Google ACE Practice Test 24 — 15 Questions

Question 1

An organization is designing a VPC network with connectivity to an on-premises network via Cloud VPN. They have multiple projects that need to share the VPN. Which three steps are required to implement this using Shared VPC? (Choose three.)

Accepted Answer

Attach the service project to the host project.. Option A is correct because attaching the service project to the host project is a fundamental step in Shared VPC. This attachment allows the service project to use the host project's VPC network resources, including the Cloud VPN gateway and tunnels, enabling centralized connectivity without duplicating VPN infrastructure.

Answer

Enable the Shared VPC feature in the service project.

Answer

Create a Cloud Router in the service project.

Question 2

A startup needs to send transactional emails (order confirmations, password resets) from their GCP-hosted application. Which GCP service handles high-volume email delivery?

Accepted Answer

A third-party email delivery service such as SendGrid or Mailgun, integrated via API. B is correct because GCP does not provide a native high-volume transactional email service. Third-party email delivery services like SendGrid or Mailgun are designed specifically for this purpose, offering dedicated SMTP relays, APIs, and reputation management to ensure reliable delivery of transactional emails such as order confirmations and password resets.

Answer

Cloud Tasks with an email delivery queue

Answer

Cloud Pub/Sub with an email topic subscriber

Answer

Cloud Functions triggered by Gmail API webhooks

Question 3

A company wants to set up a cost-effective disaster recovery solution for a critical application running on Compute Engine. The primary region is us-east1. The recovery point objective (RPO) is 1 hour, and recovery time objective (RTO) is 4 hours. Which strategy is most cost-effective?

Accepted Answer

Cross-region replica of persistent disks using snapshot schedules every hour. Option C is the most cost-effective because it uses snapshot schedules to create cross-region replicas of persistent disks every hour, meeting the 1-hour RPO without requiring always-on compute resources. This approach minimizes costs by only storing incremental snapshots in Cloud Storage, while automated restore procedures can spin up instances in the secondary region within the 4-hour RTO.

Answer

Regular backups to Cloud Storage with automated scripts to restore in a different region

Answer

Use managed instance groups in two regions with autoscaling

Answer

Active-active multi-region deployment with HTTP load balancer

Question 4

A project manager wants to see how much each GCP service is costing the team this month, broken down by service. Where should they look?

Accepted Answer

Billing > Reports (filtered by service). Option C is correct because the Billing > Reports page in the Google Cloud Console allows you to filter costs by service, SKU, project, and other dimensions. This provides a granular breakdown of monthly spending per GCP service, which is exactly what the project manager needs.

Answer

IAM & Admin > Quotas

Answer

Cloud Monitoring > Cost metrics dashboard

Answer

Resource Manager > Project settings > Cost summary

Question 5

A company has a VPC with several Compute Engine instances that only have internal IPs. These instances need to download updates from the internet. What is the recommended method to provide internet access without assigning external IPs to each instance?

Accepted Answer

Configure Cloud NAT in the same region and subnet.. Cloud NAT (Network Address Translation) allows instances with only internal IPs to initiate outbound connections to the internet, while preventing inbound connections from the internet. It translates the internal IPs to a shared external IP address, enabling secure internet access without assigning external IPs to each instance. This is the recommended method for providing internet access to private instances in Google Cloud.

Answer

Use VPC Network Peering with a public network.

Answer

Set up a Cloud VPN gateway to route traffic to on-premises.

Answer

Place the instances behind an external HTTP(S) load balancer.

Question 6

A developer wants to deploy a containerized application that can scale to zero when not in use and only pay for resources consumed during request processing. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless compute platform that automatically scales your containerized applications from zero instances up to handle traffic, and scales back down to zero when there are no requests. You only pay for the resources (CPU, memory, and networking) consumed during request processing, with no charges when the service is idle. This makes it the ideal choice for the described use case of scaling to zero and pay-per-request billing.

Answer

App Engine Flexible Environment

Answer

Compute Engine with managed instance groups

Answer

Google Kubernetes Engine

Question 7

A batch processing job runs on preemptible VMs in a managed instance group. The job frequently fails due to preemption. Which design change would most effectively improve the job's resilience?

Accepted Answer

Use a managed instance group with distribution across multiple zones and enable autoscaling.. Option D is correct because distributing the managed instance group across multiple zones and enabling autoscaling ensures that when preemptible VMs are terminated in one zone, the autoscaler can provision replacement VMs in another zone that still has capacity. This architecture leverages the fact that preemption events are often zone-specific, so multi-zone distribution combined with autoscaling provides resilience without requiring persistent resources.

Answer

Use committed use discounts (1-year or 3-year).

Answer

Add GPUs to the instances.

Answer

Use sole-tenant nodes.

Question 8

A developer wants to use Cloud Shell to create a Compute Engine VM but receives an error 'API not enabled'. What should the developer do first?

Accepted Answer

Enable the Compute Engine API. The error 'API not enabled' indicates that the Compute Engine API has not been activated for the developer's Google Cloud project. Cloud Shell uses the gcloud CLI, which requires the Compute Engine API to be enabled before it can create VM instances. The correct first step is to enable the Compute Engine API via the Cloud Console or the `gcloud services enable compute.googleapis.com` command.

Answer

Switch to a different region

Answer

Use gcloud auth login

Answer

Increase project quota

Question 9

A service account needs to be able to create snapshots of disks in a specific project and store them in a different project. What is the correct IAM policy configuration?

Accepted Answer

Grant roles/compute.snapshotAdmin on the source project and roles/storage.objectAdmin on the target bucket. Option C is correct because creating snapshots in one project and storing them in another requires distinct permissions: `roles/compute.snapshotAdmin` on the source project allows the service account to create snapshots, while `roles/storage.objectAdmin` on the target bucket (within the destination project) grants the necessary permissions to write snapshot data into the bucket. This separation follows the principle of least privilege and aligns with the cross-project snapshot workflow.

Answer

Grant roles/compute.storageAdmin on both projects

Answer

Grant roles/viewer on both projects

Answer

Grant roles/compute.instanceAdmin on the source project and roles/storage.objectAdmin on the target bucket

Question 10

A company is migrating a legacy on-premises application to Google Cloud. The application stores structured transactional data in a relational database. The database currently handles 2,000 transactions per second (TPS) and is expected to grow to 10,000 TPS over the next year. The database size is 500 GB. The application requires strong consistency and the ability to run complex JOIN queries. Which Google Cloud database service should the company choose?

Accepted Answer

Cloud SQL for PostgreSQL. Cloud SQL for PostgreSQL is the correct choice because it provides a fully managed relational database with strong ACID compliance, support for complex JOIN queries, and can scale vertically or via read replicas to handle up to 10,000 TPS with proper configuration. The 500 GB database size is well within Cloud SQL's limits, and PostgreSQL's native support for complex joins meets the application's requirements without the operational overhead of self-managed databases.

Answer

Cloud Spanner

Answer

Cloud Bigtable

Answer

Cloud Firestore

Question 11

A company recently deployed a web application on a managed instance group (MIG) behind a regional external HTTP(S) load balancer. The application is a Python Flask app running on Compute Engine VMs. After a code update that caused increased response times under load, users report intermittent 503 errors. You examine the load balancer logs and see that the backend instances are periodically marked as unhealthy. The health check is configured to query the /health endpoint every 5 seconds with a healthy threshold of 2 and a timeout of 1 second. The application's /health endpoint returns 200 OK, but sometimes takes up to 1.5 seconds to respond. What is the most likely cause of the health check failures?

Accepted Answer

The health check response timeout is too low for the application's increased response time.. The health check is configured with a timeout of 1 second, but the /health endpoint now takes up to 1.5 seconds to respond due to the code update. Since the health check waits only 1 second for a response, any request that takes longer than that will be considered a failure, causing the backend to be marked unhealthy and triggering 503 errors. This is a classic mismatch between health check timeout and application response time.

Answer

The instances are overloaded and failing health checks intermittently.

Answer

The health check firewall rule is missing or misconfigured.

Answer

The health check is checking the wrong port.

Question 12

Your company runs a data processing pipeline on Cloud Dataproc. The pipeline reads data from Cloud Storage, processes it with Spark, and writes results to BigQuery. Recently, the pipeline has been failing with errors indicating insufficient disk space on the worker nodes. The cluster is configured with standard worker nodes with 100 GB of standard persistent disk. The data size being processed has grown from 50 GB to 150 GB. What is the most cost-effective way to resolve the disk space issue?

Accepted Answer

Enable automatic disk resizing for the cluster.. Option C is correct because Cloud Dataproc's automatic disk resizing feature dynamically increases the size of persistent disks on worker nodes when disk usage exceeds a threshold (default 90%). This resolves the insufficient disk space issue without manual intervention or additional cost for unused capacity, making it the most cost-effective solution for handling the increased data volume from 50 GB to 150 GB.

Answer

Increase the size of the persistent disks on the worker nodes to 200 GB.

Answer

Use local SSDs instead of persistent disks for temporary storage.

Answer

Increase the number of worker nodes in the cluster.

Question 13

Your company uses BigQuery for analytics. Users frequently run queries against a large, date-partitioned table containing sales data. The table has 10 TB of data and is partitioned by the 'order_date' column. Queries often filter on the 'customer_id' and 'region' columns in addition to the date range. You observe that queries are slow and expensive, even when scanning only a few partitions. Which optimization should you implement first?

Accepted Answer

Enable clustering on the 'customer_id' and 'region' columns.. Clustering on 'customer_id' and 'region' organizes the data within each partition based on these filter columns, allowing BigQuery to perform block-level pruning and skip irrelevant data even when scanning only a few partitions. This directly addresses the slowness and cost by reducing the amount of data read per query, without requiring additional storage or maintenance overhead.

Answer

Create materialized views for common queries.

Answer

Create views for each combination of filters.

Answer

Change partitioning to use ingestion time instead of 'order_date'.

Question 14

Your company recently migrated to GCP and you are the new cloud administrator. You need to ensure that only specific members of the DevOps team can perform administrative actions on Compute Engine instances, such as starting, stopping, and resetting instances, but not creating or deleting them. You also want to prevent them from modifying firewall rules or other network settings. The team consists of 10 members. You have already created a custom role with the necessary permissions and assigned it to a Google Group that contains all team members. However, you receive a report that a team member was able to accidentally delete a production instance. Upon investigation, you find that the team member had been granted the roles/compute.instanceAdmin role in addition to your custom role by another administrator. What should be the best course of action to prevent this from happening again while still allowing the team to perform their intended tasks?

Accepted Answer

Remove the compute.instanceAdmin role from the team member and audit all user assignments for role conflicts.. Option A is correct because the core issue is that the team member had an additional, more permissive role (roles/compute.instanceAdmin) that overrode the restrictions of your custom role. Removing that conflicting role from the specific user and auditing all assignments ensures that only the intended permissions are applied, preventing accidental deletions while preserving the team's ability to start, stop, and reset instances.

Answer

Create an organization policy to block deletion of compute instances.

Answer

Remove the custom role from the team member and keep only the compute.instanceAdmin role.

Answer

Use IAM conditions on the custom role to enforce that instances can only be stopped during business hours.

Question 15

A startup runs its application entirely on Cloud Run. They want to use a custom domain (api.mycompany.com) instead of the default Cloud Run URL. Which GCP feature maps a custom domain to a Cloud Run service?

Accepted Answer

Cloud Run Domain Mappings or a Global Load Balancer with a Serverless NEG. Option B is correct because Cloud Run Domain Mappings provide a native, managed way to map a custom domain to a Cloud Run service without additional infrastructure. Alternatively, a Global Load Balancer with a Serverless NEG (Network Endpoint Group) can also route traffic from a custom domain to Cloud Run, offering advanced features like SSL termination and traffic splitting. Both approaches are officially supported by Google Cloud for custom domain mapping.

Answer

Cloud DNS — create a CNAME record pointing to the Cloud Run URL

Answer

Cloud Endpoints with an API gateway configuration

Answer

Firebase Hosting rewrites to Cloud Run