Google ACE Practice Test 23 — 15 Questions

Question 1

A startup builds a serverless REST API using Cloud Functions (2nd gen). Each function invocation runs for 200ms on average, processes 5 million requests per day, and uses 256 MB memory. Approximately how should they estimate monthly Cloud Functions costs?

Accepted Answer

Estimate based on invocation count, compute time (memory × duration), and networking costs beyond the free tier. Option B is correct because Cloud Functions (2nd gen) pricing is based on three components: invocation count, compute time (measured in GB-seconds, which is memory multiplied by duration), and networking egress beyond the free tier. With 5 million requests per day at 200ms each and 256 MB memory, the monthly compute time is approximately 5,000,000 × 0.2 seconds × (256/1024) GB = 250,000 GB-seconds per day, or 7.5 million GB-seconds per month, which far exceeds the free tier of 400,000 GB-seconds per month, so costs will accrue. Additionally, the 150 million invocations per month exceed the free tier of 2 million invocations, and egress traffic will also incur charges beyond the 1 GB free tier.

Answer

Approximately $0 — all invocations fall within the free tier

Answer

Approximately the same as a continuously-running e2-medium VM — Cloud Functions and VMs are priced equivalently

Answer

Fixed monthly rate based on the number of deployed functions, not invocation count

Question 2

A team is migrating a stateful application with local disk writes to GKE. The application requires a dedicated persistent disk that follows the Pod if it's rescheduled to a different node. Which Kubernetes resource provides this?

Accepted Answer

A PersistentVolumeClaim backed by a GCE persistent disk StorageClass. A PersistentVolumeClaim (PVC) backed by a GCE persistent disk StorageClass is the correct choice because it provides a durable, network-attached block storage volume that persists independently of the Pod's lifecycle. When the Pod is rescheduled to a different node, the PVC ensures the GCE persistent disk is detached from the old node and reattached to the new node, preserving the application's state. This meets the requirement for a dedicated persistent disk that follows the Pod across rescheduling events.

Answer

A HostPath volume pointing to a directory on the node

Answer

A ConfigMap mounted as a volume

Answer

An emptyDir volume scoped to the Pod

Question 3

An organization is deploying a stateful application on Google Kubernetes Engine (GKE). The application requires persistent storage with high read/write performance and must be available across multiple zones for disaster recovery. Which storage solution should they use?

Accepted Answer

Regional persistent disk. Regional persistent disks provide synchronous replication across two zones in the same region, ensuring data availability during a zonal failure. They offer high read/write performance suitable for stateful applications and can be attached to GKE pods via PersistentVolumeClaims, meeting the requirement for multi-zone disaster recovery.

Answer

Cloud Filestore

Answer

Local SSD

Answer

Zonal persistent disk

Question 4

You need to monitor the CPU utilization across all instances in a managed instance group. What is the most efficient way to create an alerting policy?

Accepted Answer

Create an alerting policy in Cloud Monitoring for the metric 'compute.googleapis.com/instance/cpu/utilization'.. Option D is correct because Cloud Monitoring provides a pre-built metric, 'compute.googleapis.com/instance/cpu/utilization', which directly measures CPU usage for VM instances. Creating an alerting policy based on this metric is the most efficient approach, as it requires no custom scripting or external scheduling, and integrates natively with managed instance groups to aggregate data across all instances.

Answer

Create an alerting policy using the Logs Explorer to parse instance logs.

Answer

Use Cloud Scheduler to call the monitoring API periodically.

Answer

Set up a cron job to run gcloud compute instances list and check CPU.

Question 5

A company wants to deploy a new version of their application with zero downtime. They are using a managed instance group (MIG) behind a load balancer. Which deployment method should they use?

Accepted Answer

Perform a rolling update using a new instance template, with a health check. Option D is correct because a rolling update using a new instance template allows the managed instance group (MIG) to gradually replace instances with the new version while health checks ensure each new instance is healthy before proceeding. This maintains the desired capacity and avoids downtime, as the load balancer automatically directs traffic only to healthy instances throughout the process.

Answer

Create a new MIG, then update the load balancer's backend service

Answer

Delete the current MIG and create a new one with the updated template

Answer

Update the instance template and restart all instances

Question 6

A company uses Cloud Build to deploy a containerized application to a GKE cluster. The build process runs kubectl commands to apply Kubernetes manifests. The build fails with a 'Permission denied' error when executing kubectl. The Cloud Build service account has been granted roles/container.clusterAdmin and roles/cloudbuild.builds.builder. What is the most likely missing configuration?

Accepted Answer

Add the Cloud Build service account to the GKE cluster's RBAC. The Cloud Build service account has cluster-admin permissions via roles/container.clusterAdmin, but GKE uses Kubernetes RBAC for authorization within the cluster. The service account must be bound to a Kubernetes RBAC role (e.g., cluster-admin) via a ClusterRoleBinding to execute kubectl commands. Without this RBAC binding, the service account is authenticated but not authorized to perform actions, causing the 'Permission denied' error.

Answer

Grant the Cloud Build service account roles/iam.serviceAccountTokenCreator

Answer

Use a different Cloud Build trigger

Answer

Enable the Kubernetes Engine API

Question 7

A data analytics team needs to run a Spark job on a schedule. They want to minimize operational overhead and only pay for resources used during job execution. Which service should they use?

Accepted Answer

Use Dataproc workflow templates with scheduled execution. Option B is correct because Dataproc workflow templates allow you to define a Spark job as a workflow and schedule its execution using Cloud Scheduler or a cron-like mechanism. This minimizes operational overhead by automatically provisioning a cluster, running the job, and tearing down the cluster when finished, ensuring you only pay for resources used during execution.

Answer

Create a Dataproc cluster and keep it running for ad-hoc jobs

Answer

Provision Compute Engine instances with Spark installed and start/stop them manually

Answer

Use BigQuery for all analytics

Question 8

A company is using Cloud Storage to store sensitive data. They want to enforce that objects are automatically deleted after 90 days. Which configuration should they use?

Accepted Answer

Configure Object Lifecycle Management with a Delete action after 90 days.. Object Lifecycle Management allows you to set rules that automatically perform actions on objects after a specified number of days. By configuring a rule with a Delete action set to trigger after 90 days, objects in the bucket will be automatically removed, meeting the requirement without manual intervention.

Answer

Set a retention policy on the bucket for 90 days.

Answer

Enable bucket locking with a retention period of 90 days.

Answer

Enable object versioning and set a lifecycle rule to delete noncurrent versions.

Question 9

A developer has deployed a Cloud Run service but receives a 503 error when accessing it. The service logs show 'The request was aborted because there was no available instance.' What is the most likely cause?

Accepted Answer

The service is experiencing a spike in traffic and the max instances are too low.. The 503 error with the message 'The request was aborted because there was no available instance' indicates that all current instances are saturated and Cloud Run cannot scale up quickly enough to handle the incoming requests. This occurs when traffic spikes exceed the configured maximum number of instances, causing new requests to be rejected until an instance becomes free. Option C correctly identifies that the max instances setting is too low for the traffic spike.

Answer

The minimum number of instances is set too high.

Answer

The container health checks are failing.

Answer

The service's memory limit is set too low.

Question 10

A team uses Cloud Shell for all GCP CLI operations. A developer notices that files they create in Cloud Shell's home directory persist between sessions, but files in other directories do not. What explains this behavior?

Accepted Answer

Only $HOME (~) has persistent 5 GB storage; other directories use ephemeral container storage. Cloud Shell provides each user with a persistent 5 GB home directory ($HOME) backed by Cloud Storage. Files created outside this directory reside in the container's ephemeral storage, which is discarded when the Cloud Shell session ends or is restarted. This design ensures user configurations and scripts are preserved while maintaining a clean, temporary environment for other operations.

Answer

Cloud Shell saves all files to Cloud Storage automatically

Answer

Cloud Shell stores files in Firestore, which only retains home directory paths

Answer

Files outside $HOME are deleted after 24 hours automatically

Question 11

An organization has deployed a Compute Engine VM instance running a web server. The web server is not responding to HTTP requests from the internet. The firewall rules allow ingress traffic on port 80 and 443 from any source (0.0.0.0/0). The VM has a public IP address and is in a VPC network with default subnets. What is the most likely cause of the issue?

Accepted Answer

The web server service is not running on the VM.. Option B is correct because the most likely cause of the web server not responding to HTTP requests, despite correct firewall rules and a public IP, is that the web server service (e.g., Apache, Nginx) is not running on the VM. Firewall rules only control network traffic; they do not ensure that the application process is listening on the specified ports. A simple `sudo systemctl status apache2` or `netstat -tlnp` would confirm whether the service is active.

Answer

The VM does not have an HTTP health check configured.

Answer

The VPC network's default firewall rule blocks ingress traffic.

Answer

The VM is not in the same region as the global load balancer.

Question 12

Refer to the exhibit. A team has this IAM policy on a Cloud Storage bucket. The bucket contains sensitive data. Which action should the team take immediately?

Accepted Answer

Remove allUsers from the objectViewer binding.. Option B is correct because the IAM policy grants `allUsers` (anyone on the internet) the `objectViewer` role on the bucket, which allows unauthenticated read access to all objects. Since the bucket contains sensitive data, this is a critical security exposure that must be removed immediately by deleting the `allUsers` principal from the binding.

Answer

Add a condition to the objectViewer binding to restrict access.

Answer

Remove the entire objectViewer binding.

Answer

Change the objectViewer role to objectAdmin for allUsers.

Question 13

Refer to the exhibit. An engineer runs this command and sees the output. The instance is unable to reach the internet. What is the most likely reason?

Accepted Answer

The instance does not have a public IP address.. The instance cannot reach the internet because it lacks a public IP address. In Google Cloud, an instance without an external IP address cannot initiate outbound connections to the internet unless a Cloud NAT or a VM with a public IP is used as a proxy. The command output likely shows that the instance only has an internal IP, confirming this as the root cause.

Answer

VPC firewall rules are blocking egress traffic.

Answer

The instance needs a Cloud NAT gateway for outbound connectivity.

Answer

The subnetwork is misconfigured.

Question 14

Which feature of Cloud SQL provides automated backups and enables point-in-time recovery?

Accepted Answer

All Cloud SQL tiers. Cloud SQL provides automated backups and point-in-time recovery (PITR) for all tiers, including Cloud SQL Enterprise, Enterprise Plus, and even the basic (non-HA) configurations. This is because the backup and PITR functionality is a core feature of the Cloud SQL service itself, not tied to a specific tier or high-availability setup. Automated backups are enabled by default, and PITR uses binary log (binlog) files to allow restoration to any point within the backup retention window.

Answer

Only Cloud SQL Enterprise

Answer

Only Cloud SQL High Availability configuration

Answer

Only Cloud SQL Enterprise Plus

Question 15

Based on the exhibit, which type of traffic will successfully reach the instance?

Accepted Answer

HTTP traffic from the internet (port 80). Option C is correct because the exhibit shows a security group rule allowing inbound HTTP traffic (port 80) from 0.0.0.0/0, which permits any source on the internet to reach the instance on that port. Security groups in Google Cloud are stateful, so the corresponding outbound return traffic is automatically allowed. No other rule permits HTTPS or all traffic, and the implicit deny-all rule blocks anything not explicitly allowed.

Answer

HTTPS traffic (port 443) from the internet

Answer

All inbound traffic

Answer

No traffic; the deny-all rule takes effect