Google ACE Practice Exam 3 — 20 Questions

Question 1

An internal web application running on GKE must be accessible only to employees who are authenticated with the company's Google Workspace account — without exposing it to the internet or using a VPN. Which GCP service provides identity-based access without a VPN?

Accepted Answer

Cloud Identity-Aware Proxy (IAP) configured on the load balancer in front of the GKE service. Cloud Identity-Aware Proxy (IAP) is the correct choice because it enforces identity-based access control at the application layer, verifying that users are authenticated via Google Workspace before allowing traffic to reach the GKE service through an HTTPS load balancer. This eliminates the need for a VPN or public internet exposure by leveraging Google's global infrastructure to authenticate and authorize each request based on the user's identity and context.

Answer

VPC Service Controls creating a perimeter around the GKE cluster

Answer

Firebase Authentication SDK integrated into the web application frontend

Answer

Cloud Armor with a Google Workspace IP allowlist

Question 2

A security team needs an inventory of all Compute Engine VM instances across all projects in their GCP organization, including instance names, zones, and status, without logging into each project individually. Which service provides this?

Accepted Answer

Cloud Asset Inventory with an organization-scoped asset search. Cloud Asset Inventory provides a unified, organization-scoped view of all resources across projects, including Compute Engine VM instances. By using an organization-scoped asset search, the security team can query for all VM instances (e.g., `asset_type = "compute.googleapis.com/Instance"`) without needing to log into each project individually. This service is purpose-built for cross-project resource discovery and inventory management.

Answer

Cloud Monitoring — use the metric explorer to list all VM instances

Answer

Cloud Resource Manager — list all projects and then query each for VMs

Answer

BigQuery information_schema views for GCP compute resources

Question 3

A Compute Engine VM with only a private IP address needs to download software updates from the internet (apt-get update). What must be configured in the VPC to enable outbound internet access for private VMs?

Accepted Answer

Configure Cloud NAT on the VPC's Cloud Router for the subnet. Cloud NAT (Network Address Translation) allows private VMs without external IP addresses to initiate outbound connections to the internet. It translates the VM's private IP to a public IP managed by Cloud NAT, enabling apt-get update to reach external repositories. This is the correct and scalable solution for outbound-only internet access from private instances.

Answer

Enable Private Google Access on the subnet

Answer

Add an external IP address to the VM temporarily for the update, then remove it

Answer

Create a VPC firewall rule allowing egress to 0.0.0.0/0 on port 80 and 443

Question 4

A CI/CD pipeline running outside GCP (on GitHub Actions) needs to authenticate to GCP to push images to Artifact Registry, without storing any long-lived service account key files. Which authentication mechanism achieves this?

Accepted Answer

Workload Identity Federation with GitHub Actions as the identity provider. Workload Identity Federation allows a GitHub Actions workflow to exchange a GitHub-issued OIDC token for a GCP access token, enabling authentication to Artifact Registry without storing any long-lived service account keys. This is the recommended approach for non-GCP CI/CD systems because it eliminates the security risk of managing static credentials while still granting fine-grained, short-lived access to GCP resources.

Answer

Store a service account JSON key as a GitHub Actions secret and use it in the workflow

Answer

OAuth 2.0 user credentials from a developer's Google account

Answer

API keys created for the Artifact Registry service

Question 5

Instead of granting IAM roles to 50 individual developer email addresses, a team wants to manage access by team membership. When a developer joins or leaves, access updates automatically. What is the recommended approach?

Accepted Answer

Grant IAM roles to a Google Group containing all team members. Option B is correct because Google Groups act as identity containers that can be granted IAM roles at the project or resource level. When developers are added to or removed from the group, their IAM permissions automatically update without requiring manual role changes for each individual user. This aligns with the principle of least privilege and simplifies access management at scale.

Answer

Create a service account shared by all developers on the team

Answer

Create a GCP project per developer and use cross-project IAM bindings

Answer

Use Cloud Identity-Aware Proxy to manage team membership

Question 6

A healthcare company stores patient data in Cloud Storage. Compliance requires that even GCP (Google) cannot decrypt this data. The company manages encryption keys entirely on their own infrastructure. Which encryption option satisfies this?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK) provided with each API request. Option B is correct because Customer-Supplied Encryption Keys (CSEK) allow the customer to provide their own AES-256 encryption key with each API request to Cloud Storage. Google does not store the key; it is used only in memory to encrypt/decrypt the data and then discarded, ensuring that even Google cannot access the plaintext. This meets the compliance requirement that the customer retains exclusive control over the encryption keys.

Answer

Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS

Answer

Google-managed encryption keys (default) with restricted IAM policies

Answer

Shielded VM with confidential computing for the VMs that access the data

Question 7

A developer accidentally creates a firewall rule allowing all inbound traffic (0.0.0.0/0) on all ports to all instances in a production VPC. The rule has priority 1000. The team has an existing rule allowing only SSH (port 22) from the corporate IP range at priority 999. Which traffic is actually allowed?

Accepted Answer

SSH from corporate IP plus all traffic from all IPs — both allow rules match for their respective traffic. In Google Cloud VPC firewall rules, both allow rules are evaluated independently. The rule at priority 999 allows SSH (TCP port 22) from the corporate IP range, and the rule at priority 1000 allows all traffic from all IPs (0.0.0.0/0) on all ports. Since both rules are allow rules and match the traffic, the result is that SSH traffic from the corporate IP is allowed by the more specific rule, and all other traffic (including SSH from other IPs and all other protocols) is allowed by the broader rule. There is no implicit deny in GCP firewall rules; only explicit deny rules can block traffic, and no deny rule is present here.

Answer

Only SSH from the corporate range is allowed — the more specific rule takes precedence for all traffic

Answer

No traffic is allowed — deny rules override allow rules in GCP

Answer

All traffic from all IPs is allowed — the priority 1000 allow-all overrides the more specific priority 999 rule

Question 8

A Kubernetes namespace is shared by multiple teams. The platform team wants to ensure no single team's workloads can consume more than 10 CPU cores and 20 GB memory in that namespace. Which Kubernetes resource enforces this constraint?

Accepted Answer

ResourceQuota scoped to the namespace. ResourceQuota is the Kubernetes resource that enforces aggregate resource consumption limits at the namespace level. By configuring a ResourceQuota with spec.hard.cpu: 10 and spec.hard.memory: 20Gi, the platform team can cap the total CPU and memory usage across all Pods in the namespace, preventing any single team from exceeding those limits.

Answer

LimitRange — sets per-Pod CPU and memory limits

Answer

PodDisruptionBudget limiting the number of running Pods

Answer

Network Policy restricting namespace traffic to avoid resource contention

Question 9

A team discovers their Cloud Logging costs are unexpectedly high. The majority of costs come from verbose DEBUG-level logs from a development service in production. They want to stop storing DEBUG logs without modifying the application. What is the solution?

Accepted Answer

Create a Cloud Logging exclusion filter to discard DEBUG-level log entries from the service. Option B is correct because Cloud Logging exclusion filters allow you to discard log entries based on criteria such as severity level, log name, or resource labels before they are ingested and stored. By creating an exclusion filter that matches DEBUG-level log entries from the specific development service, you can stop storing those logs without modifying the application code. This approach directly reduces storage costs because excluded logs are not indexed or retained.

Answer

Set the application's log level to INFO — this is the only way to reduce log volume

Answer

Move the development service to a separate GCP project with a lower logging tier

Answer

Delete old DEBUG log entries manually — Cloud Logging charges for stored volume

Question 10

A team needs to run a simple containerized script that processes a batch of files once per night and exits when done — no HTTP endpoint needed. Which GCP service is most appropriate?

Accepted Answer

Cloud Run Jobs triggered by Cloud Scheduler. Cloud Run Jobs is the correct choice because it is designed for batch workloads that run to completion, with no requirement for an HTTP endpoint. It can handle long-running tasks (up to 24 hours) and can be triggered by Cloud Scheduler for nightly execution, making it ideal for processing files once per night.

Answer

Cloud Run Services with a timeout set to 24 hours

Answer

Cloud Functions with a 540-second maximum timeout

Answer

App Engine Standard with a background service

Question 11

A team runs a Kubernetes CronJob that performs nightly database cleanup. The job runs at 2 AM UTC. This morning, the team notices the job failed at 2 AM but no one was alerted. How should the team configure alerting for CronJob failures?

Accepted Answer

Create a log-based metric on CronJob failure events in Cloud Logging and an alerting policy on that metric. Option B is correct because Google Cloud Logging captures Kubernetes CronJob failure events, and you can create a log-based metric to count these failures. An alerting policy on that metric then triggers notifications when failures occur, providing a reliable, customizable alerting mechanism that does not depend on job history or restart policies.

Answer

Set `successfulJobsHistoryLimit: 0` — GKE sends an alert when the history is empty

Answer

Set `restartPolicy: Always` on the CronJob's Pod template — it will retry until success

Answer

Enable GKE's built-in CronJob alerting feature in the cluster's Notifications settings

Question 12

A team builds a GKE application that processes healthcare data. Regulatory requirements mandate that data in transit between GKE nodes must be encrypted. GKE is running on GCP. What provides encrypted node-to-node traffic within the cluster?

Accepted Answer

GCP automatically encrypts all VM-to-VM traffic in transit within its network. GCP automatically encrypts all VM-to-VM traffic in transit at the network layer, including traffic between GKE nodes, using a combination of MACsec (IEEE 802.1AE) and IPsec. This encryption is enabled by default for all traffic within a VPC and between VPCs, without any configuration required. Therefore, node-to-node traffic within a GKE cluster is already encrypted, satisfying the regulatory requirement.

Answer

GKE node traffic is unencrypted by default — mTLS must be manually configured on every Pod

Answer

Enable VPC Flow Logs — they activate encryption for logged traffic

Answer

Install a TLS termination proxy on each GKE node — it encrypts intranode traffic

Question 13

A Cloud Run service calls external third-party APIs that have rate limits. Under burst traffic, the service spawns many concurrent instances, each making direct API calls, causing rate limit errors. What GCP pattern reduces API call volume without adding infrastructure?

Accepted Answer

Cache third-party API responses in Cloud Memorystore (Redis) with appropriate TTL. Caching third-party API responses in Cloud Memorystore (Redis) with an appropriate TTL reduces the number of outbound API calls by serving cached data to multiple concurrent Cloud Run instances. This directly addresses rate-limit errors without adding new infrastructure, as Memorystore is a managed in-memory cache that integrates seamlessly with Cloud Run via a VPC connector.

Answer

Set Cloud Run max-concurrency to 1 so each instance handles one request

Answer

Enable Cloud CDN on the Cloud Run service to cache outbound requests

Answer

Migrate to Cloud Functions with a lower default concurrency limit

Question 14

A Cloud Run service requires access to a private Cloud SQL instance in the same VPC. The Cloud SQL instance is not publicly accessible. How should the Cloud Run service connect to Cloud SQL without using the Cloud SQL Auth Proxy separately?

Accepted Answer

Configure the Cloud Run service with `--add-cloudsql-instances` to connect via the built-in Auth Proxy. Option B is correct because the Cloud Run service can use the `--add-cloudsql-instances` flag, which automatically deploys a built-in Cloud SQL Auth Proxy sidecar container within the same pod. This proxy establishes a secure, encrypted connection to the private Cloud SQL instance using the instance's private IP, without requiring the instance to have a public IP or the user to manage a separate proxy. The proxy authenticates via the service account attached to the Cloud Run service, enabling seamless and secure connectivity.

Answer

Use the Cloud SQL public IP with SSL required — Cloud Run can reach public IPs

Answer

Deploy a separate Cloud SQL Auth Proxy container in the same Cloud Run service as a sidecar

Answer

Enable Serverless VPC Access connector to route Cloud Run traffic to the private Cloud SQL IP

Question 15

A Cloud Build pipeline builds a container image and pushes it to Artifact Registry. The next step needs to deploy the image to Cloud Run. The pipeline runs as the Cloud Build service account. What minimum permission does the Cloud Build SA need for the deployment step?

Accepted Answer

`roles/run.admin` and `roles/iam.serviceAccountUser` on the Cloud Run runtime service account.. The Cloud Build service account needs `roles/run.admin` to deploy services to Cloud Run, but it also requires `roles/iam.serviceAccountUser` on the Cloud Run runtime service account (the identity the Cloud Run service runs as) because the deployment step impersonates that runtime service account to create or update the service. Without the `iam.serviceAccountUser` permission, the deployment fails with a permission denied error, even if the Cloud Build SA has full Cloud Run admin rights.

Answer

`roles/run.admin` only.

Answer

`roles/owner` to ensure all necessary permissions are covered.

Answer

`roles/cloudbuild.builds.editor` on the Cloud Run project.

Question 16

You have a Cloud Run service configured with `min-instances: 0`. During load testing you notice the first request after a period of inactivity takes 3–5 seconds instead of the normal 100ms. Subsequent requests are fast. What is causing this, and what is the most cost-effective fix?

Accepted Answer

Set `min-instances: 1` to keep a warm instance running and eliminate the cold start latency.. Cold starts occur when Cloud Run needs to spin up a new container instance from zero. The 3–5 second delay is the container startup time. Setting `min-instances: 1` keeps at least one instance warm at all times, eliminating cold starts for the first request. This adds a small cost (one always-running instance) but is the most targeted fix. Increasing memory or CPU doesn't directly address cold start if the issue is container initialization time.

Answer

The Cloud Run service's container image is too large; reduce image size.

Answer

Switch from Cloud Run to GKE, which doesn't have cold starts.

Answer

Increase Cloud Run's request timeout to 30 seconds to accommodate cold starts.

Question 17

A Cloud SQL instance's disk is at 95% capacity. The application is experiencing write failures. You need to resolve this immediately with no downtime. What should you do?

Accepted Answer

Increase the disk size via the Cloud SQL console or `gcloud sql instances patch` — this occurs with no instance restart.. Option B is correct because Cloud SQL supports dynamic disk resizing without requiring an instance restart. When you increase the disk size via the console or `gcloud sql instances patch`, the change takes effect immediately, allowing the database to continue serving writes without downtime. This directly resolves the write failures caused by disk-full conditions.

Answer

Take a snapshot of the instance, create a new larger instance from the snapshot, then update the connection string.

Answer

Delete old database tables to free up space.

Answer

Switch the instance to SSD storage, which has higher throughput and allows more writes.

Question 18

You deploy a Cloud Function (gen1) that calls an external API. During testing you find the function times out after 60 seconds even though you set `--timeout=540`. You also notice the function logs show execution completing in 45 seconds before the timeout. What is the most likely cause of the external timeout?

Accepted Answer

The HTTP client library used in the function has a default 60-second socket/connection timeout.. Option B is correct because the external API call is timing out due to the HTTP client library's default socket/connection timeout, which is often set to 60 seconds. Even though the Cloud Function's overall timeout is configured to 540 seconds, the HTTP request itself has its own timeout that expires before the function completes. The function logs show execution finishing in 45 seconds, indicating the function code completes, but the external API call fails silently or the response is not received within the client's timeout window.

Answer

Cloud Functions gen1 has a hard maximum timeout of 60 seconds regardless of configuration.

Answer

Cloud VPC restricts outbound connections to 60 seconds.

Answer

The function's service account lacks permission to make outbound HTTP calls.

Question 19

A Cloud Storage bucket contains sensitive PII data. You need to ensure that objects in this bucket are encrypted using a key that your security team controls, and that the key can be revoked if needed to render all data inaccessible. Which encryption option should you use?

Accepted Answer

Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS.. Option B is correct because Customer-Managed Encryption Keys (CMEK) allow you to control and manage the key used for encrypting Cloud Storage objects via Cloud KMS. This enables key revocation, which immediately renders all data encrypted with that key inaccessible, meeting the security team's requirement for revocable control.

Answer

Use Google-managed encryption keys (default).

Answer

Enable Cloud Storage's built-in server-side encryption with AES-256.

Answer

Use Customer-Supplied Encryption Keys (CSEK) by embedding the key in each API request.

Question 20

A team runs `gcloud organizations list` and sees no output even though they know their company has a GCP organization. What is the most likely cause, and how should they resolve it?

Accepted Answer

The user lacks org-level IAM permissions such as Organization Viewer.. The `gcloud organizations list` command retrieves organizations from the GCP Resource Manager API. If no output is returned despite the organization existing, the most likely cause is that the authenticated user lacks the `resourcemanager.organizations.get` permission, which is granted by roles like Organization Viewer (`roles/resourcemanager.organizationViewer`) or Organization Administrator (`roles/resourcemanager.organizationAdmin`). Without this IAM permission at the organization level, the API call returns an empty list rather than an error, which is a common source of confusion.

Answer

The organization does not exist yet; run `gcloud organizations create` to create it.

Answer

The gcloud SDK does not support the organizations command; use the Cloud Console instead.

Answer

The project must be linked to the organization using `gcloud projects move`.