Google ACE Practice Test 5 — 25 Questions

Question 1

A team deploys an application with sensitive internal APIs on GKE. The APIs should be reachable from other GKE services in the cluster and from on-premises systems via VPN, but not from the public internet. Which load balancer configuration meets this?

Accepted Answer

Internal Application Load Balancer with a VPC-private IP. An Internal Application Load Balancer (HTTP/HTTPS) with a VPC-private IP is correct because it exposes the APIs only within the VPC network, making them reachable from other GKE services in the cluster and from on-premises systems via VPN (which extends the VPC), while blocking all public internet traffic by design. This load balancer operates at Layer 7 and uses an internal IP address that is not routable from the internet, satisfying the requirement without relying on additional access controls.

Answer

Global external Application Load Balancer with Cloud Armor blocking non-VPN IPs

Answer

A ClusterIP Service with an external IP range allowlist

Answer

NodePort Service with VPC firewall rules restricting access to VPN IP ranges

Question 2

A security audit found that several Cloud Storage buckets in your project have `allAuthenticatedUsers` in their IAM policy with `storage.objectViewer`. What does `allAuthenticatedUsers` grant, and why is it a security risk?

Accepted Answer

It grants read access to any person with a Google account — effectively near-public access since Google accounts are free to create.. `allAuthenticatedUsers` is a special IAM member that includes any person authenticated with a Google account, regardless of whether they belong to your organization or domain. Granting `storage.objectViewer` to this group means anyone with a free Google account (e.g., Gmail) can list and read objects in the bucket, making the data effectively public. This is a significant security risk because it exposes sensitive data to a vast, uncontrolled audience.

Answer

It grants access only to users within your Google Workspace domain — a minor risk if your domain is small.

Answer

It grants access only to Google service accounts, which is acceptable since those are controlled.

Answer

It grants access to authenticated GCP users in your organization's IAM policy — this is normal for shared resources.

Question 3

A team wants to roll back a GKE Deployment to its previous revision because the new version introduced a regression. Which kubectl command performs this rollback?

Accepted Answer

kubectl rollout undo deployment/my-app. Option B is correct because `kubectl rollout undo deployment/my-app` is the standard Kubernetes command to roll back a Deployment to the previous revision. This command leverages the Deployment's revision history, which is automatically maintained by the Kubernetes controller, to revert the desired state to the prior revision without needing to manually reapply an old manifest.

Answer

kubectl revert deployment/my-app --to-previous

Answer

kubectl apply -f previous-deployment.yaml

Answer

kubectl delete deployment/my-app && kubectl create -f deployment.yaml

Question 4

A billing report shows a Compute Engine VM has been running unused for 3 months. The team wants to stop it to save costs but needs the VM's disk data preserved for potential future use. What should they do?

Accepted Answer

Stop (shut down) the VM — compute charges stop but disk storage charges continue. Option B is correct because stopping (shutting down) a Compute Engine VM immediately halts all compute charges (vCPU, memory, GPU) while preserving the persistent disk and its data. The disk continues to incur storage costs, which is acceptable since the team wants to retain the data for potential future use. This is the most cost-effective approach that meets the requirement of preserving disk data without paying for idle compute resources.

Answer

Delete the VM to avoid all compute charges

Answer

Snapshot the VM disk and delete the VM

Answer

Set the VM to a smaller machine type to reduce costs

Question 5

A Cloud Run service handles payment processing. A monitoring alert shows the service is experiencing 3-second P99 latency, up from its normal 200ms. The team wants to find the slowest individual requests in the last hour. Which tool provides per-request latency data?

Accepted Answer

Cloud Trace — sort traces by latency in the last hour. Cloud Trace is designed to capture end-to-end latency for individual requests, allowing you to sort and identify the slowest requests in a specific time range. The P99 latency increase indicates a tail-latency problem, and Trace provides per-request granularity to pinpoint the exact slow requests. This makes it the correct tool for finding the slowest individual requests in the last hour.

Answer

Cloud Monitoring — check the request_latencies metric distribution

Answer

Cloud Logging — filter for requests with duration > 3s

Answer

Cloud Profiler — view the slowest functions in the last hour

Question 6

A batch data processing job runs nightly for 4 hours and can tolerate interruption because it saves progress checkpoints every 15 minutes. Which VM option offers the greatest cost reduction?

Accepted Answer

Spot VM. Spot VMs offer significant cost reduction (up to 60-91% discount) compared to standard VMs, making them ideal for fault-tolerant, interruptible batch workloads. Since the job saves checkpoints every 15 minutes, it can resume from the last checkpoint if preempted, fully leveraging the cost benefit of Spot VMs.

Answer

Custom machine type VM with reduced memory

Answer

Sole-tenant node VM

Answer

Shielded VM

Question 7

During a gcloud CLI session, a developer runs `gcloud config list` and sees the output shows `project = old-project`. They need to work in `new-project`. Which sequence of commands correctly switches projects and verifies the change?

Accepted Answer

gcloud config set project new-project; gcloud config list. Option B is correct because `gcloud config set project new-project` updates the active project in the local CLI configuration, and `gcloud config list` then displays the current configuration, confirming the change. This is the standard method to switch the working project for subsequent gcloud commands.

Answer

gcloud projects activate new-project; gcloud config list

Answer

gcloud auth login --project=new-project; gcloud config list

Answer

export GCLOUD_PROJECT=new-project; gcloud config list

Question 8

An application running on a Compute Engine VM needs to read objects from a Cloud Storage bucket in the same project. What is the recommended authentication approach?

Accepted Answer

Attach a service account with the Storage Object Viewer role to the VM. Option B is correct because attaching a service account with the Storage Object Viewer role to the Compute Engine VM is the recommended and secure method for authenticating to Cloud Storage. The VM automatically obtains OAuth 2.0 access tokens for the service account via the metadata server, eliminating the need to manage or embed credentials in the application code.

Answer

Embed a developer's user account credentials in the application configuration file

Answer

Create an API key and store it as an environment variable on the VM

Answer

Grant the VM's IP address access to the bucket using a VPC firewall rule

Question 9

A microservices application has intermittent high latency. The team wants to identify which specific service-to-service call in the request chain is causing the slowdown. Which Cloud Operations tool is designed for this?

Accepted Answer

Cloud Trace. Cloud Trace is designed to capture latency data for individual service-to-service calls in a distributed request chain. It provides end-to-end tracing by collecting trace spans from each microservice, allowing you to pinpoint which specific call is causing the slowdown. This makes it the correct tool for identifying the exact service-to-service latency bottleneck.

Answer

Cloud Monitoring Metrics Explorer

Answer

Cloud Logging log viewer

Answer

Cloud Profiler

Question 10

A GKE node pool has an autoscaler configured with min=2, max=10 nodes. After a sustained traffic surge, the cluster scaled to 10 nodes. Traffic drops overnight to its normal level, but the cluster remains at 10 nodes after 4 hours. What is the most likely reason?

Accepted Answer

Pods have a PodDisruptionBudget preventing eviction, or nodes are still within the scale-down cooldown period. Option B is correct because the cluster autoscaler will not scale down nodes that are hosting pods protected by a PodDisruptionBudget (PDB) that prevents eviction, or if the nodes are still within the scale-down cooldown period (default 10 minutes after a scale-up). Since the cluster scaled up to 10 nodes during the traffic surge, the autoscaler must wait for the cooldown to expire and for all pods to be safely evictable before removing nodes. If any pods have a PDB that blocks eviction (e.g., requiring at least 3 replicas), the autoscaler cannot terminate the underlying nodes, keeping the cluster at 10 nodes even after traffic drops.

Answer

Cluster autoscaler only scales down once per day

Answer

The max node count prevents scale-down — setting max=10 locks the cluster at 10 nodes

Answer

Cloud Monitoring alerts are pausing the autoscaler to investigate the traffic drop

Question 11

A media company ingests 500,000 events per second from IoT sensors and needs to store them for time-series analytics queries that scan billions of rows. Which storage service is most appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is the most appropriate service because it is a fully managed, scalable NoSQL database designed for high-throughput, low-latency workloads like IoT sensor data ingestion at 500,000 events per second. It supports time-series analytics queries scanning billions of rows via its wide-column storage model and integration with BigQuery for complex analytics, while providing sub-10ms latency for point lookups and efficient range scans.

Answer

Cloud Firestore

Answer

Cloud SQL for MySQL

Answer

BigQuery streaming inserts

Question 12

A developer needs to run an interactive shell inside a running GKE Pod named 'api-pod-7d4f9' in the 'production' namespace to investigate a runtime issue. Which kubectl command opens an interactive shell?

Accepted Answer

kubectl exec -it api-pod-7d4f9 -n production -- /bin/bash. Option B is correct because `kubectl exec -it` attaches an interactive terminal to a running container in a Pod, with `-i` for stdin and `-t` for a TTY. The `-- /bin/bash` launches a Bash shell inside the container, allowing the developer to investigate runtime issues. This is the standard Kubernetes method for interactive shell access.

Answer

kubectl ssh api-pod-7d4f9 -n production

Answer

kubectl run debug --image=busybox --attach=api-pod-7d4f9

Answer

gcloud container exec api-pod-7d4f9 --namespace=production -- bash

Question 13

A deployment pipeline runs `kubectl logs` to capture output from a crashed Pod's previous container instance. Which flag retrieves logs from the previous (terminated) container instance rather than the current one?

Accepted Answer

kubectl logs api-pod --previous. The `--previous` flag in `kubectl logs` retrieves logs from the previous (terminated) container instance of a Pod. This is essential for debugging crashes where the current container has restarted, as the logs from the failed instance are preserved and accessible only with this flag.

Answer

kubectl logs api-pod --terminated

Answer

kubectl logs api-pod --all-containers --since-crash

Answer

kubectl describe pod api-pod | grep -A 50 'Last State'

Question 14

An engineering team is deciding between App Engine Standard and App Engine Flexible for a Python API. The API has unpredictable traffic, must scale to zero when idle, runs standard Python code with no custom system packages, and requires < 1 second startup time. Which environment is most suitable?

Accepted Answer

App Engine Standard — it scales to zero, starts in sub-second, and supports standard Python runtimes. App Engine Standard is the correct choice because it automatically scales to zero instances during idle periods, starts new instances in under a second, and supports standard Python runtimes without custom system packages. The requirement for sub-second startup time and scaling to zero aligns perfectly with Standard's sandboxed, pre-loaded runtime environment, whereas Flexible environment has slower startup times due to VM provisioning and cannot scale to zero.

Answer

App Engine Flexible — it supports Python with custom packages

Answer

Both are equivalent — the difference is only in supported languages

Answer

Neither — use Cloud Run instead for Python APIs

Question 15

A distributed database running on GKE requires stable, persistent hostnames (pod-0, pod-1, pod-2) and ordered startup/shutdown for proper cluster initialization. Pods must retain their identity across restarts. Which Kubernetes resource is designed for this?

Accepted Answer

StatefulSet with a headless Service. StatefulSet is the correct resource because it provides stable, unique network identifiers (e.g., pod-0, pod-1, pod-2) via a headless Service, ordered startup and shutdown (pod-0 starts first, pod-2 terminates first), and persistent pod identity that survives restarts. These features are essential for distributed databases like Cassandra or ZooKeeper that require consistent hostnames and initialization order.

Answer

Deployment with pod affinity rules

Answer

DaemonSet with a unique hostname label on each node

Answer

ReplicaSet with a fixed replica count

Question 16

A GKE Deployment runs a web application with 6 replicas across a 3-node cluster. To ensure no two replicas land on the same node (maximizing availability), which Pod spec configuration should be applied?

Accepted Answer

Set podAntiAffinity with requiredDuringSchedulingIgnoredDuringExecution and topologyKey: kubernetes.io/hostname. Option A is correct because `podAntiAffinity` with `requiredDuringSchedulingIgnoredDuringExecution` and `topologyKey: kubernetes.io/hostname` forces the scheduler to place each replica on a different node. This ensures that no two pods of the same Deployment run on the same Kubernetes node, maximizing availability by preventing a single node failure from taking down more than one replica.

Answer

Set podAffinity with requiredDuringSchedulingIgnoredDuringExecution and topologyKey: kubernetes.io/hostname

Answer

Set topologySpreadConstraints with maxSkew: 1 and topologyKey: kubernetes.io/hostname

Answer

Set nodeSelector to a specific node for each replica

Question 17

A team stores application log archives in a Cloud Storage bucket. Logs older than 90 days should automatically move to Coldline storage, and logs older than 365 days should be deleted. Which feature automates this?

Accepted Answer

Cloud Storage Object Lifecycle Management rules on the bucket. Option B is correct because Cloud Storage Object Lifecycle Management rules allow you to automatically transition objects to Coldline storage after 90 days and delete them after 365 days based on object age conditions. This is a native, serverless feature that requires no external compute or scheduling, making it the most efficient and reliable approach for automating tiering and deletion of log archives.

Answer

Cloud Scheduler jobs that run gsutil rewrite and gsutil rm commands nightly

Answer

Cloud Pub/Sub notifications triggering a Cloud Function on each object creation

Answer

Retention policies that lock objects in Coldline after 90 days

Question 18

A monitoring alert fires at 3 AM — the team's GKE Pods are being evicted. Investigation shows node memory is at 98%. Pods without resource requests are being evicted first. What is the long-term fix to prevent evictions?

Accepted Answer

Add explicit memory requests (and optionally limits) to all Pod specs. B is correct because setting explicit memory requests ensures the Kubernetes scheduler can accurately place Pods on nodes with sufficient resources, preventing the node from being overcommitted. Without requests, Pods are treated as burstable or best-effort, making them the first candidates for eviction under the kubelet's Quality of Service (QoS) classes when node memory pressure hits 98%. This is a long-term fix because it enforces proper resource governance at the scheduling level, not just a reactive measure.

Answer

Set higher memory limits on the Pods being evicted

Answer

Disable node-level eviction by modifying kubelet configuration

Answer

Add more nodes to the cluster to increase available memory

Question 19

A security auditor needs to check whether a specific user (user@company.com) currently has sufficient permissions to delete a Cloud SQL instance in project 'prod-db'. Without making any changes, which tool simulates this check?

Accepted Answer

Use the IAM Policy Troubleshooter (Policy Simulator) to check if the permission is granted. The IAM Policy Troubleshooter (Policy Simulator) is the correct tool because it allows you to check whether a specific user has a particular permission (e.g., cloudsql.instances.delete) on a given resource (the Cloud SQL instance in project 'prod-db') without making any changes. It evaluates the effective IAM policy, including all inherited roles and policies, and returns a result indicating whether the permission is granted. This directly addresses the auditor's need to simulate a permission check without executing any action.

Answer

Run the delete command with `--dry-run` flag to simulate without executing

Answer

Inspect the IAM policy with `gcloud projects get-iam-policy` and manually trace inheritance

Answer

Grant the user the permission temporarily, test the delete, then revoke it

Question 20

A team needs to create a Compute Engine VM but the `gcloud compute instances create` command is failing with 'insufficient permissions'. The team lead says the service account has the Compute Engine Default role. What is the minimal IAM role that allows creating VM instances?

Accepted Answer

Compute Instance Admin (v1). The Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) provides the necessary permissions to create, modify, and delete Compute Engine VM instances. The Compute Engine Default service account lacks the required permissions for instance creation, and this role is the minimal predefined IAM role that includes compute.instances.create.

Answer

Compute Viewer

Answer

Compute Network Admin

Answer

Project Editor