Google ACE Practice Test 4 — 25 Questions

Question 1

A developer needs to forward traffic from their local port 5432 to a PostgreSQL service running in GKE on port 5432, to test database queries locally without exposing the database externally. Which kubectl command achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

kubectl port-forward svc/postgres-service 5432:5432. `kubectl port-forward` creates a local tunnel from port 5432 on the developer's machine to the specified service's port 5432 inside the GKE cluster. This allows the developer to connect to the PostgreSQL service as if it were running locally, without exposing it to the internet via a LoadBalancer or Ingress.

Answer

kubectl expose pod postgres-pod --type=LoadBalancer --port=5432

Answer

kubectl tunnel --local=5432 --remote=postgres-service:5432

Answer

gcloud container ssh postgres-pod --port-forward=5432:5432

Question 2

A Cloud CDN cache is serving stale content after a website update. New files were deployed to Cloud Storage but CDN is still serving the old versions to some users. What is the fastest way to force CDN to serve the updated content?

Accepted Answer

Run a CDN cache invalidation for the affected URL paths. Cloud CDN supports cache invalidation, which immediately removes cached objects from edge caches for specified URL paths. This forces the CDN to fetch fresh content from the origin (Cloud Storage) on the next request, providing the fastest way to serve updated content without waiting for TTL expiry.

Answer

Wait for the CDN TTL to expire — cached content automatically refreshes

Answer

Delete and recreate the Cloud Storage bucket — CDN will detect the new bucket as a fresh origin

Answer

Disable Cloud CDN temporarily — all users will hit the origin until CDN is re-enabled

Question 3

You need to monitor a Cloud Run service for errors and receive a PagerDuty notification when the number of 5xx errors exceeds 10 in any 5-minute window. Which Cloud Monitoring feature should you use?

Accepted Answer

Create a log-based metric on Cloud Run error logs, then create an alerting policy on that metric with a PagerDuty notification channel.. A log-based metric extracts a numeric counter from Cloud Run error logs (e.g., HTTP 5xx status codes). An alerting policy can then evaluate that metric over a sliding 5-minute window, triggering a PagerDuty notification via a configured notification channel when the count exceeds 10. This is the native, serverless approach that requires no additional infrastructure.

Answer

Configure Cloud Run to send error emails directly to the PagerDuty email integration.

Answer

Use Cloud Pub/Sub to stream Cloud Run logs to a custom application that pages PagerDuty.

Answer

Enable Cloud Run's built-in alerting feature in the service configuration.

Question 4

A company is deploying a stateful application on Google Kubernetes Engine (GKE) that requires persistent storage. Each pod needs its own dedicated persistent disk that is not shared. Which Kubernetes resource should be used to manage the deployment?

Accepted Answer

StatefulSet with volumeClaimTemplates. A StatefulSet with volumeClaimTemplates is designed for stateful applications where each pod requires its own dedicated PersistentVolume (PV) that is not shared. The volumeClaimTemplates automatically generate a unique PersistentVolumeClaim (PVC) for each pod replica, ensuring each pod gets a separate, stable persistent disk that persists across rescheduling. This matches the requirement for a stateful application on GKE where pods need dedicated, non-shared storage.

Answer

Job with PersistentVolume

Answer

DaemonSet with hostPath volumes

Answer

Deployment with PersistentVolumeClaim template

Question 5

Refer to the exhibit. A team has this IAM policy on a Cloud Storage bucket. The bucket contains sensitive data. Which action should the team take immediately?

Accepted Answer

Remove allUsers from the objectViewer binding.. The IAM policy grants `allUsers` (anyone on the internet) the `objectViewer` role on the bucket, which allows unauthenticated read access to all objects. Since the bucket contains sensitive data, this is a critical security exposure that must be removed immediately by deleting the `allUsers` principal from the binding.

Answer

Add a condition to the objectViewer binding to restrict access.

Answer

Remove the entire objectViewer binding.

Answer

Change the objectViewer role to objectAdmin for allUsers.

Question 6

A FinOps team wants to analyze daily GCP spending trends, allocate costs by team using labels, and create custom dashboards. Which configuration exports billing data for this analysis?

Accepted Answer

Enable Cloud Billing data export to BigQuery and query the exported dataset. Exporting GCP billing data to BigQuery enables granular, daily cost analysis, label-based allocation, and custom dashboard creation via tools like Looker Studio. BigQuery's SQL interface allows querying detailed cost and usage data, which is essential for the FinOps team's requirements.

Answer

Enable Cloud Monitoring billing metrics and build dashboards in Metrics Explorer

Answer

Download the monthly billing PDF from the Console and import it into a spreadsheet

Answer

Use the Cloud Billing API to pull cost data into Cloud Firestore nightly

Question 7

A developer works across five different GCP projects daily and wants to switch their active project in the gcloud CLI without rerunning `gcloud init`. Which command should they use?

Accepted Answer

gcloud config set project [PROJECT_ID]. The `gcloud config set project [PROJECT_ID]` command updates the `core/project` property in the active gcloud CLI configuration, allowing the developer to switch the active project without re-running `gcloud init`. This is the standard method for changing the project context in the current configuration, which persists across sessions until changed again.

Answer

gcloud projects switch [PROJECT_ID]

Answer

gcloud auth set-project [PROJECT_ID]

Answer

gcloud init --project=[PROJECT_ID]

Question 8

A team wants to receive an email alert when the average CPU utilization of VMs in a managed instance group exceeds 80% for more than 5 minutes. What should they create in Cloud Monitoring?

Accepted Answer

An alerting policy with a CPU utilization threshold condition. B is correct because Cloud Monitoring alerting policies allow you to define conditions based on metric thresholds, such as average CPU utilization exceeding 80% for a specified duration (5 minutes). This directly meets the requirement to trigger an email alert when the condition is met.

Answer

A dashboard with a CPU utilization chart

Answer

A log-based metric filter for high-CPU events

Answer

An uptime check targeting the managed instance group

Question 9

During a gcloud CLI session, a developer runs `gcloud config list` and sees the output shows `project = old-project`. They need to work in `new-project`. Which sequence of commands correctly switches projects and verifies the change?

Accepted Answer

gcloud config set project new-project; gcloud config list. `gcloud config set project new-project` updates the active project in the local CLI configuration, and `gcloud config list` then displays the current configuration, confirming the change. This is the standard method to switch the working project for subsequent gcloud commands.

Answer

gcloud projects activate new-project; gcloud config list

Answer

gcloud auth login --project=new-project; gcloud config list

Answer

export GCLOUD_PROJECT=new-project; gcloud config list

Question 10

A managed instance group (MIG) is running 4 VMs with a CPU autoscaling target of 60%. A traffic spike drives average CPU to 90%. How does the autoscaler respond?

Accepted Answer

The autoscaler adds VMs until average CPU across the group drops to approximately 60%. The autoscaler for a managed instance group (MIG) uses a target utilization metric—here, CPU at 60%. When average CPU exceeds that target (90%), the autoscaler calculates the desired number of VMs to bring utilization back to 60% (e.g., 4 VMs * 90% / 60% = 6 VMs) and adds instances accordingly. It does not terminate, migrate, or restart VMs; it scales out horizontally.

Answer

The MIG terminates the 2 least-used VMs to trigger a restart with higher performance settings

Answer

The MIG live-migrates instances to larger machine types automatically

Answer

The MIG restarts all existing VMs to clear cached load

Question 11

A platform admin creates a new GCP project for a team. The team lead's email is teamlead@company.com. The admin needs the team lead to be able to create resources in the project but not manage IAM policies or billing. Which role is most appropriate?

Accepted Answer

Editor. The Editor role (roles/editor) grants all permissions necessary to create, modify, and delete resources within a GCP project, but explicitly excludes permissions to manage IAM policies (roles/iam.securityAdmin or roles/owner) and billing (roles/billing.admin). This makes it the correct choice for a team lead who needs to deploy and manage resources without having the ability to change access controls or alter billing configurations.

Answer

Owner

Answer

Viewer

Answer

Billing Account Administrator

Question 12

Which gcloud CLI command authenticates a developer's local environment with their Google account?

Accepted Answer

gcloud auth login. `gcloud auth login`, is correct because it initiates the OAuth 2.0 flow to authenticate the gcloud CLI with a user's Google account, storing the resulting credentials locally for subsequent API calls. This command is the standard way to authorize a developer's local environment for the first time or when switching users.

Answer

gcloud config set account [EMAIL]

Answer

gcloud init --authenticate

Answer

gcloud accounts activate

Question 13

Your security team requires that all service accounts in your GCP organization older than 90 days that have not been used must be automatically disabled. They want a fully managed, serverless solution with no persistent infrastructure. Which architecture best meets these requirements?

Accepted Answer

Use Cloud Scheduler to trigger a Cloud Function that queries Cloud Asset Inventory and disables stale service accounts.. Cloud Scheduler can trigger a serverless Cloud Function on a schedule (e.g., nightly) to query Cloud Asset Inventory for service accounts older than 90 days with no last authentication time, then disable them via the IAM API. This meets the fully managed, serverless requirement with no persistent infrastructure (no VMs or servers to maintain).

Answer

Deploy a Compute Engine VM with a cron job that calls the IAM API nightly.

Answer

Configure an org policy that automatically expires service accounts after 90 days.

Answer

Use Security Command Center to flag and manually disable unused service accounts.

Question 14

A startup needs to send transactional emails (order confirmations, password resets) from their GCP-hosted application. Which GCP service handles high-volume email delivery?

Accepted Answer

A third-party email delivery service such as SendGrid or Mailgun, integrated via API. B is correct because GCP does not provide a native high-volume transactional email service. Third-party email delivery services like SendGrid or Mailgun are designed specifically for this purpose, offering dedicated SMTP relays, APIs, and reputation management to ensure reliable delivery of transactional emails such as order confirmations and password resets.

Answer

Cloud Tasks with an email delivery queue

Answer

Cloud Pub/Sub with an email topic subscriber

Answer

Cloud Functions triggered by Gmail API webhooks

Question 15

An organization has a VPC with subnets in us-central1 and europe-west1. They want to allow traffic from a specific on-premises IP range to reach a Compute Engine instance in europe-west1, but only through a single Cloud VPN tunnel attached to the us-central1 gateway. What configuration is required?

Accepted Answer

Create a route in us-central1 with the on-premises range and next hop set to the VPN tunnel. Add a firewall rule allowing the traffic.. The VPN tunnel is attached to the us-central1 gateway, and a static route in us-central1 with the on-premises IP range as the destination and the VPN tunnel as the next hop directs traffic from the on-premises network to the VPC. Since the VPC is global, the route applies to all regions, and the Compute Engine instance in europe-west1 is reachable as long as the traffic enters the VPC through the us-central1 tunnel. A firewall rule is required to allow the inbound traffic from the on-premises range to the instance.

Answer

Use policy-based routing on the Cloud VPN gateway to route the traffic to europe-west1.

Answer

Create a static route for the on-premises range in the europe-west1 subnet pointing to the VPN tunnel in us-central1.

Answer

Configure the VPN tunnel with BGP to advertise the on-premises range to both regions.

Question 16

A company wants to set up a cost-effective disaster recovery solution for a critical application running on Compute Engine. The primary region is us-east1. The recovery point objective (RPO) is 1 hour, and recovery time objective (RTO) is 4 hours. Which strategy is most cost-effective?

Accepted Answer

Cross-region replica of persistent disks using snapshot schedules every hour. The most cost-effective because it uses snapshot schedules to create cross-region replicas of persistent disks every hour, meeting the 1-hour RPO without requiring always-on compute resources. This approach minimizes costs by only storing incremental snapshots in Cloud Storage, while automated restore procedures can spin up instances in the secondary region within the 4-hour RTO.

Answer

Regular backups to Cloud Storage with automated scripts to restore in a different region

Answer

Use managed instance groups in two regions with autoscaling

Answer

Active-active multi-region deployment with HTTP load balancer

Question 17

Your organization has multiple GCP projects and wants to implement least privilege access for operations teams. Each operations team manages a specific set of projects. You have created custom roles that grant permissions to start and stop Compute Engine instances, view logs, and monitor resources. You are using Google Groups to assign roles to users. Recently, a user from the network operations team was able to modify firewall rules in a project managed by the compute operations team, causing a security incident. During the root cause analysis, you discover that the user is a member of both the network operations group and the compute operations group. The compute operations group is assigned a custom role that does not include firewall permissions. The network operations group is assigned a role that includes firewall admin permissions. How should you redesign the IAM structure to prevent cross-team access while maintaining required permissions?

Accepted Answer

Use IAM conditions to restrict the network operations role to only the network team's projects.. IAM conditions allow you to restrict the network operations team's firewall admin permissions to only their designated projects, preventing a user who is a member of both groups from using those permissions in the compute operations team's projects. This enforces least privilege by scoping the role's effectiveness based on resource attributes, without requiring project-level separation or removing the user from necessary groups.

Answer

Create a separate project for each team and use VPC Service Controls to isolate.

Answer

Implement organization policies to deny firewall modifications unless a specific condition is met.

Answer

Remove the user from the network operations group.

Question 18

A developer accidentally grants the Owner role to a test service account on the production project. The team wants to remove only this specific IAM binding without affecting other members' access. Which gcloud command achieves this?

Accepted Answer

gcloud projects remove-iam-policy-binding [PROJECT] --member=serviceAccount:[SA_EMAIL] --role=roles/owner. `gcloud projects remove-iam-policy-binding` is the precise command to remove a single IAM binding (member-role pair) from a project's policy without affecting other bindings. It takes the project ID, member (service account email), and role as parameters, ensuring only the specified binding is removed. This command modifies the existing policy by removing only that specific entry, leaving all other IAM bindings intact.

Answer

gcloud projects set-iam-policy [PROJECT] --member=serviceAccount:[SA] --role=roles/owner

Answer

gcloud iam remove-binding --project=[PROJECT] --member=[SA] --role=owner

Answer

gcloud projects delete-member [PROJECT] --member=serviceAccount:[SA_EMAIL]

Question 19

A company wants to monitor the CPU utilization of their Compute Engine instances and receive an alert if utilization exceeds 80% for 5 minutes. Which services should they combine?

Accepted Answer

Cloud Monitoring and Cloud Pub/Sub.. Cloud Monitoring collects CPU utilization metrics from Compute Engine instances and can evaluate them against a threshold-based alerting policy. When the condition (CPU > 80% for 5 minutes) is met, the alert fires and sends a notification to a Cloud Pub/Sub topic, which can then trigger downstream actions such as sending emails or invoking serverless functions. This combination provides the metric ingestion, alert evaluation, and event-driven notification pipeline required for the use case.

Answer

Cloud Functions and Cloud Tasks.

Answer

Cloud Audit Logs and Cloud Storage.

Answer

Cloud Logging and Cloud Functions.

Question 20

What is the correct order of the Google Cloud resource hierarchy from highest to lowest level?

Accepted Answer

Organization → Folder → Project → Resources. The Google Cloud resource hierarchy is structured from highest to lowest as Organization, Folder, Project, and Resources. The Organization node is the root, allowing centralized policy management; Folders group projects under departments or teams; Projects are the base-level containers for services and APIs; Resources (like Compute Engine instances) reside within projects. Option B correctly reflects this top-down inheritance of IAM policies and access control.

Answer

Folder → Organization → Project → Resources

Answer

Project → Folder → Organization → Resources

Answer

Organization → Project → Folder → Resources