Google ACE Practice Test 25 — 15 Questions

Question 1

Arrange the steps to create a Cloud Pub/Sub topic, subscription, and publish a message.

Accepted Answer

Create topic -> Create subscription -> Publish message -> Pull message. The correct sequence ensures the topic and subscription exist before any messages are published, and messages are retrieved only after they have been published. This order prevents errors and message loss in Google Cloud Pub/Sub.

Answer

Create subscription -> Create topic -> Publish message -> Pull message

Answer

Create topic -> Publish message -> Create subscription -> Pull message

Answer

Create topic -> Create subscription -> Pull message -> Publish message

Question 2

A security auditor needs read-only access to Compute Engine instance metadata but should not be able to start or stop instances. Which predefined IAM role should be assigned?

Accepted Answer

roles/compute.viewer. The roles/compute.viewer role grants read-only access to Compute Engine resources, including instance metadata, without allowing write operations such as starting or stopping instances. This matches the requirement for read-only metadata access while preventing instance lifecycle changes.

Answer

roles/compute.instanceAdmin.v1

Answer

roles/compute.admin

Answer

roles/compute.networkAdmin

Question 3

Refer to the exhibit. After applying this IAM policy to a bucket, what access is granted?

Accepted Answer

Anyone authenticated with a Google account can list and read objects. The IAM policy grants the `roles/storage.objectViewer` role to `allAuthenticatedUsers`, which includes any identity authenticated with a Google account (including non-GCP accounts). The condition `resource.name.startsWith('projects/_/buckets/example-bucket/objects/public/')` restricts the grant to objects whose path starts with `public/`, so only those objects can be listed and read. This is why option A is correct.

Answer

No access is granted because the condition is missing

Answer

Only users in the same GCP project can read objects

Answer

Anyone on the internet can list and read objects

Question 4

A company runs a web application on Compute Engine instances behind a load balancer. They want to automatically scale the number of instances based on CPU utilization. Which two resources must they create? (Choose TWO.)

Accepted Answer

Managed instance group (MIG) with autoscaling policy. Option C is correct because a managed instance group (MIG) is the Compute Engine resource that actually performs autoscaling; you attach an autoscaling policy based on CPU utilization to the MIG, and it adds or removes VM instances to match the target utilization. Option E is correct because a MIG requires an instance template to define the machine type, boot disk image, network, and other configuration used when creating each new VM instance. Together, the instance template defines what to create and the MIG with an autoscaling policy defines how many to run and when to scale. Options A, B, and D are not required: a Cloud Storage bucket, Cloud SQL instance, and Cloud Function are unrelated to Compute Engine horizontal autoscaling and are not prerequisites for scaling instances behind a load balancer based on CPU.

Answer

Cloud Storage bucket

Answer

Cloud SQL instance

Answer

Cloud Function

Question 5

You need to create a dashboard in Cloud Monitoring that shows: (1) Cloud Run request count per second, (2) Cloud Run p99 latency, (3) GKE pod CPU utilization, and (4) Cloud SQL query duration — all on a single screen. Which Cloud Monitoring feature enables this multi-service overview?

Accepted Answer

Create a Cloud Monitoring custom dashboard with chart widgets for each metric across the different services.. Cloud Monitoring custom dashboards allow you to combine chart widgets from multiple monitored services (Cloud Run, GKE, Cloud SQL) into a single screen. This feature supports heterogeneous metric queries using the Monitoring Query Language (MQL) or metric selectors, enabling a unified view without needing separate tools or exports.

Answer

Create four separate alerting policies and pin them to a shared alerting page.

Answer

Use BigQuery to query the metrics export and build a Looker Studio dashboard.

Answer

Use Cloud Logging to create a log-based dashboard with all four metrics.

Question 6

Your team uses Cloud Logging to store application logs. You want to create a metric that counts the number of ERROR log entries per service. Which type of log-based metric should you create?

Accepted Answer

Counter metric. A counter metric in Cloud Logging counts the number of log entries that match a filter. To count ERROR log entries per service, you create a log-based counter metric with a filter like severity=ERROR and a label extractor for the service name. Counter metrics are the correct type for tallying occurrences over time.

Answer

Distribution metric

Answer

Boolean metric

Answer

Gauge metric

Question 7

Which Google Cloud service provides a managed, scalable, and secure way to store API keys, passwords, and certificates?

Accepted Answer

Secret Manager. Secret Manager is a fully managed Google Cloud service designed specifically for storing, managing, and accessing sensitive data such as API keys, passwords, and certificates. It provides versioning, fine-grained IAM access control, automatic replication, and audit logging, making it the ideal choice for secret storage. Unlike Cloud KMS, which manages encryption keys, Secret Manager stores the secrets themselves. Cloud IAM handles identity and access management, not secret storage, and Cloud Storage is a general object store not optimized for secrets.

Answer

Cloud Key Management Service (Cloud KMS)

Answer

Cloud IAM

Answer

Cloud Storage

Question 8

Match each Google Kubernetes Engine (GKE) concept to its definition.

Accepted Answer

Pod: Smallest deployable unit that runs one or more containers.. In GKE, a Pod is the smallest unit, a Service provides stable network access to Pods, a Deployment manages Pod updates, and a Node is a worker machine. Common confusions involve swapping Pod and Service definitions.

Answer

Pod: An abstraction that defines a logical set of Pods and a policy to access them.

Answer

Service: Smallest deployable unit that runs one or more containers.

Question 9

You want to view the current IAM policy for a project in JSON format using the gcloud command-line tool. Which command should you run?

Accepted Answer

gcloud projects get-iam-policy --format json. The command 'gcloud projects get-iam-policy --format json' retrieves the IAM policy for a project in JSON format. This command directly fetches the policy bindings and audit configs for the specified project.

Answer

gcloud iam service-accounts get-iam-policy <service-account> --format json

Answer

gcloud iam policies get <project-id> --format json

Answer

gcloud projects describe <project-id> --format json

Question 10

A company wants to use Customer-Managed Encryption Keys (CMEK) for a Cloud SQL instance. What must be done first?

Accepted Answer

Create a Cloud KMS key ring and key, and grant the Cloud SQL service account the cloudkms.cryptoKeyEncrypterDecrypter role.. To use Customer-Managed Encryption Keys (CMEK) with Cloud SQL, you must first create a Cloud KMS key ring and key, then grant the Cloud SQL service account the cloudkms.cryptoKeyEncrypterDecrypter role. This allows Cloud SQL to use the key to encrypt the instance's data at rest. The service account must have permission to use the key for encryption and decryption operations.

Answer

Create a bucket and upload a key file.

Answer

Enable Cloud KMS API and use default encryption.

Answer

Set the --disk-encryption-key flag to an existing key in Cloud KMS.

Question 11

A data scientist wants to deploy a Python function that processes messages from a Pub/Sub topic whenever a new message arrives. The function should be stateless and run in a serverless environment. Which deployment command should be used?

Accepted Answer

gcloud functions deploy my-function --runtime python39 --trigger-topic my-topic --entry-point my_entry --region us-central1. The correct command is 'gcloud functions deploy' with '--trigger-topic', which deploys a Cloud Function (2nd gen or 1st gen) that is invoked by Pub/Sub messages. This matches the requirement for a stateless, serverless function triggered by a Pub/Sub topic. The runtime and entry point flags are also correctly specified.

Answer

gcloud run deploy my-function --source . --region us-central1 --trigger-topic my-topic

Answer

gcloud pubsub subscriptions create my-sub --topic my-topic --push-endpoint https://my-function-url

Answer

gcloud functions deploy my-function --runtime python39 --trigger-http --entry-point my_entry --region us-central1

Question 12

Match each GCP networking concept to its description.

Accepted Answer

Firewall Rule: A set of rules that control incoming and outgoing traffic to instances. VPC is a global network, Subnet is regional, Firewall rules control traffic, Cloud Router uses BGP for hybrid connectivity, and VPC Peering connects VPCs privately.

Answer

VPC: A regional IP address range within a VPC

Answer

Subnet: A global, isolated virtual network within Google Cloud

Question 13

You need to drain a GKE node for maintenance, ensuring that daemonsets and pods using emptyDir volumes are handled properly. Which command should you use?

Accepted Answer

kubectl drain NODE --ignore-daemonsets --delete-emptydir-data. kubectl drain with flags ignores daemonsets and deletes emptyDir pods.

Answer

kubectl taint nodes NODE key=value:NoSchedule

Answer

kubectl delete node NODE

Answer

kubectl cordon NODE && kubectl delete pods --all

Question 14

An engineer is configuring a Cloud NAT to allow private Compute Engine instances to access the internet. After creating the Cloud Router and NAT gateway, the instances still cannot connect to the internet. What is the most likely missing configuration?

Accepted Answer

The VPC does not have a default route (0.0.0.0/0) to the default internet gateway.. Cloud NAT requires that the subnet has Private Google Access enabled for certain Google APIs, but for general internet access, the instances must have a default route to the internet gateway (0.0.0.0/0 next hop to default internet gateway). If this route is missing, traffic won't be sent to NAT. The other options are possible but less common.

Answer

The firewall rules do not allow egress traffic.

Answer

The Cloud Router is in a different region.

Answer

The instances are not assigned a network tag used by the NAT.

Question 15

A company wants to manage multiple GCP projects with different configurations (e.g., different regions and accounts) on the same workstation. Which gcloud feature should they use to switch between these configurations?

Accepted Answer

Configuration profiles. gcloud configurations (configuration profiles) are named sets of properties such as account, project, region, and zone that can be activated with `gcloud config configurations activate <name>`. This lets one workstation cleanly switch between projects and accounts without re-running setup. It is the intended mechanism for managing multiple GCP contexts.

Answer

Environment variables

Answer

gcloud init each time

Answer

Multiple gcloud installations