Google ACE Practice Exam 2 — 20 Questions

Question 1

A Cloud Run service needs to access a database password at runtime. Where should the password be stored according to GCP security best practices?

Accepted Answer

In Secret Manager, referenced as a mounted secret or accessed via the API at runtime. Secret Manager is the GCP-native service designed to securely store sensitive data like database passwords. It provides encryption at rest and in transit, fine-grained access control via IAM, and supports both mounting secrets as volumes and accessing them via the API at runtime. This aligns with GCP security best practices by avoiding exposure of secrets in plain text, configuration files, or container images.

Answer

As a plain-text environment variable in the Cloud Run service configuration

Answer

In a Cloud Storage bucket accessible to the service account

Answer

Baked into the container image at build time

Question 2

A team is designing a system where two GCP projects — a shared services project and an application project — need their VMs to communicate using private IPs. Both projects are in the same organization. Which networking option best enables this with centralized network management?

Accepted Answer

Shared VPC (XPN) with the shared services project as the host. Shared VPC (XPN) allows an organization to centrally manage networking across multiple projects from a single host project, enabling VMs in the shared services project and the application project to communicate via private IPs without needing separate peering or VPN configurations. This is the best option because it provides centralized network administration and policy enforcement, which aligns with the requirement for centralized network management.

Answer

VPC Peering between the two projects' VPCs

Answer

Cloud VPN between the two projects' default VPCs

Answer

Using external IPs with TLS — private IP communication isn't necessary between GCP projects

Question 3

You need to design a solution where a Cloud Function is triggered by HTTP requests from the internet, but it must also privately access a Cloud SQL instance that has no public IP. The Cloud Function should not expose the Cloud SQL instance to public traffic. Which configuration enables this?

Accepted Answer

Configure a Serverless VPC Access connector and attach it to the Cloud Function to access Cloud SQL via private IP.. A Serverless VPC Access connector allows a Cloud Function to connect to a Cloud SQL instance via its private IP, enabling private network communication without exposing the database to the internet. The connector bridges the serverless environment to a VPC, and the Cloud SQL instance must have private IP enabled. This satisfies the requirement of private access while the function itself remains publicly triggerable via HTTP.

Answer

Enable a public IP on the Cloud SQL instance and restrict access using Cloud SQL authorized networks.

Answer

Use Cloud SQL Auth Proxy on a Compute Engine VM as a jump host between the function and the database.

Answer

Deploy the Cloud Function in the same project as Cloud SQL; same-project resources can access each other privately by default.

Question 4

A Cloud Run service requires access to a private Cloud SQL instance in the same VPC. The Cloud SQL instance is not publicly accessible. How should the Cloud Run service connect to Cloud SQL without using the Cloud SQL Auth Proxy separately?

Accepted Answer

Configure the Cloud Run service with `--add-cloudsql-instances` to connect via the built-in Auth Proxy. The Cloud Run service can use the `--add-cloudsql-instances` flag, which automatically deploys a built-in Cloud SQL Auth Proxy sidecar container within the same pod. This proxy establishes a secure, encrypted connection to the private Cloud SQL instance using the instance's private IP, without requiring the instance to have a public IP or the user to manage a separate proxy. The proxy authenticates via the service account attached to the Cloud Run service, enabling seamless and secure connectivity.

Answer

Use the Cloud SQL public IP with SSL required — Cloud Run can reach public IPs

Answer

Deploy a separate Cloud SQL Auth Proxy container in the same Cloud Run service as a sidecar

Answer

Enable Serverless VPC Access connector to route Cloud Run traffic to the private Cloud SQL IP

Question 5

A team's Cloud SQL for PostgreSQL instance is running out of disk space. Automated storage increase is disabled. A monitoring alert fires at 90% disk usage. What is the fastest safe action to increase storage?

Accepted Answer

Increase storage capacity using `gcloud sql instances patch --storage-size=[NEW_SIZE]` without downtime. Cloud SQL for PostgreSQL supports online storage resizing without downtime. Using `gcloud sql instances patch --storage-size=[NEW_SIZE]` allows you to increase the allocated disk capacity while the instance remains fully operational, making it the fastest safe action when automated storage increase is disabled.

Answer

Delete old records from the database to free space — no instance changes needed

Answer

Create a new larger Cloud SQL instance and migrate data with Cloud Database Migration Service

Answer

Enable automatic storage increase and wait — Cloud SQL will expand the disk retroactively

Question 6

A financial application requires all database transactions to be durable even if the primary Cloud SQL instance fails mid-transaction. The RPO (Recovery Point Objective) must be near-zero. Which Cloud SQL feature achieves this?

Accepted Answer

Cloud SQL High Availability with synchronous standby replica in a different zone. Cloud SQL High Availability (HA) uses a synchronous standby replica in a different zone to ensure that every write is committed to both the primary and standby before acknowledging the transaction. This provides near-zero RPO because if the primary fails mid-transaction, the standby has the exact same data and can take over without data loss.

Answer

Cloud SQL read replica with synchronous replication

Answer

Cloud SQL with automated daily backups and point-in-time recovery

Answer

Cloud Spanner — it automatically replicates synchronously across zones

Question 7

You are designing a data pipeline that reads from Cloud Storage, transforms data, and writes to BigQuery. The pipeline must process data exactly when new files land (event-driven), handle files up to 5 GB, and complete within 10 minutes. Which approach best meets these requirements?

Accepted Answer

Configure a Cloud Storage Pub/Sub notification → Cloud Function that launches a Dataflow job for each new file.. Cloud Storage Pub/Sub notifications provide event-driven triggers for each new file, and launching a Dataflow job via a Cloud Function allows processing of up to 5 GB files within the 10-minute window. Dataflow’s autoscaling and streaming capabilities handle large files efficiently, while the Cloud Function acts as a lightweight orchestrator without processing the data itself.

Answer

Use a Cloud Scheduler cron job that scans Cloud Storage every minute and processes new files with Dataflow.

Answer

Use Cloud Functions triggered by GCS events to read and transform the 5 GB file directly.

Answer

Use BigQuery Data Transfer Service to load files from Cloud Storage on a schedule.

Question 8

A team needs to run a simple containerized script that processes a batch of files once per night and exits when done — no HTTP endpoint needed. Which GCP service is most appropriate?

Accepted Answer

Cloud Run Jobs triggered by Cloud Scheduler. Cloud Run Jobs is the correct choice because it is designed for batch workloads that run to completion, with no requirement for an HTTP endpoint. It can handle long-running tasks (up to 24 hours) and can be triggered by Cloud Scheduler for nightly execution, making it ideal for processing files once per night.

Answer

Cloud Run Services with a timeout set to 24 hours

Answer

Cloud Functions with a 540-second maximum timeout

Answer

App Engine Standard with a background service

Question 9

A network security team wants to capture metadata about all TCP flows entering and leaving VMs in a specific subnet — source IP, destination IP, port, and bytes transferred — for security analysis. Which GCP feature collects this data?

Accepted Answer

VPC Flow Logs enabled on the subnet. VPC Flow Logs capture metadata (source/destination IP, port, protocol, bytes transferred) for all TCP (and UDP/ICMP) flows entering and leaving VM instances in a subnet. This feature is specifically designed for network monitoring and security analysis, recording flow-level logs without inspecting packet payloads. Enabling VPC Flow Logs on the subnet directly meets the requirement to collect the specified metadata for all TCP flows.

Answer

Cloud Armor security policies with logging enabled

Answer

Cloud Packet Mirroring — captures all traffic for deep packet inspection

Answer

Firewall Rules Logging on each firewall rule

Question 10

Two GCP projects, A and B, have VPC peering configured. Project A is peered with B, and Project B is peered with Project C. Can VMs in Project A reach VMs in Project C through Project B?

Accepted Answer

No — VPC peering is non-transitive; A and C must be directly peered to communicate. VPC peering in Google Cloud is non-transitive. This means that if Project A is peered with Project B and Project B is peered with Project C, traffic from Project A cannot flow through Project B to reach Project C. Each peering connection is a direct, point-to-point link, and there is no routing of traffic across multiple peered networks unless explicitly configured with a separate mechanism like a VPN or a third-party appliance. Therefore, VMs in Project A and Project C must be directly peered to communicate.

Answer

Yes — VPC peering automatically enables transitive routing through intermediate peered networks

Answer

Yes — if Project B has IP forwarding enabled, it acts as a router between A and C

Answer

It depends on the firewall rules in Project B's VPC

Question 11

Your application is deployed on GKE and experiencing increased latency. You suspect a memory leak causing the JVM to run frequent garbage collection cycles. Cloud Monitoring shows high memory usage but you need to understand the garbage collection behavior over time. Which GCP tool provides JVM-level profiling including memory allocation data?

Accepted Answer

Cloud Profiler with heap profiling enabled for the JVM application.. Cloud Profiler with heap profiling enabled captures JVM-level memory allocation data and garbage collection behavior over time, allowing you to identify memory leaks and GC frequency. Unlike generic memory monitoring, it provides per-method allocation snapshots and GC pause analysis specific to the JVM.

Answer

Cloud Trace

Answer

Cloud Monitoring with JVM MBeans metrics exported via the Ops Agent.

Answer

Error Reporting filtered for OutOfMemoryError exceptions.

Question 12

You want to allow a vendor to upload files to a specific Cloud Storage bucket in your project without creating a GCP account for them. The upload URL should expire after 24 hours. Which mechanism should you use?

Accepted Answer

Generate a Signed URL with a 24-hour expiration for the specific bucket path.. A signed URL allows time-limited, permissionless access to a specific Cloud Storage object or bucket path without requiring a GCP identity. The URL is cryptographically signed using a service account key, and the 24-hour expiration is set via the `expires` parameter. This meets the requirement of allowing the vendor to upload files without creating a GCP account.

Answer

Create a GCP service account for the vendor and share the key JSON file.

Answer

Make the Cloud Storage bucket publicly writable and share the bucket URL.

Answer

Add the vendor's email to the bucket's IAM policy with Storage Object Creator role.

Question 13

A DevOps team deploys a MIG (Managed Instance Group) with autohealing configured. The health check probes `/health` on port 8080 with a 30-second initial delay. After deployment, new VMs are failing the health check and being immediately recreated — causing a restart loop. What is the most likely cause?

Accepted Answer

The initial delay is too short — the application hasn't finished starting before the health check probes begin. The 30-second initial delay is too short for the application to complete its startup sequence. When the health check begins probing before the application is ready, it immediately fails, causing the MIG autohealing mechanism to treat the VM as unhealthy and recreate it, leading to a restart loop. The initial delay must be set to a value that exceeds the application's typical startup time.

Answer

The health check HTTP path `/health` doesn't exist — the application uses `/healthz`

Answer

Autohealing is incompatible with autoscaling — they cannot be used together

Answer

The MIG does not support HTTP health checks — TCP checks must be used instead

Question 14

A Cloud SQL production instance experiences a spike in connections during business hours, causing 'too many connections' errors. The application uses 50 microservices each maintaining 10 connections. What is the recommended solution to reduce connection count without rewriting the application?

Accepted Answer

Deploy a connection pooler (e.g., PgBouncer) between the microservices and Cloud SQL. Deploying a connection pooler like PgBouncer between the microservices and Cloud SQL allows many application connections to be multiplexed over a smaller number of actual database connections. This directly reduces the total connection count on the Cloud SQL instance without requiring any application code changes, as the pooler transparently manages the connection lifecycle and reuses idle connections.

Answer

Increase the Cloud SQL instance's max_connections database flag to 10,000

Answer

Enable Cloud SQL HA — the standby will handle the connection overflow

Answer

Add a read replica — microservices can connect to the replica instead of the primary

Question 15

A team's Cloud Storage bucket has fine-grained access control (ACLs) enabled. They want to switch to a simpler model where IAM policies alone control access, and object-level ACLs are ignored. What should they enable?

Accepted Answer

Enable Uniform Bucket-Level Access (UBLA) on the bucket. Enabling Uniform Bucket-Level Access (UBLA) on the bucket disables object-level ACLs and enforces IAM policies as the sole access control mechanism. This simplifies management by ignoring any existing ACLs on objects, ensuring that only bucket-level IAM permissions are evaluated for access decisions.

Answer

Delete all ACLs on each object and set them to 'authenticated-read'

Answer

Enable VPC Service Controls on the bucket

Answer

Set the bucket's default object ACL to `projectPrivate` and apply it to all objects

Question 16

A microservices application has intermittent high latency. The team wants to identify which specific service-to-service call in the request chain is causing the slowdown. Which Cloud Operations tool is designed for this?

Accepted Answer

Cloud Trace. Cloud Trace is designed to capture latency data for individual service-to-service calls in a distributed request chain. It provides end-to-end tracing by collecting trace spans from each microservice, allowing you to pinpoint which specific call is causing the slowdown. This makes it the correct tool for identifying the exact service-to-service latency bottleneck.

Answer

Cloud Monitoring Metrics Explorer

Answer

Cloud Logging log viewer

Answer

Cloud Profiler

Question 17

A junior developer needs read-only access to all GCP resources in a project. Which IAM role grants the minimum permissions required?

Accepted Answer

Viewer. The Viewer role (roles/viewer) grants read-only access to all GCP resources in a project, including existing and future resources, without allowing any modifications. This is the minimum permissions required for read-only access, as it provides exactly the necessary permissions (e.g., resourcemanager.projects.get, storage.objects.list) without any write or administrative capabilities.

Answer

Editor

Answer

Owner

Answer

Browser

Question 18

A project is being decommissioned. You need to delete it but want to ensure there is a 30-day window during which the deletion can be cancelled if needed. What happens when you delete a GCP project?

Accepted Answer

The project enters a 30-day pending deletion period; resources are inaccessible but the project can be restored within this window.. When you delete a GCP project, it enters a 30-day pending deletion period. During this time, all resources are inaccessible, but the project and its data can be fully restored if needed. This ensures a safety window before permanent deletion, aligning with the requirement for a 30-day cancellation window.

Answer

The project is immediately and permanently deleted along with all resources.

Answer

The project is archived but billing continues for 30 days before final deletion.

Answer

All resources are deleted immediately but the project ID is reserved for 90 days.

Question 19

A developer attempts to create a Cloud SQL instance but receives the error: 'API [sqladmin.googleapis.com] not enabled.' What is the correct resolution?

Accepted Answer

Enable the Cloud SQL Admin API via APIs & Services > Library in the Console. The error 'API [sqladmin.googleapis.com] not enabled' indicates that the Cloud SQL Admin API has not been activated for the project. The correct resolution is to enable the API via APIs & Services > Library in the Google Cloud Console, as this is a prerequisite for creating any Cloud SQL instance. Assigning IAM roles or requesting quota increases does not enable the underlying API service.

Answer

Assign the developer the Cloud SQL Admin IAM role

Answer

Request a quota increase for Cloud SQL in the project

Answer

Create a new project — Cloud SQL is enabled by default in new projects

Question 20

An application architect is comparing Cloud SQL (PostgreSQL) and Cloud Spanner for a new global e-commerce platform. The platform must serve customers on three continents with <50ms latency for reads and strong consistency for inventory updates. Which service best fits?

Accepted Answer

Cloud Spanner multi-region configuration. Cloud Spanner multi-region configuration is the correct choice because it provides strong global consistency with <50ms read latency across continents, which is essential for an e-commerce platform requiring real-time inventory updates. Spanner uses TrueTime and Paxos-based replication to ensure ACID transactions globally, meeting both the latency and consistency requirements simultaneously.

Answer

Cloud SQL with one primary instance and cross-region read replicas

Answer

Cloud Firestore in multi-region mode

Answer

Cloud SQL with Cloud Memorystore caching layer for reads