Google ACE Practice Test 23 — 15 Questions

Question 1

A project manager wants to see how much each GCP service is costing the team this month, broken down by service. Where should they look?

Accepted Answer

Billing > Reports (filtered by service). The Billing > Reports page in the Google Cloud Console allows you to filter costs by service, SKU, project, and other dimensions. This provides a granular breakdown of monthly spending per GCP service, which is exactly what the project manager needs.

Answer

IAM & Admin > Quotas

Answer

Cloud Monitoring > Cost metrics dashboard

Answer

Resource Manager > Project settings > Cost summary

Question 2

A data analytics team needs to run a Spark job on a schedule. They want to minimize operational overhead and only pay for resources used during job execution. Which service should they use?

Accepted Answer

Use Dataproc workflow templates with scheduled execution. Dataproc workflow templates allow you to define a Spark job as a workflow and schedule its execution using Cloud Scheduler or a cron-like mechanism. This minimizes operational overhead by automatically provisioning a cluster, running the job, and tearing down the cluster when finished, ensuring you only pay for resources used during execution.

Answer

Create a Dataproc cluster and keep it running for ad-hoc jobs

Answer

Provision Compute Engine instances with Spark installed and start/stop them manually

Answer

Use BigQuery for all analytics

Question 3

You need to audit all IAM policy changes in your project. You want to ensure that every change is logged with the identity of the user who made the change. Which type of audit log should you enable?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (also known as Cloud Audit Logs) record all API calls that modify the configuration or metadata of resources, including IAM policy changes. These logs capture the identity of the user who made the change, the time of the change, and the specific modification, ensuring full accountability for administrative actions.

Answer

Data Access audit logs

Answer

Policy Denied audit logs

Answer

System Event audit logs

Question 4

A company is using BigQuery for analytics. They notice that queries are slow and expensive. The data is loaded daily into a single table. Which action would most improve performance and reduce cost?

Accepted Answer

Partition the table by date and cluster by frequently filtered columns.. Partitioning the table by date allows BigQuery to prune partitions during query execution, scanning only the relevant daily data instead of the entire table. Clustering on frequently filtered columns further reduces the data scanned by sorting data within partitions. This directly reduces both query cost (pay-per-byte) and latency, addressing the core issue of slow, expensive queries on a large daily-loaded table.

Answer

Use a flat-rate reservation to improve query concurrency.

Answer

Denormalize the table to reduce joins.

Answer

Increase the number of slots available for the project.

Question 5

A team is using Terraform to manage infrastructure in Google Cloud. After running terraform apply, they receive an error: 'Error 409: Resource already exists'. The team needs to resolve this without deleting and recreating the resource. What should they do?

Accepted Answer

Import the existing resource into Terraform state with 'terraform import'.. The 'Error 409: Resource already exists' indicates that the resource was created outside of Terraform or the state file lost track of it. Running 'terraform import' brings the existing resource under Terraform management by adding its current attributes to the state file, allowing subsequent operations without deletion or recreation.

Answer

Run 'terraform refresh' to update the state file.

Answer

Set the 'create_before_destroy' lifecycle rule on the resource.

Answer

Change the resource name in the Terraform configuration.

Question 6

The company wants to change the storage class of these log files to Nearline to reduce costs while still retaining the ability to access them without restoration fees. Which command should be used?

Accepted Answer

gsutil rewrite -s NEARLINE gs://my-bucket/logs/*.log. The `gsutil rewrite` command is specifically designed to change the storage class of existing objects without incurring restoration fees. It rewrites the object metadata to the new storage class (Nearline) while keeping the object in place, and the operation does not require retrieving the object from cold storage, so no restoration charges apply.

Answer

gsutil cp -s NEARLINE gs://my-bucket/logs/*.log

Answer

gsutil setmeta -s NEARLINE gs://my-bucket/logs/*.log

Answer

gsutil mv -s NEARLINE gs://my-bucket/logs/*.log

Question 7

A company is using Cloud NAT to allow private instances to access the internet. However, they notice that traffic from different instances appears to come from the same external IP address. What is the reason?

Accepted Answer

Cloud NAT uses a single external IP by default unless you specify multiple.. Cloud NAT uses a source network address translation (SNAT) configuration that, by default, maps all outbound traffic from instances in a VPC network to a single external IP address. This is the expected behavior unless you explicitly configure multiple NAT IP addresses in a NAT gateway or use a Cloud Router with custom SNAT settings. Option B correctly identifies that Cloud NAT defaults to a single external IP unless you specify multiple.

Answer

Cloud NAT is not configured correctly; traffic should come from different IPs.

Answer

The instances are using a shared VPC so NAT IP is shared.

Answer

Each instance is assigned a unique external IP by Cloud NAT.

Question 8

An organization is running a batch job that processes sensitive data. The job writes output to a Cloud Storage bucket. The security team requires that all data at rest be encrypted with a customer-managed key. Which key type should be used?

Accepted Answer

Cloud KMS CMEK. Cloud KMS CMEK (Customer-Managed Encryption Keys) is the correct choice because it allows the organization to control and manage the encryption keys used to protect data at rest in Cloud Storage, meeting the security team's requirement for customer-managed keys. CMEK keys are created and managed in Cloud KMS, and you can control key rotation, access, and lifecycle, ensuring compliance with regulatory mandates for customer-managed encryption.

Answer

Cloud HSM

Answer

Default encryption (Google-managed)

Answer

Customer-supplied encryption keys (CSEK)

Question 9

A company is migrating a legacy monolithic application to Google Cloud. The application runs on a single VM and contains both the web server and backend processes. The team wants to separate concerns and deploy the web tier on Cloud Run and the backend on Compute Engine. They need to allow the Cloud Run service to initiate HTTPS connections to the backend VM. What is the most secure way to accomplish this?

Accepted Answer

Use Serverless VPC Access to connect Cloud Run to the VPC, and keep the VM internal. Serverless VPC Access creates a direct, private connection between Cloud Run and your VPC, allowing the Cloud Run service to reach the backend VM using its internal IP address. This avoids exposing the VM to the public internet, which is the most secure approach for initiating HTTPS connections between the two tiers.

Answer

Assign a public IP to the backend VM and configure firewall rules to allow HTTPS from any source

Answer

Set up a VPN tunnel between Cloud Run and the VPC

Answer

Use Cloud NAT to provide outbound internet access to Cloud Run

Question 10

A company has a VPC with several Compute Engine instances that only have internal IPs. These instances need to download updates from the internet. What is the recommended method to provide internet access without assigning external IPs to each instance?

Accepted Answer

Configure Cloud NAT in the same region and subnet.. Cloud NAT (Network Address Translation) allows instances with only internal IPs to initiate outbound connections to the internet, while preventing inbound connections from the internet. It translates the internal IPs to a shared external IP address, enabling secure internet access without assigning external IPs to each instance. This is the recommended method for providing internet access to private instances in Google Cloud.

Answer

Use VPC Network Peering with a public network.

Answer

Set up a Cloud VPN gateway to route traffic to on-premises.

Answer

Place the instances behind an external HTTP(S) load balancer.

Question 11

A company wants to deploy a containerized web application on Google Kubernetes Engine (GKE) with minimal operational overhead. They require automatic scaling based on CPU utilization. Which resource should they configure?

Accepted Answer

HorizontalPodAutoscaler. The HorizontalPodAutoscaler (HPA) is the correct resource because it automatically scales the number of pod replicas in a GKE deployment based on observed CPU utilization (or other custom metrics). This directly meets the requirement for automatic scaling with minimal operational overhead, as HPA is a native Kubernetes controller that adjusts replica counts without manual intervention.

Answer

Cluster autoscaler

Answer

VerticalPodAutoscaler

Answer

Node auto-provisioning

Question 12

Refer to the exhibit. A user runs `gcloud compute instances list` in Cloud Shell and gets the output 'Listed 0 items.' The user expects to see the VM they just created via the Console. What is the most likely cause?

Accepted Answer

The Cloud Shell is in a different project. The `gcloud compute instances list` command lists VM instances in the currently configured project (set via `gcloud config set project`). If the Cloud Shell is pointing to a different project than the one where the VM was created via the Console, the command will return 'Listed 0 items' even though the VM exists. This is the most likely cause because the user expects to see the VM but the command is scoped to a different project context.

Answer

The VM was created in a different region

Answer

The VM is stopping

Answer

The user does not have compute.instances.list permission

Question 13

Arrange the steps to create a Compute Engine instance with a custom service account in the correct order.

Accepted Answer

First create the custom service account, then grant the appropriate IAM roles to it, and finally create the Compute Engine instance specifying that service account.. The service account must exist before attaching to an instance; instance creation is the final step.

Answer

First grant IAM roles to a service account, then create the service account, and finally create the Compute Engine instance with that service account.

Answer

First create the Compute Engine instance, then create the custom service account, and finally grant IAM roles to the service account.

Answer

First create the custom service account, then create the Compute Engine instance with that service account, and finally grant IAM roles to the service account.

Question 14

Refer to the exhibit. A user attempts to create a Deployment Manager deployment that references a service account. What is the most likely issue?

Accepted Answer

The user does not have the roles/iam.serviceAccountUser role on the service account. When a Deployment Manager deployment references a service account, the user must have the `roles/iam.serviceAccountUser` role on that service account to impersonate it. Without this role, the deployment fails even if the user has `deploymentmanager.deployments.create` permission, because the service account is used to execute the deployment's resources. Option B correctly identifies this missing IAM binding as the most likely issue.

Answer

The user does not have deploymentmanager.deployments.create permission

Answer

The service account is disabled

Answer

The service account does not exist

Question 15

Order the steps to attach a persistent disk to a running Compute Engine instance and format/mount it.

Accepted Answer

Attach the disk to the instance, SSH into the instance, format the disk (if needed), then mount the disk.. The correct sequence for attaching a persistent disk to a running Compute Engine instance and formatting/mounting it is: first attach the disk to the instance using gcloud or the console, then SSH into the instance, format the disk (e.g., with mkfs) if it is new, and finally mount it to a directory (e.g., using mount). This ensures the disk is available and prepared for use.

Answer

Format the disk, attach the disk to the instance, SSH into the instance, then mount the disk.

Answer

SSH into the instance, attach the disk, format the disk, then mount the disk.

Answer

Attach the disk, SSH into the instance, mount the disk, then format the disk.