Google ACE Practice Test 22 — 15 Questions

Question 1

A company wants to set up a budget alert at 50% and 90% of their projected monthly spending. Which service should they use?

Accepted Answer

Cloud Billing budgets. Cloud Billing budgets allow setting budget amounts and alerts at specified thresholds.

Answer

Cost breakdown reports

Answer

Cloud Scheduler

Answer

Cloud Monitoring alerts

Question 2

A company has multiple Google Cloud projects and wants to track costs by department. They have already applied labels to resources with key 'department'. What is the next step to view costs grouped by department?

Accepted Answer

Go to Billing > Reports and filter by 'department' label. Costs can be viewed in the Cloud Console under Billing > Reports. You can filter by labels to see costs grouped by label values.

Answer

Run gcloud billing accounts list and parse the output

Answer

Set up a budget alert with department labels

Answer

Enable billing export to BigQuery and run a query

Question 3

A startup wants to control costs across multiple GCP projects. They want to track spending by department and set budget alerts. Which THREE actions should they take?

Accepted Answer

Assign labels to resources indicating department. Using labels, budgets, and billing export enables tracking and alerts.

Answer

Use Cloud Monitoring to track costs

Answer

Create separate billing accounts for each department

Question 4

An administrator needs to create a custom IAM role that allows listing projects and viewing billing accounts. Which TWO permissions should be included?

Accepted Answer

billing.accounts.list. resourcemanager.projects.list and billing.accounts.list allow these actions.

Answer

billing.accounts.create

Answer

resourcemanager.projects.create

Answer

resourcemanager.projects.delete

Question 5

A team wants logs from their Python application running on a Compute Engine VM to appear in Cloud Logging. What must be installed on the VM?

Accepted Answer

Ops Agent (Google Cloud's combined logging and monitoring agent). The Ops Agent is Google Cloud's unified agent for both logging and monitoring, and it is required to stream custom application logs from a Compute Engine VM to Cloud Logging. While the VM itself sends basic platform logs (e.g., serial console output), application-level logs (e.g., from a Python app) require the Ops Agent to collect, parse, and forward them to the Cloud Logging API.

Answer

Cloud Trace SDK for the Python application

Answer

Cloud Monitoring agent only

Answer

No installation needed — GCE VMs automatically stream logs to Cloud Logging

Question 6

An engineer wants to authenticate to Google Cloud using their own user credentials and also set up application default credentials for a local development environment. Which sequence of gcloud auth commands should they use?

Accepted Answer

gcloud auth login then gcloud auth application-default login. First, use 'gcloud auth login' to authenticate the gcloud CLI with user credentials. Then, use 'gcloud auth application-default login' to set up application default credentials for local development. The other options are incorrect or reversed.

Answer

gcloud auth application-default login then gcloud auth login

Answer

gcloud init then gcloud auth login

Answer

gcloud auth configure-docker then gcloud auth login

Question 7

A company wants to manage multiple Google Cloud projects and enforce consistent security policies across all of them. Which TWO resources should they use? (Choose two.)

Accepted Answer

Organization policies. Organization policies are used to enforce constraints across projects. Folders allow grouping projects and applying common IAM policies.

Answer

Cloud Audit Logs

Answer

Shared VPC

Answer

Labels

Question 8

A Cloud Build pipeline builds a container image and pushes it to Artifact Registry. The next step needs to deploy the image to Cloud Run. The pipeline runs as the Cloud Build service account. What minimum permission does the Cloud Build SA need for the deployment step?

Accepted Answer

`roles/run.admin` and `roles/iam.serviceAccountUser` on the Cloud Run runtime service account.. The Cloud Build service account needs `roles/run.admin` to deploy services to Cloud Run, but it also requires `roles/iam.serviceAccountUser` on the Cloud Run runtime service account (the identity the Cloud Run service runs as) because the deployment step impersonates that runtime service account to create or update the service. Without the `iam.serviceAccountUser` permission, the deployment fails with a permission denied error, even if the Cloud Build SA has full Cloud Run admin rights.

Answer

`roles/run.admin` only.

Answer

`roles/owner` to ensure all necessary permissions are covered.

Answer

`roles/cloudbuild.builds.editor` on the Cloud Run project.

Question 9

A developer frequently switches between three GCP projects and accounts throughout the day. They want to avoid rerunning `gcloud init` each time. Which gcloud feature lets them save and switch between pre-configured project/account/region combinations?

Accepted Answer

gcloud named configurations created with `gcloud config configurations create`. `gcloud config configurations` allow a developer to create, save, and switch between named sets of gcloud properties (project, account, region, zone) without re-running `gcloud init`. Each configuration stores its own active account, project ID, and default compute region/zone, and can be activated instantly with `gcloud config configurations activate <name>`, making it ideal for frequent context switching between multiple GCP projects and accounts.

Answer

gcloud environments — a built-in workspace manager

Answer

Separate gcloud installations — one per project

Answer

A .gcloudrc file in each project directory that gcloud reads automatically

Question 10

A team deploys a new version of their application using a blue-green strategy on GKE. The 'green' deployment is running but still in testing. When ready, traffic should instantly switch from 'blue' to 'green' with rollback possible in seconds. How is the instant switch implemented?

Accepted Answer

Update the Service's label selector from 'version: blue' to 'version: green'. In a blue-green deployment on GKE, the Service acts as a stable network endpoint abstracting the underlying Pods. By changing the Service's label selector from 'version: blue' to 'version: green', traffic is instantly routed to the green Pods without any downtime or need to recreate resources. This allows immediate rollback by simply reverting the selector back to 'version: blue'.

Answer

Delete the blue Deployment and create the green Deployment as the replacement

Answer

Update the Deployment's container image tag — GKE automatically performs a blue-green rollout

Answer

Use kubectl patch to update the Service's ClusterIP to point to the green Deployment

Question 11

Your organization uses Cloud Identity to manage users. A new employee joins and needs access to a GCP project. What is the correct sequence to grant access?

Accepted Answer

Add the user to Cloud Identity, then grant the appropriate IAM role in the project.. First, you add the user to Cloud Identity (if not already there). Then, in the GCP project, you grant an IAM role to the user. Cloud Identity provides the user account; IAM grants permissions. You cannot skip adding to Cloud Identity.

Answer

Grant the user an IAM role directly; Cloud Identity is not required.

Answer

Create a service account for the user and grant roles to the service account.

Answer

Add the user to a Cloud Identity group, then grant the group an IAM role.

Question 12

A Cloud Architect needs to understand the GCP resource hierarchy to set up proper access control. Which three resources are part of the GCP resource hierarchy? (Choose THREE.)

Accepted Answer

Folder. The GCP resource hierarchy includes Organization, Folder, Project, and Resources (like VMs). Cloud Identity and Billing Account are separate services.

Answer

Billing Account

Answer

Cloud Identity

Question 13

A team wants to grant three developers access to view Cloud SQL instance details and connection strings, but not create, delete, or modify any Cloud SQL instances. Which predefined IAM role is the most appropriate?

Accepted Answer

Cloud SQL Viewer. The Cloud SQL Viewer role (roles/cloudsql.viewer) grants read-only permissions to view Cloud SQL instance details, including connection strings, without allowing any create, delete, or modify operations. This matches the requirement precisely, as it provides the necessary visibility while preventing any changes to the instances.

Answer

Cloud SQL Editor

Answer

Cloud SQL Client

Answer

Project Viewer

Question 14

A company wants to run a batch job that processes files from a Cloud Storage bucket and writes results to BigQuery. The job runs once daily and can take up to 30 minutes. Which compute option is the most cost-effective and requires the least operational overhead?

Accepted Answer

Cloud Run jobs. Cloud Functions is event-driven, but for scheduled batch jobs, Cloud Run or Compute Engine are better. However, Cloud Run offers serverless execution with per-second billing and scales down to zero. It is cost-effective for short-lived jobs and requires minimal operational overhead.

Answer

GKE Autopilot cluster

Answer

Cloud Functions (2nd gen)

Answer

Compute Engine with a preemptible VM

Question 15

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is designed for exactly this use case — petabyte-scale, low-latency (single-digit ms), high-throughput NoSQL storage for time-series, IoT, and financial data. It scales horizontally by adding nodes. BigQuery is optimised for analytics (seconds-to-minutes latency), Cloud SQL is for OLTP (limited to tens of thousands of QPS), and Firestore is for document data with hierarchical structure.

Answer

BigQuery

Answer

Firestore

Answer

Cloud Spanner