Google ACE Practice Exam 3 — 20 Questions

Question 1

An application architect is comparing Cloud SQL (PostgreSQL) and Cloud Spanner for a new global e-commerce platform. The platform must serve customers on three continents with <50ms latency for reads and strong consistency for inventory updates. Which service best fits?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Spanner multi-region configuration. Cloud Spanner multi-region configuration is the correct choice because it provides strong global consistency with <50ms read latency across continents, which is essential for an e-commerce platform requiring real-time inventory updates. Spanner uses TrueTime and Paxos-based replication to ensure ACID transactions globally, meeting both the latency and consistency requirements simultaneously.

Answer

Cloud SQL with one primary instance and cross-region read replicas

Answer

Cloud Firestore in multi-region mode

Answer

Cloud SQL with Cloud Memorystore caching layer for reads

Question 2

A regulated financial company must ensure that all GCP API calls made by employees are logged with full request and response payloads for audit purposes. Which combination of Cloud Audit Log types captures this?

Accepted Answer

Admin Activity logs + Data Access logs (DATA_READ and DATA_WRITE). Admin Activity logs capture administrative actions like creating or modifying resources, but not the data within API calls. Data Access logs (DATA_READ and DATA_WRITE) capture the request and response payloads for API calls that read or write data, which is required for full audit logging. Together, they cover both the administrative context and the data-level payloads mandated for regulated financial companies.

Answer

Admin Activity logs only

Answer

VPC Flow Logs + Cloud Monitoring metrics

Answer

System event logs + Data Access logs

Question 3

A team is creating a new GCP project for a sensitive workload. They need to ensure the project is linked to the correct billing account, placed in the correct folder, and has specific APIs enabled — all reproducibly. They want to automate this via Infrastructure as Code. Which approach is most appropriate?

Accepted Answer

Use Terraform with `google_project`, `google_project_service`, and billing account linkage resources.. Terraform is an Infrastructure as Code (IaC) tool that allows you to define the entire project setup—including folder placement, billing account linkage, and API enablement—in declarative configuration files. This ensures reproducibility, version control, and automation, which aligns with the requirement for a sensitive workload that must be set up consistently every time.

Answer

Use a gcloud script with `gcloud projects create`, `gcloud beta billing projects link`, and `gcloud services enable`.

Answer

Use Cloud Console to manually create the project, then document the steps in a runbook.

Answer

Use Cloud Deployment Manager with a Python template to create the project.

Question 4

A developer wants to see the details of a specific GKE Pod including its events, container status, and resource requests/limits. Which kubectl command provides this?

Accepted Answer

kubectl describe pod [POD_NAME]. B is correct because `kubectl describe pod` provides a comprehensive view of a pod, including its events (e.g., scheduling, pulling images), container status (e.g., waiting, running, terminated with reasons), and resource requests/limits (CPU and memory). This command aggregates detailed information from the Kubernetes API, making it the standard tool for debugging pod issues.

Answer

kubectl get pod [POD_NAME] -o wide

Answer

kubectl inspect pod [POD_NAME]

Answer

kubectl get pod [POD_NAME] -o json

Question 5

A mobile app needs a managed database to store user profiles with flexible nested structures that evolve frequently — new fields are added without schema migrations. Which GCP database service is most appropriate?

Accepted Answer

Cloud Firestore. Cloud Firestore is a NoSQL document database that supports flexible, nested data structures and automatically handles schema evolution. New fields can be added to documents at any time without requiring migrations, making it ideal for user profiles that change frequently. It also provides real-time synchronization and offline support, which are common requirements for mobile apps.

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Bigtable

Answer

Cloud Spanner

Question 6

You have pushed a new container image to Artifact Registry. The image is tagged `us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0`. You need to deploy this specific image version to Cloud Run in production. Which command deploys this exact image?

Accepted Answer

`gcloud run deploy app --image us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0 --region us-central1`. The `gcloud run deploy` command with the `--image` flag explicitly specifies the exact container image URI from Artifact Registry, including the tag `v2.0`. This ensures that Cloud Run deploys that precise version of the image, and the `--region` flag targets the correct regional service. The full URI is required because Cloud Run must pull the image from the exact repository path and tag.

Answer

`gcloud run services update app --tag v2.0 --region us-central1`

Answer

`docker push us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0` followed by a Cloud Run auto-deploy.

Answer

`gcloud run deploy app --image app:v2.0 --region us-central1`

Question 7

You need to deploy a containerized application to GKE that stores user session data. The application has 3 replicas. Session data must not be lost if a replica is restarted. All replicas share the same session store. Which architecture handles this correctly?

Accepted Answer

Store sessions in Cloud Memorystore (Redis) shared by all replicas.. Cloud Memorystore (Redis) provides a centralized, persistent, and highly available session store that all replicas can access. This ensures session data survives pod restarts and is shared across all replicas, meeting the requirement for no data loss and shared access.

Answer

Store sessions in each pod's memory; use session affinity on the load balancer to route users to the same pod.

Answer

Use an emptyDir volume shared between replicas for session storage.

Answer

Store sessions in a Cloud SQL table with a connection pool per replica.

Question 8

An organization has a policy requiring all new GCP projects to be created within specific folders and linked to approved billing accounts only. Which combination of features enforces this at scale?

Accepted Answer

Organization policies to restrict allowed billing accounts + granting Project Creator role only at approved folder level. It combines two enforcement mechanisms: Organization policies (specifically the `constraints/compute.restrictBillingAccounts` constraint) to limit which billing accounts can be attached to projects, and granting the Project Creator role (`roles/resourcemanager.projectCreator`) only at the folder level (not the organization level). This ensures that new projects can only be created within the approved folders and must use an approved billing account, enforcing the policy at scale across the entire organization.

Answer

IAM deny policies on the organization + VPC Service Controls

Answer

Cloud Asset Inventory alerts + manual review of new projects

Answer

Requiring multi-factor authentication for all project creators

Question 9

You are on-call and receive a PagerDuty alert: `Cloud SQL CPU utilization > 90% for 15 minutes`. Checking `pg_stat_activity`, you find 200 connections with many in `idle` state and 15 queries running for > 5 minutes each. The long queries are table scans on a 500 GB unindexed table. What should you do IMMEDIATELY to restore service, and what is the root cause fix?

Accepted Answer

Terminate the long-running table scan queries immediately, then add indexes on the frequently queried columns as the root cause fix.. Terminating the long-running table scans immediately stops the CPU-intensive queries, restoring service. The root cause is the missing index on the 500 GB table, which forces sequential scans and high CPU usage. Adding indexes on frequently queried columns eliminates the need for full table scans, preventing recurrence.

Answer

Restart the Cloud SQL instance to clear all connections and queries.

Answer

Increase Cloud SQL's CPU to a larger machine type to handle the current load.

Answer

Reduce `max_connections` to prevent new connections from adding load.

Question 10

A security team discovers that a service account key was accidentally committed to a public GitHub repository 48 hours ago. What should be the immediate steps to remediate this incident?

Accepted Answer

Delete the leaked key immediately, audit Cloud Audit Logs for unauthorized activity using the key, then create a new key or switch to keyless authentication. The immediate priority is to revoke the compromised key's access by deleting it, which invalidates it instantly. Auditing Cloud Audit Logs is essential to detect any unauthorized usage that occurred during the 48-hour exposure window. Finally, creating a new key or switching to keyless authentication (e.g., workload identity federation) restores secure access without relying on long-lived static credentials.

Answer

Rotate the service account key to generate a new one, keeping the old key active briefly for transition

Answer

Change the service account's display name and email to invalidate the leaked key

Answer

Remove all IAM roles from the service account to deny all actions until the investigation completes

Question 11

A compliance archive stores legal documents accessed at most once per quarter. Which Cloud Storage class minimizes storage cost while meeting that access pattern?

Accepted Answer

Coldline. Coldline storage is designed for data accessed less than once per quarter, offering lower storage costs than Standard or Nearline while still providing millisecond access when needed. For a compliance archive accessed at most once per quarter, Coldline minimizes storage cost without incurring the higher retrieval fees or minimum storage durations of Archive storage.

Answer

Standard

Answer

Nearline

Answer

Archive

Question 12

A team deploys a containerized service to Cloud Run. After deployment, requests are timing out after 60 seconds. The service sometimes needs 3 minutes to process certain long-running requests. What should the team adjust?

Accepted Answer

Increase the Cloud Run request timeout to at least 180 seconds. Cloud Run has a default request timeout of 60 seconds. Since the service requires up to 3 minutes (180 seconds) for certain long-running requests, the timeout must be increased to at least 180 seconds. This is configured via the `--timeout` flag or the `timeout_seconds` field in the YAML configuration, and the maximum allowed value is 60 minutes (3600 seconds).

Answer

Increase the minimum number of instances to reduce cold starts

Answer

Set concurrency to 1 to ensure each instance handles only one request at a time

Answer

Switch to Cloud Run Jobs instead of Cloud Run Services

Question 13

A team's CI/CD pipeline authenticates to GCP using Application Default Credentials (ADC). The pipeline runs on a GCE VM with a service account attached. Which credential source does the ADC use when running on a GCE VM?

Accepted Answer

The VM's attached service account credentials via the instance metadata server. On a GCE VM, Application Default Credentials (ADC) automatically uses the credentials from the VM's attached service account by querying the instance metadata server at the link-local address 169.254.169.254. This is the default behavior when no environment variable or other credential source is explicitly configured, making option B correct.

Answer

The GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to a JSON key file

Answer

The developer's personal Google account used during `gcloud auth login`

Answer

A randomly selected service account from the project's service accounts list

Question 14

A GKE Deployment runs a web application with 6 replicas across a 3-node cluster. To ensure no two replicas land on the same node (maximizing availability), which Pod spec configuration should be applied?

Accepted Answer

Set podAntiAffinity with requiredDuringSchedulingIgnoredDuringExecution and topologyKey: kubernetes.io/hostname. `podAntiAffinity` with `requiredDuringSchedulingIgnoredDuringExecution` and `topologyKey: kubernetes.io/hostname` forces the scheduler to place each replica on a different node. This ensures that no two pods of the same Deployment run on the same Kubernetes node, maximizing availability by preventing a single node failure from taking down more than one replica.

Answer

Set podAffinity with requiredDuringSchedulingIgnoredDuringExecution and topologyKey: kubernetes.io/hostname

Answer

Set topologySpreadConstraints with maxSkew: 1 and topologyKey: kubernetes.io/hostname

Answer

Set nodeSelector to a specific node for each replica

Question 15

A team discovers their Cloud Logging costs are unexpectedly high. The majority of costs come from verbose DEBUG-level logs from a development service in production. They want to stop storing DEBUG logs without modifying the application. What is the solution?

Accepted Answer

Create a Cloud Logging exclusion filter to discard DEBUG-level log entries from the service. Cloud Logging exclusion filters allow you to discard log entries based on criteria such as severity level, log name, or resource labels before they are ingested and stored. By creating an exclusion filter that matches DEBUG-level log entries from the specific development service, you can stop storing those logs without modifying the application code. This approach directly reduces storage costs because excluded logs are not indexed or retained.

Answer

Set the application's log level to INFO — this is the only way to reduce log volume

Answer

Move the development service to a separate GCP project with a lower logging tier

Answer

Delete old DEBUG log entries manually — Cloud Logging charges for stored volume

Question 16

Refer to the exhibit. A user tries to delete the disk 'my-disk' but receives an error. Based on the exhibit, what is the most likely cause?

Accepted Answer

The disk is still attached to an instance.. A disk cannot be deleted while it is attached to a running or stopped instance. In Google Cloud, you must first detach the disk from the instance before deletion. The error message indicates the disk is in use, and the exhibit confirms it is attached to an instance.

Answer

The disk is being used by a snapshot.

Answer

The disk size must be 0 to delete.

Answer

The disk is not in the correct project.

Question 17

A web application uses a managed instance group. Traffic spikes sharply between 9 AM and 5 PM and drops to near zero overnight. Which autoscaling metric most directly triggers scale-out before user experience degrades?

Accepted Answer

HTTP load balancing serving capacity (requests per second per instance). HTTP load balancing serving capacity (requests per second per instance) is the most direct metric because it measures the actual user-facing load on each instance. When traffic spikes, this metric rises immediately, triggering scale-out before instances become saturated and response times degrade. CPU utilization can lag behind the spike due to queuing or async processing, making it less responsive for sharp traffic patterns.

Answer

Average CPU utilization of instances in the group

Answer

Pub/Sub subscription queue depth

Answer

Disk I/O throughput

Question 18

Your GKE application's pods are being evicted frequently during periods of high traffic. You notice that pods without resource requests are being evicted first. The nodes are running at ~85% memory utilization. What should you do to reduce pod eviction?

Accepted Answer

Set memory requests and limits for all pods to match their actual memory usage.. Setting memory requests and limits for all pods to match their actual memory usage ensures that the Kubernetes scheduler can accurately allocate resources and make informed scheduling decisions. Without requests, pods are treated as BestEffort QoS class, making them the first candidates for eviction under memory pressure (when nodes exceed ~85% utilization). By defining requests, pods are classified as Burstable or Guaranteed, which gives them higher priority during eviction and prevents unnecessary disruptions.

Answer

Increase the node machine type to have more memory.

Answer

Configure pod disruption budgets (PDBs) to prevent eviction.

Answer

Enable cluster autoscaler to add nodes before memory pressure occurs.

Question 19

A team runs a Kubernetes CronJob that performs nightly database cleanup. The job runs at 2 AM UTC. This morning, the team notices the job failed at 2 AM but no one was alerted. How should the team configure alerting for CronJob failures?

Accepted Answer

Create a log-based metric on CronJob failure events in Cloud Logging and an alerting policy on that metric. Google Cloud Logging captures Kubernetes CronJob failure events, and you can create a log-based metric to count these failures. An alerting policy on that metric then triggers notifications when failures occur, providing a reliable, customizable alerting mechanism that does not depend on job history or restart policies.

Answer

Set `successfulJobsHistoryLimit: 0` — GKE sends an alert when the history is empty

Answer

Set `restartPolicy: Always` on the CronJob's Pod template — it will retry until success

Answer

Enable GKE's built-in CronJob alerting feature in the cluster's Notifications settings

Question 20

You are planning a GCP network for a company with offices in three regions: `us-central1`, `europe-west1`, and `asia-east1`. All three regions must communicate with each other, and traffic must NOT traverse the public internet. Each region has its own subnet. Which network design achieves this with the least management overhead?

Accepted Answer

Use a single global VPC with subnets in each region; traffic between subnets stays on Google's private network.. A single global VPC allows you to create subnets in multiple regions, and traffic between those subnets stays on Google's private backbone network without traversing the public internet. This design requires no additional connectivity configuration, peering, or VPN tunnels, making it the simplest to manage while meeting all requirements.

Answer

Create three separate VPCs (one per region) and connect them with VPC Network Peering.

Answer

Set up Cloud VPN tunnels between each pair of regions.

Answer

Use Cloud Interconnect dedicated connections in each region and configure BGP routing between them.