Google ACE Practice Test 22 — 15 Questions

Question 1

A company recently deployed a web application on a managed instance group (MIG) behind a regional external HTTP(S) load balancer. The application is a Python Flask app running on Compute Engine VMs. After a code update that caused increased response times under load, users report intermittent 503 errors. You examine the load balancer logs and see that the backend instances are periodically marked as unhealthy. The health check is configured to query the /health endpoint every 5 seconds with a healthy threshold of 2 and a timeout of 1 second. The application's /health endpoint returns 200 OK, but sometimes takes up to 1.5 seconds to respond. What is the most likely cause of the health check failures?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The health check response timeout is too low for the application's increased response time.. The health check is configured with a timeout of 1 second, but the /health endpoint now takes up to 1.5 seconds to respond due to the code update. Since the health check waits only 1 second for a response, any request that takes longer than that will be considered a failure, causing the backend to be marked unhealthy and triggering 503 errors. This is a classic mismatch between health check timeout and application response time.

Answer

The instances are overloaded and failing health checks intermittently.

Answer

The health check firewall rule is missing or misconfigured.

Answer

The health check is checking the wrong port.

Question 2

A team packages their Kubernetes application as a Helm chart. They need to install it into a GKE cluster with the release name 'webapp' in the 'production' namespace, overriding the default image tag to 'v2.1'. Which Helm command achieves this?

Accepted Answer

helm install webapp ./chart -n production --set image.tag=v2.1. `helm install` is the standard Helm command to deploy a chart into a cluster, and the `--set` flag overrides default values like `image.tag`. The `-n` flag specifies the namespace, and the release name 'webapp' is given as the first argument. This matches the Helm CLI syntax exactly.

Answer

helm deploy webapp ./chart -n production --set image.tag=v2.1

Answer

kubectl apply -f helm-chart.yaml -n production --image-tag=v2.1

Answer

helm apply webapp -n production --chart=./chart --tag=v2.1

Question 3

A developer wants to deploy a containerized application that can scale to zero when not in use and only pay for resources consumed during request processing. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless compute platform that automatically scales your containerized applications from zero instances up to handle traffic, and scales back down to zero when there are no requests. You only pay for the resources (CPU, memory, and networking) consumed during request processing, with no charges when the service is idle. This makes it the ideal choice for the described use case of scaling to zero and pay-per-request billing.

Answer

App Engine Flexible Environment

Answer

Compute Engine with managed instance groups

Answer

Google Kubernetes Engine

Question 4

A security team needs an inventory of all Compute Engine VM instances across all projects in their GCP organization, including instance names, zones, and status, without logging into each project individually. Which service provides this?

Accepted Answer

Cloud Asset Inventory with an organization-scoped asset search. Cloud Asset Inventory provides a unified, organization-scoped view of all resources across projects, including Compute Engine VM instances. By using an organization-scoped asset search, the security team can query for all VM instances (e.g., `asset_type = "compute.googleapis.com/Instance"`) without needing to log into each project individually. This service is purpose-built for cross-project resource discovery and inventory management.

Answer

Cloud Monitoring — use the metric explorer to list all VM instances

Answer

Cloud Resource Manager — list all projects and then query each for VMs

Answer

BigQuery information_schema views for GCP compute resources

Question 5

Where in the Google Cloud Console can a user view all APIs currently enabled for their project and monitor their usage?

Accepted Answer

APIs & Services > Dashboard. The 'APIs & Services > Dashboard' page in the Google Cloud Console provides a centralized view of all enabled APIs for a project, along with real-time usage metrics such as requests per second, error rates, and latency. This dashboard is the primary interface for monitoring API consumption and identifying throttling or quota issues.

Answer

Cloud Shell > Active Sessions

Answer

IAM & Admin > Service Accounts

Answer

Monitoring > Metrics Explorer

Question 6

A company wants to deploy a globally distributed, multi-tier application with strict low-latency communication between the web and database tiers. The database must be fully managed and able to survive a regional outage with automatic failover. Which combination is most appropriate?

Accepted Answer

Cloud Run (multi-region) and Cloud Spanner (multi-region). Cloud Run (multi-region) provides a serverless compute layer that can automatically route traffic across regions for low-latency access, while Cloud Spanner (multi-region) offers a fully managed, globally distributed relational database with synchronous replication and automatic failover, ensuring strong consistency and regional outage survival without manual intervention. This combination meets the strict low-latency communication and automatic failover requirements for a multi-tier application.

Answer

Cloud Run (multi-region) and Cloud SQL (cross-region replica with manual failover)

Answer

Compute Engine regional managed instance group and Cloud SQL (regional with automatic failover)

Answer

App Engine (standard) and Cloud Datastore (multi-region)

Question 7

An infrastructure team uses Terraform to manage GCP resources including API enablement. Which Terraform resource enables a GCP API for a project, equivalent to `gcloud services enable`?

Accepted Answer

google_project_service with the desired service endpoint. The `google_project_service` resource is the direct Terraform equivalent of `gcloud services enable`, as it explicitly enables a specified GCP service API for a given project. This resource takes the service endpoint (e.g., `compute.googleapis.com`) and handles the enablement lifecycle, including dependency tracking and disabling on destroy.

Answer

google_project_iam_binding with the serviceusage.services.enable permission

Answer

google_service_account with enabled_services block

Answer

google_project with the services argument listing all required APIs

Question 8

A team's Cloud Storage bucket containing backups has been accidentally made publicly readable. A monitoring alert fires. What is the fastest way to remove public access?

Accepted Answer

Remove the 'allUsers' IAM binding from the bucket using the Console or gcloud/gsutil. Removing the 'allUsers' IAM binding from the bucket is the fastest and most direct way to revoke public access. This can be done via the Cloud Console, gsutil iam ch -d allUsers gs://BUCKET_NAME, or gcloud commands, immediately restoring the bucket's private state without any data loss or additional configuration.

Answer

Delete the bucket and recreate it with correct permissions

Answer

Enable VPC Service Controls around Cloud Storage to block all external access

Answer

Apply a Cloud Armor policy to Cloud Storage to block external IPs

Question 9

A team uses Terraform to manage GCP infrastructure. After running `terraform plan`, they see 15 resources to be created. They want to apply only the Cloud SQL instance (resource name: `google_sql_database_instance.main`) without applying all 15 changes. Which Terraform command targets a specific resource?

Accepted Answer

terraform apply -target=google_sql_database_instance.main. Terraform uses the `-target` flag to limit the operation to a specific resource address, allowing you to apply only the `google_sql_database_instance.main` resource without affecting the other 14 resources in the plan. This is the standard Terraform syntax for targeting a single resource during `apply` or `destroy` operations.

Answer

terraform apply --resource=google_sql_database_instance.main

Answer

terraform apply -only=google_sql_database_instance.main

Answer

terraform plan --filter=google_sql_database_instance.main && terraform apply

Question 10

A project was accidentally deleted. A GCP administrator realizes the mistake 3 days later. What is the maximum time window in which the project can be restored?

Accepted Answer

30 days — projects can be restored using `gcloud projects undelete` within this window. Google Cloud projects have a 30-day soft-delete period after deletion. During this window, the project can be recovered using the `gcloud projects undelete` command or the Cloud Resource Manager API, restoring all associated resources and configurations.

Answer

24 hours — projects are permanently deleted after one day

Answer

7 days — projects enter a one-week soft-delete period

Answer

Projects are permanently deleted immediately and cannot be recovered

Question 11

Which command creates a Cloud Storage bucket named 'my-archive-bucket' in the US multi-region using the modern gcloud CLI?

Accepted Answer

gcloud storage buckets create gs://my-archive-bucket --location=US. The modern gcloud CLI uses the `gcloud storage buckets create` command to create a Cloud Storage bucket, and the `--location=US` flag specifies the US multi-region. This command is part of the newer, unified `gcloud storage` command group that replaces the older `gsutil` tool for bucket management.

Answer

gcloud storage mk gs://my-archive-bucket --location=US

Answer

gcloud cloud-storage create my-archive-bucket --region=US

Answer

gsutil mk -l US gs://my-archive-bucket

Question 12

A company wants to ensure that all IAM users in a project must use two-factor authentication. Which Google Cloud service should be used?

Accepted Answer

Cloud Identity. Cloud Identity is the correct service because it provides identity-as-a-service (IDaaS) that allows administrators to enforce security policies, including requiring two-factor authentication (2FA) for all IAM users. By enabling 2FA at the Cloud Identity level, every user authenticating through Google Cloud's identity layer must complete a second factor (e.g., TOTP via Google Authenticator or a security key) before accessing any Google Cloud resources. This policy applies globally across all projects in the organization, ensuring consistent enforcement without needing to configure per-user or per-project settings.

Answer

Identity Platform

Answer

Cloud IAM

Answer

Cloud Audit Logs

Question 13

Which feature of Cloud SQL provides automated backups and enables point-in-time recovery?

Accepted Answer

All Cloud SQL tiers. Cloud SQL provides automated backups and point-in-time recovery (PITR) for all tiers, including Cloud SQL Enterprise, Enterprise Plus, and even the basic (non-HA) configurations. This is because the backup and PITR functionality is a core feature of the Cloud SQL service itself, not tied to a specific tier or high-availability setup. Automated backups are enabled by default, and PITR uses binary log (binlog) files to allow restoration to any point within the backup retention window.

Answer

Only Cloud SQL Enterprise

Answer

Only Cloud SQL High Availability configuration

Answer

Only Cloud SQL Enterprise Plus

Question 14

Refer to the exhibit. An engineer runs this command and sees the output. The instance is unable to reach the internet. What is the most likely reason?

Accepted Answer

The instance does not have a public IP address.. The instance cannot reach the internet because it lacks a public IP address. In Google Cloud, an instance without an external IP address cannot initiate outbound connections to the internet unless a Cloud NAT or a VM with a public IP is used as a proxy. The command output likely shows that the instance only has an internal IP, confirming this as the root cause.

Answer

VPC firewall rules are blocking egress traffic.

Answer

The instance needs a Cloud NAT gateway for outbound connectivity.

Answer

The subnetwork is misconfigured.

Question 15

A company is using Cloud Storage to store sensitive data. They want to enforce that objects are automatically deleted after 90 days. Which configuration should they use?

Accepted Answer

Configure Object Lifecycle Management with a Delete action after 90 days.. Object Lifecycle Management allows you to set rules that automatically perform actions on objects after a specified number of days. By configuring a rule with a Delete action set to trigger after 90 days, objects in the bucket will be automatically removed, meeting the requirement without manual intervention.

Answer

Set a retention policy on the bucket for 90 days.

Answer

Enable bucket locking with a retention period of 90 days.

Answer

Enable object versioning and set a lifecycle rule to delete noncurrent versions.