Google ACE Practice Test 4 — 25 Questions

Question 1

A managed instance group (MIG) is configured with autohealing using a health check. During a rolling update, several VMs become unhealthy before the new application version starts responding to health checks. The MIG deletes and recreates these VMs repeatedly, causing a deployment loop. How should you fix this?

Accepted Answer

Increase the `initialDelaySec` in the autohealing policy to give VMs time to start before health checks are evaluated.. Option B is correct because increasing `initialDelaySec` in the autohealing policy gives the new application version sufficient time to start and become healthy before the health check begins evaluating the VM. This prevents the MIG from prematurely marking VMs as unhealthy during the rolling update, breaking the deployment loop where VMs are repeatedly deleted and recreated.

Answer

Disable autohealing during rolling updates by removing the health check.

Answer

Switch from rolling update to canary update to reduce the number of affected VMs.

Answer

Reduce the health check interval and timeout to detect unhealthy VMs faster.

Question 2

You are enabling OS Login for a GCP project to manage SSH access to Compute Engine VMs. A developer cannot SSH to a VM despite having `roles/compute.osLogin` granted. The VM has OS Login enabled. What is the most likely missing configuration?

Accepted Answer

The VM metadata `enable-oslogin` is not set to `TRUE` at the VM or project level.. Option B is correct because OS Login requires the VM or project metadata key `enable-oslogin` to be set to `TRUE`. Even if the user has the `roles/compute.osLogin` role, OS Login will not function if this metadata is missing or set to `FALSE`. The metadata enables the OS Login agent on the VM to authenticate users via IAM permissions rather than local SSH keys.

Answer

The developer needs `roles/compute.instanceAdmin` in addition to `roles/compute.osLogin`.

Answer

The developer must generate an SSH key pair and upload the public key to the VM's authorized_keys.

Answer

The developer's account needs `roles/iam.serviceAccountTokenCreator` to authenticate via SSH.

Question 3

You need to prevent developers from creating Compute Engine VMs with external IP addresses in a specific folder. Developers must still be able to create VMs with internal IPs only. Which org policy constraint enforces this?

Accepted Answer

Apply the `compute.vmExternalIpAccess` org policy constraint set to deny all VMs.. The `compute.vmExternalIpAccess` organization policy constraint is specifically designed to control whether Compute Engine VMs can be assigned external IP addresses. By setting this constraint to deny all VMs in the folder, developers are prevented from creating VMs with external IPs while still being able to create VMs with only internal IPs. This is the correct, native Google Cloud mechanism for enforcing this requirement at the folder level.

Answer

Create a VPC firewall rule blocking all outbound internet traffic.

Answer

Remove the `compute.instanceAdmin` role from developers so they cannot configure network interfaces.

Answer

Configure the default VPC network to use internal-only routes.

Question 4

Your security team wants to monitor all privileged IAM changes in your GCP organization (e.g., when anyone is granted `roles/owner` or `roles/editor`). They need real-time notifications. Which approach achieves this?

Accepted Answer

Create a Cloud Monitoring alerting policy on the `iam.googleapis.com/SetIamPolicy` log metric.. Option A is correct because Cloud Monitoring can ingest log-based metrics from the `iam.googleapis.com/SetIamPolicy` audit log entry, and an alerting policy can be configured to trigger in near real-time when that log metric exceeds a threshold. This provides immediate notification of privileged IAM changes such as granting `roles/owner` or `roles/editor`.

Answer

Enable Security Command Center's Event Threat Detection for IAM changes.

Answer

Run a daily script using `gcloud projects get-iam-policy` and compare with the previous day's output.

Question 5

Your company's compliance policy requires that all customer data stored in Cloud Storage must be encrypted using keys stored in a Hardware Security Module (HSM). The encryption keys must be managed by your security team and must not be exportable. Which configuration meets these requirements?

Accepted Answer

Use Cloud KMS HSM-backed keys (protection level: HSM) with Cloud Storage CMEK.. Option B is correct because Cloud KMS HSM-backed keys (protection level: HSM) ensure that encryption keys are stored in a Hardware Security Module, are managed by the security team, and are non-exportable by design. When used with Cloud Storage CMEK, this configuration meets the compliance requirement for HSM-based key storage with full customer control and no key export capability.

Answer

Use Cloud KMS software keys (protection level: SOFTWARE) with Cloud Storage CMEK.

Answer

Use Customer-Supplied Encryption Keys (CSEK) managed by your security team.

Answer

Enable Google-managed encryption with HSM by selecting it in Cloud Storage settings.

Question 6

You want to receive email notifications when your GCP project's billing reaches 50%, 80%, and 100% of a monthly budget. Which GCP feature should you configure?

Accepted Answer

Cloud Billing Budget with alert thresholds at 50%, 80%, and 100%.. Option B is correct because Cloud Billing Budgets allow you to set a budget amount for a GCP project and define alert threshold percentages (e.g., 50%, 80%, 100%). When the actual cost or forecasted cost reaches any threshold, Cloud Billing automatically sends email notifications to Billing Administrators and users you specify. This is the native, purpose-built feature for budget-based billing alerts.

Answer

Cloud Monitoring alerting policies on billing metrics.

Answer

Set a project spending limit in the Cloud Console billing settings.

Answer

Enable billing export to BigQuery and create a scheduled query that sends alert emails.

Question 7

Order the steps to set up a Cloud Storage bucket with uniform bucket-level access and make objects publicly readable.

Question 8

Order the steps to set up a Cloud IAM policy that grants a user the 'roles/compute.admin' role on a specific project.

Question 9

Arrange the steps to create a Cloud SQL MySQL instance, configure a database, and connect using the Cloud SQL Proxy.

Question 10

Order the steps to configure a Cloud Load Balancer (HTTP/S) in front of a Compute Engine instance group.

Question 11

Arrange the steps to create a Compute Engine instance with a custom service account in the correct order.

Question 12

Arrange the steps to deploy a containerized application to Google Kubernetes Engine (GKE) using a Deployment and expose it via a Service.

Question 13

Order the steps to set up a VPC network with a subnet, firewall rule allowing SSH, and a Compute Engine instance in that subnet.

Question 14

Arrange the steps to set up a Cloud Function triggered by a Cloud Storage bucket event.

Question 15

Arrange the steps to create a Cloud Pub/Sub topic, subscription, and publish a message.

Question 16

A team must choose between Cloud Pub/Sub and Cloud Tasks for a use case where jobs must be delivered to a single HTTP endpoint, each job executed at most once, with rate limiting to 10 requests per second, and with retry on failure. Which service is the better fit and why?

Accepted Answer

Cloud Tasks — it provides rate limiting, at-most-once delivery via deduplication, and targeted HTTP dispatch. Cloud Tasks is the better fit because it is designed for targeted HTTP dispatch to a single endpoint, supports rate limiting (max bursts per second), and provides at-most-once delivery via task deduplication (based on a unique task ID). Cloud Pub/Sub push subscriptions do not offer built-in rate limiting and guarantee at-least-once delivery, not at-most-once.

Answer

Cloud Pub/Sub — it supports rate-limited push subscriptions and at-most-once delivery

Answer

Cloud Pub/Sub with a Dataflow consumer applying rate limiting

Answer

Both are equivalent for this use case — choose based on cost

Question 17

A team wants proactive alerting if their public HTTPS endpoint returns a non-2xx HTTP status code or becomes unreachable — before users report it. Which Cloud Monitoring capability provides this?

Accepted Answer

An uptime check with an HTTP status code condition. An uptime check with an HTTP status code condition is the correct choice because Cloud Monitoring’s uptime checks are specifically designed to proactively verify that a public HTTPS endpoint is reachable and returns a successful HTTP status (e.g., 2xx). When the check detects a non-2xx status or a timeout/unreachable condition, it can trigger an alert before users are impacted. This is the only option that directly monitors endpoint availability and HTTP response codes from an external perspective.

Answer

A log-based alert on 5xx error log entries

Answer

A Cloud Armor rule blocking 5xx responses

Answer

A metric alert on instance CPU exceeding 90%

Question 18

A GKE application Pod needs a sidecar container that proxies all outbound network requests through an audit logger before they reach the internet. Both containers share the same network namespace. Which Kubernetes pattern implements this?

Accepted Answer

Add the audit logger as a second container in the same Pod spec (sidecar pattern). Option B is correct because the sidecar pattern allows two containers to share the same network namespace within a single Pod, enabling the audit logger to intercept all outbound traffic from the application container before it reaches the internet. This is achieved by configuring the application container to route its outbound requests through the sidecar (e.g., via a localhost proxy or iptables rules), ensuring all traffic is logged without external network hops.

Answer

Run the audit logger as a separate Deployment and route traffic via a Service

Answer

Use a DaemonSet for the audit logger on each node to intercept node-level traffic

Answer

Add an initContainer to start the audit logger before the main application

Question 19

A Cloud SQL production instance experiences a spike in connections during business hours, causing 'too many connections' errors. The application uses 50 microservices each maintaining 10 connections. What is the recommended solution to reduce connection count without rewriting the application?

Accepted Answer

Deploy a connection pooler (e.g., PgBouncer) between the microservices and Cloud SQL. Option B is correct because deploying a connection pooler like PgBouncer between the microservices and Cloud SQL allows many application connections to be multiplexed over a smaller number of actual database connections. This directly reduces the total connection count on the Cloud SQL instance without requiring any application code changes, as the pooler transparently manages the connection lifecycle and reuses idle connections.

Answer

Increase the Cloud SQL instance's max_connections database flag to 10,000

Answer

Enable Cloud SQL HA — the standby will handle the connection overflow

Answer

Add a read replica — microservices can connect to the replica instead of the primary

Question 20

Which command creates a Cloud Storage bucket named 'my-archive-bucket' in the US multi-region using the modern gcloud CLI?

Accepted Answer

gcloud storage buckets create gs://my-archive-bucket --location=US. Option B is correct because the modern gcloud CLI uses the `gcloud storage buckets create` command to create a Cloud Storage bucket, and the `--location=US` flag specifies the US multi-region. This command is part of the newer, unified `gcloud storage` command group that replaces the older `gsutil` tool for bucket management.

Answer

gcloud storage mk gs://my-archive-bucket --location=US

Answer

gcloud cloud-storage create my-archive-bucket --region=US

Answer

gsutil mk -l US gs://my-archive-bucket