Google ACE Practice Test 27 — 15 Questions

Question 1

Which IAM role should be granted to a user to allow them to create and manage secrets in Secret Manager?

Accepted Answer

roles/secretmanager.admin. roles/secretmanager.admin provides full control over secrets, including creation, deletion, and granting access. roles/secretmanager.secretAccessor only allows reading secret payloads. roles/editor is too broad and not specific. roles/viewer is read-only.

Answer

roles/secretmanager.secretAccessor

Answer

roles/editor

Answer

roles/secretmanager.viewer

Question 2

You need to create a snapshot of a persistent disk attached to a running Compute Engine instance. The disk is used by a production database; you want minimal impact. What should you do?

Accepted Answer

Stop the instance, create the snapshot using gcloud compute disks snapshot, then restart the instance.. Creating a snapshot of a disk in use is possible, but for data consistency, it's recommended to stop the instance or at least freeze the filesystem. However, the question says 'minimal impact', so the best practice is to stop the instance. But the correct answer reflects that snapshots can be taken from attached disks, but for database consistency, stop is recommended. Let's choose the safer answer: stop the instance.

Answer

Detach the disk, create the snapshot, then reattach.

Answer

Create the snapshot while the instance is running; snapshots are always consistent.

Answer

Use gcloud compute disks snapshot without stopping; data will be consistent.

Question 3

You want to receive notifications when a specific metric exceeds a threshold. Which Cloud Monitoring resource defines the condition and the action?

Accepted Answer

Alerting policy. An alerting policy defines conditions (metric threshold) and notification channels.

Answer

Dashboard

Answer

Uptime check

Answer

Notification channel

Question 4

Your GKE cluster nodes are running low on resources. You need to enable node pool autoscaling so that the cluster automatically adds and removes nodes based on demand. The node pool is named 'default-pool'. Which command completes this task?

Accepted Answer

gcloud container node-pools update default-pool --enable-autoscaling --min-nodes 1 --max-nodes 10. gcloud container node-pools update with --enable-autoscaling enables autoscaling, and --min-nodes/--max-nodes set boundaries.

Answer

gcloud container node-pools update default-pool --autoscaling enabled

Answer

kubectl autoscale node-pool default-pool --min 1 --max 10

Answer

gcloud container clusters update my-cluster --enable-autoscaling --min-nodes 1 --max-nodes 10

Question 5

You need to load a CSV file from Cloud Storage into an existing BigQuery table. Which bq command should you use?

Accepted Answer

bq load --source_format=CSV mydataset.mytable gs://mybucket/myfile.csv. The bq load command loads data into a BigQuery table. You specify the source format (CSV) and the location of the file in Cloud Storage.

Answer

bq query --source_format=CSV 'SELECT * FROM mydataset.mytable'

Answer

bq insert mydataset.mytable gs://mybucket/myfile.csv

Answer

bq import mydataset.mytable gs://mybucket/myfile.csv

Question 6

You are troubleshooting a slow Pub/Sub subscription. Which three steps should you take to diagnose the issue? (Choose three.)

Accepted Answer

Check the subscription's backlog in the Pub/Sub console or via gcloud pubsub subscriptions describe. Cloud Monitoring (Metrics Explorer) can show subscription backlog, Cloud Logging can show subscriber errors, and checking the subscription's backlog via gcloud or console helps assess the issue. Cloud Trace is for HTTP-based services, not Pub/Sub directly. Cloud Debugger is for code debugging, not Pub/Sub monitoring.

Answer

Use Cloud Trace to analyze the latency of each Pub/Sub message

Answer

Use Cloud Debugger to inspect the subscriber code

Question 7

You need to export all Cloud Logging logs from your project to BigQuery for long-term analysis. What should you create?

Accepted Answer

A log sink with destination BigQuery. Log sinks route logs to supported destinations including BigQuery.

Answer

A Cloud Monitoring dashboard

Answer

A VPC flow log

Answer

A log-based alert

Question 8

You need to attach an existing 100 GB persistent disk named 'my-disk' to a Compute Engine instance 'web-server-1'. What is the correct command?

Accepted Answer

gcloud compute instances attach-disk web-server-1 --disk my-disk. The command is gcloud compute instances attach-disk.

Answer

gcloud compute instances add-disk web-server-1 --disk my-disk

Answer

gcloud compute disks attach my-disk --instance web-server-1

Answer

gcloud compute disks create my-disk --instance web-server-1

Question 9

Your application running on Compute Engine is experiencing intermittent high latency. You need to diagnose the root cause. Which THREE tools or services should you use to gather data? (Choose 3)

Accepted Answer

Cloud Monitoring. Cloud Monitoring provides metrics and dashboards; Cloud Logging provides logs; Cloud Trace provides trace data for latency analysis. Together they cover metrics, logs, and traces for comprehensive troubleshooting.

Answer

Cloud Profiler

Answer

Cloud Debugger

Question 10

Match each Cloud Monitoring resource to its purpose.

Accepted Answer

Workspace: A container that organizes all monitoring data and configurations for a project.. Cloud Monitoring resources serve distinct purposes: Workspace organizes monitoring data, Alerting Policies define alert conditions, Notification Channels specify delivery methods, and Uptime Checks verify resource availability. The distractors confuse these roles.

Answer

Workspace: A mechanism to send notifications when an alert fires.

Answer

Alerting Policy: A visual representation of metric data over time.

Question 11

A company wants to run a stateful application that requires persistent storage on individual VMs. The VMs are not part of a managed instance group. Which Google Cloud storage option is best for this use case?

Accepted Answer

Persistent Disk. Persistent disks are durable block storage that can be attached to a single VM and persist independently of the VM lifecycle. Cloud Storage is object storage; Filestore is file storage; local SSDs are ephemeral and lose data on VM stop/termination.

Answer

Local SSD

Answer

Cloud Storage

Answer

Filestore

Question 12

An engineer needs to enable Private Google Access for a subnet to allow instances without external IPs to access Google APIs and services. Which flag should be used when creating or updating the subnet?

Accepted Answer

--enable-private-ip-google-access. Private Google Access is enabled on a subnet using the `--enable-private-ip-google-access` flag. This allows instances in the subnet to reach Google APIs via the default route.

Answer

--enable-google-access

Answer

--private-google-access

Answer

--enable-private-ip

Question 13

You need to create a Google-managed SSL certificate for an external HTTPS load balancer. The domain is 'www.example.com'. Which command creates the certificate?

Accepted Answer

gcloud compute ssl-certificates create my-cert --domains www.example.com. The correct command is gcloud compute ssl-certificates create with the --domains flag. This creates a Google-managed certificate that will be provisioned and renewed automatically.

Answer

gcloud compute ssl-certificates create my-cert --certificate example.crt --private-key example.key

Answer

gcloud compute ssl-certificates create my-cert --certificate example.crt

Answer

gcloud compute ssl-certificates create my-cert --domains www.example.com --managed

Question 14

An engineer wants to view the current IAM policy for a project. Which TWO commands will accomplish this?

Accepted Answer

gcloud projects get-iam-policy my-project --format json. The gcloud projects get-iam-policy command retrieves the IAM policy for a project. The gcloud projects get-ancestors-iam-policy retrieves policies from ancestors, not the project itself. The other commands are for different purposes.

Answer

gcloud resource-manager folders get-iam-policy my-folder

Answer

gcloud iam service-accounts get-iam-policy my-sa@my-project.iam.gserviceaccount.com

Answer

gcloud projects get-ancestors-iam-policy my-project

Question 15

An engineer needs to view the current IAM policy for a project in JSON format to analyze bindings. Which command should be used?

Accepted Answer

gcloud projects get-iam-policy my-project --format json. The command gcloud projects get-iam-policy PROJECT_ID --format json retrieves the IAM policy for the project in JSON format. Other commands either get policies for different resources or use a different format.

Answer

gcloud resource-manager folders get-iam-policy my-project --format json

Answer

gcloud projects get-iam-policy my-project --format yaml

Answer

gcloud iam policies get my-project --format json