead.

Answer

Write a Cloud Function triggered by bucket creation events to check and delete non-compliant buckets.

Answer

Create a custom IAM role that removes the `storage.buckets.create` permission for disallowed regions.

Answer

Use Terraform to provision all buckets and include validation in the Terraform plan step.

Question 4

A team wants to use Cloud Run to deploy a container that processes messages from a Pub/Sub topic. The container is stateless and the workload is expected to have irregular traffic spikes with high concurrency. Which scaling configuration is most appropriate?

Accepted Answer

Set min-instances to 0 and max-instances to 100 with concurrency of 80. Cloud Run can set a maximum number of concurrent requests per container instance. For Pub/Sub processing, setting max-instances can control cost, and the CPU is always allocated during request processing. The key is to allow multiple concurrent requests to handle spikes efficiently.

Answer

Set min-instances to 0 and max-instances to 1000 with concurrency of 1

Answer

Set min-instances to 10 and max-instances to 100 with concurrency of 1

Answer

Set min-instances to 1 and max-instances to 100 with concurrency of 1

Question 5

Your on-premises data center needs a dedicated, private connection to GCP with a guaranteed 10 Gbps bandwidth and SLA-backed availability. Internet-based VPN is not acceptable due to compliance requirements. Which connectivity option should you choose?

Accepted Answer

Cloud Interconnect Dedicated (10 Gbps). Dedicated Interconnect provides a direct, private physical connection between your on-premises network and GCP, offering up to 10 Gbps per circuit with a 99.99% SLA. Since internet-based VPN is not acceptable due to compliance requirements, this option meets the need for dedicated bandwidth and SLA-backed availability without traversing the public internet.

Answer

Cloud VPN with multiple tunnels for redundancy

Answer

Partner Interconnect via a carrier partner

Answer

Cloud Router with BGP peering over the public internet

Question 6

A new engineer joins the team and needs access to GCP. The company uses Google Workspace for identity management. The GCP admin needs to add the engineer and grant them access to one project. What is the correct order of steps?

Accepted Answer

Create the user in Google Workspace Admin Console, then grant their account IAM roles on the GCP project. Google Workspace is the identity provider (IdP) for the organization, so the engineer must first be created as a user in the Google Workspace Admin Console. Once the user exists, the GCP admin can then grant IAM roles (e.g., roles/viewer, roles/editor) on the specific project, which maps the Workspace user identity to GCP permissions. This follows the principle that GCP IAM relies on existing identities from the Cloud Identity or Workspace domain, not on separate user creation within GCP.

Answer

Create a service account for the engineer in GCP, then share the key file

Answer

Create a GCP project for the engineer, then add their personal Gmail as a project owner

Answer

Create an API key for the engineer in the GCP Console and share it securely

Question 7

You want to export a subset of Cloud Logging logs to BigQuery for long-term analysis. Which method should you use?

Accepted Answer

Create a log sink with a filter and destination BigQuery. Log sinks route logs to destinations like BigQuery, Cloud Storage, or Pub/Sub. Creating a sink with a filter is the correct approach.

Answer

Create a log-based metric and export the metric to BigQuery

Answer

Set up a Cloud Function that triggers on logs and inserts into BigQuery

Answer

Use gcloud logging read and pipe to bq load

Question 8

You are troubleshooting a Pub/Sub subscription that is not receiving messages as fast as they are published. You want to check if there is a backlog of unacknowledged messages for the subscription. What should you use?

Accepted Answer

Use Cloud Monitoring to view the 'oldest_unacked_message_age' metric. Cloud Monitoring has a metric for Pub/Sub subscription backlog (oldest unacknowledged message age or num_undelivered_messages).

Answer

Check the Cloud Logging logs for the subscription

Answer

Use gcloud pubsub subscriptions describe and check the ackDeadlineSeconds

Answer

Check the Cloud Console Pub/Sub dashboard for the topic publish rate

Question 9

A security engineer needs to ensure that Compute Engine instances in a VPC can only communicate with each other on port 443 and cannot receive traffic from the internet. The VPC has a default network with default firewall rules. What should the engineer do?

Accepted Answer

Delete all default firewall rules and create a rule allowing ingress from the VPC's subnet range (e.g., 10.0.0.0/16) on port 443.. The default VPC includes default firewall rules that allow ingress from the internet and allow all internal traffic. To restrict communication, the engineer must first delete the default ingress rule that allows all traffic from the internet (allow-ssh, allow-icmp, allow-rdp, and allow-http/https can be deleted), then create a new rule that allows ingress only from the VPC's IP range on port 443. The default internal rule allows all traffic within the network; to restrict to port 443, a new rule with higher priority can override it, or the default rule can be deleted and a new one created.

Answer

Create a firewall rule with priority 2000 denying ingress from 0.0.0.0/0 and a rule allowing ingress from 10.0.0.0/16 on port 443 with priority 1000.

Answer

Create a firewall rule with priority 1000 allowing ingress from 0.0.0.0/0 on port 443 and deny all other traffic.

Answer

Modify the default-allow-internal rule to only allow port 443.

Question 10

An engineer needs to audit all Data Access logs for a project to detect unauthorized access to sensitive data. The engineer must ensure that logs are retained for 5 years and are immutable. Which THREE steps should the engineer take?

Accepted Answer

Configure the Cloud Storage bucket with a retention policy and enable object versioning. To achieve this, the engineer must: 1. Enable Data Access audit logs for the required services (e.g., Cloud Storage, BigQuery) in the project's IAM audit config. 2. Create a log sink that exports the logs to a Cloud Storage bucket (which provides cost-effective long-term retention). 3. Configure the bucket with retention policy and object versioning to make logs immutable and protect against deletion. Using Logging's default retention is only 30 days, not 5 years. Cloud Monitoring does not store logs. BigQuery is not ideal for immutable storage.

Answer

Use the default Logging retention of 30 days

Answer

Set up a Cloud Monitoring alert for any Data Access log entries

Question 11

What is the purpose of creating a Cloud NAT gateway?

Accepted Answer

To enable private instances to reach the internet for updates and patches.. Cloud NAT allows instances without external IP addresses to access the internet for outbound connections, while preventing inbound connections from the internet.

Answer

To allow VPN connections to on-premises networks.

Answer

To provide a static IP address for inbound traffic.

Answer

To provide DNS resolution for VPC networks.

Question 12

An organization has multiple projects under a folder. They want to grant a network admin the ability to create firewall rules in all projects in the folder. Which IAM policy binding achieves this with least privilege?

Accepted Answer

Grant roles/compute.securityAdmin at the folder level. Grant the roles/compute.securityAdmin role at the folder level. This allows managing firewall rules across all projects under that folder. Granting at project level would require adding the role to each project individually. The compute.networkAdmin role does not include firewall rule management.

Answer

Grant roles/owner at the folder level

Answer

Grant roles/compute.admin at the project level for each project

Answer

Grant roles/compute.networkAdmin at the folder level

Question 13

A team is designing a data pipeline: Cloud Storage → Pub/Sub → Dataflow → BigQuery. They expect 50 GB of data per hour. Dataflow jobs must automatically scale workers based on pipeline backlog. Which Dataflow feature provides automatic horizontal scaling of worker VMs?

Accepted Answer

Dataflow Horizontal Autoscaling — automatically adds/removes workers based on pipeline lag. Dataflow Horizontal Autoscaling is the correct feature because it automatically adds or removes worker VMs based on the pipeline's backlog (lag), which directly matches the requirement for automatic horizontal scaling. This feature uses the Cloud Monitoring service to track the number of unprocessed elements and adjusts worker count accordingly, ensuring efficient resource usage without manual intervention.

Answer

Vertical scaling — Dataflow automatically increases worker machine types under load

Answer

GKE cluster autoscaler — Dataflow runs on GKE and inherits its autoscaling

Answer

Cloud Monitoring alerting policy that triggers worker additions via gcloud

Question 14

A company runs a batch job every night that processes data from a Cloud Storage bucket and writes results to BigQuery. The job runs on a Compute Engine VM. To minimize costs, what is the best practice for the VM?

Accepted Answer

Use a preemptible VM. Preemptible VMs are up to 80% cheaper and can be terminated at any time, which is acceptable for batch jobs that can be checkpointed or restarted from the beginning.

Answer

Use a VM with GPUs for faster processing

Answer

Use a VM with local SSD for temporary storage

Answer

Use a standard VM and commit to a 1-year commitment

Question 15

A financial services company needs to run analytics queries on transaction data that arrives in real-time. The queries must return results within 2 seconds and the dataset grows by ~100 GB per day. The company also needs to retain all data for 7 years for regulatory compliance. Which architecture best satisfies these requirements?

Accepted Answer

Stream transactions through Pub/Sub → Dataflow → BigQuery; run analytics on BigQuery.. It uses Pub/Sub for real-time ingestion, Dataflow for stream processing, and BigQuery for analytics, which can handle 100 GB/day growth and return queries within 2 seconds using BigQuery's columnar storage and automatic sharding. BigQuery's 7-year retention is supported by its time-based partitioning and long-term storage at reduced cost, meeting regulatory compliance without manual intervention.

Answer

Write transactions to Cloud Spanner; run analytics queries directly against Spanner.

Answer

Store transactions in Cloud Bigtable and use Dataproc/Spark for analytics queries.

Answer

Use Cloud SQL for storage and Cloud Dataprep for analytics transformations.

Question 16

A company organizes its GCP projects by business unit — Finance, Engineering, and Sales. Which resource is best suited to group these projects while applying shared IAM policies to all projects in each group?

Accepted Answer

Create GCP Folders for each business unit and add the relevant projects. C is correct because GCP Folders are the hierarchical resource designed to group projects under an organization node, allowing you to apply shared IAM policies at the folder level that automatically propagate to all projects within that folder. This aligns with the requirement to organize projects by business unit and enforce consistent access controls across each group.

Answer

Apply labels to each project to identify the business unit

Answer

Apply resource tags to each project for policy enforcement

Answer

Create a Shared VPC host project for each business unit

Question 17

A GKE Pod needs to call the Cloud Storage API. The team wants to avoid creating and managing service account key files. What is the recommended approach?

Accepted Answer

Enable Workload Identity on the GKE cluster and bind a Kubernetes ServiceAccount to a GCP IAM ServiceAccount. Workload Identity is the recommended approach because it allows a Kubernetes ServiceAccount in GKE to authenticate as a GCP IAM ServiceAccount without managing or storing any service account key files. This eliminates the security risk of key leakage and simplifies credential rotation. By binding the Kubernetes ServiceAccount to a GCP IAM ServiceAccount, Pods can directly call Cloud Storage APIs using the IAM permissions of the linked service account, with automatic token exchange via the GKE metadata server.

Answer

Mount a service account JSON key file as a Kubernetes Secret and set GOOGLE_APPLICATION_CREDENTIALS

Answer

Rely on the GKE node's Compute Engine service account for all Pod authentication

Answer

Grant the GKE node pool's service account the Storage Admin role to cover all Pod needs

Question 18

A Cloud KMS key used to encrypt a Cloud Storage bucket's data is being destroyed. What happens to the data in the bucket when the KMS key is destroyed?

Accepted Answer

The encrypted data becomes permanently inaccessible (cryptographic erasure) since the decryption key no longer exists.. When a Cloud KMS key is destroyed, the encrypted data in Cloud Storage becomes permanently inaccessible because the cryptographic key material is irrecoverably deleted. This is known as cryptographic erasure: without the key, the ciphertext cannot be decrypted, even though the raw encrypted bytes still exist in the bucket. Cloud Storage does not store a copy of the KMS key, and there is no fallback mechanism to re-encrypt or recover the data.

Answer

The data in Cloud Storage is automatically deleted along with the key.

Answer

Cloud Storage automatically re-encrypts the data using Google-managed keys as a fallback.

Answer

The key enters a 'disabled' state where data can still be decrypted by Google support.

Question 19

Arrange the steps to create a Cloud SQL MySQL instance, configure a database, and connect using the Cloud SQL Proxy.

Accepted Answer

Create a Cloud SQL MySQL instance → Configure a database → Connect using the Cloud SQL Proxy. The correct order is to first create the Cloud SQL instance, then configure a database (e.g., create a database and user), and finally connect using the Cloud SQL Proxy for secure access. Common mistakes include attempting to configure the database before instance creation or using the proxy before the database is ready.

Answer

Configure a database → Create a Cloud SQL MySQL instance → Connect using the Cloud SQL Proxy

Answer

Create a Cloud SQL MySQL instance → Connect using the Cloud SQL Proxy → Configure a database

Answer

Connect using the Cloud SQL Proxy → Create a Cloud SQL MySQL instance → Configure a database

Question 20

You need persistent shared file storage for a legacy application running on multiple Compute Engine VMs that requires POSIX-compliant file system access (NFS). The workload is I/O intensive with files up to 100 GB. Which GCP storage service should you use?

Accepted Answer

Cloud Filestore (NFS). Cloud Filestore provides a fully managed NFS server that supports POSIX-compliant file access, making it the correct choice for a legacy application requiring NFS. It can handle I/O-intensive workloads with large files (up to 100 GB) by offering high throughput and low-latency access from multiple Compute Engine VMs simultaneously.

Answer

Cloud Storage FUSE mounted on each VM

Answer

Persistent Disk attached in ReadWriteMany mode to all VMs

Answer

Local SSD on each VM with rsync synchronization between VMs