Google ACE Practice Test 24 — 15 Questions

Question 1

A developer needs to create a Cloud Storage bucket that stores data for only 30 days and then automatically deletes it. Which feature should be used to achieve this?

Accepted Answer

Object lifecycle management. Object lifecycle management rules can automatically delete objects after a specified age. Bucket lock is for retention compliance, not deletion. Versioning keeps multiple versions. Requester pays shifts costs.

Answer

Object versioning

Answer

Requester pays

Answer

Bucket lock

Question 2

A security team wants to centrally identify misconfigured GCP resources across their organization — such as publicly accessible Cloud Storage buckets, unencrypted disks, and overly permissive firewall rules. Which GCP service provides these findings?

Accepted Answer

Security Command Center (SCC) with Security Health Analytics enabled. Security Command Center (SCC) with Security Health Analytics enabled is the correct service because it provides built-in, automated scanning for common misconfigurations such as publicly accessible Cloud Storage buckets, unencrypted disks, and overly permissive firewall rules. Security Health Analytics uses a set of pre-defined detectors (e.g., `PUBLIC_BUCKET_ACL`, `DISK_ENCRYPTION_DISABLED`, `FIREWALL_RULE_OPEN`) to continuously assess resources and surface findings in the SCC dashboard, without requiring custom code or manual queries.

Answer

Cloud Asset Inventory — query for all resources and write custom checks

Answer

Cloud Monitoring alert policies with metric conditions for firewall rule changes

Answer

Cloud Logging audit log analysis for admin activity changes

Question 3

A payment service publishes an event to a message queue every time a transaction completes. Multiple downstream services (inventory, analytics, email) must each process every event independently. Which messaging pattern and GCP service best supports this?

Accepted Answer

Cloud Pub/Sub with one subscription per downstream service on a shared topic. Cloud Pub/Sub with a single topic and one subscription per downstream service is the correct pattern because it implements a fan-out messaging model where each subscriber receives an independent copy of every published message. This ensures that inventory, analytics, and email services each process every transaction event without interference, while Pub/Sub handles at-least-once delivery and automatic scaling.

Answer

Cloud Tasks with one queue per downstream service

Answer

Cloud Storage event notifications with three separate buckets

Answer

Directly calling each downstream service's API synchronously from the payment service

Question 4

An operations team wants to count how many times the string 'PaymentFailure' appears in application logs per minute and alert when it exceeds 10 occurrences. Cloud Monitoring doesn't have a native metric for this log pattern. What is the correct approach?

Accepted Answer

Create a log-based metric in Cloud Logging with a filter matching 'PaymentFailure', then alert on it in Cloud Monitoring. Cloud Logging log-based metrics allow you to define a filter (e.g., `textPayload:"PaymentFailure"`) that counts matching log entries in real time, and Cloud Monitoring can directly create an alerting policy on that metric with a threshold of 10 occurrences per minute. This approach avoids custom code, external exports, or additional services, and it leverages the native integration between Cloud Logging and Cloud Monitoring.

Answer

Create a Cloud Monitoring custom metric and write values via the application's exception handler

Answer

Export logs to BigQuery and run a scheduled query counting PaymentFailure entries

Answer

Enable Cloud Trace and look for PaymentFailure in trace annotations

Question 5

An engineer wants to create a VPC with a custom subnet mode and then create a subnet with Private Google Access enabled. Which two commands should they use? (Choose TWO.)

Accepted Answer

gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24 --enable-private-ip-google-access. To create a custom mode VPC, use 'gcloud compute networks create' with '--subnet-mode custom'. Then add a subnet with 'gcloud compute networks subnets create' including '--enable-private-ip-google-access'. The other commands are incorrect: one creates an auto mode VPC, another is for firewall rules.

Answer

gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80

Answer

gcloud compute networks create my-vpc --subnet-mode auto

Question 6

A developer needs to run an interactive shell inside a running GKE Pod named 'api-pod-7d4f9' in the 'production' namespace to investigate a runtime issue. Which kubectl command opens an interactive shell?

Accepted Answer

kubectl exec -it api-pod-7d4f9 -n production -- /bin/bash. `kubectl exec -it` attaches an interactive terminal to a running container in a Pod, with `-i` for stdin and `-t` for a TTY. The `-- /bin/bash` launches a Bash shell inside the container, allowing the developer to investigate runtime issues. This is the standard Kubernetes method for interactive shell access.

Answer

kubectl ssh api-pod-7d4f9 -n production

Answer

kubectl run debug --image=busybox --attach=api-pod-7d4f9

Answer

gcloud container exec api-pod-7d4f9 --namespace=production -- bash

Question 7

A financial application requires a relational database with automatic failover to a standby in a different zone, with minimal configuration overhead. Which Cloud SQL configuration provides this?

Accepted Answer

Cloud SQL with High Availability (HA) configuration. Cloud SQL's High Availability (HA) configuration provides automatic failover to a standby instance in a different zone using synchronous replication and a regional persistent disk. This meets the requirement for minimal configuration overhead because it is a built-in feature that requires no application-level logic or manual intervention.

Answer

Cloud SQL with a read replica in a different zone

Answer

Cloud Spanner multi-region instance

Answer

Two separate Cloud SQL instances with application-level failover logic

Question 8

A production GKE cluster is running low on node resources. Pods are in Pending state because no node has sufficient CPU or memory. Without deleting existing Pods, what is the fastest way to resolve this?

Accepted Answer

Resize the node pool to add more nodes: `gcloud container clusters resize`. Resizing the node pool with `gcloud container clusters resize` immediately adds more nodes to the cluster, providing additional CPU and memory capacity. This allows the scheduler to place pending Pods without modifying or deleting existing workloads, making it the fastest solution that preserves running Pods.

Answer

Delete existing Pods to free resources for the Pending Pods

Answer

Change the Pending Pods' resource requests to zero

Answer

Upgrade the Kubernetes control plane version

Question 9

A GCP organization has recently experienced a credential theft incident involving a service account key. The CISO requires that all service account keys in the organization be inventoried and those older than 90 days be rotated. Which tool identifies old service account keys across all projects?

Accepted Answer

Cloud Asset Inventory querying all IAM ServiceAccountKey assets across the organization. Cloud Asset Inventory (CAI) is the correct tool because it can query all IAM ServiceAccountKey assets across the entire organization, including all projects, using a single API call or gcloud command. This allows you to filter by the `validAfterTime` field to identify keys older than 90 days, meeting the CISO's requirement for a comprehensive, automated inventory without manual per-project inspection.

Answer

Security Command Center — it audits service account key age automatically

Answer

Cloud Monitoring metric for service account key creation date

Answer

Manually check each service account in each project's IAM & Admin > Service Accounts page

Question 10

A DevOps engineer needs to deploy a new GKE Pod that mounts a ConfigMap named 'app-config' as environment variables. The ConfigMap already exists in the cluster. Which YAML snippet correctly references it?

Accepted Answer

envFrom: - configMapRef: name: app-config. The `envFrom` field with a `configMapRef` allows a Pod to load all key-value pairs from a ConfigMap as environment variables. This is the standard Kubernetes syntax for injecting ConfigMap data into a container's environment without specifying individual keys.

Answer

volumes: - name: config / configMap: name: app-config

Answer

env: - name: CONFIG / valueFrom: secretKeyRef: name: app-config

Answer

envFrom: - secretRef: name: app-config

Question 11

A regulated company requires a log of all actions taken by Google support engineers when they access customer GCP environments during support cases. Which Cloud Audit Log type captures this?

Accepted Answer

Access Transparency logs. Access Transparency logs are the correct choice because they specifically capture actions taken by Google support engineers when accessing customer data or configurations in GCP. These logs provide near real-time records of Google-initiated access, which is required for regulated companies to audit support personnel activities. Admin Activity logs only record administrative actions by customers, not Google personnel, while Data Access logs with Google-initiated access filter are not a valid log type in Cloud Audit Logs.

Answer

Admin Activity audit logs

Answer

Data Access audit logs with Google-initiated access filter

Answer

System event audit logs with personnel filter

Question 12

A startup's GCP project has a project ID of 'my-startup-prod' and a project number of '123456789012'. An API call requires the project number, not the project ID. How can the project number be retrieved quickly?

Accepted Answer

Run `gcloud projects describe my-startup-prod` and look for the projectNumber field. The `gcloud projects describe` command retrieves detailed metadata about a GCP project, including the `projectNumber` field, which is a unique numeric identifier assigned by Google Cloud. This is the standard method to quickly obtain the project number when only the project ID is known, as the project number is not derivable from the project ID.

Answer

The project number is always the same as the last 12 digits of the project ID

Answer

Run `gcloud config get-value project-number`

Answer

The project number appears in the URL bar of the GCP Console — it's the number after /project/

Question 13

A developer needs to use Application Default Credentials (ADC) in a local development environment to call the Cloud Translation API. They have already run `gcloud auth login`. What additional step is required to make ADC work correctly?

Accepted Answer

Run `gcloud auth application-default login` to generate ADC credentials.. `gcloud auth application-default login` creates a special credential file (typically at `~/.config/gcloud/application_default_credentials.json`) that Application Default Credentials (ADC) uses to authenticate API calls. While `gcloud auth login` sets up user credentials for gcloud CLI commands, ADC does not use those credentials directly; it requires its own separate credential file. Running this command ensures that the local development environment can authenticate to the Cloud Translation API via ADC without additional configuration.

Answer

Set the `GOOGLE_CLOUD_PROJECT` environment variable to the project ID.

Answer

Download a service account JSON key and set `GOOGLE_APPLICATION_CREDENTIALS`.

Answer

Run `gcloud config set account` to switch to the correct account.

Question 14

A distributed database running on GKE requires stable, persistent hostnames (pod-0, pod-1, pod-2) and ordered startup/shutdown for proper cluster initialization. Pods must retain their identity across restarts. Which Kubernetes resource is designed for this?

Accepted Answer

StatefulSet with a headless Service. StatefulSet is the correct resource because it provides stable, unique network identifiers (e.g., pod-0, pod-1, pod-2) via a headless Service, ordered startup and shutdown (pod-0 starts first, pod-2 terminates first), and persistent pod identity that survives restarts. These features are essential for distributed databases like Cassandra or ZooKeeper that require consistent hostnames and initialization order.

Answer

Deployment with pod affinity rules

Answer

DaemonSet with a unique hostname label on each node

Answer

ReplicaSet with a fixed replica count

Question 15

You need to allow inbound HTTP traffic to a set of Compute Engine instances that have the tag 'web-server'. All other inbound traffic should be denied. Which firewall rule configuration should you create?

Accepted Answer

Create an allow rule for tcp:80 with source range 0.0.0.0/0 and target tags 'web-server'. No deny rule is needed.. Firewall rules are stateful; you should create an allow rule for HTTP (tcp:80) with source range 0.0.0.0/0 and target tag 'web-server'. Implicit deny all inbound traffic is the default, so no explicit deny is needed.

Answer

Create an allow rule for tcp:80 with target tags 'web-server' and source range 0.0.0.0/0, and a deny rule for all other traffic.

Answer

Create an allow rule for tcp:80 with source range 0.0.0.0/0 and apply to all instances.

Answer

Create a deny rule for all ports except tcp:80 with target tags 'web-server'.