Google ACE Practice Test 24 — 15 Questions

Question 1

A user wants to use gcloud to create a Cloud Storage bucket but receives a permission denied error. What is the most likely cause?

Accepted Answer

The user does not have storage.buckets.create permission. C is correct because Cloud Storage uses IAM permissions to control access to bucket creation. The specific permission required is `storage.buckets.create`, which must be granted at the project level. Without this permission, the gcloud command will fail with a permission denied error, even if the user is authenticated and billing is enabled.

Answer

The bucket name is already taken

Answer

The user is not authenticated

Answer

The project does not have billing enabled

Question 2

A company wants to migrate an on-premises MySQL database to Cloud SQL with minimal downtime. Which service should they use?

Accepted Answer

Database Migration Service. Database Migration Service (DMS) is the correct choice because it is specifically designed to migrate on-premises MySQL databases to Cloud SQL with minimal downtime using continuous replication. It handles schema conversion, data transfer, and ongoing sync until you cut over, ensuring near-zero downtime without manual intervention.

Answer

Cloud SQL for MySQL

Answer

Cloud SQL with external replicas

Answer

Compute Engine with MySQL installed

Question 3

A company is running a batch processing job on Compute Engine every night. The job usually completes in 2 hours, but recently it has been taking over 4 hours. The CPU utilization on the VM is consistently below 20%. What is the most likely cause?

Accepted Answer

The VM is running out of memory and swapping to disk.. When CPU utilization is below 20% but job execution time has doubled, the bottleneck is likely I/O, not compute. Swapping to disk occurs when the VM runs out of memory, causing the kernel to page memory to the persistent disk, which is orders of magnitude slower than RAM. This I/O wait directly increases job duration without raising CPU utilization.

Answer

The VM is using a shared-core machine type.

Answer

The VM's machine type is too small.

Answer

The VM's persistent disk is in a different zone.

Question 4

A developer wants to use Cloud Shell to create a Compute Engine VM but receives an error 'API not enabled'. What should the developer do first?

Accepted Answer

Enable the Compute Engine API. The error 'API not enabled' indicates that the Compute Engine API has not been activated for the developer's Google Cloud project. Cloud Shell uses the gcloud CLI, which requires the Compute Engine API to be enabled before it can create VM instances. The correct first step is to enable the Compute Engine API via the Cloud Console or the `gcloud services enable compute.googleapis.com` command.

Answer

Switch to a different region

Answer

Use gcloud auth login

Answer

Increase project quota

Question 5

A company uses preemptible VMs for batch processing. Which TWO best practices should be implemented to improve resilience and manageability? (Choose 2)

Accepted Answer

Use instance metadata to pass configuration parameters.. Instance metadata is a key-value store that can be used to pass configuration parameters to preemptible VMs at boot time. Since preemptible VMs can be terminated at any time, using metadata ensures that new instances can be recreated with the same configuration without manual intervention. This improves manageability by centralizing configuration and resilience by enabling automated re-provisioning.

Answer

Use persistent disks to store application state.

Answer

Use Cloud Functions to monitor instance termination.

Answer

Use persistent disk snapshots for backup.

Question 6

A team is deploying a stateful application on GKE that requires each pod to have its own persistent disk. Which TWO Kubernetes resources are essential for this deployment? (Choose two.)

Accepted Answer

StatefulSet. A StatefulSet is essential because it provides stable, unique network identifiers and ordered, graceful deployment and scaling for stateful applications, ensuring each pod maintains its identity and persistent storage binding across rescheduling. A PersistentVolumeClaim (PVC) is required to request and bind a persistent disk to each pod, enabling the pod to retain its data independently of other pods in the set.

Answer

Deployment

Answer

ConfigMap

Answer

Ingress

Question 7

A data engineering team is deploying a streaming Dataflow pipeline that reads from Pub/Sub and writes to BigQuery. They need to ensure that each event is processed exactly once, even in the event of failures. Which Dataflow feature should they use?

Accepted Answer

Rely on Dataflow's exactly-once processing guarantees. Dataflow's streaming engine provides built-in exactly-once processing guarantees for sources like Pub/Sub and sinks like BigQuery. This is achieved through a combination of checkpointing, deterministic replay, and idempotent writes, ensuring that each record is processed exactly once even during worker failures or pipeline updates. No additional configuration or external deduplication is required.

Answer

Enable at-least-once delivery on the Pub/Sub subscription

Answer

Set the Dataflow pipeline to use the 'exactly_once' parameter in the pipeline options

Answer

Use Cloud Functions to deduplicate messages before sending to Dataflow

Question 8

An organization needs to set up a new Google Cloud project with restricted access to only approved IP ranges for SSH into VMs. Which Google Cloud service should be used?

Accepted Answer

VPC Firewall Rules. VPC Firewall Rules (Option C) are the correct choice because they allow you to restrict inbound SSH (TCP port 22) traffic to specific source IP ranges by defining ingress rules at the VPC network level. This directly enforces IP-based access control for SSH into VM instances without additional services or proxies.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

Identity-Aware Proxy (IAP) TCP forwarding

Question 9

A company needs to store structured data with strong consistency and global distribution for a global user base. Which Google Cloud database service is best suited?

Accepted Answer

Cloud Spanner. Cloud Spanner is the correct choice because it provides strong consistency, horizontal scalability, and global distribution via synchronous replication across regions. It supports SQL queries and ACID transactions, making it ideal for structured data that requires both consistency and global access.

Answer

Bigtable

Answer

Cloud SQL

Answer

Firestore

Question 10

Which TWO actions should a DevOps engineer take to reduce egress costs when transferring large amounts of data from Compute Engine to Cloud Storage in the same region?

Accepted Answer

Use internal IP addresses for the Compute Engine instances.. Using internal IP addresses for Compute Engine instances ensures that traffic to Cloud Storage stays within Google's internal network, avoiding internet egress charges. When instances communicate with Cloud Storage using external IPs, the traffic is routed over the public internet, incurring egress costs. Internal IPs keep the data transfer on Google's backbone, which is free for same-region transfers.

Answer

Set up a VPN between the instances and Cloud Storage.

Answer

Use a multi-regional Cloud Storage bucket.

Answer

Configure a Cloud NAT gateway.

Question 11

Which THREE are valid ways to authenticate a user for gcloud commands? (Choose three.)

Accepted Answer

OAuth2 access token. An OAuth2 access token can be used to authenticate gcloud commands by passing it with the `--access-token-file` flag or via the `gcloud auth print-access-token` command. This token is obtained from an authorization server and provides temporary, scoped access to Google Cloud resources without requiring a long-lived credential like a service account key.

Answer

API key

Answer

IdP token

Question 12

A service account needs to be able to create snapshots of disks in a specific project and store them in a different project. What is the correct IAM policy configuration?

Accepted Answer

Grant roles/compute.snapshotAdmin on the source project and roles/storage.objectAdmin on the target bucket. Creating snapshots in one project and storing them in another requires distinct permissions: `roles/compute.snapshotAdmin` on the source project allows the service account to create snapshots, while `roles/storage.objectAdmin` on the target bucket (within the destination project) grants the necessary permissions to write snapshot data into the bucket. This separation follows the principle of least privilege and aligns with the cross-project snapshot workflow.

Answer

Grant roles/compute.storageAdmin on both projects

Answer

Grant roles/viewer on both projects

Answer

Grant roles/compute.instanceAdmin on the source project and roles/storage.objectAdmin on the target bucket

Question 13

Which console page would you use to create and manage custom IAM roles?

Accepted Answer

IAM & Admin > Roles. The IAM & Admin > Roles page in the Google Cloud Console is the dedicated interface for creating, editing, and managing custom IAM roles. Custom roles allow you to define a precise set of permissions that are not available in predefined roles, giving you granular control over access to Google Cloud resources. This page also lists all predefined and custom roles, and allows you to clone, delete, or update role definitions.

Answer

IAM & Admin > Audit Logs

Answer

IAM & Admin > Organization Policies

Answer

IAM & Admin > Service Accounts

Question 14

Which THREE options are valid methods to authenticate a service account when making calls to Google Cloud APIs from a Compute Engine instance?

Accepted Answer

Using a JSON key file downloaded for the service account.. A JSON key file downloaded for a service account contains the private key necessary to create a signed JWT assertion, which is exchanged for an OAuth 2.0 access token via the Google OAuth 2.0 token endpoint (https://oauth2.googleapis.com/token). This is a standard authentication method for service accounts outside of Google Cloud, but it is also valid from a Compute Engine instance, though less secure than using the metadata server.

Answer

Using a user account's OAuth2 tokens obtained via a web browser.

Answer

Using an API key generated from the Cloud Console.

Question 15

Order the steps to configure a Cloud Load Balancer (HTTP/S) in front of a Compute Engine instance group.

Accepted Answer

Create instance group, then health check, then backend service, then URL map, then target proxy, then forwarding rule.. Instance group and health check must exist before backend service; then frontend components.

Answer

Create backend service, then health check, then instance group, then URL map, then target proxy, then forwarding rule.

Answer

Create health check, then instance group, then backend service, then target proxy, then URL map, then forwarding rule.

Answer

Create forwarding rule, then target proxy, then URL map, then backend service, then health check, then instance group.