Google ACE Practice Test 28 — 15 Questions

Question 1

A company wants to deploy a globally distributed, multi-tier application with strict low-latency communication between the web and database tiers. The database must be fully managed and able to survive a regional outage with automatic failover. Which combination is most appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Run (multi-region) and Cloud Spanner (multi-region). Cloud Run (multi-region) provides a serverless compute layer that can automatically route traffic across regions for low-latency access, while Cloud Spanner (multi-region) offers a fully managed, globally distributed relational database with synchronous replication and automatic failover, ensuring strong consistency and regional outage survival without manual intervention. This combination meets the strict low-latency communication and automatic failover requirements for a multi-tier application.

Answer

Cloud Run (multi-region) and Cloud SQL (cross-region replica with manual failover)

Answer

Compute Engine regional managed instance group and Cloud SQL (regional with automatic failover)

Answer

App Engine (standard) and Cloud Datastore (multi-region)

Question 2

An infrastructure team uses Terraform to manage GCP resources including API enablement. Which Terraform resource enables a GCP API for a project, equivalent to `gcloud services enable`?

Accepted Answer

google_project_service with the desired service endpoint. The `google_project_service` resource is the direct Terraform equivalent of `gcloud services enable`, as it explicitly enables a specified GCP service API for a given project. This resource takes the service endpoint (e.g., `compute.googleapis.com`) and handles the enablement lifecycle, including dependency tracking and disabling on destroy.

Answer

google_project_iam_binding with the serviceusage.services.enable permission

Answer

google_service_account with enabled_services block

Answer

google_project with the services argument listing all required APIs

Question 3

A team uses Terraform to manage GCP infrastructure. After running `terraform plan`, they see 15 resources to be created. They want to apply only the Cloud SQL instance (resource name: `google_sql_database_instance.main`) without applying all 15 changes. Which Terraform command targets a specific resource?

Accepted Answer

terraform apply -target=google_sql_database_instance.main. Terraform uses the `-target` flag to limit the operation to a specific resource address, allowing you to apply only the `google_sql_database_instance.main` resource without affecting the other 14 resources in the plan. This is the standard Terraform syntax for targeting a single resource during `apply` or `destroy` operations.

Answer

terraform apply --resource=google_sql_database_instance.main

Answer

terraform apply -only=google_sql_database_instance.main

Answer

terraform plan --filter=google_sql_database_instance.main && terraform apply

Question 4

A project was accidentally deleted. A GCP administrator realizes the mistake 3 days later. What is the maximum time window in which the project can be restored?

Accepted Answer

30 days — projects can be restored using `gcloud projects undelete` within this window. Google Cloud projects have a 30-day soft-delete period after deletion. During this window, the project can be recovered using the `gcloud projects undelete` command or the Cloud Resource Manager API, restoring all associated resources and configurations.

Answer

24 hours — projects are permanently deleted after one day

Answer

7 days — projects enter a one-week soft-delete period

Answer

Projects are permanently deleted immediately and cannot be recovered

Question 5

Which command creates a Cloud Storage bucket named 'my-archive-bucket' in the US multi-region using the modern gcloud CLI?

Accepted Answer

gcloud storage buckets create gs://my-archive-bucket --location=US. The modern gcloud CLI uses the `gcloud storage buckets create` command to create a Cloud Storage bucket, and the `--location=US` flag specifies the US multi-region. This command is part of the newer, unified `gcloud storage` command group that replaces the older `gsutil` tool for bucket management.

Answer

gcloud storage mk gs://my-archive-bucket --location=US

Answer

gcloud cloud-storage create my-archive-bucket --region=US

Answer

gsutil mk -l US gs://my-archive-bucket

Question 6

A company wants to ensure that all IAM users in a project must use two-factor authentication. Which Google Cloud service should be used?

Accepted Answer

Cloud Identity. Cloud Identity is the correct service because it provides identity-as-a-service (IDaaS) that allows administrators to enforce security policies, including requiring two-factor authentication (2FA) for all IAM users. By enabling 2FA at the Cloud Identity level, every user authenticating through Google Cloud's identity layer must complete a second factor (e.g., TOTP via Google Authenticator or a security key) before accessing any Google Cloud resources. This policy applies globally across all projects in the organization, ensuring consistent enforcement without needing to configure per-user or per-project settings.

Answer

Identity Platform

Answer

Cloud IAM

Answer

Cloud Audit Logs

Question 7

Which feature of Cloud SQL provides automated backups and enables point-in-time recovery?

Accepted Answer

All Cloud SQL tiers. Cloud SQL provides automated backups and point-in-time recovery (PITR) for all tiers, including Cloud SQL Enterprise, Enterprise Plus, and even the basic (non-HA) configurations. This is because the backup and PITR functionality is a core feature of the Cloud SQL service itself, not tied to a specific tier or high-availability setup. Automated backups are enabled by default, and PITR uses binary log (binlog) files to allow restoration to any point within the backup retention window.

Answer

Only Cloud SQL Enterprise

Answer

Only Cloud SQL High Availability configuration

Answer

Only Cloud SQL Enterprise Plus

Question 8

Refer to the exhibit. An engineer runs this command and sees the output. The instance is unable to reach the internet. What is the most likely reason?

Accepted Answer

The instance does not have a public IP address.. The instance cannot reach the internet because it lacks a public IP address. In Google Cloud, an instance without an external IP address cannot initiate outbound connections to the internet unless a Cloud NAT or a VM with a public IP is used as a proxy. The command output likely shows that the instance only has an internal IP, confirming this as the root cause.

Answer

VPC firewall rules are blocking egress traffic.

Answer

The instance needs a Cloud NAT gateway for outbound connectivity.

Answer

The subnetwork is misconfigured.

Question 9

A company is using Cloud Storage to store sensitive data. They want to enforce that objects are automatically deleted after 90 days. Which configuration should they use?

Accepted Answer

Configure Object Lifecycle Management with a Delete action after 90 days.. Object Lifecycle Management allows you to set rules that automatically perform actions on objects after a specified number of days. By configuring a rule with a Delete action set to trigger after 90 days, objects in the bucket will be automatically removed, meeting the requirement without manual intervention.

Answer

Set a retention policy on the bucket for 90 days.

Answer

Enable bucket locking with a retention period of 90 days.

Answer

Enable object versioning and set a lifecycle rule to delete noncurrent versions.

Question 10

A project manager wants to see how much each GCP service is costing the team this month, broken down by service. Where should they look?

Accepted Answer

Billing > Reports (filtered by service). The Billing > Reports page in the Google Cloud Console allows you to filter costs by service, SKU, project, and other dimensions. This provides a granular breakdown of monthly spending per GCP service, which is exactly what the project manager needs.

Answer

IAM & Admin > Quotas

Answer

Cloud Monitoring > Cost metrics dashboard

Answer

Resource Manager > Project settings > Cost summary

Question 11

A data analytics team needs to run a Spark job on a schedule. They want to minimize operational overhead and only pay for resources used during job execution. Which service should they use?

Accepted Answer

Use Dataproc workflow templates with scheduled execution. Dataproc workflow templates allow you to define a Spark job as a workflow and schedule its execution using Cloud Scheduler or a cron-like mechanism. This minimizes operational overhead by automatically provisioning a cluster, running the job, and tearing down the cluster when finished, ensuring you only pay for resources used during execution.

Answer

Create a Dataproc cluster and keep it running for ad-hoc jobs

Answer

Provision Compute Engine instances with Spark installed and start/stop them manually

Answer

Use BigQuery for all analytics

Question 12

You need to audit all IAM policy changes in your project. You want to ensure that every change is logged with the identity of the user who made the change. Which type of audit log should you enable?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs (also known as Cloud Audit Logs) record all API calls that modify the configuration or metadata of resources, including IAM policy changes. These logs capture the identity of the user who made the change, the time of the change, and the specific modification, ensuring full accountability for administrative actions.

Answer

Data Access audit logs

Answer

Policy Denied audit logs

Answer

System Event audit logs

Question 13

A company is using BigQuery for analytics. They notice that queries are slow and expensive. The data is loaded daily into a single table. Which action would most improve performance and reduce cost?

Accepted Answer

Partition the table by date and cluster by frequently filtered columns.. Partitioning the table by date allows BigQuery to prune partitions during query execution, scanning only the relevant daily data instead of the entire table. Clustering on frequently filtered columns further reduces the data scanned by sorting data within partitions. This directly reduces both query cost (pay-per-byte) and latency, addressing the core issue of slow, expensive queries on a large daily-loaded table.

Answer

Use a flat-rate reservation to improve query concurrency.

Answer

Denormalize the table to reduce joins.

Answer

Increase the number of slots available for the project.

Question 14

A team is using Terraform to manage infrastructure in Google Cloud. After running terraform apply, they receive an error: 'Error 409: Resource already exists'. The team needs to resolve this without deleting and recreating the resource. What should they do?

Accepted Answer

Import the existing resource into Terraform state with 'terraform import'.. The 'Error 409: Resource already exists' indicates that the resource was created outside of Terraform or the state file lost track of it. Running 'terraform import' brings the existing resource under Terraform management by adding its current attributes to the state file, allowing subsequent operations without deletion or recreation.

Answer

Run 'terraform refresh' to update the state file.

Answer

Set the 'create_before_destroy' lifecycle rule on the resource.

Answer

Change the resource name in the Terraform configuration.

Question 15

The company wants to change the storage class of these log files to Nearline to reduce costs while still retaining the ability to access them without restoration fees. Which command should be used?

Accepted Answer

gsutil rewrite -s NEARLINE gs://my-bucket/logs/*.log. The `gsutil rewrite` command is specifically designed to change the storage class of existing objects without incurring restoration fees. It rewrites the object metadata to the new storage class (Nearline) while keeping the object in place, and the operation does not require retrieving the object from cold storage, so no restoration charges apply.

Answer

gsutil cp -s NEARLINE gs://my-bucket/logs/*.log

Answer

gsutil setmeta -s NEARLINE gs://my-bucket/logs/*.log

Answer

gsutil mv -s NEARLINE gs://my-bucket/logs/*.log