Google ACE Practice Test 27 — 15 Questions

Question 1

A team runs `gcloud organizations list` and sees no output even though they know their company has a GCP organization. What is the most likely cause, and how should they resolve it?

Accepted Answer

The user lacks org-level IAM permissions such as Organization Viewer.. The `gcloud organizations list` command retrieves organizations from the GCP Resource Manager API. If no output is returned despite the organization existing, the most likely cause is that the authenticated user lacks the `resourcemanager.organizations.get` permission, which is granted by roles like Organization Viewer (`roles/resourcemanager.organizationViewer`) or Organization Administrator (`roles/resourcemanager.organizationAdmin`). Without this IAM permission at the organization level, the API call returns an empty list rather than an error, which is a common source of confusion.

Answer

The organization does not exist yet; run `gcloud organizations create` to create it.

Answer

The gcloud SDK does not support the organizations command; use the Cloud Console instead.

Answer

The project must be linked to the organization using `gcloud projects move`.

Question 2

An organization needs to ensure that only images from their approved Container Registry (gcr.io/approved-project) can be deployed on GKE clusters in their organization. Which GCP control enforces this?

Accepted Answer

Binary Authorization with a policy requiring attestation from the approved registry. Binary Authorization enforces deployment-time policies that require images to be signed by trusted authorities. By configuring a policy that requires attestations from the approved registry (gcr.io/approved-project), only images from that registry can be deployed on GKE clusters, directly meeting the requirement.

Answer

A VPC firewall rule blocking pulls from unauthorized registries

Answer

Cloud Armor rules blocking container pull requests from external sources

Answer

Manually reviewing all Docker images before deployment

Question 3

A GCP project has three service accounts. A developer wants to list all service accounts in the project using the gcloud CLI. Which command is correct?

Accepted Answer

gcloud iam service-accounts list. The `gcloud iam service-accounts list` command is the standard gcloud CLI command to list all service accounts in a GCP project. It uses the IAM API to retrieve the service accounts associated with the current project (or a specified project via the `--project` flag). This command is part of the `gcloud iam` group, which manages IAM resources, and the `service-accounts` sub-group specifically handles service account operations.

Answer

gcloud service-accounts list

Answer

gcloud iam list service-accounts

Answer

gcloud projects list-service-accounts

Question 4

A small business is deploying a web application on Compute Engine and wants to ensure high availability. They have set up two instances in different zones behind a TCP load balancer. What should they also configure to detect and route traffic away from unhealthy instances?

Accepted Answer

Configure a health check on the load balancer.. A health check is required for the TCP load balancer to monitor the backend instances. It periodically probes the instances on a specified port and path, marking them as unhealthy if they fail to respond. The load balancer then stops routing new traffic to unhealthy instances, ensuring high availability by directing traffic only to healthy backends.

Answer

Set a firewall rule to allow traffic only on port 80.

Answer

Use a global HTTP(S) load balancer instead.

Answer

Create a snapshot schedule for the persistent disks.

Question 5

A developer has deployed a Cloud Run service but receives a 503 error when accessing it. The service logs show 'The request was aborted because there was no available instance.' What is the most likely cause?

Accepted Answer

The service is experiencing a spike in traffic and the max instances are too low.. The 503 error with the message 'The request was aborted because there was no available instance' indicates that all current instances are saturated and Cloud Run cannot scale up quickly enough to handle the incoming requests. This occurs when traffic spikes exceed the configured maximum number of instances, causing new requests to be rejected until an instance becomes free. Option C correctly identifies that the max instances setting is too low for the traffic spike.

Answer

The minimum number of instances is set too high.

Answer

The container health checks are failing.

Answer

The service's memory limit is set too low.

Question 6

Which THREE configurations are required to enable Private Google Access for Compute Engine instances in a custom VPC subnet? (Select 3 correct answers)

Accepted Answer

Create a subnet with the --enable-private-ip-google-access flag.. Private Google Access is enabled on a subnet. Instances in that subnet can reach Google APIs using internal IPs. It does not require Cloud NAT, Cloud VPN, or internet access. The three required elements are: a VPC network, a subnet with Private Google Access enabled, and instances in that subnet.

Answer

Create a Cloud Router to advertise routes to Google.

Answer

Configure Cloud NAT to route traffic to Google APIs.

Question 7

A developer created a service account with the roles/storage.admin role and wants to use it from a Compute Engine instance without downloading a key file. What is the best practice?

Accepted Answer

Attach the service account to the instance using the --service-account flag when creating the instance.. The best practice is to attach the service account to the Compute Engine instance at creation time using the --service-account flag. This allows the instance to automatically obtain credentials via the metadata server, avoiding the need to download and manage a service account key file. Downloading keys should be avoided due to security risks.

Answer

Download the service account key and store it on the instance's persistent disk.

Answer

Use gcloud auth activate-service-account on the instance with the service account email.

Answer

Store the service account email in an instance metadata and use gcloud commands.

Question 8

A startup wants to grant developers the ability to create and manage Compute Engine instances, but prevent them from deleting instances or changing firewall rules. Which IAM approach should they use?

Accepted Answer

Create a custom role with permissions for instance management but without compute.instances.delete.. Creating a custom role allows the startup to grant fine-grained permissions for instance management (e.g., compute.instances.create, compute.instances.start, compute.instances.stop) while explicitly omitting compute.instances.delete and any firewall-related permissions like compute.firewalls.update or compute.firewalls.delete. This ensures developers can manage instances but cannot delete them or alter firewall rules, meeting the exact requirement.

Answer

Assign the roles/compute.instanceAdmin.v1 role.

Answer

Assign the roles/compute.instanceOperator role.

Answer

Assign the roles/compute.admin role.

Question 9

Which gcloud command lists all available roles that can be granted on a GCP project, including both predefined and custom roles?

Accepted Answer

`gcloud iam list-grantable-roles //cloudresourcemanager.googleapis.com/projects/PROJECT_ID`. The `gcloud iam list-grantable-roles` command is specifically designed to list all roles (both predefined and custom) that can be granted on a given resource, such as a GCP project. The resource is identified by its canonical name, which for a project is `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID`. This command returns roles that are eligible for binding at that resource level, including those inherited from ancestors.

Answer

`gcloud iam roles list --project=PROJECT_ID`

Answer

`gcloud projects get-iam-policy PROJECT_ID`

Answer

`gcloud iam roles describe roles/editor`

Question 10

A batch data processing job runs nightly for 4 hours and can tolerate interruption because it saves progress checkpoints every 15 minutes. Which VM option offers the greatest cost reduction?

Accepted Answer

Spot VM. Spot VMs offer significant cost reduction (up to 60-91% discount) compared to standard VMs, making them ideal for fault-tolerant, interruptible batch workloads. Since the job saves checkpoints every 15 minutes, it can resume from the last checkpoint if preempted, fully leveraging the cost benefit of Spot VMs.

Answer

Custom machine type VM with reduced memory

Answer

Sole-tenant node VM

Answer

Shielded VM

Question 11

A company recently deployed a web application on a managed instance group (MIG) behind a regional external HTTP(S) load balancer. The application is a Python Flask app running on Compute Engine VMs. After a code update that caused increased response times under load, users report intermittent 503 errors. You examine the load balancer logs and see that the backend instances are periodically marked as unhealthy. The health check is configured to query the /health endpoint every 5 seconds with a healthy threshold of 2 and a timeout of 1 second. The application's /health endpoint returns 200 OK, but sometimes takes up to 1.5 seconds to respond. What is the most likely cause of the health check failures?

Accepted Answer

The health check response timeout is too low for the application's increased response time.. The health check is configured with a timeout of 1 second, but the /health endpoint now takes up to 1.5 seconds to respond due to the code update. Since the health check waits only 1 second for a response, any request that takes longer than that will be considered a failure, causing the backend to be marked unhealthy and triggering 503 errors. This is a classic mismatch between health check timeout and application response time.

Answer

The instances are overloaded and failing health checks intermittently.

Answer

The health check firewall rule is missing or misconfigured.

Answer

The health check is checking the wrong port.

Question 12

A team packages their Kubernetes application as a Helm chart. They need to install it into a GKE cluster with the release name 'webapp' in the 'production' namespace, overriding the default image tag to 'v2.1'. Which Helm command achieves this?

Accepted Answer

helm install webapp ./chart -n production --set image.tag=v2.1. `helm install` is the standard Helm command to deploy a chart into a cluster, and the `--set` flag overrides default values like `image.tag`. The `-n` flag specifies the namespace, and the release name 'webapp' is given as the first argument. This matches the Helm CLI syntax exactly.

Answer

helm deploy webapp ./chart -n production --set image.tag=v2.1

Answer

kubectl apply -f helm-chart.yaml -n production --image-tag=v2.1

Answer

helm apply webapp -n production --chart=./chart --tag=v2.1

Question 13

A developer wants to deploy a containerized application that can scale to zero when not in use and only pay for resources consumed during request processing. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless compute platform that automatically scales your containerized applications from zero instances up to handle traffic, and scales back down to zero when there are no requests. You only pay for the resources (CPU, memory, and networking) consumed during request processing, with no charges when the service is idle. This makes it the ideal choice for the described use case of scaling to zero and pay-per-request billing.

Answer

App Engine Flexible Environment

Answer

Compute Engine with managed instance groups

Answer

Google Kubernetes Engine

Question 14

A security team needs an inventory of all Compute Engine VM instances across all projects in their GCP organization, including instance names, zones, and status, without logging into each project individually. Which service provides this?

Accepted Answer

Cloud Asset Inventory with an organization-scoped asset search. Cloud Asset Inventory provides a unified, organization-scoped view of all resources across projects, including Compute Engine VM instances. By using an organization-scoped asset search, the security team can query for all VM instances (e.g., `asset_type = "compute.googleapis.com/Instance"`) without needing to log into each project individually. This service is purpose-built for cross-project resource discovery and inventory management.

Answer

Cloud Monitoring — use the metric explorer to list all VM instances

Answer

Cloud Resource Manager — list all projects and then query each for VMs

Answer

BigQuery information_schema views for GCP compute resources

Question 15

Where in the Google Cloud Console can a user view all APIs currently enabled for their project and monitor their usage?

Accepted Answer

APIs & Services > Dashboard. The 'APIs & Services > Dashboard' page in the Google Cloud Console provides a centralized view of all enabled APIs for a project, along with real-time usage metrics such as requests per second, error rates, and latency. This dashboard is the primary interface for monitoring API consumption and identifying throttling or quota issues.

Answer

Cloud Shell > Active Sessions

Answer

IAM & Admin > Service Accounts

Answer

Monitoring > Metrics Explorer