Google ACE Practice Test 2 — 25 Questions

Question 1

A Cloud Identity admin needs to grant a user access to manage billing for a specific GCP project without giving them access to any other projects in the organization. Which role should be assigned at the project level?

Accepted Answer

Project Billing Manager on the specific project. The Project Billing Manager role is the correct choice because it grants permissions to manage billing for a specific GCP project, including viewing billing reports and setting budget alerts, without providing access to other projects. This role is assigned at the project level, ensuring the user's billing management scope is limited to that single project.

Answer

Billing Account Administrator at the organization level

Answer

Editor on the specific project

Answer

Billing Account User at the billing account level

Question 2

An organization needs to ensure that only images from their approved Container Registry (gcr.io/approved-project) can be deployed on GKE clusters in their organization. Which GCP control enforces this?

Accepted Answer

Binary Authorization with a policy requiring attestation from the approved registry. Binary Authorization enforces deployment-time policies that require images to be signed by trusted authorities. By configuring a policy that requires attestations from the approved registry (gcr.io/approved-project), only images from that registry can be deployed on GKE clusters, directly meeting the requirement.

Answer

A VPC firewall rule blocking pulls from unauthorized registries

Answer

Cloud Armor rules blocking container pull requests from external sources

Answer

Manually reviewing all Docker images before deployment

Question 3

A managed instance group serves production traffic. During a rolling update to a new VM template, 30% of instances become unhealthy (failing health checks). The update has not completed yet. What should the team do to immediately restore service?

Accepted Answer

Pause the rolling update, then roll back using `gcloud compute instance-groups managed rolling-action rollback`. Option B is correct because the `gcloud compute instance-groups managed rolling-action rollback` command immediately reverts all instances in the managed instance group (MIG) to the previous template, restoring the known-good configuration. Pausing the update first stops the rollout from continuing to affect more instances, and the rollback command then replaces the unhealthy instances with the old template, allowing health checks to pass again.

Answer

Delete all unhealthy instances manually; the MIG will recreate them with the old template

Answer

Increase the target size of the MIG to dilute the unhealthy instances

Answer

Disable autohealing temporarily to prevent the MIG from restarting instances

Question 4

A SaaS company serves 200 enterprise customers, each requiring complete data isolation in separate databases. The company needs to provision a new customer database within minutes and manage 200 databases with minimal overhead. Which GCP approach scales most efficiently?

Accepted Answer

A single Cloud SQL instance with a separate schema (database) per customer, provisioned via API automation. Option B is correct because it uses a single Cloud SQL instance with separate schemas (databases) per customer, which allows you to achieve complete data isolation while minimizing overhead. Provisioning a new schema via API automation takes seconds, and managing 200 schemas on one instance is far more efficient than managing 200 separate instances. This approach scales efficiently because Cloud SQL supports up to 10,000 databases per instance, and you can leverage connection pooling and shared resources without sacrificing isolation.

Answer

200 separate Cloud SQL instances, one per customer

Answer

Storing all customer data in a single shared database with customer_id as a discriminator column

Answer

Using BigQuery with a separate dataset per customer

Question 5

A GCP project needs to allow outbound internet access from VMs that have only private IP addresses, without exposing those VMs to inbound internet traffic. Which GCP service provides this?

Accepted Answer

Cloud NAT configured on the VPC's Cloud Router. Cloud NAT (Network Address Translation) is the correct service because it allows VMs with only private IP addresses to initiate outbound connections to the internet while preventing any inbound connections from the internet. It works by translating the private source IP addresses of outbound packets to a set of ephemeral public IP addresses managed by Google, using the VPC's Cloud Router to dynamically allocate NAT IPs and ports. This meets the requirement of outbound-only internet access without exposing the VMs to inbound traffic.

Answer

Cloud VPN connecting the VPC to the internet

Answer

A VPC firewall rule allowing egress to 0.0.0.0/0 on all ports

Answer

An internal load balancer with internet routing enabled

Question 6

A team has a Docker container image locally and wants to push it to Google Artifact Registry. They've already authenticated Docker with GCP. The registry host is 'us-central1-docker.pkg.dev'. Which commands correctly tag and push the image?

Accepted Answer

docker tag myimage us-central1-docker.pkg.dev/myproject/myrepo/myimage:v1 && docker push us-central1-docker.pkg.dev/myproject/myrepo/myimage:v1. Option A is correct because it uses the standard Docker CLI workflow: first tagging the local image with the full Artifact Registry path (including the registry host, project, repository, and image name with tag), then pushing it. Since the team has already authenticated Docker with GCP, the `docker push` command will authenticate via the Docker credential helper and upload the image to the specified Artifact Registry repository.

Answer

gcloud artifacts docker push myimage --location=us-central1 --repository=myrepo

Answer

docker push gcr.io/myproject/myimage:v1

Answer

gcloud container images push myimage:v1 --region=us-central1

Question 7

A compliance requirement mandates that all VM-to-VM traffic within a GCP project must be encrypted in transit, even for internal VPC traffic. Which feature enforces this for Compute Engine?

Accepted Answer

Mutual TLS (mTLS) enforced at the application layer between VMs. Mutual TLS (mTLS) is the correct answer because it enforces encryption in transit for all VM-to-VM traffic within a GCP project, including internal VPC traffic, by requiring both sides to present certificates and establishing a TLS-encrypted session. GCP's internal mTLS feature, when enabled on a VPC network, automatically encrypts traffic between Compute Engine VMs using TLS 1.2 or higher, regardless of the application layer, ensuring compliance with encryption mandates without requiring application changes.

Answer

Shielded VMs with Secure Boot enabled

Answer

VPC firewall rules denying all non-encrypted traffic

Answer

Enabling VPC Flow Logs on all subnets

Question 8

A cost-conscious team notices their GKE cluster's node pools have consistently high memory utilization (>90%) while CPU remains at 30%. Pods are occasionally OOMKilled. What should they do to balance resource efficiency and stability?

Accepted Answer

Switch node pool machine type to a memory-optimized series (e.g., m2-ultramem) and ensure Pod memory requests are accurate. Option A is correct because the team has a memory-bound workload (high memory utilization, low CPU, OOMKills). Switching to a memory-optimized machine series (e.g., m2-ultramem) provides a higher memory-to-CPU ratio, directly addressing the memory pressure. Ensuring accurate Pod memory requests allows the scheduler to place Pods efficiently and prevents overcommitment, balancing resource efficiency with stability.

Answer

Increase CPU limits for all Pods to use the available CPU capacity

Answer

Enable vertical pod autoscaling (VPA) set to Recreate mode as the only change

Answer

Reduce the number of replica Pods to lower memory consumption

Question 9

A security team discovers that a service account key was accidentally committed to a public GitHub repository 48 hours ago. What should be the immediate steps to remediate this incident?

Accepted Answer

Delete the leaked key immediately, audit Cloud Audit Logs for unauthorized activity using the key, then create a new key or switch to keyless authentication. Option B is correct because the immediate priority is to revoke the compromised key's access by deleting it, which invalidates it instantly. Auditing Cloud Audit Logs is essential to detect any unauthorized usage that occurred during the 48-hour exposure window. Finally, creating a new key or switching to keyless authentication (e.g., workload identity federation) restores secure access without relying on long-lived static credentials.

Answer

Rotate the service account key to generate a new one, keeping the old key active briefly for transition

Answer

Change the service account's display name and email to invalidate the leaked key

Answer

Remove all IAM roles from the service account to deny all actions until the investigation completes

Question 10

A GCP project uses labels extensively for cost attribution across teams. A finance team member needs to add a 'cost-center' label to an existing Compute Engine VM. Which gcloud command applies the label?

Accepted Answer

gcloud compute instances add-labels my-vm --labels=cost-center=finance-ops --zone=us-central1-a. Option B is correct because the `gcloud compute instances add-labels` command is the specific gcloud command designed to add labels to an existing Compute Engine VM. It requires the `--labels` flag with key-value pairs and the `--zone` flag to specify the VM's location, which is necessary for the API call to succeed.

Answer

gcloud compute instances update my-vm --add-label=cost-center=finance-ops

Answer

gcloud label add --resource=my-vm --key=cost-center --value=finance-ops

Answer

gcloud compute instances set-labels my-vm --labels=cost-center=finance-ops

Question 11

A team is deploying a Cloud Function that requires a private environment variable containing an API key. They want the key stored securely and automatically injected at runtime. Which approach follows GCP best practices?

Accepted Answer

Store the key in Secret Manager and reference it as a secret environment variable in the function deployment. Option C is correct because Secret Manager is the GCP-native service designed to securely store API keys and other sensitive data. By referencing a secret as an environment variable in the Cloud Function deployment configuration, the key is automatically decrypted and injected at runtime without exposing it in source code or configuration files. This follows the principle of least privilege and ensures the secret is encrypted at rest and in transit.

Answer

Hardcode the API key in the function source code

Answer

Pass the API key as a plain-text environment variable in the function configuration

Answer

Store the API key in a Cloud Storage bucket and download it at function startup

Question 12

A team runs a Kubernetes Deployment with 3 replicas behind a Service. They want to expose it externally with HTTPS and route traffic based on URL paths (/api → backend service, / → frontend service). Which Kubernetes resource handles path-based routing at Layer 7?

Accepted Answer

A Kubernetes Ingress resource with path rules. A Kubernetes Ingress resource is the native API object designed for Layer 7 (HTTP/HTTPS) routing, including path-based routing. It allows you to define rules that map URL paths (e.g., /api, /) to different backend Services, and it typically works with an Ingress controller (e.g., NGINX, HAProxy) that terminates TLS and performs the routing. This directly meets the requirement for external HTTPS exposure and path-based traffic splitting.

Answer

A LoadBalancer Service with path routing rules

Answer

A NodePort Service with iptables path routing rules

Answer

Multiple ClusterIP Services with DNS SRV records for path routing

Question 13

A team's GCP project is approaching its monthly budget. They want to receive an email alert when spending reaches 80% and 100% of the $500 monthly budget. Which GCP feature sends these budget alerts?

Accepted Answer

Cloud Billing budget with alert thresholds set at 80% and 100%. Option C is correct because Cloud Billing budgets are the native GCP feature designed to monitor spending against a budget and send email alerts when actual or forecasted costs exceed user-defined thresholds (e.g., 80% and 100% of $500). This feature is configured directly in the Cloud Console or via the Billing API and automatically triggers notifications without requiring custom code or additional services.

Answer

Cloud Monitoring alerting policy on the billing/cost metric

Answer

A Cloud Scheduler job that queries the Billing API and sends an email when cost exceeds thresholds

Answer

Cloud Logging alert on billing cost log entries

Question 14

A developer accidentally grants the Owner role to a test service account on the production project. The team wants to remove only this specific IAM binding without affecting other members' access. Which gcloud command achieves this?

Accepted Answer

gcloud projects remove-iam-policy-binding [PROJECT] --member=serviceAccount:[SA_EMAIL] --role=roles/owner. Option B is correct because `gcloud projects remove-iam-policy-binding` is the precise command to remove a single IAM binding (member-role pair) from a project's policy without affecting other bindings. It takes the project ID, member (service account email), and role as parameters, ensuring only the specified binding is removed. This command modifies the existing policy by removing only that specific entry, leaving all other IAM bindings intact.

Answer

gcloud projects set-iam-policy [PROJECT] --member=serviceAccount:[SA] --role=roles/owner

Answer

gcloud iam remove-binding --project=[PROJECT] --member=[SA] --role=owner

Answer

gcloud projects delete-member [PROJECT] --member=serviceAccount:[SA_EMAIL]

Question 15

An internal web application running on GKE must be accessible only to employees who are authenticated with the company's Google Workspace account — without exposing it to the internet or using a VPN. Which GCP service provides identity-based access without a VPN?

Accepted Answer

Cloud Identity-Aware Proxy (IAP) configured on the load balancer in front of the GKE service. Cloud Identity-Aware Proxy (IAP) is the correct choice because it enforces identity-based access control at the application layer, verifying that users are authenticated via Google Workspace before allowing traffic to reach the GKE service through an HTTPS load balancer. This eliminates the need for a VPN or public internet exposure by leveraging Google's global infrastructure to authenticate and authorize each request based on the user's identity and context.

Answer

VPC Service Controls creating a perimeter around the GKE cluster

Answer

Firebase Authentication SDK integrated into the web application frontend

Answer

Cloud Armor with a Google Workspace IP allowlist

Question 16

A security team needs an inventory of all Compute Engine VM instances across all projects in their GCP organization, including instance names, zones, and status, without logging into each project individually. Which service provides this?

Accepted Answer

Cloud Asset Inventory with an organization-scoped asset search. Cloud Asset Inventory provides a unified, organization-scoped view of all resources across projects, including Compute Engine VM instances. By using an organization-scoped asset search, the security team can query for all VM instances (e.g., `asset_type = "compute.googleapis.com/Instance"`) without needing to log into each project individually. This service is purpose-built for cross-project resource discovery and inventory management.

Answer

Cloud Monitoring — use the metric explorer to list all VM instances

Answer

Cloud Resource Manager — list all projects and then query each for VMs

Answer

BigQuery information_schema views for GCP compute resources

Question 17

A Compute Engine VM with only a private IP address needs to download software updates from the internet (apt-get update). What must be configured in the VPC to enable outbound internet access for private VMs?

Accepted Answer

Configure Cloud NAT on the VPC's Cloud Router for the subnet. Cloud NAT (Network Address Translation) allows private VMs without external IP addresses to initiate outbound connections to the internet. It translates the VM's private IP to a public IP managed by Cloud NAT, enabling apt-get update to reach external repositories. This is the correct and scalable solution for outbound-only internet access from private instances.

Answer

Enable Private Google Access on the subnet

Answer

Add an external IP address to the VM temporarily for the update, then remove it

Answer

Create a VPC firewall rule allowing egress to 0.0.0.0/0 on port 80 and 443

Question 18

A CI/CD pipeline running outside GCP (on GitHub Actions) needs to authenticate to GCP to push images to Artifact Registry, without storing any long-lived service account key files. Which authentication mechanism achieves this?

Accepted Answer

Workload Identity Federation with GitHub Actions as the identity provider. Workload Identity Federation allows a GitHub Actions workflow to exchange a GitHub-issued OIDC token for a GCP access token, enabling authentication to Artifact Registry without storing any long-lived service account keys. This is the recommended approach for non-GCP CI/CD systems because it eliminates the security risk of managing static credentials while still granting fine-grained, short-lived access to GCP resources.

Answer

Store a service account JSON key as a GitHub Actions secret and use it in the workflow

Answer

OAuth 2.0 user credentials from a developer's Google account

Answer

API keys created for the Artifact Registry service

Question 19

Instead of granting IAM roles to 50 individual developer email addresses, a team wants to manage access by team membership. When a developer joins or leaves, access updates automatically. What is the recommended approach?

Accepted Answer

Grant IAM roles to a Google Group containing all team members. Option B is correct because Google Groups act as identity containers that can be granted IAM roles at the project or resource level. When developers are added to or removed from the group, their IAM permissions automatically update without requiring manual role changes for each individual user. This aligns with the principle of least privilege and simplifies access management at scale.

Answer

Create a service account shared by all developers on the team

Answer

Create a GCP project per developer and use cross-project IAM bindings

Answer

Use Cloud Identity-Aware Proxy to manage team membership

Question 20

A healthcare company stores patient data in Cloud Storage. Compliance requires that even GCP (Google) cannot decrypt this data. The company manages encryption keys entirely on their own infrastructure. Which encryption option satisfies this?

Accepted Answer

Customer-Supplied Encryption Keys (CSEK) provided with each API request. Option B is correct because Customer-Supplied Encryption Keys (CSEK) allow the customer to provide their own AES-256 encryption key with each API request to Cloud Storage. Google does not store the key; it is used only in memory to encrypt/decrypt the data and then discarded, ensuring that even Google cannot access the plaintext. This meets the compliance requirement that the customer retains exclusive control over the encryption keys.

Answer

Customer-Managed Encryption Keys (CMEK) stored in Cloud KMS

Answer

Google-managed encryption keys (default) with restricted IAM policies

Answer

Shielded VM with confidential computing for the VMs that access the data