Google ACE Practice Test 26 — 15 Questions

Question 1

You need to resize a Compute Engine instance from n1-standard-4 to n1-highmem-8. The instance has a local SSD attached. What must you do before changing the machine type?

Accepted Answer

Stop the instance, change the machine type, then start the instance. To change the machine type, the instance must be stopped. Local SSDs preserve data only if the instance is not stopped or terminated; however, when you stop the instance, local SSD data is lost. The correct procedure is to stop the instance, change the machine type, and then start it. Data on local SSDs will be lost.

Answer

Take a snapshot of the local SSD

Answer

Change the machine type without stopping

Answer

Detach the local SSD

Question 2

Your company recently migrated to GCP and you are the new cloud administrator. You need to ensure that only specific members of the DevOps team can perform administrative actions on Compute Engine instances, such as starting, stopping, and resetting instances, but not creating or deleting them. You also want to prevent them from modifying firewall rules or other network settings. The team consists of 10 members. You have already created a custom role with the necessary permissions and assigned it to a Google Group that contains all team members. However, you receive a report that a team member was able to accidentally delete a production instance. Upon investigation, you find that the team member had been granted the roles/compute.instanceAdmin role in addition to your custom role by another administrator. What should be the best course of action to prevent this from happening again while still allowing the team to perform their intended tasks?

Accepted Answer

Remove the compute.instanceAdmin role from the team member and audit all user assignments for role conflicts.. The core issue is that the team member had an additional, more permissive role (roles/compute.instanceAdmin) that overrode the restrictions of your custom role. Removing that conflicting role from the specific user and auditing all assignments ensures that only the intended permissions are applied, preventing accidental deletions while preserving the team's ability to start, stop, and reset instances.

Answer

Create an organization policy to block deletion of compute instances.

Answer

Remove the custom role from the team member and keep only the compute.instanceAdmin role.

Answer

Use IAM conditions on the custom role to enforce that instances can only be stopped during business hours.

Question 3

A company has two on-premises data centers connected via a redundant network. They want to extend their Google Cloud VPC to on-premises using Cloud VPN with dynamic routing (BGP). They need to ensure traffic from on-premises to Google Cloud can fail over to the secondary tunnel if the primary tunnel fails. The VPC has a single region. What should they configure?

Accepted Answer

Create two Cloud VPN gateways in the VPC, each with a BGP session to its own on-prem VPN device, both using the same Cloud Router with separate BGP sessions.. It provides true active/passive failover for on-premises to Google Cloud traffic. By creating two Cloud VPN gateways, each with a BGP session to its own on-premises VPN device, and attaching both sessions to the same Cloud Router, you enable BGP to advertise the same VPC prefixes over both tunnels. The Cloud Router uses BGP path selection (e.g., MED or AS path prepending) to prefer one tunnel as primary; if that tunnel fails, BGP withdraws the route and traffic automatically switches to the secondary tunnel. This satisfies the requirement for failover without relying on a single gateway or tunnel.

Answer

Use a single Cloud VPN gateway and create two tunnels to separate on-prem VPN devices, each with BGP.

Answer

Use Cloud Interconnect as the primary and Cloud VPN as the backup.

Answer

Use a Cloud Router in global dynamic routing mode and set up a single VPN tunnel with BGP.

Question 4

An organization requires that all Compute Engine instances be created with a specific service account that has minimal permissions. They also want to prevent users from creating instances with a different service account. Which IAM policy should they implement?

Accepted Answer

Organization policy with constraint compute.setServiceAccount. The organization policy constraint `compute.setServiceAccount` is the correct choice because it allows administrators to restrict which service accounts can be used when creating Compute Engine instances. By setting this constraint to only permit a specific service account, users are prevented from launching instances with any other service account, ensuring minimal permissions are enforced at the organization level.

Answer

Organization policy with constraint compute.disableUserServiceAccountCreation

Answer

IAM condition that restricts instances to only use the authorized service account

Answer

Custom role with permission compute.instances.setServiceAccount only for authorized users

Question 5

A GKE pod's container is frequently crashing and restarting. You need to view the logs from the previous container instance (before the last crash) to diagnose the crash cause. Which command retrieves these logs?

Accepted Answer

`kubectl logs POD_NAME --previous`. The `--previous` flag in `kubectl logs` retrieves logs from the previous instance of a container in a pod, which is exactly what you need when the current container has crashed and restarted. This allows you to see the logs that led to the crash, even though the container is now running a new instance.

Answer

`kubectl logs POD_NAME`

Answer

`kubectl describe pod POD_NAME`

Answer

`kubectl get events --field-selector reason=OOMKilled`

Question 6

A platform team needs to categorize GCP resources for policy enforcement (e.g., applying IAM conditions only to resources tagged 'environment:production'). Labels exist but don't support IAM conditions. What feature provides policy-tag-based enforcement?

Accepted Answer

Resource Manager Tags — attach a tag with key 'environment' and value 'production' and reference it in IAM conditions. Resource Manager Tags are the GCP feature specifically designed to support IAM conditions for policy enforcement. Unlike resource labels, which are simple key-value pairs used for metadata and billing, Resource Manager Tags can be referenced in IAM condition expressions using the `resource.matchTag` function, enabling fine-grained access control based on tag values such as 'environment:production'.

Answer

Resource labels — set environment=production on each resource and reference in IAM conditions

Answer

Cloud Asset Inventory metadata fields — query by label and apply policies

Answer

Pub/Sub event-driven policy application triggered by label changes

Question 7

A company wants to run a stateless HTTP web application that experiences highly variable traffic, including periods of zero traffic. The application is packaged as a Docker container. The team wants to minimize operational overhead and pay only for resources consumed during request processing. Which Google Cloud compute service is the best fit?

Accepted Answer

Cloud Run. Cloud Run is serverless, scales to zero, charges per request, and runs containers from container images. Cloud Functions is for event-driven functions, not full web apps. GKE Standard and Compute Engine require managing servers and do not scale to zero.

Answer

Cloud Functions

Answer

GKE Standard

Answer

Compute Engine with managed instance group

Question 8

You need to change the machine type of a running Compute Engine instance from n1-standard-4 to n1-standard-8. What is the correct procedure?

Accepted Answer

Stop the instance, run gcloud compute instances set-machine-type, then start the instance.. Changing machine type requires stopping the instance first.

Answer

Delete the instance and recreate it with the new machine type.

Answer

Run gcloud compute instances set-machine-type while the instance is running.

Answer

Take a snapshot, create a new instance, and attach the disk.

Question 9

A startup is building a web application using Cloud Run. They want to deploy multiple independent services that can communicate with each other internally, but each service should be deployed and scaled independently. Which deployment strategy should they use?

Accepted Answer

Create multiple Cloud Run services and use internal endpoints for communication. Cloud Run natively supports deploying multiple independent services, each with its own URL and scaling configuration. Internal communication between these services can be achieved using Cloud Run's built-in internal endpoints (e.g., using the `run.app` domain with internal traffic routing), which avoids exposing services to the public internet. This approach allows each service to scale independently based on its own request load, meeting the startup's requirement for independent deployment and scaling.

Answer

Deploy the application to App Engine Standard Environment

Answer

Use a single GKE cluster with multiple deployments and services

Answer

Deploy a single Cloud Run service with multiple containers

Question 10

You need to create a log-based metric that counts the number of errors in your application logs. What must you do first in Cloud Logging?

Accepted Answer

Define a filter that matches the error logs. In Cloud Logging, a log-based metric is based on a filter. You define the filter using the logging query language to match the logs you want to count, then create the metric from that filter.

Answer

Create an alerting policy with a condition

Answer

Create a log sink that exports logs to BigQuery

Answer

Install the Logging agent on your VMs

Question 11

An organization wants to enforce that all Compute Engine instances in a project use customer-managed encryption keys (CMEK) for their boot disks. Which TWO steps should the security team take?

Accepted Answer

Set an organization policy constraint that requires CMEK for Compute Engine disks. To enforce CMEK, you can set an organization policy constraint (e.g., constraints/compute.requireCmek) to prevent creation of instances without CMEK. Additionally, you must grant the compute engine service account permission to use the KMS key so it can encrypt disks. Simply specifying the key in the instance template does not enforce the policy, and the Cloud KMS Admin role is too broad.

Answer

Specify the CMEK key in each instance template used for managed instance groups

Answer

Grant the Cloud KMS Admin role to the project's compute service account

Answer

Create a Cloud Audit Logs sink to monitor instances without CMEK

Question 12

A company is deploying a microservices application on Google Kubernetes Engine (GKE). They want to expose their services to the internet using a single external IP address and route traffic based on the request path. Which resource should they use?

Accepted Answer

An Ingress resource. An Ingress resource is the correct choice because it provides HTTP(S) layer 7 routing, allowing you to expose multiple services behind a single external IP address and route traffic based on request paths (e.g., /api to one service, /web to another). This meets the requirement of using one external IP and path-based routing, which a Service alone cannot achieve.

Answer

A Service of type NodePort

Answer

A Service of type LoadBalancer for each microservice

Answer

A Network Endpoint Group (NEG)

Question 13

A platform team needs a Kubernetes workload that runs exactly one Pod on every node in a GKE cluster — including nodes added in the future. The workload collects host-level metrics. Which Kubernetes resource type should they use?

Accepted Answer

DaemonSet. A DaemonSet ensures that exactly one Pod runs on every node in the cluster, including nodes added after creation. This is the correct resource for host-level metrics collection because it automatically scales with the node pool and guarantees one Pod per node without manual intervention.

Answer

Deployment with replicas set equal to the node count

Answer

StatefulSet with one replica per node

Answer

CronJob running every minute to check and restore missing Pods

Question 14

A developer wants to verify which IAM roles they currently have on a specific GCP project before requesting additional access. Which gcloud command lists the IAM policy for a project?

Accepted Answer

gcloud projects get-iam-policy [PROJECT_ID]. The correct command to retrieve the IAM policy for a GCP project is `gcloud projects get-iam-policy [PROJECT_ID]`. This command returns the complete IAM policy bindings (roles and members) for the specified project, allowing the developer to see which roles they currently have. It directly queries the Cloud Resource Manager API to fetch the project-level IAM policy.

Answer

gcloud iam roles list --project=[PROJECT_ID]

Answer

gcloud auth list --project=[PROJECT_ID]

Answer

gcloud iam service-accounts get-iam-policy [PROJECT_ID]

Question 15

Your application writes structured JSON logs to stdout from a Cloud Run service. You want to query logs in Cloud Logging to find all requests where the `user_id` field equals `12345`. Which log query syntax finds these entries?

Accepted Answer

`jsonPayload.user_id="12345"`. Cloud Logging uses the `jsonPayload` field to access structured JSON fields in log entries. When your application writes structured JSON logs to stdout, Cloud Run automatically parses them and stores the fields under `jsonPayload`. The query `jsonPayload.user_id="12345"` directly matches the `user_id` field within that JSON payload.

Answer

`textPayload:"user_id:12345"`

Answer

`resource.labels.user_id="12345"`

Answer

`labels.user_id="12345"`