Google ACE Practice Test 27 — 15 Questions

Question 1

A gaming company's GKE cluster uses a mix of node pools: a standard on-demand pool for stateful database pods, and a Spot VM pool for compute-intensive but fault-tolerant game simulation pods. The simulation pods occasionally get preempted. How should the Deployment be configured to route simulation pods to the Spot pool only?

Accepted Answer

Add a nodeSelector: cloud.google.com/gke-spot: 'true' to the simulation Deployment spec. Option B is correct because GKE uses the node label `cloud.google.com/gke-spot` to identify Spot VMs. Adding a `nodeSelector` with that exact key-value pair ensures the simulation Deployment is scheduled exclusively on Spot nodes, which is the intended behavior for fault-tolerant, preemptible workloads.

Answer

Set podAffinity to prefer nodes where Spot pods are running

Answer

Set requests.cpu and requests.memory to very high values — GKE will route them to Spot nodes

Answer

Name the simulation Deployment with a 'spot-' prefix — GKE routes prefixed deployments to Spot pools

Question 2

An application receives the error 'Permission denied on resource project [PROJECT_ID] (or it may not exist)' when making an API call with a service account. The service account has the correct IAM role. What else might be missing?

Accepted Answer

The relevant GCP API is not enabled in the project. The error 'Permission denied on resource project [PROJECT_ID] (or it may not exist)' typically occurs when the service account has the correct IAM role but the API being called is not enabled for the project. Even with proper IAM permissions, GCP requires that the specific API (e.g., Compute Engine API, Cloud Storage API) be enabled in the project before any API calls can succeed. Enabling the API activates the service and allows the service account to use it.

Answer

The service account needs the Project Owner role to make any API calls

Answer

The service account needs to be in the same organization as the project

Answer

The service account email must be explicitly allow-listed in the API's configuration

Question 3

A team stores sensitive configuration files in Cloud Storage that internal services download at startup. External partners occasionally need time-limited access to specific files without creating GCP accounts. Which feature grants temporary access without modifying bucket permissions?

Accepted Answer

Generate a Signed URL for the specific files with the required expiration time. Option B is correct because Signed URLs provide time-limited, granular access to specific Cloud Storage objects without altering the underlying bucket permissions. The partner receives a URL that embeds authentication information and an expiration time, enabling secure, temporary downloads without requiring a GCP account or IAM role.

Answer

Make the specific files publicly readable and share the direct URL

Answer

Create a temporary GCP service account for the partner and share its JSON key

Answer

Enable uniform bucket-level access and create a public IAM binding for 24 hours

Question 4

Which gcloud command lists all available roles that can be granted on a GCP project, including both predefined and custom roles?

Accepted Answer

`gcloud iam list-grantable-roles //cloudresourcemanager.googleapis.com/projects/PROJECT_ID`. Option B is correct because the `gcloud iam list-grantable-roles` command is specifically designed to list all roles (both predefined and custom) that can be granted on a given resource, such as a GCP project. The resource is identified by its canonical name, which for a project is `//cloudresourcemanager.googleapis.com/projects/PROJECT_ID`. This command returns roles that are eligible for binding at that resource level, including those inherited from ancestors.

Answer

`gcloud iam roles list --project=PROJECT_ID`

Answer

`gcloud projects get-iam-policy PROJECT_ID`

Answer

`gcloud iam roles describe roles/editor`

Question 5

You are designing an application that needs to process exactly once each message published to a topic, even if the consumer fails partway through and restarts. Which GCP service provides built-in exactly-once processing semantics with Pub/Sub?

Accepted Answer

Dataflow with Pub/Sub as the source using the Beam SDK.. Dataflow with Pub/Sub as the source using the Beam SDK provides built-in exactly-once processing semantics because it leverages the Beam engine's checkpointing and the Pub/Sub source's snapshot-based deduplication. Dataflow tracks each message's unique ID and ensures that even if a worker fails and restarts, the message is not reprocessed, guaranteeing exactly-once delivery within the pipeline.

Answer

Cloud Functions subscribed to the Pub/Sub topic with idempotent logic.

Answer

BigQuery Subscriptions connected directly to the Pub/Sub topic.

Answer

Cloud Run with a Pub/Sub push subscription and database deduplication table.

Question 6

A GKE pod's container is frequently crashing and restarting. You need to view the logs from the previous container instance (before the last crash) to diagnose the crash cause. Which command retrieves these logs?

Accepted Answer

`kubectl logs POD_NAME --previous`. Option B is correct because the `--previous` flag in `kubectl logs` retrieves logs from the previous instance of a container in a pod, which is exactly what you need when the current container has crashed and restarted. This allows you to see the logs that led to the crash, even though the container is now running a new instance.

Answer

`kubectl logs POD_NAME`

Answer

`kubectl describe pod POD_NAME`

Answer

`kubectl get events --field-selector reason=OOMKilled`

Question 7

A financial services company needs to run analytics queries on transaction data that arrives in real-time. The queries must return results within 2 seconds and the dataset grows by ~100 GB per day. The company also needs to retain all data for 7 years for regulatory compliance. Which architecture best satisfies these requirements?

Accepted Answer

Stream transactions through Pub/Sub → Dataflow → BigQuery; run analytics on BigQuery.. Option B is correct because it uses Pub/Sub for real-time ingestion, Dataflow for stream processing, and BigQuery for analytics, which can handle 100 GB/day growth and return queries within 2 seconds using BigQuery's columnar storage and automatic sharding. BigQuery's 7-year retention is supported by its time-based partitioning and long-term storage at reduced cost, meeting regulatory compliance without manual intervention.

Answer

Write transactions to Cloud Spanner; run analytics queries directly against Spanner.

Answer

Store transactions in Cloud Bigtable and use Dataproc/Spark for analytics queries.

Answer

Use Cloud SQL for storage and Cloud Dataprep for analytics transformations.

Question 8

You are planning a GCP network for a company with offices in three regions: `us-central1`, `europe-west1`, and `asia-east1`. All three regions must communicate with each other, and traffic must NOT traverse the public internet. Each region has its own subnet. Which network design achieves this with the least management overhead?

Accepted Answer

Use a single global VPC with subnets in each region; traffic between subnets stays on Google's private network.. Option B is correct because a single global VPC allows you to create subnets in multiple regions, and traffic between those subnets stays on Google's private backbone network without traversing the public internet. This design requires no additional connectivity configuration, peering, or VPN tunnels, making it the simplest to manage while meeting all requirements.

Answer

Create three separate VPCs (one per region) and connect them with VPC Network Peering.

Answer

Set up Cloud VPN tunnels between each pair of regions.

Answer

Use Cloud Interconnect dedicated connections in each region and configure BGP routing between them.

Question 9

A company's application currently runs on a single Compute Engine VM with a persistent disk. The application serves read-heavy traffic and the single VM is becoming a bottleneck. The application is stateless. Which change provides the most immediate horizontal scalability improvement?

Accepted Answer

Create a Managed Instance Group from the VM and configure autoscaling with a load balancer.. Option B is correct because creating a Managed Instance Group (MIG) from the existing VM and configuring autoscaling with a load balancer directly addresses the read-heavy, stateless bottleneck by distributing traffic across multiple VM instances. This provides immediate horizontal scalability, as new instances are automatically provisioned or terminated based on load, without requiring any application changes.

Answer

Upgrade the existing VM to a larger machine type (vertical scaling).

Answer

Add more persistent disks to the existing VM to handle more I/O.

Answer

Enable live migration on the existing VM so it can move between hosts.

Question 10

You need to allow a third-party auditing company to view all resources and IAM policies across your GCP organization without being able to modify anything. Which role should you grant, and at which level?

Accepted Answer

Grant `roles/iam.securityReviewer` at the organization level.. Option B is correct because `roles/iam.securityReviewer` at the organization level grants read-only access to all IAM policies and resources across all projects in the organization, exactly meeting the requirement for a third-party auditor to view without modification. This role includes permissions like `iam.roles.get`, `iam.policies.get`, and `resourcemanager.projects.get`, which are scoped organization-wide when assigned at the org level.

Answer

Grant `roles/viewer` on each individual project the auditor needs to access.

Answer

Grant `roles/owner` at the organization level with a time-limited condition.

Answer

Create a custom role with only `*.get` and `*.list` permissions and grant it at the org level.

Question 11

Your GKE application's pods are being evicted frequently during periods of high traffic. You notice that pods without resource requests are being evicted first. The nodes are running at ~85% memory utilization. What should you do to reduce pod eviction?

Accepted Answer

Set memory requests and limits for all pods to match their actual memory usage.. Setting memory requests and limits for all pods to match their actual memory usage ensures that the Kubernetes scheduler can accurately allocate resources and make informed scheduling decisions. Without requests, pods are treated as BestEffort QoS class, making them the first candidates for eviction under memory pressure (when nodes exceed ~85% utilization). By defining requests, pods are classified as Burstable or Guaranteed, which gives them higher priority during eviction and prevents unnecessary disruptions.

Answer

Increase the node machine type to have more memory.

Answer

Configure pod disruption budgets (PDBs) to prevent eviction.

Answer

Enable cluster autoscaler to add nodes before memory pressure occurs.

Question 12

You are designing a solution for a retail application that needs to store customer shopping cart data. The cart data is accessed frequently during active sessions and must survive for at least 30 days even without activity. Each cart entry is small (< 1 KB) and identified by a user ID. The solution must support microsecond read latency and be horizontally scalable. Which GCP storage service best meets these requirements?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is correct because it is a fully managed, scalable NoSQL database designed for large analytical and operational workloads, offering consistent sub-10ms latency and horizontal scaling. For small (<1 KB) entries accessed with microsecond read latency, Bigtable's key-value model and high throughput make it ideal, and its data persists indefinitely (beyond 30 days) with no automatic expiration. It supports high-frequency access patterns typical of active shopping cart sessions.

Answer

Cloud Firestore in Datastore mode

Answer

Cloud SQL (PostgreSQL)

Answer

Cloud Memorystore (Redis)

Question 13

Your team is planning a GKE cluster for a microservices application. Some services process sensitive payment data and must run on dedicated nodes that no other workloads can access. The rest of the application can share nodes. How should you configure the cluster?

Accepted Answer

Apply taints to the dedicated node pool and tolerations to payment service pod specs.. Option B is correct because taints on dedicated node pools prevent pods without matching tolerations from being scheduled on those nodes, ensuring that only payment service pods (which include the corresponding tolerations) can run on the dedicated nodes. This isolates sensitive workloads at the node level without requiring separate clusters, which would add operational overhead and complexity.

Answer

Use separate GKE clusters: one for payment services and one for everything else.

Answer

Use Kubernetes NetworkPolicy to restrict network access between payment pods and other pods.

Answer

Set resource requests and limits so payment services consume all resources on their nodes.

Question 14

You are deploying a stateful application to GKE that requires each pod to have its own dedicated persistent disk, and each disk must persist data even if the pod is rescheduled to a different node. Which Kubernetes object type should you use?

Accepted Answer

StatefulSet with volumeClaimTemplates to provision individual PVCs per pod.. A StatefulSet with volumeClaimTemplates is the correct choice because it automatically provisions a unique PersistentVolumeClaim (PVC) for each pod replica, ensuring each pod gets its own dedicated persistent disk. When a pod is rescheduled to a different node, the PVC remains bound to its original PersistentVolume (PV), allowing the new pod to mount the same disk and retain the data. This meets the requirement for both per-pod dedicated storage and data persistence across rescheduling events.

Answer

Deployment with a shared PersistentVolumeClaim mounted by all pods.

Answer

DaemonSet with a hostPath volume on each node.

Answer

Deployment with an emptyDir volume for each pod.

Question 15

Your company uses Google Workspace for email. You need to set up GCP for a new team that includes contractors who use non-Google email addresses. Which identity solution allows contractors to authenticate to GCP without a Google Workspace license?

Accepted Answer

Provision contractor accounts using Cloud Identity Free, independent of Google Workspace.. Cloud Identity Free provides identity management for users without requiring a Google Workspace license. It allows contractors with non-Google email addresses to authenticate to GCP using their existing email as a Google account, enabling IAM role assignment without additional licensing costs. This is the correct solution because it decouples identity from Google Workspace, supporting external users while maintaining centralized access control.

Answer

Issue each contractor a Gmail account and add it directly to IAM.

Answer

Create service accounts for each contractor and share the key JSON files.

Answer

Add contractor email addresses as external users and grant them project-level IAM roles.