Google ACE Practice Test 21 — 15 Questions

Question 1

You need to create a log-based metric that counts the number of errors in your application logs. What must you do first in Cloud Logging?

Accepted Answer

Define a filter that matches the error logs. In Cloud Logging, a log-based metric is based on a filter. You define the filter using the logging query language to match the logs you want to count, then create the metric from that filter.

Answer

Create an alerting policy with a condition

Answer

Create a log sink that exports logs to BigQuery

Answer

Install the Logging agent on your VMs

Question 2

An organization wants to enforce that all Compute Engine instances in a project use customer-managed encryption keys (CMEK) for their boot disks. Which TWO steps should the security team take?

Accepted Answer

Set an organization policy constraint that requires CMEK for Compute Engine disks. To enforce CMEK, you can set an organization policy constraint (e.g., constraints/compute.requireCmek) to prevent creation of instances without CMEK. Additionally, you must grant the compute engine service account permission to use the KMS key so it can encrypt disks. Simply specifying the key in the instance template does not enforce the policy, and the Cloud KMS Admin role is too broad.

Answer

Specify the CMEK key in each instance template used for managed instance groups

Answer

Grant the Cloud KMS Admin role to the project's compute service account

Answer

Create a Cloud Audit Logs sink to monitor instances without CMEK

Question 3

A company is deploying a microservices application on Google Kubernetes Engine (GKE). They want to expose their services to the internet using a single external IP address and route traffic based on the request path. Which resource should they use?

Accepted Answer

An Ingress resource. An Ingress resource is the correct choice because it provides HTTP(S) layer 7 routing, allowing you to expose multiple services behind a single external IP address and route traffic based on request paths (e.g., /api to one service, /web to another). This meets the requirement of using one external IP and path-based routing, which a Service alone cannot achieve.

Answer

A Service of type NodePort

Answer

A Service of type LoadBalancer for each microservice

Answer

A Network Endpoint Group (NEG)

Question 4

A platform team needs a Kubernetes workload that runs exactly one Pod on every node in a GKE cluster — including nodes added in the future. The workload collects host-level metrics. Which Kubernetes resource type should they use?

Accepted Answer

DaemonSet. A DaemonSet ensures that exactly one Pod runs on every node in the cluster, including nodes added after creation. This is the correct resource for host-level metrics collection because it automatically scales with the node pool and guarantees one Pod per node without manual intervention.

Answer

Deployment with replicas set equal to the node count

Answer

StatefulSet with one replica per node

Answer

CronJob running every minute to check and restore missing Pods

Question 5

A developer wants to verify which IAM roles they currently have on a specific GCP project before requesting additional access. Which gcloud command lists the IAM policy for a project?

Accepted Answer

gcloud projects get-iam-policy [PROJECT_ID]. The correct command to retrieve the IAM policy for a GCP project is `gcloud projects get-iam-policy [PROJECT_ID]`. This command returns the complete IAM policy bindings (roles and members) for the specified project, allowing the developer to see which roles they currently have. It directly queries the Cloud Resource Manager API to fetch the project-level IAM policy.

Answer

gcloud iam roles list --project=[PROJECT_ID]

Answer

gcloud auth list --project=[PROJECT_ID]

Answer

gcloud iam service-accounts get-iam-policy [PROJECT_ID]

Question 6

Your application writes structured JSON logs to stdout from a Cloud Run service. You want to query logs in Cloud Logging to find all requests where the `user_id` field equals `12345`. Which log query syntax finds these entries?

Accepted Answer

`jsonPayload.user_id="12345"`. Cloud Logging uses the `jsonPayload` field to access structured JSON fields in log entries. When your application writes structured JSON logs to stdout, Cloud Run automatically parses them and stores the fields under `jsonPayload`. The query `jsonPayload.user_id="12345"` directly matches the `user_id` field within that JSON payload.

Answer

`textPayload:"user_id:12345"`

Answer

`resource.labels.user_id="12345"`

Answer

`labels.user_id="12345"`

Question 7

A team runs `gcloud organizations list` and sees no output even though they know their company has a GCP organization. What is the most likely cause, and how should they resolve it?

Accepted Answer

The user lacks org-level IAM permissions such as Organization Viewer.. The `gcloud organizations list` command retrieves organizations from the GCP Resource Manager API. If no output is returned despite the organization existing, the most likely cause is that the authenticated user lacks the `resourcemanager.organizations.get` permission, which is granted by roles like Organization Viewer (`roles/resourcemanager.organizationViewer`) or Organization Administrator (`roles/resourcemanager.organizationAdmin`). Without this IAM permission at the organization level, the API call returns an empty list rather than an error, which is a common source of confusion.

Answer

The organization does not exist yet; run `gcloud organizations create` to create it.

Answer

The gcloud SDK does not support the organizations command; use the Cloud Console instead.

Answer

The project must be linked to the organization using `gcloud projects move`.

Question 8

An organization needs to ensure that only images from their approved Container Registry (gcr.io/approved-project) can be deployed on GKE clusters in their organization. Which GCP control enforces this?

Accepted Answer

Binary Authorization with a policy requiring attestation from the approved registry. Binary Authorization enforces deployment-time policies that require images to be signed by trusted authorities. By configuring a policy that requires attestations from the approved registry (gcr.io/approved-project), only images from that registry can be deployed on GKE clusters, directly meeting the requirement.

Answer

A VPC firewall rule blocking pulls from unauthorized registries

Answer

Cloud Armor rules blocking container pull requests from external sources

Answer

Manually reviewing all Docker images before deployment

Question 9

A GCP project has three service accounts. A developer wants to list all service accounts in the project using the gcloud CLI. Which command is correct?

Accepted Answer

gcloud iam service-accounts list. The `gcloud iam service-accounts list` command is the standard gcloud CLI command to list all service accounts in a GCP project. It uses the IAM API to retrieve the service accounts associated with the current project (or a specified project via the `--project` flag). This command is part of the `gcloud iam` group, which manages IAM resources, and the `service-accounts` sub-group specifically handles service account operations.

Answer

gcloud service-accounts list

Answer

gcloud iam list service-accounts

Answer

gcloud projects list-service-accounts

Question 10

A small business is deploying a web application on Compute Engine and wants to ensure high availability. They have set up two instances in different zones behind a TCP load balancer. What should they also configure to detect and route traffic away from unhealthy instances?

Accepted Answer

Configure a health check on the load balancer.. A health check is required for the TCP load balancer to monitor the backend instances. It periodically probes the instances on a specified port and path, marking them as unhealthy if they fail to respond. The load balancer then stops routing new traffic to unhealthy instances, ensuring high availability by directing traffic only to healthy backends.

Answer

Set a firewall rule to allow traffic only on port 80.

Answer

Use a global HTTP(S) load balancer instead.

Answer

Create a snapshot schedule for the persistent disks.

Question 11

A developer has deployed a Cloud Run service but receives a 503 error when accessing it. The service logs show 'The request was aborted because there was no available instance.' What is the most likely cause?

Accepted Answer

The service is experiencing a spike in traffic and the max instances are too low.. The 503 error with the message 'The request was aborted because there was no available instance' indicates that all current instances are saturated and Cloud Run cannot scale up quickly enough to handle the incoming requests. This occurs when traffic spikes exceed the configured maximum number of instances, causing new requests to be rejected until an instance becomes free. Option C correctly identifies that the max instances setting is too low for the traffic spike.

Answer

The minimum number of instances is set too high.

Answer

The container health checks are failing.

Answer

The service's memory limit is set too low.

Question 12

Which THREE configurations are required to enable Private Google Access for Compute Engine instances in a custom VPC subnet? (Select 3 correct answers)

Accepted Answer

Create a subnet with the --enable-private-ip-google-access flag.. Private Google Access is enabled on a subnet. Instances in that subnet can reach Google APIs using internal IPs. It does not require Cloud NAT, Cloud VPN, or internet access. The three required elements are: a VPC network, a subnet with Private Google Access enabled, and instances in that subnet.

Answer

Create a Cloud Router to advertise routes to Google.

Answer

Configure Cloud NAT to route traffic to Google APIs.

Question 13

A startup wants to grant developers the ability to create and manage Compute Engine instances, but prevent them from deleting instances or changing firewall rules. Which IAM approach should they use?

Accepted Answer

Create a custom role with permissions for instance management but without compute.instances.delete.. Creating a custom role allows the startup to grant fine-grained permissions for instance management (e.g., compute.instances.create, compute.instances.start, compute.instances.stop) while explicitly omitting compute.instances.delete and any firewall-related permissions like compute.firewalls.update or compute.firewalls.delete. This ensures developers can manage instances but cannot delete them or alter firewall rules, meeting the exact requirement.

Answer

Assign the roles/compute.instanceAdmin.v1 role.

Answer

Assign the roles/compute.instanceOperator role.

Answer

Assign the roles/compute.admin role.

Question 14

Which gcloud command lists all available roles that can be granted on a GCP project, including both predefined and custom roles?

Accepted Answer

`gcloud iam list-grantable-roles //cloudresourcemanager.googleapis.com/projects/PROJECT_ID`. The `gcloud iam list-grantable-roles` command is specifically designed to list all roles (both predefined and custom) that can be granted on a given resource, such as a GCP project. The resource is identified by its canonical name, which for a project is `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID`. This command returns roles that are eligible for binding at that resource level, including those inherited from ancestors.

Answer

`gcloud iam roles list --project=PROJECT_ID`

Answer

`gcloud projects get-iam-policy PROJECT_ID`

Answer

`gcloud iam roles describe roles/editor`

Question 15

A batch data processing job runs nightly for 4 hours and can tolerate interruption because it saves progress checkpoints every 15 minutes. Which VM option offers the greatest cost reduction?

Accepted Answer

Spot VM. Spot VMs offer significant cost reduction (up to 60-91% discount) compared to standard VMs, making them ideal for fault-tolerant, interruptible batch workloads. Since the job saves checkpoints every 15 minutes, it can resume from the last checkpoint if preempted, fully leveraging the cost benefit of Spot VMs.

Answer

Custom machine type VM with reduced memory

Answer

Sole-tenant node VM

Answer

Shielded VM