Google ACE Practice Test 21 — 15 Questions

Question 1

A team's GCP project is approaching its monthly budget. They want to receive an email alert when spending reaches 80% and 100% of the $500 monthly budget. Which GCP feature sends these budget alerts?

Accepted Answer

Cloud Billing budget with alert thresholds set at 80% and 100%. Cloud Billing budgets are the native GCP feature designed to monitor spending against a budget and send email alerts when actual or forecasted costs exceed user-defined thresholds (e.g., 80% and 100% of $500). This feature is configured directly in the Cloud Console or via the Billing API and automatically triggers notifications without requiring custom code or additional services.

Answer

Cloud Monitoring alerting policy on the billing/cost metric

Answer

A Cloud Scheduler job that queries the Billing API and sends an email when cost exceeds thresholds

Answer

Cloud Logging alert on billing cost log entries

Question 2

You have a Kubernetes Deployment running 5 replicas. You need to update the container image with zero downtime, ensuring that at least 4 replicas are always available during the update, and no more than 6 replicas exist at any time. Which Deployment strategy and settings achieve this?

Accepted Answer

RollingUpdate with `maxUnavailable: 1` and `maxSurge: 1`.. A RollingUpdate strategy with `maxUnavailable: 1` and `maxSurge: 1` ensures that during the update, at most one replica is taken down (so at least 4 remain available) and at most one extra replica is created above the desired 5 (so no more than 6 exist at any time). This satisfies both constraints while achieving zero downtime.

Answer

Recreate strategy with `minReadySeconds: 30`.

Answer

RollingUpdate with `maxUnavailable: 0` and `maxSurge: 2`.

Answer

RollingUpdate with `maxUnavailable: 2` and `maxSurge: 1`.

Question 3

A Cloud SQL instance's disk is at 95% capacity. The application is experiencing write failures. You need to resolve this immediately with no downtime. What should you do?

Accepted Answer

Increase the disk size via the Cloud SQL console or `gcloud sql instances patch` — this occurs with no instance restart.. Cloud SQL supports dynamic disk resizing without requiring an instance restart. When you increase the disk size via the console or `gcloud sql instances patch`, the change takes effect immediately, allowing the database to continue serving writes without downtime. This directly resolves the write failures caused by disk-full conditions.

Answer

Take a snapshot of the instance, create a new larger instance from the snapshot, then update the connection string.

Answer

Delete old database tables to free up space.

Answer

Switch the instance to SSD storage, which has higher throughput and allows more writes.

Question 4

An application uses the S3-compatible API to interact with Cloud Storage. The team needs credentials compatible with HMAC-based S3 authentication. Which credential type does Cloud Storage support for this?

Accepted Answer

HMAC keys created for a service account in Cloud Storage settings. Cloud Storage supports HMAC keys for service accounts to provide S3-compatible authentication. These keys consist of an access key and a secret key, which are used to sign requests using the HMAC-SHA256 algorithm, matching the AWS S3 signature process. This allows applications using the S3 API to authenticate directly against Cloud Storage without needing a JSON key file or OAuth 2.0 tokens.

Answer

Service account JSON key file — it's compatible with the S3 HMAC authentication format

Answer

Cloud KMS symmetric keys configured for Cloud Storage access

Answer

An API key generated in the GCP Console for Cloud Storage

Question 5

Your team needs to manage Google Kubernetes Engine clusters across multiple projects. Rather than granting `roles/container.admin` on each project individually, you want a centralized approach. What is the most maintainable solution?

Accepted Answer

Grant `roles/container.admin` to the team's Google Group at the folder level containing all relevant projects.. Granting `roles/container.admin` at the folder level to a Google Group is the most maintainable solution because it centralizes IAM policy management. When new projects are added under that folder, they automatically inherit the role, and team membership changes are handled by updating the Google Group rather than modifying individual project IAM policies. This approach follows Google Cloud's recommended practice of using groups and resource hierarchy for scalable access control.

Answer

Create a service account with `roles/container.admin` and share its key JSON with team members.

Answer

Grant `roles/container.admin` to each team member individually in each project's IAM policy.

Answer

Use the GKE Hub to create a fleet and assign RBAC roles within each cluster.

Question 6

Your company wants to track costs per department. Each department has its own project. You need to set up a budget alert in the billing account for each project. What is the most efficient approach?

Accepted Answer

Create one budget per project by selecting the project in the 'Scoped to' field.. You can create budgets at the billing account level with scoped projects. This allows one budget per project. Creating budgets per project individually is manual. Using labels requires tagging resources. Billing export to BigQuery is for analysis, not alerts.

Answer

Use Billing Export to BigQuery and create custom alerts using Cloud Monitoring.

Answer

Create a budget for each project by manually enabling billing for each project.

Answer

Create a single budget for the entire billing account and rely on labels.

Question 7

A media company needs to serve large video files (average 2 GB) to global users with low latency. The files are stored in Cloud Storage. What combination of services delivers the best streaming performance?

Accepted Answer

Cloud Storage + Cloud CDN via a Global Load Balancer backend bucket. Cloud Storage combined with Cloud CDN via a Global Loader Balancer backend bucket is the best choice because it provides edge-caching of large video files, reducing latency for global users. The Global Load Balancer terminates HTTP(S) traffic at the closest point of presence, and Cloud CDN caches content from the multi-region bucket, minimizing origin load and improving streaming performance.

Answer

Cloud Storage in a multi-region bucket with direct public access

Answer

Upload video files to a Compute Engine VM with nginx serving them directly

Answer

Cloud Filestore with NFS-mounted streaming

Question 8

You run `kubectl get pods` and see a pod in `ImagePullBackOff` state. What are the two most common causes of this error?

Accepted Answer

Incorrect image name/tag, or missing pull credentials for a private registry.. The `ImagePullBackOff` state indicates that the kubelet is unable to pull the container image from the registry. The two most common causes are an incorrect image name or tag (e.g., a typo or a non-existent tag), which results in a `404 Not Found` from the registry, and missing or invalid pull credentials for a private registry, which results in a `401 Unauthorized` or `403 Forbidden` response. Both prevent the image from being downloaded, causing the pod to enter a backoff loop.

Answer

Insufficient CPU/memory on the node, or the pod's resource requests are too high.

Answer

The pod's liveness probe is failing, causing the container to restart.

Answer

The container's entrypoint command is failing, causing the image pull to abort.

Question 9

A startup's application uses both GCP services and an existing on-premises Kubernetes cluster. They want a single control plane to manage Kubernetes clusters across both environments with consistent policy enforcement. Which Google service provides this?

Accepted Answer

Anthos (Google Distributed Cloud) for hybrid multi-cluster management. Anthos (Google Distributed Cloud) is the correct answer because it provides a unified control plane for managing Kubernetes clusters across on-premises and GCP environments, enabling consistent policy enforcement, configuration, and observability. Anthos uses GKE on-prem and GKE in the cloud, with a centralized Anthos Config Management and Service Mesh for policy and security consistency, directly addressing the hybrid multi-cluster management requirement.

Answer

GKE Hub (Fleet management)

Answer

Cloud Interconnect — connects on-premises clusters to GCP so they share a control plane

Answer

Cloud Composer — a managed Kubernetes workflow across environments

Question 10

A developer accidentally committed a service account key JSON file to a public GitHub repository. The key was valid for a service account with broad Editor permissions. What should you do FIRST?

Accepted Answer

Immediately delete or disable the service account key in the Cloud Console or via gcloud.. The immediate priority is to revoke the exposed credential to prevent unauthorized access. Deleting or disabling the service account key in the Cloud Console or via `gcloud iam service-accounts keys delete` ensures the key is invalidated within minutes, stopping any attacker from using it to authenticate with Google Cloud APIs. This aligns with the principle of least privilege and incident response best practices: contain the breach before remediation.

Answer

Remove the committed file from Git history using `git filter-branch` or BFG Repo Cleaner.

Answer

Make the GitHub repository private to hide the exposed key.

Answer

Reduce the service account's permissions to limit the blast radius.

Question 11

A company is extending its on-premises network to Google Cloud using a Cloud VPN tunnel with dynamic routing (BGP). They have set up a Cloud Router in the VPN region. Which additional step is required for the Cloud Router to exchange routes with the on-premises router?

Accepted Answer

Configure a BGP session on the Cloud Router with the on-premises router's ASN and IP address. For a Cloud VPN with dynamic routing (BGP), the Cloud Router must have a BGP session configured with the on-premises router. This session requires the on-premises router's ASN and its BGP peer IP address to exchange routes. Without this explicit BGP session configuration, the Cloud Router cannot establish a peering relationship or advertise/learn routes dynamically.

Answer

Create a static route for the on-premises network on the VPC

Answer

Assign an external IP address to the Cloud Router

Answer

Enable the IP forwarding feature on the VPN gateway

Question 12

Your organization mandates that all service-to-service communication within a GKE cluster must be encrypted in transit using mutual TLS (mTLS). The team does not want to manage certificates or modify application code. Which solution meets these requirements?

Accepted Answer

Enable Anthos Service Mesh with mTLS policy set to STRICT mode.. Anthos Service Mesh (ASM) with mTLS set to STRICT mode enforces mutual TLS between all services in the mesh without requiring any application code changes or manual certificate management. ASM automatically injects Envoy sidecar proxies that handle certificate issuance, rotation, and encryption, meeting the requirement for encrypted service-to-service communication with mTLS.

Answer

Configure Kubernetes TLS Secrets and mount them as volumes in each pod.

Answer

Use Cloud Armor to enforce TLS between services within the cluster.

Answer

Enable GKE node-to-node encryption to encrypt all traffic between nodes.

Question 13

An engineer wants to create a Google-managed SSL certificate for a domain and attach it to an HTTPS load balancer. Which gcloud command should they use to create the certificate?

Accepted Answer

gcloud compute ssl-certificates create --domains example.com. The gcloud compute ssl-certificates create command with the --domains flag creates a Google-managed SSL certificate. The other commands are for creating SSL policies, self-managed certificates, or target HTTPS proxies.

Answer

gcloud compute target-https-proxies create --ssl-certificates

Answer

gcloud compute ssl-policies create

Answer

gcloud compute ssl-certificates create --certificate example.crt --private-key example.key

Question 14

An organization has multiple Google Cloud projects and wants to enforce a policy that all Compute Engine instances must use a specific set of approved machine types. Which tool should be used to implement this constraint?

Accepted Answer

Organization policies. Organization policies are used to enforce constraints across projects, folders, or the entire organization. The constraint 'compute.constraints.allowMachineTypes' can be set to restrict machine types. IAM roles control access, not resource configuration. Cloud Scheduler is for cron jobs. VPC Service Controls is for data exfiltration prevention.

Answer

IAM custom roles

Answer

VPC Service Controls

Answer

Cloud Scheduler

Question 15

You are designing a resource hierarchy for a company with three departments: Engineering, Sales, and HR. Each department should have its own projects, and policies should be applied at the department level. Which THREE steps should you take? (Choose three.)

Accepted Answer

Create a folder for each department. Create an organization node (if not already present). Under it, create a folder for each department. Then create projects within each folder. Apply IAM policies at the folder level.

Answer

Use labels to separate departments

Answer

Apply IAM policies at the project level only