Google ACE Practice Test 28 — 15 Questions

Question 1

You are designing a data pipeline that reads from Cloud Storage, transforms data, and writes to BigQuery. The pipeline must process data exactly when new files land (event-driven), handle files up to 5 GB, and complete within 10 minutes. Which approach best meets these requirements?

Accepted Answer

Configure a Cloud Storage Pub/Sub notification → Cloud Function that launches a Dataflow job for each new file.. Option A is correct because Cloud Storage Pub/Sub notifications provide event-driven triggers for each new file, and launching a Dataflow job via a Cloud Function allows processing of up to 5 GB files within the 10-minute window. Dataflow’s autoscaling and streaming capabilities handle large files efficiently, while the Cloud Function acts as a lightweight orchestrator without processing the data itself.

Answer

Use a Cloud Scheduler cron job that scans Cloud Storage every minute and processes new files with Dataflow.

Answer

Use Cloud Functions triggered by GCS events to read and transform the 5 GB file directly.

Answer

Use BigQuery Data Transfer Service to load files from Cloud Storage on a schedule.

Question 2

Your team needs to manage Google Kubernetes Engine clusters across multiple projects. Rather than granting `roles/container.admin` on each project individually, you want a centralized approach. What is the most maintainable solution?

Accepted Answer

Grant `roles/container.admin` to the team's Google Group at the folder level containing all relevant projects.. Granting `roles/container.admin` at the folder level to a Google Group is the most maintainable solution because it centralizes IAM policy management. When new projects are added under that folder, they automatically inherit the role, and team membership changes are handled by updating the Google Group rather than modifying individual project IAM policies. This approach follows Google Cloud's recommended practice of using groups and resource hierarchy for scalable access control.

Answer

Create a service account with `roles/container.admin` and share its key JSON with team members.

Answer

Grant `roles/container.admin` to each team member individually in each project's IAM policy.

Answer

Use the GKE Hub to create a fleet and assign RBAC roles within each cluster.

Question 3

Your on-premises data center needs a dedicated, private connection to GCP with a guaranteed 10 Gbps bandwidth and SLA-backed availability. Internet-based VPN is not acceptable due to compliance requirements. Which connectivity option should you choose?

Accepted Answer

Cloud Interconnect Dedicated (10 Gbps). Dedicated Interconnect provides a direct, private physical connection between your on-premises network and GCP, offering up to 10 Gbps per circuit with a 99.99% SLA. Since internet-based VPN is not acceptable due to compliance requirements, this option meets the need for dedicated bandwidth and SLA-backed availability without traversing the public internet.

Answer

Cloud VPN with multiple tunnels for redundancy

Answer

Partner Interconnect via a carrier partner

Answer

Cloud Router with BGP peering over the public internet

Question 4

You need to choose between Cloud Storage storage classes for a dataset used in BigQuery for ad-hoc analysis. The data is queried approximately once per month. Which storage class minimizes storage cost while maintaining query availability?

Accepted Answer

Nearline storage class. Nearline storage class is the best choice because it offers the lowest storage cost for data accessed less than once a month (30-day minimum storage duration) while still providing sub-second access for BigQuery queries. Standard storage has no minimum duration but is more expensive for infrequent access, while Coldline and Archive have lower storage costs but impose higher retrieval costs and longer access times that are unsuitable for ad-hoc BigQuery queries.

Answer

Standard storage class

Answer

Coldline storage class

Answer

Archive storage class

Question 5

A company needs to run a batch processing workload that processes 10 TB of data nightly. The job runs for 4 hours and can tolerate interruption with checkpointing. Cost must be minimized. Which Compute Engine pricing model is most appropriate for the batch VMs?

Accepted Answer

Spot VMs (preemptible pricing). Spot VMs (preemptible pricing) are the most cost-effective choice for batch workloads that are fault-tolerant and can handle interruptions via checkpointing. Since the job runs for only 4 hours nightly and can resume from checkpoints, Spot VMs offer up to 60-91% cost savings over on-demand pricing without requiring any commitment.

Answer

On-demand VM pricing with committed use discounts (1-year CUD)

Answer

Sustained use discounts applied automatically to long-running VMs

Answer

Standard on-demand pricing with no special configuration

Question 6

You need to transfer 50 TB of data from an AWS S3 bucket to Cloud Storage. The data must be transferred within 48 hours, and the network bandwidth between AWS and GCP is limited to 1 Gbps. Which GCP service manages this transfer efficiently?

Accepted Answer

Use Storage Transfer Service to set up an S3-to-GCS transfer job.. Storage Transfer Service is the correct choice because it is a managed service designed specifically for moving large datasets from external cloud providers (like AWS S3) to Google Cloud Storage. It handles the transfer asynchronously, can parallelize connections to maximize throughput, and is ideal for the 50 TB / 48-hour constraint given a 1 Gbps link (theoretical max ~5.4 TB/day, but with parallelism and retries, STS can approach line rate). It eliminates the need for an intermediate VM or manual scripting.

Answer

Use `gsutil -m cp` from a Compute Engine VM in the same region as the destination bucket.

Answer

Download from S3 and re-upload to GCS using a local machine with high bandwidth.

Answer

Use BigQuery Data Transfer Service to move S3 data to GCS.

Question 7

You are planning a Private Service Connect (PSC) configuration to allow your VPC to access a managed Cloud SQL instance over a private endpoint without exposing traffic to the public internet. What does Private Service Connect provide in this context?

Accepted Answer

PSC provides a private, internal IP endpoint in your VPC that routes to the managed service without traversing the public internet.. Private Service Connect (PSC) allows you to access Google-managed services (like Cloud SQL) by creating a private, internal IP endpoint within your VPC. This endpoint uses an internal IP address from your VPC's subnet and forwards traffic to the service without ever leaving Google's network, thus avoiding the public internet. Unlike VPC peering, PSC does not require you to manage peering relationships or worry about overlapping IP ranges.

Answer

PSC creates a VPC peering connection between your VPC and Google's service VPC.

Answer

PSC enables bidirectional private communication between your VPC and the service's VPC, similar to peering.

Answer

PSC replaces the need for a Serverless VPC Access connector when calling managed services from Cloud Run.

Question 8

A Cloud Function (gen2) is triggered by Pub/Sub messages. The function processes each message by calling three external APIs sequentially. The total processing time is 25 seconds per message. The Pub/Sub subscription's ack deadline is 10 seconds. What will happen, and how should you fix it?

Accepted Answer

Messages will be redelivered before processing completes; extend the Pub/Sub subscription ack deadline to exceed 25 seconds.. The Pub/Sub subscription has a 10-second ack deadline, but the Cloud Function takes 25 seconds to process each message. Since the function does not acknowledge the message within the deadline, Pub/Sub considers the message unacknowledged and redelivers it, causing duplicate processing. The fix is to increase the ack deadline to exceed 25 seconds, ensuring the function has enough time to complete processing and send an acknowledgment.

Answer

Pub/Sub will wait indefinitely for the function to acknowledge; no issue occurs.

Answer

The Cloud Function will automatically extend its own ack deadline via the Pub/Sub client library.

Answer

Increase the Cloud Function's memory to process faster and complete within 10 seconds.

Question 9

You need to verify that a Compute Engine VM in `us-central1` can reach an on-premises server at IP `10.1.2.3` over a Cloud VPN connection. The VPN tunnel appears UP but you're unsure if routing is correct. Which GCP tool can test this connectivity?

Accepted Answer

Use Network Intelligence Center Connectivity Tests to analyze the path from the VM to the on-premises IP.. B is correct because Network Intelligence Center Connectivity Tests can analyze the path from a specific source (the Compute Engine VM) to a destination (the on-premises server IP 10.1.2.3) across hybrid connectivity like Cloud VPN. It validates routing, firewall rules, and tunnel health without requiring you to SSH into the VM or run live traffic, making it ideal for diagnosing routing issues when the VPN tunnel is UP but connectivity is uncertain.

Answer

SSH into the VM and run `ping 10.1.2.3` to test connectivity.

Answer

Review Cloud VPN tunnel metrics in Cloud Monitoring for packet loss.

Answer

Run `gcloud compute routes list` to verify the route to 10.1.2.3 exists.

Question 10

Your application writes structured JSON logs to stdout from a Cloud Run service. You want to query logs in Cloud Logging to find all requests where the `user_id` field equals `12345`. Which log query syntax finds these entries?

Accepted Answer

`jsonPayload.user_id="12345"`. Option B is correct because Cloud Logging uses the `jsonPayload` field to access structured JSON fields in log entries. When your application writes structured JSON logs to stdout, Cloud Run automatically parses them and stores the fields under `jsonPayload`. The query `jsonPayload.user_id="12345"` directly matches the `user_id` field within that JSON payload.

Answer

`textPayload:"user_id:12345"`

Answer

`resource.labels.user_id="12345"`

Answer

`labels.user_id="12345"`

Question 11

A platform team wants to define a formal service level objective (SLO) for their API: 99.9% of requests must succeed (HTTP 2xx) over a 30-day rolling window. Which Cloud Monitoring feature tracks this?

Accepted Answer

Define a Cloud Monitoring SLO with a 99.9% availability target over a 30-day rolling window. Option B is correct because Cloud Monitoring's SLO feature is specifically designed to track compliance with a formal service level objective, such as 99.9% of requests succeeding over a 30-day rolling window. It automatically calculates the success rate from the selected metric (e.g., request count or latency) and reports the SLO's performance over the defined period, including error budgets and burn rates.

Answer

Create an alerting policy with a 99.9% threshold on the request success metric

Answer

Build a BigQuery dashboard showing 30-day average success rates from exported logs

Answer

Set an uptime check target of 99.9% in Cloud Monitoring

Question 12

A payment service publishes an event to a message queue every time a transaction completes. Multiple downstream services (inventory, analytics, email) must each process every event independently. Which messaging pattern and GCP service best supports this?

Accepted Answer

Cloud Pub/Sub with one subscription per downstream service on a shared topic. Cloud Pub/Sub with a single topic and one subscription per downstream service is the correct pattern because it implements a fan-out messaging model where each subscriber receives an independent copy of every published message. This ensures that inventory, analytics, and email services each process every transaction event without interference, while Pub/Sub handles at-least-once delivery and automatic scaling.

Answer

Cloud Tasks with one queue per downstream service

Answer

Cloud Storage event notifications with three separate buckets

Answer

Directly calling each downstream service's API synchronously from the payment service

Question 13

Match each Compute Engine machine family to its typical workload.

Question 14

Match each BigQuery feature to its description.

Question 15

You need to set an organization policy that prevents any project from creating Cloud SQL instances with a public IP address. The constraint you need is `sql.restrictPublicIp`. What type of constraint is this, and how do you enable it?

Accepted Answer

Boolean constraint — set `enforce: true` in the organization policy.. Option B is correct because `sql.restrictPublicIp` is a boolean constraint in Google Cloud Organization Policies. Boolean constraints have a simple `enforce: true` or `enforce: false` setting, and setting it to `true` prevents projects from creating Cloud SQL instances with public IP addresses. This is the standard method to enforce this restriction across the organization.

Answer

List constraint — add `CLOUD_SQL_INSTANCE` to the `deniedValues` list.

Answer

Custom constraint — define a CEL expression that evaluates the Cloud SQL instance's IP configuration.

Answer

List constraint — add `0.0.0.0/0` to the `deniedValues` list.