Google ACE Practice Test 4 — 25 Questions

Question 1

A DevOps team uses Terraform to manage GCP infrastructure and wants to store Terraform state in a shared location that all team members can access securely, with state locking to prevent concurrent modifications. Which backend configuration achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

gcs backend storing state in a Cloud Storage bucket. The `gcs` backend is the correct choice because it stores Terraform state in a Google Cloud Storage bucket, which provides secure, shared access via IAM policies and supports state locking natively through object versioning and write-preconditions. This ensures that only one team member can modify the state at a time, preventing conflicts and corruption.

Answer

gcp backend storing state in a BigQuery table

Answer

remote backend connected to a Cloud SQL database

Answer

local backend with a path shared over Cloud Filestore

Question 2

You want to use Kustomize to manage environment-specific Kubernetes configurations (dev, staging, prod) from a single base set of manifests. How does Kustomize achieve environment customization without duplicating YAML files?

Accepted Answer

Kustomize uses overlays that patch a shared base: environment-specific differences are expressed as patches without duplicating base manifests.. Kustomize uses a base set of Kubernetes manifests and applies environment-specific overlays that contain patches. These patches modify only the differences (e.g., replicas, image tags, namespaces) without copying or altering the original base YAML files. This approach avoids duplication and keeps the base clean, with each overlay representing a distinct environment.

Answer

Kustomize duplicates all YAML files per environment, then applies find-and-replace on values.

Answer

Kustomize uses Helm charts with values files per environment for templating.

Answer

Kustomize requires a separate Git branch per environment where manifests are committed.

Question 3

You need to deploy a new version of an App Engine standard environment application. The new version should receive 10% of traffic while the current version continues to receive 90%. Which command achieves this?

Accepted Answer

`gcloud app services set-traffic default --splits v1=0.9,v2=0.1`. The `gcloud app services set-traffic` command explicitly splits traffic between versions of an App Engine service. By specifying `--splits v1=0.9,v2=0.1`, you direct 90% of requests to version v1 and 10% to version v2, without deploying a new version or promoting it. This is the standard method for gradual traffic migration in App Engine standard environment.

Answer

`gcloud app deploy --version=v2 --no-promote`

Answer

`gcloud app versions migrate v2`

Answer

`gcloud app deploy --version=v2 --promote --stop-previous-version`

Question 4

You have an Artifact Registry repository for Python packages (`format: python`). A developer needs to publish a new Python package to this repository. Which tool and configuration allows them to publish?

Accepted Answer

Use `twine upload` with the Artifact Registry Python repository URL as the repository target.. B is correct because `twine` is the standard tool for uploading Python packages to package indices, and Artifact Registry's Python repositories are compatible with the PyPI API. By specifying the Artifact Registry repository URL as the `--repository-url` target in `twine upload`, the developer can authenticate via a service account or OAuth token and publish the package directly.

Answer

Use `pip install` pointing to the Artifact Registry URL to upload the package.

Answer

Use `docker push` to push the Python package as a container layer.

Answer

Use `gsutil cp` to copy the wheel file to the Artifact Registry bucket.

Question 5

A developer needs to forward traffic from their local port 5432 to a PostgreSQL service running in GKE on port 5432, to test database queries locally without exposing the database externally. Which kubectl command achieves this?

Accepted Answer

kubectl port-forward svc/postgres-service 5432:5432. `kubectl port-forward` creates a local tunnel from port 5432 on the developer's machine to the specified service's port 5432 inside the GKE cluster. This allows the developer to connect to the PostgreSQL service as if it were running locally, without exposing it to the internet via a LoadBalancer or Ingress.

Answer

kubectl expose pod postgres-pod --type=LoadBalancer --port=5432

Answer

kubectl tunnel --local=5432 --remote=postgres-service:5432

Answer

gcloud container ssh postgres-pod --port-forward=5432:5432

Question 6

A Cloud CDN cache is serving stale content after a website update. New files were deployed to Cloud Storage but CDN is still serving the old versions to some users. What is the fastest way to force CDN to serve the updated content?

Accepted Answer

Run a CDN cache invalidation for the affected URL paths. Cloud CDN supports cache invalidation, which immediately removes cached objects from edge caches for specified URL paths. This forces the CDN to fetch fresh content from the origin (Cloud Storage) on the next request, providing the fastest way to serve updated content without waiting for TTL expiry.

Answer

Wait for the CDN TTL to expire — cached content automatically refreshes

Answer

Delete and recreate the Cloud Storage bucket — CDN will detect the new bucket as a fresh origin

Answer

Disable Cloud CDN temporarily — all users will hit the origin until CDN is re-enabled

Question 7

You need to monitor a Cloud Run service for errors and receive a PagerDuty notification when the number of 5xx errors exceeds 10 in any 5-minute window. Which Cloud Monitoring feature should you use?

Accepted Answer

Create a log-based metric on Cloud Run error logs, then create an alerting policy on that metric with a PagerDuty notification channel.. A log-based metric extracts a numeric counter from Cloud Run error logs (e.g., HTTP 5xx status codes). An alerting policy can then evaluate that metric over a sliding 5-minute window, triggering a PagerDuty notification via a configured notification channel when the count exceeds 10. This is the native, serverless approach that requires no additional infrastructure.

Answer

Configure Cloud Run to send error emails directly to the PagerDuty email integration.

Answer

Use Cloud Pub/Sub to stream Cloud Run logs to a custom application that pages PagerDuty.

Answer

Enable Cloud Run's built-in alerting feature in the service configuration.

Question 8

A company is deploying a stateful application on Google Kubernetes Engine (GKE) that requires persistent storage. Each pod needs its own dedicated persistent disk that is not shared. Which Kubernetes resource should be used to manage the deployment?

Accepted Answer

StatefulSet with volumeClaimTemplates. A StatefulSet with volumeClaimTemplates is designed for stateful applications where each pod requires its own dedicated PersistentVolume (PV) that is not shared. The volumeClaimTemplates automatically generate a unique PersistentVolumeClaim (PVC) for each pod replica, ensuring each pod gets a separate, stable persistent disk that persists across rescheduling. This matches the requirement for a stateful application on GKE where pods need dedicated, non-shared storage.

Answer

Job with PersistentVolume

Answer

DaemonSet with hostPath volumes

Answer

Deployment with PersistentVolumeClaim template

Question 9

Refer to the exhibit. A team has this IAM policy on a Cloud Storage bucket. The bucket contains sensitive data. Which action should the team take immediately?

Accepted Answer

Remove allUsers from the objectViewer binding.. The IAM policy grants `allUsers` (anyone on the internet) the `objectViewer` role on the bucket, which allows unauthenticated read access to all objects. Since the bucket contains sensitive data, this is a critical security exposure that must be removed immediately by deleting the `allUsers` principal from the binding.

Answer

Add a condition to the objectViewer binding to restrict access.

Answer

Remove the entire objectViewer binding.

Answer

Change the objectViewer role to objectAdmin for allUsers.

Question 10

A FinOps team wants to analyze daily GCP spending trends, allocate costs by team using labels, and create custom dashboards. Which configuration exports billing data for this analysis?

Accepted Answer

Enable Cloud Billing data export to BigQuery and query the exported dataset. Exporting GCP billing data to BigQuery enables granular, daily cost analysis, label-based allocation, and custom dashboard creation via tools like Looker Studio. BigQuery's SQL interface allows querying detailed cost and usage data, which is essential for the FinOps team's requirements.

Answer

Enable Cloud Monitoring billing metrics and build dashboards in Metrics Explorer

Answer

Download the monthly billing PDF from the Console and import it into a spreadsheet

Answer

Use the Cloud Billing API to pull cost data into Cloud Firestore nightly

Question 11

A company has a Compute Engine instance in the us-west1 region that does not have a public IP address. The instance is part of a VPC network that has a Cloud NAT gateway configured in the us-east1 region. The Cloud NAT gateway is configured to allow all traffic from the VPC subnet. The VPC has a default route (0.0.0.0/0) pointing to the default internet gateway. Firewall rules allow all egress traffic. The instance is unable to download updates from the internet. What is the most likely cause of this problem?

Accepted Answer

The Cloud NAT gateway is in a different region than the instance.. Cloud NAT is regional. An instance in us-west1 cannot use a Cloud NAT gateway in us-east1 because NAT is only applied to instances in the same region. The instance's traffic destined for the internet is not translated, so it cannot reach external hosts without a public IP.

Answer

The instance's firewall rules block egress traffic to port 80.

Answer

The instance's service account does not have the compute.instances.update permission.

Answer

The VPC does not have a route for the instance's subnet to the internet gateway.

Question 12

A company wants to track and forecast GCP spending across different departments. They have already set up labels on resources to indicate the department. Which additional step should they take to analyze costs by department in BigQuery?

Accepted Answer

Enable billing export to BigQuery in the Cloud Billing console. Enabling billing export to BigQuery will stream billing data (including labels) into a BigQuery dataset, allowing custom queries and analysis.

Answer

Use the Cloud Billing API to programmatically fetch cost data and write it to BigQuery

Answer

Run a scheduled query in BigQuery that calls the Cloud Billing API

Answer

Create a Cloud Function that captures billing events and inserts them into BigQuery

Question 13

A developer works across five different GCP projects daily and wants to switch their active project in the gcloud CLI without rerunning `gcloud init`. Which command should they use?

Accepted Answer

gcloud config set project [PROJECT_ID]. The `gcloud config set project [PROJECT_ID]` command updates the `core/project` property in the active gcloud CLI configuration, allowing the developer to switch the active project without re-running `gcloud init`. This is the standard method for changing the project context in the current configuration, which persists across sessions until changed again.

Answer

gcloud projects switch [PROJECT_ID]

Answer

gcloud auth set-project [PROJECT_ID]

Answer

gcloud init --project=[PROJECT_ID]

Question 14

A team wants to receive an email alert when the average CPU utilization of VMs in a managed instance group exceeds 80% for more than 5 minutes. What should they create in Cloud Monitoring?

Accepted Answer

An alerting policy with a CPU utilization threshold condition. B is correct because Cloud Monitoring alerting policies allow you to define conditions based on metric thresholds, such as average CPU utilization exceeding 80% for a specified duration (5 minutes). This directly meets the requirement to trigger an email alert when the condition is met.

Answer

A dashboard with a CPU utilization chart

Answer

A log-based metric filter for high-CPU events

Answer

An uptime check targeting the managed instance group

Question 15

During a gcloud CLI session, a developer runs `gcloud config list` and sees the output shows `project = old-project`. They need to work in `new-project`. Which sequence of commands correctly switches projects and verifies the change?

Accepted Answer

gcloud config set project new-project; gcloud config list. `gcloud config set project new-project` updates the active project in the local CLI configuration, and `gcloud config list` then displays the current configuration, confirming the change. This is the standard method to switch the working project for subsequent gcloud commands.

Answer

gcloud projects activate new-project; gcloud config list

Answer

gcloud auth login --project=new-project; gcloud config list

Answer

export GCLOUD_PROJECT=new-project; gcloud config list

Question 16

An engineer is designing a VPC for a multi-tier application. The application has web servers that need direct internet access, and a private database tier that must not have public IP addresses. The database tier needs outbound internet access to download updates. Which network configuration should the engineer implement?

Accepted Answer

Place web servers in a subnet with public IPs, and database servers in a separate subnet with Cloud NAT and no public IP. Web servers should be in a subnet with public IPs or a Cloud NAT for outbound. The database tier must be in a private subnet without public IP, but needs outbound internet via Cloud NAT. This allows secure outbound without public exposure.

Answer

Place web servers in a subnet with Cloud NAT, and database servers in the same subnet without public IP

Answer

Place both tiers in the same subnet with no public IPs and use Cloud NAT for all outbound traffic

Answer

Place web servers in a subnet with Cloud NAT, and database servers in a subnet with public IPs and firewall rules to restrict inbound

Question 17

A managed instance group (MIG) is running 4 VMs with a CPU autoscaling target of 60%. A traffic spike drives average CPU to 90%. How does the autoscaler respond?

Accepted Answer

The autoscaler adds VMs until average CPU across the group drops to approximately 60%. The autoscaler for a managed instance group (MIG) uses a target utilization metric—here, CPU at 60%. When average CPU exceeds that target (90%), the autoscaler calculates the desired number of VMs to bring utilization back to 60% (e.g., 4 VMs * 90% / 60% = 6 VMs) and adds instances accordingly. It does not terminate, migrate, or restart VMs; it scales out horizontally.

Answer

The MIG terminates the 2 least-used VMs to trigger a restart with higher performance settings

Answer

The MIG live-migrates instances to larger machine types automatically

Answer

The MIG restarts all existing VMs to clear cached load

Question 18

A platform admin creates a new GCP project for a team. The team lead's email is teamlead@company.com. The admin needs the team lead to be able to create resources in the project but not manage IAM policies or billing. Which role is most appropriate?

Accepted Answer

Editor. The Editor role (roles/editor) grants all permissions necessary to create, modify, and delete resources within a GCP project, but explicitly excludes permissions to manage IAM policies (roles/iam.securityAdmin or roles/owner) and billing (roles/billing.admin). This makes it the correct choice for a team lead who needs to deploy and manage resources without having the ability to change access controls or alter billing configurations.

Answer

Owner

Answer

Viewer

Answer

Billing Account Administrator

Question 19

Which gcloud CLI command authenticates a developer's local environment with their Google account?

Accepted Answer

gcloud auth login. `gcloud auth login`, is correct because it initiates the OAuth 2.0 flow to authenticate the gcloud CLI with a user's Google account, storing the resulting credentials locally for subsequent API calls. This command is the standard way to authorize a developer's local environment for the first time or when switching users.

Answer

gcloud config set account [EMAIL]

Answer

gcloud init --authenticate

Answer

gcloud accounts activate

Question 20

Your security team requires that all service accounts in your GCP organization older than 90 days that have not been used must be automatically disabled. They want a fully managed, serverless solution with no persistent infrastructure. Which architecture best meets these requirements?

Accepted Answer

Use Cloud Scheduler to trigger a Cloud Function that queries Cloud Asset Inventory and disables stale service accounts.. Cloud Scheduler can trigger a serverless Cloud Function on a schedule (e.g., nightly) to query Cloud Asset Inventory for service accounts older than 90 days with no last authentication time, then disable them via the IAM API. This meets the fully managed, serverless requirement with no persistent infrastructure (no VMs or servers to maintain).

Answer

Deploy a Compute Engine VM with a cron job that calls the IAM API nightly.

Answer

Configure an org policy that automatically expires service accounts after 90 days.

Answer

Use Security Command Center to flag and manually disable unused service accounts.