Google ACE Practice Exam 4 — 20 Questions

Question 1

A financial trading platform must support globally distributed, strongly consistent SQL transactions at thousands of writes per second, with no downtime for planned maintenance. Which GCP database service meets all these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Spanner. Cloud Spanner is the only GCP database service that provides globally distributed, strongly consistent SQL transactions with horizontal scaling, supporting thousands of writes per second. It uses synchronous replication across regions and TrueTime-based clock synchronization to ensure external consistency, while also offering 99.999% availability with no planned downtime for maintenance.

Answer

Cloud SQL with synchronous read replicas

Answer

Cloud Bigtable

Answer

Cloud Firestore

Question 2

An e-commerce platform sees a 20x traffic spike every Black Friday. The rest of the year traffic is low and stable. The team wants to minimize costs during normal periods while handling the annual peak without manual intervention. Which architecture achieves this?

Accepted Answer

Managed instance group with autoscaling + scheduled scaling pre-warming before Black Friday. It combines managed instance group autoscaling for normal low-cost operation with scheduled scaling to pre-warm capacity before the Black Friday spike, ensuring seamless handling of the 20x traffic surge without manual intervention. This approach uses the 'autoscaler' and 'scheduled scaling' features in Google Cloud to dynamically adjust resources based on load, while pre-warming prevents cold-start latency during the peak.

Answer

Pre-provision 20x capacity year-round to guarantee Black Friday performance

Answer

Deploy on Cloud SQL — it scales compute automatically for traffic spikes

Answer

Add 20 manual VMs on Black Friday and delete them afterward each year

Question 3

A team's GKE application is running out of memory due to a memory leak. Pods are restarting with OOMKilled status. As an immediate measure before a code fix is available, what kubectl action provides the most insight into which container is leaking?

Accepted Answer

kubectl top pods --containers -n [NAMESPACE]. `kubectl top pods --containers` shows per-container CPU and memory usage for each pod in the namespace. This allows you to identify which specific container within a pod is consuming excessive memory and triggering the OOMKilled status, even before a code fix is deployed. It provides immediate, real-time insight into resource consumption at the container level, which is essential for diagnosing a memory leak in a multi-container pod.

Answer

kubectl get events --field-selector=reason=OOMKilling

Answer

kubectl delete pod [POD_NAME] -- force=true to clear the memory leak

Answer

gcloud container clusters describe [CLUSTER] --memory-usage

Question 4

A company requires that all service account keys be automatically rotated every 90 days. Which two steps should the administrator take to enforce this? (Choose two.)

Accepted Answer

Use the Service Account API to create keys with a custom expiration time.. The Service Account API allows creating keys with a custom expiration time, which enforces automatic rotation by ensuring keys are invalid after 90 days. Option E is correct because a Cloud Function can monitor key age and delete keys older than 90 days, providing a programmatic enforcement mechanism. Both approaches ensure keys are rotated automatically without manual intervention.

Answer

Enable the Service Account Key Rotator in the Google Cloud Console.

Answer

Use IAM to set a condition that keys must have an expiration date.

Answer

Use an Organization Policy to disable service account key creation.

Question 5

An organization with multiple teams needs to provision separate, isolated environments (e.g., development, test, production) while sharing common services like Cloud NAT and VPC firewall rules. Which VPC networking pattern is most suitable?

Accepted Answer

Shared VPC (XPN). Shared VPC (XPN) allows an organization to create a single, centrally managed VPC network that hosts common services like Cloud NAT and firewall rules, while enabling multiple project teams to provision their own isolated environments (dev, test, prod) within that same VPC. This pattern meets the requirement for separate, isolated environments with shared services without needing individual VPCs for each team.

Answer

Network Service Tiers (Premium vs Standard)

Answer

VPC Network Peering between team VPCs

Answer

Single VPC with per-team firewall rules

Question 6

A GKE Deployment must be updated to a new container image version with zero downtime — old Pods should be replaced gradually, not all at once. Which update strategy should be configured?

Accepted Answer

RollingUpdate strategy. The RollingUpdate strategy is correct because it gradually replaces old Pods with new ones while keeping the Deployment available, ensuring zero downtime. By default, it uses a `maxSurge` of 25% and `maxUnavailable` of 25%, allowing a controlled, incremental rollout that matches the requirement of replacing Pods gradually rather than all at once.

Answer

Recreate strategy

Answer

Blue-green deployment using a separate Deployment and Service selector swap

Answer

Canary deployment with a traffic-splitting ingress

Question 7

A public API receives global traffic but has been targeted by both volumetric DDoS attacks and SQL injection attempts in HTTP request parameters. Which single GCP service provides protection against both threats?

Accepted Answer

Cloud Armor security policies on the load balancer. Cloud Armor security policies, when attached to a Google Cloud HTTPS Load Balancer, provide both Layer 7 DDoS protection (via pre-configured WAF rules like 'modsecurity-crs' to block SQL injection) and volumetric DDoS defense (via rate limiting and adaptive protection). This makes it the single GCP service that directly addresses both threats mentioned in the question.

Answer

VPC firewall rules with deny rules for known attacker IPs

Answer

Cloud NAT to hide backend IP addresses

Answer

Identity-Aware Proxy (IAP) to require authentication before accessing the API

Question 8

Your application exposes a REST API that external partners consume. You need rate limiting per partner (API key), usage analytics, and developer portal for onboarding. Traffic is currently 1,000 requests/day but expected to grow to 10M/day within a year. Which GCP service best fits these requirements?

Accepted Answer

Apigee API Management. Apigee API Management is correct because it provides built-in rate limiting per API key (via quota policies), detailed analytics dashboards for usage tracking, and a developer portal for partner onboarding and key management. Unlike simpler API gateways, Apigee is designed for enterprise-grade API management at scale, handling growth from 1,000 to 10M requests/day with features like monetization, traffic management, and security policies.

Answer

Cloud Endpoints with Extensible Service Proxy

Answer

Cloud Armor with rate limiting rules

Answer

API Gateway with a backend Cloud Run service

Question 9

A team needs to export all Cloud Logging entries from a production GCP project to a BigQuery dataset for long-term analysis and compliance. The export must be near-real-time and include future log entries automatically. Which approach achieves this?

Accepted Answer

Create a log sink (Log Router) that routes all logs from the project to the BigQuery dataset. A log sink (Log Router) in Cloud Logging can be configured to route log entries in near-real-time to a BigQuery dataset. This approach automatically includes all future log entries without requiring any scheduled jobs or manual intervention, making it ideal for long-term analysis and compliance.

Answer

Schedule a daily Cloud Function to query the Logging API and write results to BigQuery

Answer

Use BigQuery Data Transfer Service to pull logs from Cloud Logging on a schedule

Answer

Enable VPC Flow Logs and stream them directly to BigQuery

Question 10

A platform engineer is deploying a Kubernetes Job that processes a batch of records. The Job should run 10 parallel workers, each processing a subset of records, and complete when all workers finish successfully. Which Job spec configuration achieves this?

Accepted Answer

Set parallelism: 10 and completions: 10 in the Job spec. In Kubernetes, a Job's `parallelism` field specifies the number of Pods that can run concurrently, and `completions` specifies the total number of successful Pod completions required for the Job to be considered finished. Setting both to 10 ensures exactly 10 Pods run in parallel, each processing a subset of records, and the Job completes only when all 10 have succeeded.

Answer

Set replicas: 10 in the Job spec

Answer

Create 10 separate Job objects — one per worker

Answer

Set concurrency: 10 in the Job spec

Question 11

A Cloud Function must execute automatically every time a new object is written to a specific Cloud Storage bucket. Which trigger type should be configured for the function?

Accepted Answer

Cloud Storage trigger (object finalized event). The Cloud Storage trigger (object finalized event) is the correct choice because Cloud Functions natively supports Cloud Storage events via the `google.storage.object.finalize` event type, which fires when a new object is created or an existing object is overwritten in a bucket. This trigger automatically invokes the function without requiring any intermediary service, directly binding the function to the bucket's notification system.

Answer

HTTP trigger

Answer

Pub/Sub trigger

Answer

Cloud Scheduler trigger

Question 12

A DevOps team uses Terraform to manage GCP infrastructure and wants to store Terraform state in a shared location that all team members can access securely, with state locking to prevent concurrent modifications. Which backend configuration achieves this?

Accepted Answer

gcs backend storing state in a Cloud Storage bucket. The `gcs` backend is the correct choice because it stores Terraform state in a Google Cloud Storage bucket, which provides secure, shared access via IAM policies and supports state locking natively through object versioning and write-preconditions. This ensures that only one team member can modify the state at a time, preventing conflicts and corruption.

Answer

gcp backend storing state in a BigQuery table

Answer

remote backend connected to a Cloud SQL database

Answer

local backend with a path shared over Cloud Filestore

Question 13

You want to use Kustomize to manage environment-specific Kubernetes configurations (dev, staging, prod) from a single base set of manifests. How does Kustomize achieve environment customization without duplicating YAML files?

Accepted Answer

Kustomize uses overlays that patch a shared base: environment-specific differences are expressed as patches without duplicating base manifests.. Kustomize uses a base set of Kubernetes manifests and applies environment-specific overlays that contain patches. These patches modify only the differences (e.g., replicas, image tags, namespaces) without copying or altering the original base YAML files. This approach avoids duplication and keeps the base clean, with each overlay representing a distinct environment.

Answer

Kustomize duplicates all YAML files per environment, then applies find-and-replace on values.

Answer

Kustomize uses Helm charts with values files per environment for templating.

Answer

Kustomize requires a separate Git branch per environment where manifests are committed.

Question 14

You need to deploy a new version of an App Engine standard environment application. The new version should receive 10% of traffic while the current version continues to receive 90%. Which command achieves this?

Accepted Answer

`gcloud app services set-traffic default --splits v1=0.9,v2=0.1`. The `gcloud app services set-traffic` command explicitly splits traffic between versions of an App Engine service. By specifying `--splits v1=0.9,v2=0.1`, you direct 90% of requests to version v1 and 10% to version v2, without deploying a new version or promoting it. This is the standard method for gradual traffic migration in App Engine standard environment.

Answer

`gcloud app deploy --version=v2 --no-promote`

Answer

`gcloud app versions migrate v2`

Answer

`gcloud app deploy --version=v2 --promote --stop-previous-version`

Question 15

You have an Artifact Registry repository for Python packages (`format: python`). A developer needs to publish a new Python package to this repository. Which tool and configuration allows them to publish?

Accepted Answer

Use `twine upload` with the Artifact Registry Python repository URL as the repository target.. B is correct because `twine` is the standard tool for uploading Python packages to package indices, and Artifact Registry's Python repositories are compatible with the PyPI API. By specifying the Artifact Registry repository URL as the `--repository-url` target in `twine upload`, the developer can authenticate via a service account or OAuth token and publish the package directly.

Answer

Use `pip install` pointing to the Artifact Registry URL to upload the package.

Answer

Use `docker push` to push the Python package as a container layer.

Answer

Use `gsutil cp` to copy the wheel file to the Artifact Registry bucket.

Question 16

A developer needs to forward traffic from their local port 5432 to a PostgreSQL service running in GKE on port 5432, to test database queries locally without exposing the database externally. Which kubectl command achieves this?

Accepted Answer

kubectl port-forward svc/postgres-service 5432:5432. `kubectl port-forward` creates a local tunnel from port 5432 on the developer's machine to the specified service's port 5432 inside the GKE cluster. This allows the developer to connect to the PostgreSQL service as if it were running locally, without exposing it to the internet via a LoadBalancer or Ingress.

Answer

kubectl expose pod postgres-pod --type=LoadBalancer --port=5432

Answer

kubectl tunnel --local=5432 --remote=postgres-service:5432

Answer

gcloud container ssh postgres-pod --port-forward=5432:5432

Question 17

A Cloud CDN cache is serving stale content after a website update. New files were deployed to Cloud Storage but CDN is still serving the old versions to some users. What is the fastest way to force CDN to serve the updated content?

Accepted Answer

Run a CDN cache invalidation for the affected URL paths. Cloud CDN supports cache invalidation, which immediately removes cached objects from edge caches for specified URL paths. This forces the CDN to fetch fresh content from the origin (Cloud Storage) on the next request, providing the fastest way to serve updated content without waiting for TTL expiry.

Answer

Wait for the CDN TTL to expire — cached content automatically refreshes

Answer

Delete and recreate the Cloud Storage bucket — CDN will detect the new bucket as a fresh origin

Answer

Disable Cloud CDN temporarily — all users will hit the origin until CDN is re-enabled

Question 18

You need to monitor a Cloud Run service for errors and receive a PagerDuty notification when the number of 5xx errors exceeds 10 in any 5-minute window. Which Cloud Monitoring feature should you use?

Accepted Answer

Create a log-based metric on Cloud Run error logs, then create an alerting policy on that metric with a PagerDuty notification channel.. A log-based metric extracts a numeric counter from Cloud Run error logs (e.g., HTTP 5xx status codes). An alerting policy can then evaluate that metric over a sliding 5-minute window, triggering a PagerDuty notification via a configured notification channel when the count exceeds 10. This is the native, serverless approach that requires no additional infrastructure.

Answer

Configure Cloud Run to send error emails directly to the PagerDuty email integration.

Answer

Use Cloud Pub/Sub to stream Cloud Run logs to a custom application that pages PagerDuty.

Answer

Enable Cloud Run's built-in alerting feature in the service configuration.

Question 19

A company is deploying a stateful application on Google Kubernetes Engine (GKE) that requires persistent storage. Each pod needs its own dedicated persistent disk that is not shared. Which Kubernetes resource should be used to manage the deployment?

Accepted Answer

StatefulSet with volumeClaimTemplates. A StatefulSet with volumeClaimTemplates is designed for stateful applications where each pod requires its own dedicated PersistentVolume (PV) that is not shared. The volumeClaimTemplates automatically generate a unique PersistentVolumeClaim (PVC) for each pod replica, ensuring each pod gets a separate, stable persistent disk that persists across rescheduling. This matches the requirement for a stateful application on GKE where pods need dedicated, non-shared storage.

Answer

Job with PersistentVolume

Answer

DaemonSet with hostPath volumes

Answer

Deployment with PersistentVolumeClaim template

Question 20

Refer to the exhibit. A team has this IAM policy on a Cloud Storage bucket. The bucket contains sensitive data. Which action should the team take immediately?

Accepted Answer

Remove allUsers from the objectViewer binding.. The IAM policy grants `allUsers` (anyone on the internet) the `objectViewer` role on the bucket, which allows unauthenticated read access to all objects. Since the bucket contains sensitive data, this is a critical security exposure that must be removed immediately by deleting the `allUsers` principal from the binding.

Answer

Add a condition to the objectViewer binding to restrict access.

Answer

Remove the entire objectViewer binding.

Answer

Change the objectViewer role to objectAdmin for allUsers.