Google ACE Practice Exam 4 — 20 Questions

Question 1

A Cloud Run service needs to read secrets from Secret Manager. The service is deployed with a custom runtime service account. Which IAM role should be granted to the runtime service account, and on which resource?

Accepted Answer

Grant `roles/secretmanager.secretAccessor` on the specific secret resource.. The principle of least privilege dictates that the runtime service account should only have the minimum permissions required to access the specific secret. The `roles/secretmanager.secretAccessor` role provides exactly the `secretmanager.versions.access` permission needed to read the secret value, and granting it on the specific secret resource (rather than the project) scopes the permission to that secret only, preventing broader access.

Answer

Grant `roles/secretmanager.admin` on the project.

Answer

Grant `roles/viewer` on the project.

Answer

Grant `roles/secretmanager.secretVersionManager` on the secret.

Question 2

You are reviewing a GCP project's IAM policy and find that the `allUsers` principal has `storage.objectViewer` on a Cloud Storage bucket. The bucket contains internal documentation. What are the security implications, and what should you do?

Accepted Answer

Any person on the internet can read the internal documents; remove the `allUsers` binding immediately and restrict access to authorized identities.. Option B is correct because granting `storage.objectViewer` to `allUsers` makes the bucket's objects publicly readable by anyone on the internet, including anonymous users. This violates the principle of least privilege and exposes internal documentation to unauthorized access. The immediate remediation is to remove the `allUsers` binding and replace it with specific, authenticated identities (e.g., service accounts or Google Groups) that require access.

Answer

This is acceptable if the bucket has Uniform Bucket-Level Access enabled; UBLA encrypts the data.

Answer

This is a read-only permission so it's acceptable — attackers can't modify the documents.

Answer

Enable Cloud Armor on the bucket to restrict access to your corporate IP range.

Question 3

A developer needs to test a Cloud Run service locally before deploying it to GCP. The service is packaged as a Docker container. Which tool allows them to run and test the container locally in a way that closely mimics the Cloud Run execution environment?

Accepted Answer

Run the container using `docker run -p 8080:8080 IMAGE` with the required environment variables.. Option A is correct because `docker run -p 8080:8080 IMAGE` with the required environment variables directly runs the containerized Cloud Run service on your local machine, mapping port 8080 to the container's port 8080 (the default Cloud Run listens on). This approach closely mimics the Cloud Run execution environment because Cloud Run also runs containers in a Docker-like runtime, and you can replicate environment variables, memory limits, and concurrency settings locally for accurate testing before deployment.

Answer

Deploy the service to a staging Cloud Run environment using `gcloud run deploy --no-traffic`.

Answer

Use `gcloud run services describe` to simulate a local run.

Answer

Use Cloud Shell to run the container since Cloud Shell has Docker installed.

Question 4

You need to store application configuration data that changes infrequently (e.g., feature flags, database connection strings). Multiple services need to read this configuration at startup, and values must never appear in application code or container images. Updates to configuration should not require redeploying services. Which GCP service is most appropriate?

Accepted Answer

Use Cloud Secret Manager to store and retrieve configuration at runtime.. Secret Manager is designed exactly for storing sensitive configuration (connection strings, API keys, feature flags with sensitive values). Secrets can be accessed via API or SDK at runtime without being embedded in code or images. Secret Manager supports versioning, automatic rotation triggers, and IAM-controlled access. When a secret value changes, services can be configured to reload it without redeployment using Secret Manager's notification integration.

Answer

Store configuration in environment variables set at deployment time.

Answer

Store configuration in a Cloud Storage bucket readable by all services.

Answer

Use Cloud Firestore to store configuration documents that services read on startup.

Question 5

You are managing a GKE cluster that runs a mixed workload: latency-sensitive web services and batch data processing jobs. The batch jobs run for hours and consume significant CPU/memory. During batch peaks, the web services experience CPU throttling. What is the best configuration to prevent batch jobs from impacting web service latency?

Accepted Answer

Assign web service pods a higher PriorityClass and run batch jobs on a separate node pool with taints.. Option B is correct because it uses PriorityClass to ensure web service pods are scheduled and maintained over batch pods during resource contention, while placing batch jobs on a separate node pool with taints isolates their resource consumption. This prevents batch jobs from causing CPU throttling on latency-sensitive web services by guaranteeing that web pods have priority access to CPU cycles and that batch workloads do not share nodes with web pods.

Answer

Set CPU requests and limits on batch job pods to be lower than web service pods.

Answer

Use Horizontal Pod Autoscaler for batch jobs so they scale down during peak web traffic.

Answer

Enable Cluster Autoscaler so new nodes are added when batch jobs demand more resources.

Question 6

You need to ensure that a Cloud Run service can only be invoked by specific Cloud Scheduler jobs and not from the public internet, while still receiving HTTP requests. The Cloud Run service currently allows unauthenticated invocations. What configuration changes are required?

Accepted Answer

Disable unauthenticated invocations on the Cloud Run service, grant `roles/run.invoker` to the Scheduler SA, and configure Scheduler to use OIDC authentication.. Option B is correct because Cloud Run services that require authentication must have unauthenticated invocations disabled, and the Cloud Scheduler service account must be granted the `roles/run.invoker` role. Additionally, Cloud Scheduler must be configured to use OIDC authentication, which allows it to present an identity token signed by Google to the Cloud Run service, ensuring only authorized scheduler jobs can invoke the service.

Answer

Add a Cloud Armor security policy to the Cloud Run service blocking all IPs except Cloud Scheduler.

Answer

Deploy the Cloud Run service in a VPC and use a VPC firewall rule to block all traffic except Cloud Scheduler.

Answer

Add a secret header to Cloud Scheduler requests and validate it in the Cloud Run application code.

Question 7

You have a GCP organization with hundreds of projects. You need to find all projects that have the `compute.googleapis.com` API enabled. Which approach provides the most efficient way to query this across all projects?

Accepted Answer

Use Cloud Asset Inventory to search for `serviceusage.googleapis.com/Service` assets with state `ENABLED` and name matching `compute.googleapis.com`.. Cloud Asset Inventory provides a scalable, API-driven way to query resources across all projects in an organization without iterating over each project. By searching for `serviceusage.googleapis.com/Service` assets with `state: ENABLED` and `name: compute.googleapis.com`, you can retrieve the exact list of projects with the Compute Engine API enabled in a single, efficient query. This avoids the latency and quota limitations of scripting against each project individually.

Answer

Write a script that runs `gcloud services list --enabled` for each project ID returned by `gcloud projects list`.

Answer

Check the Cloud Console's API library for each project manually.

Answer

Query Cloud Billing export data in BigQuery for projects with Compute Engine line items.

Question 8

You need persistent shared file storage for a legacy application running on multiple Compute Engine VMs that requires POSIX-compliant file system access (NFS). The workload is I/O intensive with files up to 100 GB. Which GCP storage service should you use?

Accepted Answer

Cloud Filestore (NFS). Cloud Filestore provides a fully managed NFS server that supports POSIX-compliant file access, making it the correct choice for a legacy application requiring NFS. It can handle I/O-intensive workloads with large files (up to 100 GB) by offering high throughput and low-latency access from multiple Compute Engine VMs simultaneously.

Answer

Cloud Storage FUSE mounted on each VM

Answer

Persistent Disk attached in ReadWriteMany mode to all VMs

Answer

Local SSD on each VM with rsync synchronization between VMs

Question 9

You are designing a GKE cluster for a workload that requires high-memory instances (768 GB RAM) for in-memory analytics. Standard machine types in GCP don't offer this configuration. Which machine family should you select for the node pool?

Accepted Answer

Memory-optimized (M1 or M2) machine family. The M1 and M2 memory-optimized machine families are specifically designed for workloads requiring large amounts of RAM, such as in-memory analytics, with configurations offering up to 12 TB of memory. Standard machine types like N2 do not provide 768 GB RAM instances, making memory-optimized families the correct choice for this high-memory requirement.

Answer

N2 machine family with custom vCPU and memory configuration

Answer

Compute-optimized (C2) machine family

Answer

Accelerator-optimized (A2) machine family

Question 10

You need to configure a GCP organization so that when new projects are created, a specific set of default IAM bindings is automatically applied (e.g., the security team's group gets Security Reviewer on every new project). Which approach achieves this without requiring manual post-creation steps?

Accepted Answer

Trigger a Cloud Function via Eventarc on project creation audit log events to automatically apply the IAM bindings.. Option B is correct because it uses Eventarc to capture audit log events for 'google.cloud.resourcemanager.v3.CreateProject' and triggers a Cloud Function that programmatically applies IAM bindings to the new project. This ensures the bindings are applied automatically without manual steps, leveraging serverless event-driven architecture.

Answer

Set an org policy constraint that applies default IAM bindings to all new projects.

Answer

Require all project creators to use a Terraform module that includes the IAM binding in its configuration.

Question 11

An e-commerce application has a read-heavy database workload: 95% reads, 5% writes. The primary Cloud SQL instance is experiencing CPU saturation during peak read traffic. What is the most appropriate GCP-native solution that minimizes changes to application code?

Accepted Answer

Create Cloud SQL read replicas and route read queries to the replica endpoint.. B is correct because Cloud SQL read replicas are designed to offload read traffic from the primary instance, directly addressing CPU saturation during peak reads without requiring application code changes—simply route SELECT queries to the read replica's IP address. This is the most appropriate GCP-native solution for a read-heavy (95% reads) workload, as it horizontally scales read capacity while keeping writes on the primary.

Answer

Enable Cloud SQL high availability; the standby replica will serve read traffic.

Answer

Scale the primary Cloud SQL instance vertically to a larger machine type.

Answer

Migrate from Cloud SQL to Cloud Spanner for unlimited horizontal read scalability.

Question 12

Your application runs on GKE and needs to call the Cloud Translation API. You want to follow Google's recommended security practice for service-to-cloud-API authentication within GKE. Which approach should you use?

Accepted Answer

Configure Workload Identity to bind the pod's Kubernetes Service Account to a Google Service Account with Translation API access.. Workload Identity is Google's recommended approach for authenticating workloads in GKE to Google Cloud APIs. It allows you to bind a Kubernetes Service Account (KSA) to a Google Service Account (GSA), so pods can impersonate the GSA without managing or storing long-lived service account keys. This eliminates the security risk of key exposure and follows the principle of least privilege.

Answer

Download a service account key JSON and mount it as a Kubernetes Secret in the pod.

Answer

Grant the GKE node pool's service account `roles/cloudtranslate.user`.

Answer

Use the GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to a mounted key file.

Question 13

You are configuring a GKE Autopilot cluster. A developer reports that their pod keeps being rejected with: `Autopilot rejected pod: resource request 0.5 vCPU and 64Mi memory is below minimum`. What should the developer do?

Accepted Answer

Set resource requests to at least 250m CPU and 512Mi memory to meet Autopilot's pod minimums.. B is correct because GKE Autopilot enforces minimum resource requests per pod: at least 0.5 vCPU (500m CPU) and 512Mi memory. The developer's request of 0.5 vCPU (500m) and 64Mi memory meets the CPU minimum but fails the memory minimum, so setting requests to at least 250m CPU and 512Mi memory satisfies both thresholds. This is a fundamental constraint of Autopilot's managed infrastructure model, not a configurable limit.

Answer

Switch to GKE Standard cluster to remove resource minimums.

Answer

Add a LimitRange to the namespace to override Autopilot's minimum requirements.

Answer

Set `resources: {}` (empty) to let Autopilot choose the correct resource allocation automatically.

Question 14

A Compute Engine VM's boot disk is nearly full and the application is failing. You want to snapshot the disk first (for safety), then resize it online. What is the correct sequence of gcloud commands?

Accepted Answer

Snapshot the disk, resize the disk with `gcloud compute disks resize`, then grow the filesystem within the VM.. Option B is correct because you must snapshot the disk first to ensure data safety before making changes, then resize the disk using `gcloud compute disks resize` (which works on a running VM with live resize enabled), and finally grow the filesystem inside the VM to utilize the additional space. This sequence avoids downtime and preserves a recovery point.

Answer

Stop the VM, resize the disk, take a snapshot, restart the VM.

Answer

Resize the disk with `gcloud compute instances set-disk-auto-delete` to automatically expand the disk.

Answer

Create a new larger disk, attach it as a secondary disk, and move data using rsync.

Question 15

You are managing Terraform state for a GCP infrastructure project shared by a team of 5 engineers. You need to prevent simultaneous `terraform apply` operations from causing state corruption. What is the recommended backend configuration?

Accepted Answer

Configure the `gcs` backend in Terraform, pointing to a Cloud Storage bucket with versioning enabled.. Option B is correct because the `gcs` backend with versioning enabled provides both remote state storage and built-in state locking via Cloud Storage's object-level consistency model. When one engineer runs `terraform apply`, the backend acquires a lock by writing a lock file to the bucket; other concurrent operations are blocked until the lock is released, preventing state corruption. Versioning further protects against accidental state deletion or corruption by allowing rollback to previous state versions.

Answer

Store state locally on each engineer's machine and merge state files manually after each apply.

Answer

Use Terraform Cloud (HashiCorp) as the backend for state locking.

Answer

Use a Cloud Source Repository to store state files with branch-based locking.

Question 16

You are deploying a Cloud Run service revision that should initially receive 0% of traffic (for testing via a direct URL), while the existing revision continues to serve 100% of production traffic. Which `gcloud run deploy` flag achieves this?

Accepted Answer

`--no-traffic`. The `--no-traffic` flag on `gcloud run deploy` deploys a new revision but directs 0% of traffic to it, leaving the existing revision serving 100% of production traffic. This allows you to test the new revision via its direct URL without impacting live users. It is the correct and explicit way to achieve a zero-traffic deployment in Cloud Run.

Answer

`--traffic=0`

Answer

`--revision-suffix=canary` with no traffic configuration

Answer

`--min-instances=0 --max-instances=0`

Question 17

A managed instance group (MIG) is configured with autohealing using a health check. During a rolling update, several VMs become unhealthy before the new application version starts responding to health checks. The MIG deletes and recreates these VMs repeatedly, causing a deployment loop. How should you fix this?

Accepted Answer

Increase the `initialDelaySec` in the autohealing policy to give VMs time to start before health checks are evaluated.. Option B is correct because increasing `initialDelaySec` in the autohealing policy gives the new application version sufficient time to start and become healthy before the health check begins evaluating the VM. This prevents the MIG from prematurely marking VMs as unhealthy during the rolling update, breaking the deployment loop where VMs are repeatedly deleted and recreated.

Answer

Disable autohealing during rolling updates by removing the health check.

Answer

Switch from rolling update to canary update to reduce the number of affected VMs.

Answer

Reduce the health check interval and timeout to detect unhealthy VMs faster.

Question 18

You are enabling OS Login for a GCP project to manage SSH access to Compute Engine VMs. A developer cannot SSH to a VM despite having `roles/compute.osLogin` granted. The VM has OS Login enabled. What is the most likely missing configuration?

Accepted Answer

The VM metadata `enable-oslogin` is not set to `TRUE` at the VM or project level.. Option B is correct because OS Login requires the VM or project metadata key `enable-oslogin` to be set to `TRUE`. Even if the user has the `roles/compute.osLogin` role, OS Login will not function if this metadata is missing or set to `FALSE`. The metadata enables the OS Login agent on the VM to authenticate users via IAM permissions rather than local SSH keys.

Answer

The developer needs `roles/compute.instanceAdmin` in addition to `roles/compute.osLogin`.

Answer

The developer must generate an SSH key pair and upload the public key to the VM's authorized_keys.

Answer

The developer's account needs `roles/iam.serviceAccountTokenCreator` to authenticate via SSH.

Question 19

You need to prevent developers from creating Compute Engine VMs with external IP addresses in a specific folder. Developers must still be able to create VMs with internal IPs only. Which org policy constraint enforces this?

Accepted Answer

Apply the `compute.vmExternalIpAccess` org policy constraint set to deny all VMs.. The `compute.vmExternalIpAccess` organization policy constraint is specifically designed to control whether Compute Engine VMs can be assigned external IP addresses. By setting this constraint to deny all VMs in the folder, developers are prevented from creating VMs with external IPs while still being able to create VMs with only internal IPs. This is the correct, native Google Cloud mechanism for enforcing this requirement at the folder level.

Answer

Create a VPC firewall rule blocking all outbound internet traffic.

Answer

Remove the `compute.instanceAdmin` role from developers so they cannot configure network interfaces.

Answer

Configure the default VPC network to use internal-only routes.

Question 20

Your security team wants to monitor all privileged IAM changes in your GCP organization (e.g., when anyone is granted `roles/owner` or `roles/editor`). They need real-time notifications. Which approach achieves this?

Accepted Answer

Create a Cloud Monitoring alerting policy on the `iam.googleapis.com/SetIamPolicy` log metric.. Option A is correct because Cloud Monitoring can ingest log-based metrics from the `iam.googleapis.com/SetIamPolicy` audit log entry, and an alerting policy can be configured to trigger in near real-time when that log metric exceeds a threshold. This provides immediate notification of privileged IAM changes such as granting `roles/owner` or `roles/editor`.

Answer

Enable Security Command Center's Event Threat Detection for IAM changes.

Answer

Run a daily script using `gcloud projects get-iam-policy` and compare with the previous day's output.