Google ACE Practice Test 5 — 25 Questions

Question 1

A company wants to monitor the CPU utilization of their Compute Engine instances and receive an alert if utilization exceeds 80% for 5 minutes. Which services should they combine?

Accepted Answer

Cloud Monitoring and Cloud Pub/Sub.. Cloud Monitoring collects CPU utilization metrics from Compute Engine instances and can evaluate them against a threshold-based alerting policy. When the condition (CPU > 80% for 5 minutes) is met, the alert fires and sends a notification to a Cloud Pub/Sub topic, which can then trigger downstream actions such as sending emails or invoking serverless functions. This combination provides the metric ingestion, alert evaluation, and event-driven notification pipeline required for the use case.

Answer

Cloud Functions and Cloud Tasks.

Answer

Cloud Audit Logs and Cloud Storage.

Answer

Cloud Logging and Cloud Functions.

Question 2

What is the correct order of the Google Cloud resource hierarchy from highest to lowest level?

Accepted Answer

Organization → Folder → Project → Resources. The Google Cloud resource hierarchy is structured from highest to lowest as Organization, Folder, Project, and Resources. The Organization node is the root, allowing centralized policy management; Folders group projects under departments or teams; Projects are the base-level containers for services and APIs; Resources (like Compute Engine instances) reside within projects. Option B correctly reflects this top-down inheritance of IAM policies and access control.

Answer

Folder → Organization → Project → Resources

Answer

Project → Folder → Organization → Resources

Answer

Organization → Project → Folder → Resources

Question 3

A security team wants to restrict access to a Google Cloud project such that only virtual machines with a specific tag 'web' can connect to a Compute Engine instance on port 443. Which configuration is required?

Accepted Answer

Create a firewall rule allowing ingress from instances with tag 'web' to the target instance on port 443.. Firewall rules in Google Cloud are stateful and control ingress traffic at the network level. To allow only VMs with tag 'web' to connect to the target instance on port 443, you must create an ingress firewall rule that specifies the source tag 'web', the target instance (or its network tag), and the protocol/port tcp:443. This rule permits incoming HTTPS traffic from any VM that has the 'web' tag, regardless of its IP address.

Answer

Create a firewall rule allowing egress from instances with tag 'web' to the target instance on port 443.

Answer

Set an IAM condition on the instance to only allow calls from instances with tag 'web'.

Answer

Use Cloud Armor to filter traffic based on tags.

Question 4

Your organization uses Cloud Functions to process messages from a Pub/Sub topic. Each function processes a single message and writes results to BigQuery. Recently, the function has been timing out and the Pub/Sub subscription's unacknowledged message count is growing rapidly. The function's memory is set to 256 MB and timeout is 60 seconds. The function logs show occasional 'memory limit exceeded' errors. You suspect that the function is leaking memory when processing large messages. What should you do to resolve the issue while minimizing cost and complexity?

Accepted Answer

Increase the function's memory to 512 MB and timeout to 120 seconds.. The function is timing out and running out of memory due to large messages. Increasing memory to 512 MB provides more headroom for processing, and raising the timeout to 120 seconds gives the function enough time to complete without unnecessary cost. This directly addresses the memory leak and timeout issues while keeping complexity low.

Answer

Increase the function's memory to 1 GB and timeout to 540 seconds.

Answer

Set up a retry policy on the Pub/Sub subscription to dead-letter undelivered messages.

Answer

Increase the function's timeout to 120 seconds and reduce the batch size.

Question 5

A company has a Compute Engine instance that needs to read files from a Cloud Storage bucket. The instance is running a custom application. What is the recommended way to grant the instance access to the bucket?

Accepted Answer

Create a service account with Storage Object Viewer role and associate it with the instance.. Associating a service account with a Compute Engine instance and granting it the Storage Object Viewer role is the recommended IAM-based approach for granting least-privilege access to Cloud Storage. The instance retrieves short-lived OAuth 2.0 access tokens from the metadata server, which the application can use to authenticate API calls without embedding long-lived credentials.

Answer

Generate a signed URL for the bucket and embed it in the application.

Answer

Use the default Compute Engine service account with Storage Admin role.

Answer

Store the bucket credentials in the instance metadata.

Question 6

You need to monitor the CPU utilization across all instances in a managed instance group. What is the most efficient way to create an alerting policy?

Accepted Answer

Create an alerting policy in Cloud Monitoring for the metric 'compute.googleapis.com/instance/cpu/utilization'.. Cloud Monitoring provides a pre-built metric, 'compute.googleapis.com/instance/cpu/utilization', which directly measures CPU usage for VM instances. Creating an alerting policy based on this metric is the most efficient approach, as it requires no custom scripting or external scheduling, and integrates natively with managed instance groups to aggregate data across all instances.

Answer

Create an alerting policy using the Logs Explorer to parse instance logs.

Answer

Use Cloud Scheduler to call the monitoring API periodically.

Answer

Set up a cron job to run gcloud compute instances list and check CPU.

Question 7

Refer to the exhibit. A user 'admin@example.com' attempts to create a Compute Engine instance but fails with a permission error. Which permission is missing?

Accepted Answer

iam.serviceAccounts.actAs. The error occurs because when a user creates a Compute Engine instance with a service account, they need the `iam.serviceAccounts.actAs` permission on that service account. This permission allows the user to impersonate the service account and delegate its identity to the instance. Without it, the creation fails even if the user has `compute.instances.create`.

Answer

compute.instances.get

Answer

compute.instances.create

Answer

compute.instances.setServiceAccount

Question 8

A solutions architect is designing a disaster recovery plan for a Cloud SQL for PostgreSQL instance. The primary instance is in us-central1. They need to automate failover to a different region with a Recovery Point Objective (RPO) of less than 5 seconds. Which configuration should they choose?

Accepted Answer

Configure a cross-region read replica in us-west1. Cloud SQL cross-region replication uses asynchronous replication and typically has an RPO of a few seconds. A read replica in another region can be promoted in a disaster. Backups have higher RPO. HA within same region does not help for regional disaster. External replication is less managed.

Answer

Use Cloud SQL external replication with a Compute Engine instance

Answer

Deploy a high-availability (HA) configuration within the same region

Answer

Enable automatic backups and point-in-time recovery

Question 9

You need to check the CPU and memory utilization of all pods running in the `production` namespace. Which command provides this information?

Accepted Answer

`kubectl top pods -n production`. The `kubectl top pods` command retrieves real-time CPU and memory utilization metrics from the metrics server for pods in a specified namespace. This is the correct tool for monitoring resource usage, as it directly queries the resource metrics API.

Answer

`kubectl describe pods -n production`

Answer

`kubectl get pods -n production -o wide`

Answer

`kubectl logs -n production --all-pods`

Question 10

A load balancer is routing traffic to a VM where the application process has crashed, but the VM itself is still running. What prevents the load balancer from continuing to send traffic to this instance?

Accepted Answer

An HTTP health check configured on the backend service. The load balancer uses an HTTP health check to periodically probe the application on the VM. When the application process crashes, the health check fails (e.g., returns a non-2xx status code or times out), and the load balancer automatically stops routing new traffic to that unhealthy instance. This is the standard mechanism in Google Cloud for detecting application-level failures, as opposed to infrastructure-level failures.

Answer

A VPC firewall rule blocking traffic to the VM

Answer

A Cloud Armor security policy blocking the crashed instance's IP

Answer

The instance group autoscaling policy detecting the failure

Question 11

A company is running a Cloud SQL for MySQL instance that experiences high read traffic. They want to offload read queries to reduce load on the primary instance. Which action should they take?

Accepted Answer

Create one or more read replicas and direct read queries to them. Creating one or more read replicas allows you to offload read queries from the primary Cloud SQL for MySQL instance. Read replicas are asynchronous replicas that can serve read traffic, reducing load on the primary and improving overall read throughput. This is the correct approach for scaling read-heavy workloads without modifying the primary instance.

Answer

Enable automatic storage increase on the primary instance

Answer

Increase the machine type of the primary instance

Answer

Change the instance to use private IP only

Question 12

Refer to the exhibit. The Terraform plan above returns the error: Error: "member" is required. What is the issue?

Accepted Answer

The member argument should be 'member' (singular) not 'members'.. The Terraform error 'Error: "member" is required' indicates that the resource block is using the plural argument 'members' instead of the singular 'member'. In the Google Cloud Terraform provider, the google_project_iam_member resource expects a single 'member' argument (e.g., 'user:email@example.com'), not a list. The correct syntax is 'member = "user:email@example.com"', not 'members = ["user:email@example.com"]'. This is a common syntax error when transitioning from other IAM resources that accept lists.

Answer

The Terraform provider version is outdated.

Answer

The project ID is incorrect.

Answer

The member argument must be a service account, not a user.

Question 13

Arrange the steps to set up a Cloud Function triggered by a Cloud Storage bucket event.

Accepted Answer

Create the Cloud Storage bucket → Write the Cloud Function code → Deploy the Cloud Function with bucket trigger → Upload a file to the bucket to test the trigger. The correct order ensures that the required infrastructure (bucket) and code are in place before deployment. The bucket must be created first so the trigger can reference it, then the function code is written, then the function is deployed with the bucket trigger, and finally a test upload verifies the function executes. Common mistakes include deploying before the bucket or code exist, or writing code after deployment.

Answer

Write the Cloud Function code → Deploy the Cloud Function with bucket trigger → Create the Cloud Storage bucket → Upload a file to the bucket to test the trigger

Answer

Create the Cloud Storage bucket → Deploy the Cloud Function with bucket trigger → Write the Cloud Function code → Upload a file to the bucket to test the trigger

Answer

Deploy the Cloud Function with bucket trigger → Write the Cloud Function code → Create the Cloud Storage bucket → Upload a file to the bucket to test the trigger

Question 14

An organization wants to manage GCP resources for multiple teams using a hierarchy of folders and projects. They need to apply a uniform policy that restricts the regions where VM instances can be created across all projects in a folder. Which approach should they use?

Accepted Answer

Set an IAM policy on the folder that denies compute.instances.create permission in disallowed regions. The correct approach uses IAM conditions to restrict resource creation based on location. While organization policies with the 'gcp.resource-locations' constraint are the recommended method, option C is the only valid choice among the given options. IAM policies on the folder with conditions can effectively deny compute.instances.create permission in disallowed regions, enforcing uniform control across all projects in the folder.

Answer

Apply an organization policy with the `compute.allowedExternalIpAccess` constraint

Answer

Apply an organization policy with the `compute.restrictResourceCreation` constraint

Answer

Use gcloud config set compute/region and enforce with a script

Question 15

A developer wants to deploy a containerized web application that receives HTTP requests and can scale to zero when not in use. The application is stateless and has a startup time of less than 2 seconds. Which Google Cloud compute option is the most cost-effective?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero, charges per request, and is ideal for stateless HTTP workloads. It meets the startup time requirement and minimises cost when idle.

Answer

Compute Engine with managed instance group and autoscaling

Answer

Google Kubernetes Engine (GKE) Standard

Answer

App Engine Standard with manual scaling

Question 16

A company needs to run a batch job every hour on a Compute Engine VM. The VM should be terminated after the job completes to save costs. The job is run from a script inside a custom container image stored in Container Registry. Which approach is the most cost-effective?

Accepted Answer

Create a VM with a preemptible instance setting and a startup script that runs the container, then shuts down the VM. Compute Engine preemptible VMs are up to 60-91% cheaper than regular VMs. For batch jobs that can be interrupted, they are highly cost-effective. Combining with a startup script that pulls and runs the container, and having the script shut down the VM after the job, minimizes costs.

Answer

Use a managed instance group with autoscaling and a target CPU load of 0%

Answer

Use a regular VM and stop it manually when the job finishes

Answer

Use Cloud Run with a scheduled job

Question 17

A company has multiple projects under an organization. They want to enforce that all service accounts created in any project must use the naming prefix 'sa-'. Which policy should be used?

Accepted Answer

Organization policy using a custom constraint. An organization policy with a custom constraint is the correct approach because it allows you to define a specific rule (e.g., all service accounts must start with 'sa-') that is enforced across all projects in the organization. Custom constraints use the Resource Manager API's `constraints/*` format and are evaluated at resource creation time, making them ideal for naming conventions that must be applied universally.

Answer

VPC Service Controls

Answer

Project-level IAM condition

Answer

Cloud Audit Logs

Question 18

A user needs to view the list of firewall rules in a project but should not be able to create or modify them. Which predefined IAM role should you grant?

Accepted Answer

roles/compute.viewer. The roles/compute.viewer role grants read-only access to Compute Engine resources, including the ability to list firewall rules, without permitting create, update, or delete operations. This aligns with the principle of least privilege for a user who only needs to view firewall configurations.

Answer

roles/editor

Answer

roles/compute.securityAdmin

Answer

roles/owner

Question 19

An organisation requires a managed relational database for an online transaction processing (OLTP) application with strong consistency, automated backups, and a 99.95% SLA. The database size is expected to be under 10 TB. Which service meets these requirements at the lowest cost?

Accepted Answer

Cloud SQL. Cloud SQL provides managed MySQL/PostgreSQL/SQL Server with automated backups, strong consistency, and a 99.95% SLA for zonal deployments. It is cost-effective for databases under 10 TB. Cloud Spanner is more expensive and suited for global scale.

Answer

Bare Metal Solution

Answer

Cloud Bigtable

Answer

Cloud Spanner

Question 20

A company has a VPC in auto mode and wants to create a VPN connection to an on-premises network using HA VPN. The on-premises VPN gateway supports only a single public IP address. Which configuration step is required to establish a functional HA VPN tunnel?

Accepted Answer

Configure the HA VPN gateway with only one interface and disable the second interface. HA VPN normally requires two interfaces (two public IPs) for redundancy. If the on-premises gateway supports only one IP, you can configure the Cloud VPN tunnel to use a single interface (interface 0) and disable the second interface. Alternatively, you can create a Classic VPN tunnel, but Classic VPN is not recommended. The correct approach is to use HA VPN with only one interface enabled.

Answer

Configure the HA VPN gateway with two interfaces and use BGP to load balance traffic

Answer

Use a Cloud Router with custom route advertisements to the on-premises network

Answer

Create a Classic VPN tunnel instead of HA VPN