Google ACE Practice Test 25 — 15 Questions

Question 1

Your organization uses Cloud Functions to process messages from a Pub/Sub topic. Each function processes a single message and writes results to BigQuery. Recently, the function has been timing out and the Pub/Sub subscription's unacknowledged message count is growing rapidly. The function's memory is set to 256 MB and timeout is 60 seconds. The function logs show occasional 'memory limit exceeded' errors. You suspect that the function is leaking memory when processing large messages. What should you do to resolve the issue while minimizing cost and complexity?

Accepted Answer

Increase the function's memory to 512 MB and timeout to 120 seconds.. The function is timing out and running out of memory due to large messages. Increasing memory to 512 MB provides more headroom for processing, and raising the timeout to 120 seconds gives the function enough time to complete without unnecessary cost. This directly addresses the memory leak and timeout issues while keeping complexity low.

Answer

Increase the function's memory to 1 GB and timeout to 540 seconds.

Answer

Set up a retry policy on the Pub/Sub subscription to dead-letter undelivered messages.

Answer

Increase the function's timeout to 120 seconds and reduce the batch size.

Question 2

An application architect is comparing Cloud SQL (PostgreSQL) and Cloud Spanner for a new global e-commerce platform. The platform must serve customers on three continents with <50ms latency for reads and strong consistency for inventory updates. Which service best fits?

Accepted Answer

Cloud Spanner multi-region configuration. Cloud Spanner multi-region configuration is the correct choice because it provides strong global consistency with <50ms read latency across continents, which is essential for an e-commerce platform requiring real-time inventory updates. Spanner uses TrueTime and Paxos-based replication to ensure ACID transactions globally, meeting both the latency and consistency requirements simultaneously.

Answer

Cloud SQL with one primary instance and cross-region read replicas

Answer

Cloud Firestore in multi-region mode

Answer

Cloud SQL with Cloud Memorystore caching layer for reads

Question 3

A GKE cluster hosts both a public-facing web application and an internal data processing service. The data processing service should only accept traffic from the web application Pods, not from the internet. Which Kubernetes feature enforces this policy?

Accepted Answer

Kubernetes NetworkPolicy restricting ingress to the data service to only Pods with the web app label. Kubernetes NetworkPolicy is the native Kubernetes resource that controls traffic flow at the IP address or port level (OSI layer 3 or 4). By defining an ingress rule that allows traffic only from Pods with a specific label (e.g., 'app: web-app'), you can restrict access to the data processing service exclusively to the web application Pods, regardless of whether the service is exposed via ClusterIP, NodePort, or LoadBalancer. This is the correct and recommended approach for pod-level network segmentation within a cluster.

Answer

A VPC firewall rule blocking external traffic to the data service's Node IPs

Answer

IAP (Identity-Aware Proxy) configured on the data service

Answer

Using a private ClusterIP Service for the data service — it's automatically private

Question 4

Your company runs a critical web application on Google Kubernetes Engine (GKE) with a regional cluster. The application uses a Cloud SQL instance for database. Recently, users have been experiencing intermittent connection timeouts. The application logs show database connection errors, but the Cloud SQL instance's CPU and memory usage are low. The GKE cluster and Cloud SQL are in the same region. You notice that the Cloud SQL instance is configured with a private IP address. What is the most likely cause of the timeouts?

Accepted Answer

The GKE cluster is not using a Private Service Connect endpoint to reach Cloud SQL.. The most likely cause is that the GKE cluster is not using a Private Service Connect endpoint to reach the Cloud SQL instance. When Cloud SQL uses a private IP, it is accessible only through a VPC network that has a Private Service Connect endpoint or a VPC peering connection to the Service Networking API. Without this endpoint, the GKE nodes cannot route traffic to the Cloud SQL private IP, leading to intermittent connection timeouts even though the instance itself is healthy.

Answer

The Cloud SQL instance is not configured with automatic failover.

Answer

The Cloud SQL instance's connection pool size is too small.

Answer

The GKE cluster's nodes are in a different VPC subnet than the Cloud SQL instance.

Question 5

A developer frequently switches between three GCP projects and accounts throughout the day. They want to avoid rerunning `gcloud init` each time. Which gcloud feature lets them save and switch between pre-configured project/account/region combinations?

Accepted Answer

gcloud named configurations created with `gcloud config configurations create`. Option B is correct because `gcloud config configurations` allow a developer to create, save, and switch between named sets of gcloud properties (project, account, region, zone) without re-running `gcloud init`. Each configuration stores its own active account, project ID, and default compute region/zone, and can be activated instantly with `gcloud config configurations activate <name>`, making it ideal for frequent context switching between multiple GCP projects and accounts.

Answer

gcloud environments — a built-in workspace manager

Answer

Separate gcloud installations — one per project

Answer

A .gcloudrc file in each project directory that gcloud reads automatically

Question 6

A team's application emits a custom business metric (orders per minute) via its code. They want to display this metric on a Cloud Monitoring dashboard and alert when it drops below 50 orders per minute. What must be done first?

Accepted Answer

Instrument the application to write the metric to the Cloud Monitoring API using a client library or OpenTelemetry. Option B is correct because Cloud Monitoring requires metrics to be explicitly ingested via its API or through OpenTelemetry. Custom metrics are not automatically available; the application must be instrumented to write the metric data (e.g., using the `cloud.google.com/go/monitoring` client library or OpenTelemetry exporter) to the Cloud Monitoring API. Without this step, the metric does not exist in Cloud Monitoring for dashboards or alerts.

Answer

Enable the Custom Metrics feature flag in the GCP Console under Cloud Monitoring settings

Answer

Create a log-based metric that extracts the orders value from application logs

Answer

Custom metrics require BigQuery — store values in BigQuery and link it to Cloud Monitoring

Question 7

A team wants to create a consistent backup of a Compute Engine VM's boot disk before applying a major OS patch. The backup should be usable to restore the disk to a new VM if the patch fails. What is the recommended approach?

Accepted Answer

Create a persistent disk snapshot using `gcloud compute disks snapshot`. Option B is correct because a persistent disk snapshot captures a point-in-time, crash-consistent backup of the disk, including the boot disk, without requiring the VM to be stopped. Snapshots are the recommended method for backing up persistent disks because they support incremental backups, can be used to create new disks, and are optimized for restore operations to a new VM. This approach ensures the backup is usable for disaster recovery if the OS patch fails.

Answer

Create a custom VM image from the running instance using `gcloud compute images create`

Answer

Copy all files to a Cloud Storage bucket using gsutil rsync

Answer

Enable live migration for the VM — it automatically backs up state before migrations

Question 8

A project was accidentally deleted. A GCP administrator realizes the mistake 3 days later. What is the maximum time window in which the project can be restored?

Accepted Answer

30 days — projects can be restored using `gcloud projects undelete` within this window. Option C is correct because Google Cloud projects have a 30-day soft-delete period after deletion. During this window, the project can be recovered using the `gcloud projects undelete` command or the Cloud Resource Manager API, restoring all associated resources and configurations.

Answer

24 hours — projects are permanently deleted after one day

Answer

7 days — projects enter a one-week soft-delete period

Answer

Projects are permanently deleted immediately and cannot be recovered

Question 9

A team is designing a system where two GCP projects — a shared services project and an application project — need their VMs to communicate using private IPs. Both projects are in the same organization. Which networking option best enables this with centralized network management?

Accepted Answer

Shared VPC (XPN) with the shared services project as the host. Shared VPC (XPN) allows an organization to centrally manage networking across multiple projects from a single host project, enabling VMs in the shared services project and the application project to communicate via private IPs without needing separate peering or VPN configurations. This is the best option because it provides centralized network administration and policy enforcement, which aligns with the requirement for centralized network management.

Answer

VPC Peering between the two projects' VPCs

Answer

Cloud VPN between the two projects' default VPCs

Answer

Using external IPs with TLS — private IP communication isn't necessary between GCP projects

Question 10

A GKE cluster running Kubernetes 1.27 needs to be upgraded to 1.29. The cluster has a stateful workload with a PodDisruptionBudget requiring at least 2 out of 3 replicas running at all times. What is the correct upgrade sequence?

Accepted Answer

Upgrade the control plane to 1.28 first, then 1.29; then upgrade node pools incrementally, respecting the PDB. Option B is correct because Kubernetes requires that the control plane be upgraded one minor version at a time (e.g., 1.27 → 1.28 → 1.29) to maintain API compatibility and stability. After the control plane is upgraded, node pools can be upgraded incrementally, and the PodDisruptionBudget (PDB) ensures that during node upgrades, at least 2 out of 3 replicas remain available, preventing workload disruption.

Answer

Upgrade node pools first, then upgrade the control plane

Answer

Delete and recreate the cluster at version 1.29 to skip incremental upgrades

Answer

Upgrade control plane directly from 1.27 to 1.29, then upgrade node pools

Question 11

A team deploys an application on GKE and needs it to be accessible at https://api.company.com with automatic TLS certificate provisioning. They use a Global external Application Load Balancer. What handles the TLS certificate?

Accepted Answer

A Google-managed SSL certificate attached to the load balancer's HTTPS target proxy. A Global external Application Load Balancer uses an HTTPS target proxy to terminate TLS. To automatically provision and renew TLS certificates for a custom domain, you attach a Google-managed SSL certificate to that target proxy. Google manages the entire lifecycle, including domain verification via Cloud DNS, so no manual certificate generation or third-party tools are needed.

Answer

The GKE cluster automatically generates a self-signed TLS certificate for the domain

Answer

Cloud DNS automatically provisions a TLS certificate when a domain is added

Answer

cert-manager in GKE automatically obtains Let's Encrypt certificates for the Ingress

Question 12

A team packages their Kubernetes application as a Helm chart. They need to install it into a GKE cluster with the release name 'webapp' in the 'production' namespace, overriding the default image tag to 'v2.1'. Which Helm command achieves this?

Accepted Answer

helm install webapp ./chart -n production --set image.tag=v2.1. Option B is correct because `helm install` is the standard Helm command to deploy a chart into a cluster, and the `--set` flag overrides default values like `image.tag`. The `-n` flag specifies the namespace, and the release name 'webapp' is given as the first argument. This matches the Helm CLI syntax exactly.

Answer

helm deploy webapp ./chart -n production --set image.tag=v2.1

Answer

kubectl apply -f helm-chart.yaml -n production --image-tag=v2.1

Answer

helm apply webapp -n production --chart=./chart --tag=v2.1

Question 13

A global web application serves static assets (images, JavaScript, CSS) from a Cloud Storage bucket via an HTTPS load balancer. Users in Asia report slow load times compared to users in the US where the bucket resides. What is the most effective solution?

Accepted Answer

Enable Cloud CDN on the load balancer backend pointing to the Cloud Storage bucket. Option B is correct because enabling Cloud CDN on the load balancer backend that points to the Cloud Storage bucket caches static assets at Google's globally distributed edge caches. This reduces latency for Asian users by serving content from a nearby point of presence (PoP) rather than from the origin bucket in the US, without requiring any bucket relocation or replication.

Answer

Move the Cloud Storage bucket to a multi-region bucket in Asia

Answer

Replicate the Cloud Storage bucket to multiple regions using storage transfer

Answer

Use Cloud Interconnect to provide dedicated bandwidth to Asian users

Question 14

Microservices in a GKE cluster need to discover each other by name without using public DNS. Service A calls Service B at `http://service-b.production.svc.cluster.local`. Which GCP/Kubernetes feature provides this internal DNS resolution?

Accepted Answer

Kubernetes cluster DNS (CoreDNS) resolving Service names within the cluster. Kubernetes cluster DNS, typically implemented by CoreDNS, is the built-in mechanism that resolves Service names like `service-b.production.svc.cluster.local` to the corresponding ClusterIP. This allows Pods to discover each other by name without relying on external or public DNS. CoreDNS runs as a Deployment in the kube-system namespace and automatically creates DNS records for every Service based on its name and namespace.

Answer

Cloud DNS private zone configured for the cluster's namespace

Answer

Anthos Service Mesh — required for service-to-service DNS

Answer

A custom /etc/hosts entry on each Pod

Question 15

A development team stores Docker images in Artifact Registry. A new team member needs to pull images to their local machine using Docker. Which command authenticates Docker to pull from a specific Artifact Registry repository in us-central1?

Accepted Answer

gcloud auth configure-docker us-central1-docker.pkg.dev. Option B is correct because `gcloud auth configure-docker` is the official Google Cloud command that configures Docker to authenticate to Artifact Registry. When you specify the registry location (e.g., `us-central1-docker.pkg.dev`), it updates Docker's configuration file with the appropriate credential helper, enabling Docker to automatically obtain and refresh short-lived access tokens for pulling images from that specific repository.

Answer

docker login us-central1-docker.pkg.dev --username=_json_key --password-stdin < key.json

Answer

kubectl create secret docker-registry artifactregistry --server=us-central1-docker.pkg.dev

Answer

gcloud artifacts docker auth --region=us-central1