Google ACE Practice Test 23 — 15 Questions

Question 1

A company wants to run a containerized application on Google Cloud with minimal operational overhead. The application is stateless and can tolerate cold starts. Which three compute services should they consider? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GKE Autopilot. Cloud Run, Cloud Functions, and GKE Autopilot are all serverless or fully managed container platforms with minimal operational overhead. Compute Engine and GKE Standard require node management.

Answer

Compute Engine

Answer

GKE Standard

Question 2

A company uses Cloud SQL for PostgreSQL and wants to reduce costs for a development environment that is only used for 8 hours a day (Monday-Friday). The database is under 100 GB and does not require high availability. Which action is the most cost-effective?

Accepted Answer

Change the activation policy to ON_DEMAND. Cloud SQL supports activation policies: ALWAYS (runs 24/7) and ON_DEMAND (starts when a connection is made, stops after a period of inactivity). For development environments used only during business hours, ON_DEMAND can significantly reduce costs by stopping the instance when not in use.

Answer

Use a smaller machine type and add a read replica

Answer

Migrate to Cloud Spanner for better cost efficiency

Answer

Enable deletion protection and manually stop the instance after hours, start it before hours

Question 3

A company wants to store archival data that is accessed less than once a year. The data must be preserved for 10 years. Which Cloud Storage storage class is most cost-effective?

Accepted Answer

Archive. Archive class is the lowest-cost storage for data accessed less than once a year, with a 365-day minimum storage duration. Coldline is slightly more expensive but for less than once a year, Archive is better.

Answer

Standard

Answer

Nearline

Answer

Coldline

Question 4

A healthcare company uses GCP to store sensitive patient data in Cloud Storage buckets. Their security policy requires that all data access be logged and that any attempt to access data from outside the corporate network is blocked. They have implemented VPC Service Controls to create a service perimeter around the projects containing the buckets. They have also enabled Data Access audit logs. However, during an audit, they find that a few access attempts from an IP address outside the corporate network succeeded. The logs show that the requests were made using service account credentials. The service account has the storage.objectViewer role on the bucket. The VPC Service Controls perimeter is configured to block all access from outside the perimeter, but the logs show that some requests were allowed. What is the most likely reason?

Accepted Answer

The VPC Service Controls perimeter was configured with an access level that permits certain IP ranges.. VPC Service Controls can be configured with access levels that define allowed client IP ranges. If the access level permits the IP addresses from which the service account requests originated, those requests would be allowed even though they come from outside the corporate network. The logs confirm that the requests used service account credentials, and the storage.objectViewer role grants read access, so the only remaining control that could have been bypassed is the VPC Service Controls perimeter — and an overly permissive access level is the most likely cause.

Answer

The bucket is outside the service perimeter.

Answer

The service account is a member of the perimeter.

Answer

The VPC Service Controls perimeter does not block requests made by service accounts.

Question 5

A developer wants to deploy a Cloud Function that processes images uploaded to a Cloud Storage bucket. The function should be triggered automatically when an object is created. What is the best practice for setting up this trigger?

Accepted Answer

Create a Cloud Function with a Cloud Storage trigger and specify the bucket and event type. Cloud Functions natively supports Cloud Storage triggers via the `google.storage.object.finalize` event type, which fires when a new object is created in the specified bucket. This is the simplest and most reliable approach, as it eliminates the need for intermediate services and ensures low-latency, event-driven invocation directly from the storage layer.

Answer

Use a Pub/Sub topic and a push subscription to invoke the Cloud Function

Answer

Use a Compute Engine instance to watch the bucket and call the function

Answer

Set up a Cloud Scheduler job to periodically scan the bucket and invoke the function

Question 6

Based on the exhibit, which type of traffic will successfully reach the instance?

Accepted Answer

HTTP traffic from the internet (port 80). The exhibit shows a firewall rule allowing inbound HTTP traffic (port 80) from 0.0.0.0/0, which permits any source on the internet to reach the instance on that port. Firewall rules in Google Cloud are stateful, so the corresponding outbound return traffic is automatically allowed. No other rule permits HTTPS or all traffic, and the implicit deny-all rule blocks anything not explicitly allowed.

Answer

HTTPS traffic (port 443) from the internet

Answer

All inbound traffic

Answer

No traffic; the deny-all rule takes effect

Question 7

A DevOps engineer creates a service account for a CI/CD pipeline. The pipeline needs to push container images to Artifact Registry. Which role grants the minimum required permission?

Accepted Answer

Artifact Registry Writer. The Artifact Registry Writer role provides the minimal permissions needed to push container images to Artifact Registry, specifically the `artifactregistry.writer` permission. This role allows writing artifacts without granting broader administrative or read-only access, aligning with the principle of least privilege.

Answer

Artifact Registry Administrator

Answer

Storage Object Creator on the underlying Cloud Storage bucket

Answer

Artifact Registry Reader

Question 8

A startup processes uploaded videos — each video upload triggers transcoding that takes 5–30 minutes. Users should get an immediate response after upload, not wait for transcoding. The transcoding system must handle burst uploads. Which architecture fits?

Accepted Answer

Publish a transcoding job to Cloud Pub/Sub after upload; respond immediately; workers consume and process jobs asynchronously. It decouples the upload from the transcoding process using Cloud Pub/Sub, allowing the API to respond immediately to the user while workers asynchronously process the transcoding jobs. This pattern handles burst uploads by buffering messages in Pub/Sub and scaling workers independently, ensuring no upload is lost even under high load.

Answer

Upload the video and synchronously wait for transcoding to complete before responding

Answer

Use Cloud Spanner to store video metadata and transcode synchronously in a Cloud SQL stored procedure

Answer

Deploy the transcoding directly in the API server and scale the API server horizontally for bursts

Question 9

A platform team is deploying a multi-tier application on GKE: a frontend Deployment, a backend Deployment, and a Redis StatefulSet. The backend must be reachable by name from the frontend, but not from outside the cluster. Which Kubernetes resource enables internal name-based service discovery?

Accepted Answer

A ClusterIP Service for the backend. A ClusterIP Service exposes the backend Pods on a stable, internal IP address that is only reachable from within the GKE cluster. The frontend can resolve the backend by the Service's DNS name (e.g., `backend.default.svc.cluster.local`) using the cluster's internal DNS (CoreDNS), enabling name-based service discovery without exposing the backend to external traffic.

Answer

A NodePort Service for the backend

Answer

A LoadBalancer Service for the backend

Answer

A Kubernetes Ingress resource for the backend

Question 10

You are setting up billing for a new GCP project. You want to receive an alert when the projected cost for the month exceeds 80% of your budget. You also want to be notified if the actual cost reaches 100%. Which budget alert thresholds should you set?

Accepted Answer

Set a single alert at 80% and another at 100%. Budget alerts can be set at specific percentages, but only whole numbers are allowed. Typically, you set alerts at 80% and 100%. The 80% alert is for projected cost, and 100% is for actual cost.

Answer

Set a single alert at 100% and use the 'forecast' option to get projected cost alerts

Answer

Set alerts at 50%, 80%, and 100%

Answer

Set a single alert at 80% for projected cost; GCP automatically alerts at 100%

Question 11

A security team wants to ensure that all Compute Engine instances in a project automatically use a custom service account with minimal permissions. What must the engineer do when creating new instances?

Accepted Answer

Use gcloud compute instances create with the --service-account flag pointing to the custom service account.. When creating a Compute Engine instance, you can specify a custom service account using the --service-account flag. This attaches the service account to the instance and grants the associated IAM roles. The instance will use the custom service account instead of the default compute engine service account.

Answer

Create a custom role and assign it to the instance's service account through the instance metadata.

Answer

Set the project-wide default service account to the custom service account in the project settings.

Answer

Create a startup script that configures the instance to use the custom service account after boot.

Question 12

A DevOps engineer needs to grant a service account the ability to pull images from a specific Container Registry repository in project 'my-project'. The service account is in project 'other-project'. Which command should the engineer use?

Accepted Answer

gcloud projects add-iam-policy-binding my-project --member serviceAccount:sa@other-project.iam.gserviceaccount.com --role roles/storage.objectViewer. Cross-project IAM bindings require the resource owner project (my-project) to grant access to the service account principal. The correct command is 'gcloud projects add-iam-policy-binding' on the resource project.

Answer

gcloud projects add-iam-policy-binding my-project --member user:admin@other-project.com --role roles/storage.objectViewer

Answer

gcloud iam service-accounts add-iam-policy-binding sa@other-project.iam.gserviceaccount.com --member serviceAccount:sa@other-project.iam.gserviceaccount.com --role roles/storage.objectViewer

Answer

gcloud projects add-iam-policy-binding other-project --member serviceAccount:sa@other-project.iam.gserviceaccount.com --role roles/storage.objectViewer

Question 13

You need to grant a user the ability to view audit logs for a project but not modify any resources. Which predefined IAM role should you assign?

Accepted Answer

roles/logging.viewer. The roles/logging.viewer role provides read-only access to logs, including audit logs. roles/iam.securityReviewer provides read access to IAM policies but not logs. roles/viewer is too broad. roles/owner is administrative.

Answer

roles/iam.securityReviewer

Answer

roles/owner

Answer

roles/viewer

Question 14

An engineer is tasked with creating a new VPC network for a production environment. The company requires the VPC to support multiple regions and allow custom IP address ranges for each subnet. Which VPC network mode should the engineer use?

Accepted Answer

Custom mode VPC. Custom mode VPC allows full control over subnets, including custom IP ranges per region. Auto mode creates subnets in each region with predefined IP ranges, which may not meet production requirements. Shared VPC is for sharing across projects, not for a single project's network.

Answer

Shared VPC

Answer

Auto mode VPC

Answer

Legacy mode VPC

Question 15

A team is setting up a new project and wants to estimate the monthly cost of running a Compute Engine VM with 4 vCPUs, 16 GB memory, and a 100 GB persistent disk, using the Google Cloud Pricing Calculator. The VM will run for 12 hours every day for a month. Which discount type will automatically apply to reduce the cost based on usage?

Accepted Answer

Sustained use discount. Sustained use discounts automatically apply for VMs that run for a significant portion of a month. Committed use discounts require a commitment. Preemptible discounts are for short-lived VMs. Free tier is limited.

Answer

Preemptible VM discount

Answer

Committed use discount

Answer

Free tier discount