Google ACE Practice Test 26 — 15 Questions

Question 1

An engineer needs to give a data analyst access to run BigQuery queries but prevent them from viewing or modifying data in Cloud Storage. The analyst should be able to create new datasets. Which IAM role should the engineer assign at the project level?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

roles/bigquery.dataEditor. The role roles/bigquery.dataEditor allows creating datasets and querying data, but does not grant any Cloud Storage permissions.

Answer

roles/storage.objectViewer

Answer

roles/bigquery.dataOwner

Answer

roles/bigquery.user

Question 2

You need to set up log-based alerting in Cloud Logging to send notifications when a specific error pattern appears in your application logs. Which TWO components are required to accomplish this?

Accepted Answer

An alerting policy. Option A, an alerting policy, is required because it is the Cloud Monitoring resource that defines the condition to watch and the notification channels to fire when that condition is met, which is what actually sends the notifications. Option E, a log-based metric, is required because log-based alerting in Cloud Logging works by defining a metric that counts or extracts values from log entries matching the specified error pattern, and the alerting policy then evaluates that metric. Together, the log-based metric translates the log filter into a time series and the alerting policy triggers notifications when that series crosses the threshold. Option B, a log sink, is not required because sinks route or export log entries to destinations such as Cloud Storage or BigQuery and are not part of the alerting evaluation path. Option C, a Cloud Pub/Sub topic, is not required because Pub/Sub is only needed for log routing/export or for notification delivery if explicitly chosen as a channel, not for creating the log-based alert itself. Option D, an uptime check, is not required because uptime checks probe endpoint availability over HTTP/TCP and are unrelated to matching error patterns in log entries.

Answer

A log sink

Answer

A Cloud Pub/Sub topic

Answer

An uptime check

Question 3

You need to store a database password securely in Google Cloud. The password will be used by a Compute Engine instance. Which service should you use?

Accepted Answer

Secret Manager. Google Cloud Secret Manager is designed to store, manage, and access sensitive data like passwords, API keys, and certificates. It provides versioning, IAM-based access control, and audit logging, making it the correct choice for storing a database password used by a Compute Engine instance.

Answer

Cloud Storage

Answer

Cloud KMS

Answer

Cloud Firestore

Question 4

A company needs to store and analyze large amounts of log data (hundreds of terabytes) with occasional SQL queries. The data is rarely accessed after 30 days and must be kept for compliance for 7 years. They want to minimize storage costs. Which three actions should they take? (Choose THREE.)

Accepted Answer

Use Cloud Storage Object Lifecycle Management to move objects to Nearline after 30 days, then to Coldline after 90 days, then to Archive after 1 year. BigQuery is ideal for log analysis. For historical data, moving older data to lower-cost storage classes like NEARLINE or COLDLINE reduces cost. Partitioning and clustering improve query performance and reduce costs. Cloud Storage is an alternative, but BigQuery is better for SQL queries.

Answer

Store the data in BigQuery and set an expiration on the table to delete data after 30 days

Answer

Use BigQuery partitions based on ingestion time and set partition expiration to 30 days

Question 5

A DevOps engineer is responsible for deploying a new microservice to GKE. They need to expose the service externally on a static IP address and scale based on HTTP request load. Which THREE resources must be created? (Choose 3 correct answers.)

Accepted Answer

Deployment. To expose a microservice externally with a static IP and load-based scaling, you typically create a Deployment, a Service of type LoadBalancer (which provisions a TCP load balancer with a static IP), and a HorizontalPodAutoscaler to scale based on CPU (or custom metrics). Ingress is not required if using LoadBalancer, but it's another option. ConfigMap is not needed for this.

Answer

Ingress

Answer

ConfigMap

Question 6

Which kubectl command is used to view the logs of a specific pod named 'my-pod'?

Accepted Answer

kubectl logs my-pod. The 'kubectl logs' command streams logs from a pod. 'kubectl describe' shows metadata, 'kubectl get' shows status, and 'kubectl exec' runs commands inside the pod.

Answer

kubectl exec my-pod -- logs

Answer

kubectl get pod my-pod

Answer

kubectl describe pod my-pod

Question 7

A team is deploying a web application on Cloud Run. The application needs to be available globally with low latency, and the team wants to use a custom domain with an SSL certificate. Which TWO actions are required to achieve this?

Accepted Answer

Configure a custom domain mapping on the Cloud Run service. Cloud Run services are regional; to serve globally, you need a global load balancer (e.g., using an external HTTPS load balancer with serverless NEG). Mapping a custom domain to the service is also required.

Answer

Set the --ingress=all flag on the Cloud Run service

Answer

Use Cloud CDN to cache content

Answer

Deploy the service as a Cloud Run for Anthos on GKE

Question 8

A developer is deploying a new application on GKE and needs to configure a HorizontalPodAutoscaler (HPA). Which two resources are required for HPA to work correctly?

Accepted Answer

CPU utilization metrics. HPA requires a deployment (or other scalable resource) and a target metric, usually CPU utilization. The HPA will scale the deployment based on the metric. A ConfigMap and a service are not strictly required for HPA.

Answer

A Service

Answer

A ConfigMap

Answer

A NodePort service

Question 9

A company wants to set up a Cloud SQL for MySQL instance with automated backups and a read replica for disaster recovery. Which THREE features or configurations should be enabled?

Accepted Answer

Enable automated backups. Automated backups are enabled by default but must be configured. A read replica requires the binary log to be enabled on the primary. The backup location can be set to multi-regional for DR. Cross-region replication requires a replica in another region. Point-in-time recovery uses binary logs.

Answer

Enable deletion protection on the primary instance

Answer

Assign a public IP address to the read replica

Question 10

A Cloud SQL for MySQL instance needs to be created with the following requirements: MySQL 8.0, db-n1-standard-2 tier, in us-central1, with root password 'secret'. Which command meets these requirements?

Accepted Answer

gcloud sql instances create my-instance --database-version MYSQL_8_0 --tier db-n1-standard-2 --region us-central1 --root-password secret. The 'gcloud sql instances create' command with --database-version, --tier, --region, and --root-password correctly creates the instance.

Answer

gcloud compute instances create my-instance --database-version MYSQL_8_0 --tier db-n1-standard-2 --region us-central1 --root-password secret

Answer

gcloud sql instances create my-instance --database-version MYSQL8 --tier n1-standard-2 --region us-central1 --password secret

Answer

gcloud sql instances create my-instance --database-version MYSQL_8_0 --machine-type db-n1-standard-2 --region us-central1 --root-password secret

Question 11

A data engineering team wants to create a Cloud Storage bucket for storing sensitive analytics data. They require encryption at rest with customer-managed keys (CMEK) and want to restrict access to a specific service account. Which three steps are necessary?

Accepted Answer

Set the bucket's default encryption to use the KMS key. To use CMEK, you must create a Cloud KMS key ring and key, then configure the bucket to use that key. Access is controlled via IAM; granting the service account roles/storage.objectAdmin allows full object management. Note: The KMS key must be in the same region as the bucket.

Answer

Enable uniform bucket-level access

Answer

Create a service account and download its JSON key

Question 12

An engineer wants to create a regional GKE cluster with 3 nodes by default. Which command should be used?

Accepted Answer

gcloud container clusters create my-cluster --region us-central1 --num-nodes 3. The 'gcloud container clusters create' command with --region (not --zone) creates a regional cluster. --num-nodes specifies the number of nodes per zone.

Answer

gcloud container clusters create my-cluster --zone us-central1-a --num-nodes 3

Answer

gcloud container clusters create my-cluster --region us-central1 --nodes 3

Answer

gcloud compute clusters create my-cluster --region us-central1 --size 3

Question 13

A company is deploying a microservice on Cloud Run. They want to ensure that the service can handle high traffic spikes by allowing multiple concurrent requests per container instance. They also want to minimize cold starts. Which two settings should they configure? (Choose two.)

Accepted Answer

Set min-instances to a value greater than 0 (e.g., 1). Setting concurrency to a higher value (e.g., 80) allows each container instance to handle multiple requests simultaneously, improving throughput. Setting min-instances to a value greater than 0 keeps instances warm to reduce cold starts. Max-instances limits scaling but does not help with cold starts. CPU always on keeps CPU allocated but does not directly affect cold starts. Timeout affects request duration, not concurrency or cold starts.

Answer

Set the timeout to 900 seconds

Answer

Set CPU always on to true

Answer

Set max-instances to a high value

Question 14

A data analyst wants to import a SQL dump file from a Cloud Storage bucket into an existing Cloud SQL database. Which command should they use?

Accepted Answer

gcloud sql import sql my-instance gs://my-bucket/dump.sql --database=mydb. The correct command is 'gcloud sql import sql gs:/// --database='. This imports a SQL dump file. The other commands either use wrong syntax or wrong import type (csv for CSV files).

Answer

gcloud sql instances import my-instance gs://my-bucket/dump.sql --database=mydb

Answer

gcloud sql import csv my-instance gs://my-bucket/dump.sql --database=mydb

Answer

gcloud sql databases import my-instance gs://my-bucket/dump.sql

Question 15

An engineer needs to create a GKE cluster with 3 nodes of machine type e2-medium in the us-central1 region. Which command should they use?

Accepted Answer

gcloud container clusters create my-cluster --num-nodes=3 --machine-type=e2-medium --region=us-central1. The correct command is 'gcloud container clusters create my-cluster --num-nodes=3 --machine-type=e2-medium --region=us-central1'. The --zone flag is for zonal clusters, not regional. The other options either use wrong zone or wrong flags.

Answer

gcloud container clusters create my-cluster --num-nodes=3 --machine-type=e2-medium

Answer

gcloud container clusters create my-cluster --num-nodes=3 --machine-type=e2-medium --region=us-central1-a

Answer

gcloud container clusters create my-cluster --num-nodes=3 --machine-type=e2-medium --zone=us-central1-a