Google ACE Practice Test 25 — 15 Questions

Question 1

A Cloud Run service has been running for weeks. A sudden spike in 5xx errors appears in Cloud Monitoring. The team wants to view the actual request logs to identify which endpoint is failing. Where should they look?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Logging Logs Explorer — filter by resource type 'cloud_run_revision'. Cloud Logging's Logs Explorer is the correct place to view actual request logs for a Cloud Run service. It allows filtering by resource type 'cloud_run_revision' and by HTTP status codes (e.g., 5xx) to identify which specific endpoint is failing. Cloud Monitoring Metrics Explorer shows aggregated metrics, not individual log entries, so it cannot pinpoint the exact endpoint.

Answer

Cloud Monitoring Metrics Explorer — filter by request_count metric with error status

Answer

Cloud Trace — filter by 5xx response code

Answer

Cloud Debugger — set a snapshot at the error handler

Question 2

Which gcloud command creates a Compute Engine VM named 'web-01' using the e2-medium machine type in zone us-central1-a?

Accepted Answer

gcloud compute instances create web-01 --zone=us-central1-a --machine-type=e2-medium. The `gcloud compute instances create` command is the proper syntax for creating a Compute Engine VM, and it requires the `--machine-type` flag (not `--machine`) to specify the machine type. The zone is specified with `--zone`, and the VM name is provided as a positional argument.

Answer

gcloud vm create web-01 --zone=us-central1-a --machine=e2-medium

Answer

gcloud instances create web-01 --region=us-central1 --type=e2-medium

Answer

gcloud compute create-instance web-01 --zone=us-central1-a --size=e2-medium

Question 3

A developer wants to deploy a Cloud Function that is triggered by messages in a Pub/Sub topic. Which TWO flags are required in the gcloud functions deploy command?

Accepted Answer

--runtime. For a Pub/Sub-triggered Cloud Function, you must specify --trigger-topic and --runtime. The --entry-point is optional if the function name matches. --memory and --timeout are optional.

Answer

--timeout

Answer

--memory

Answer

--entry-point

Question 4

An organization wants to deploy a containerized web application on Google Cloud with minimum operational overhead. The application should scale to zero when not in use and only incur costs when serving requests. Which service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform that scales to zero, charges only for request processing time, and abstracts infrastructure management. GKE requires cluster management and nodes always running. App Engine Flexible requires at least one instance always running. Compute Engine requires full VM management.

Answer

App Engine Flexible Environment

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine with container-optimized OS

Question 5

A DevOps engineer is configuring a managed instance group (MIG) for a stateless web application. They want to ensure that when new instances are created via rolling update or autoscaling, a startup script runs to install security patches and deploy the latest application code from a Cloud Storage bucket. What is the BEST way to achieve this?

Accepted Answer

Add the script to the instance template using the metadata key 'startup-script'. Using the instance template's metadata key 'startup-script' is the simplest and most reliable method to run custom scripts on instance startup. A custom image requires more maintenance. SSH from Cloud Shell is not automated. A startup script as part of the instance template is the standard approach.

Answer

Create a custom image with pre-installed patches and code, and use that image in the template

Answer

After the MIG is created, use gcloud compute ssh to run the script on each instance

Answer

Store the script in Cloud Storage and use gcloud compute instances add-metadata on each instance

Question 6

A team has a Docker container image locally and wants to push it to Google Artifact Registry. They've already authenticated Docker with GCP. The registry host is 'us-central1-docker.pkg.dev'. Which commands correctly tag and push the image?

Accepted Answer

docker tag myimage us-central1-docker.pkg.dev/myproject/myrepo/myimage:v1 && docker push us-central1-docker.pkg.dev/myproject/myrepo/myimage:v1. It uses the standard Docker CLI workflow: first tagging the local image with the full Artifact Registry path (including the registry host, project, repository, and image name with tag), then pushing it. Since the team has already authenticated Docker with GCP, the `docker push` command will authenticate via the Docker credential helper and upload the image to the specified Artifact Registry repository.

Answer

gcloud artifacts docker push myimage --location=us-central1 --repository=myrepo

Answer

docker push gcr.io/myproject/myimage:v1

Answer

gcloud container images push myimage:v1 --region=us-central1

Question 7

Which gcloud command is used to deploy a Cloud Function triggered by HTTP requests?

Accepted Answer

gcloud functions deploy my-function --runtime python39 --trigger-http. The command 'gcloud functions deploy' with --trigger-http creates an HTTP-triggered function. --runtime specifies the language runtime. --trigger-topic is for Pub/Sub triggers.

Answer

gcloud functions call my-function --data '{"key":"value"}'

Answer

gcloud run deploy my-function --source . --platform managed

Answer

gcloud functions deploy my-function --runtime python39 --trigger-topic my-topic

Question 8

A team is using Terraform to manage GCP infrastructure. They want to store the state file in a Cloud Storage bucket with versioning enabled. Which backend configuration is correct?

Accepted Answer

terraform { backend "gcs" { bucket = "my-bucket" prefix = "terraform/state" } }. To use Cloud Storage as a backend, you must specify 'bucket' and optionally 'prefix' for the state file path. The provider block is for the Google provider, not state storage.

Answer

provider "google" { backend "gcs" { bucket = "my-bucket" } }

Answer

terraform { backend "gcs" { bucket = "my-bucket" versioning = true } }

Answer

terraform { backend "cloud-storage" { bucket = "my-bucket" } }

Question 9

A company is using Cloud NAT to allow private Compute Engine instances to access the internet. They notice that traffic from some instances is not being NATed. What is the most likely cause?

Accepted Answer

The instances have external IP addresses assigned.. Cloud NAT only applies to instances that do not have external IP addresses. If an instance has an external IP, it will use that IP for outbound traffic and bypass Cloud NAT.

Answer

The Cloud Router is not configured correctly.

Answer

The firewall rules block egress traffic.

Answer

The instances are in a different region than the Cloud NAT gateway.

Question 10

A developer needs to create a zonal GKE cluster with 3 nodes of type e2-standard-4 in zone us-central1-a. Which command should they use?

Accepted Answer

gcloud container clusters create my-cluster --zone=us-central1-a --num-nodes=3 --machine-type=e2-standard-4. The correct command creates a zonal cluster (single zone) with specified node count and machine type. The --region flag creates a regional cluster, which is not required.

Answer

gcloud compute instances create my-cluster --zone=us-central1-a --machine-type=e2-standard-4 --num-nodes=3

Answer

gcloud container clusters create my-cluster --zone=us-central1-a --num-nodes=1 --machine-type=e2-standard-4

Answer

gcloud container clusters create my-cluster --region=us-central1 --num-nodes=3 --machine-type=e2-standard-4

Question 11

A company wants to allow unauthenticated HTTP invocations of a container deployed on Cloud Run. Which flag should be included in the 'gcloud run deploy' command?

Accepted Answer

--allow-unauthenticated. The '--allow-unauthenticated' flag allows unauthenticated invocations. By default, Cloud Run requires authentication.

Answer

--public

Answer

--no-authentication

Answer

--auth-type public

Question 12

An engineer needs to view the logs generated by a Cloud Run service to troubleshoot a recent deployment. Which service should they use?

Accepted Answer

Cloud Logging. Cloud Logging (formerly Stackdriver Logging) is the unified logging service for Google Cloud. Cloud Run logs are automatically sent to Cloud Logging.

Answer

Cloud Monitoring

Answer

Error Reporting

Answer

Cloud Trace

Question 13

A developer has a Kubernetes Deployment manifest in a file named 'api-deployment.yaml'. Which command creates the Deployment if it doesn't exist, or updates it if it does?

Accepted Answer

kubectl apply -f api-deployment.yaml. `kubectl apply -f api-deployment.yaml` uses a declarative approach: it creates the Deployment if it does not exist, or performs a rolling update if it already exists, by applying the desired state defined in the YAML manifest. This command leverages the Kubernetes API's server-side apply logic, merging changes without requiring the resource to be deleted first.

Answer

kubectl create -f api-deployment.yaml

Answer

kubectl run api-deployment.yaml

Answer

kubectl deploy -f api-deployment.yaml

Question 14

A compliance team needs a log of every time a user or service account accessed data in a BigQuery dataset — specifically read operations. Which Cloud Audit Log type captures this?

Accepted Answer

Data Access audit logs. Data Access audit logs record API calls that read or modify user-provided data, including BigQuery read operations like SELECT queries. Since the requirement is specifically for read operations on user data, Data Access logs are the correct type. Admin Activity logs cover configuration changes, not data reads, and System Event logs cover Google-managed actions, not user-initiated reads.

Answer

System event audit logs

Answer

Admin Activity audit logs

Answer

VPC flow logs

Question 15

A security audit found that several Cloud Storage buckets in your project have `allAuthenticatedUsers` in their IAM policy with `storage.objectViewer`. What does `allAuthenticatedUsers` grant, and why is it a security risk?

Accepted Answer

It grants read access to any person with a Google account — effectively near-public access since Google accounts are free to create.. `allAuthenticatedUsers` is a special IAM member that includes any person authenticated with a Google account, regardless of whether they belong to your organization or domain. Granting `storage.objectViewer` to this group means anyone with a free Google account (e.g., Gmail) can list and read objects in the bucket, making the data effectively public. This is a significant security risk because it exposes sensitive data to a vast, uncontrolled audience.

Answer

It grants access only to users within your Google Workspace domain — a minor risk if your domain is small.

Answer

It grants access only to Google service accounts, which is acceptable since those are controlled.

Answer

It grants access to authenticated GCP users in your organization's IAM policy — this is normal for shared resources.