Google ACE Practice Test 29 — 15 Questions

Question 1

A company is using Cloud NAT to allow private instances to access the internet. However, they notice that traffic from different instances appears to come from the same external IP address. What is the reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud NAT uses a single external IP by default unless you specify multiple.. Cloud NAT uses a source network address translation (SNAT) configuration that, by default, maps all outbound traffic from instances in a VPC network to a single external IP address. This is the expected behavior unless you explicitly configure multiple NAT IP addresses in a NAT gateway or use a Cloud Router with custom SNAT settings. Option B correctly identifies that Cloud NAT defaults to a single external IP unless you specify multiple.

Answer

Cloud NAT is not configured correctly; traffic should come from different IPs.

Answer

The instances are using a shared VPC so NAT IP is shared.

Answer

Each instance is assigned a unique external IP by Cloud NAT.

Question 2

An organization is running a batch job that processes sensitive data. The job writes output to a Cloud Storage bucket. The security team requires that all data at rest be encrypted with a customer-managed key. Which key type should be used?

Accepted Answer

Cloud KMS CMEK. Cloud KMS CMEK (Customer-Managed Encryption Keys) is the correct choice because it allows the organization to control and manage the encryption keys used to protect data at rest in Cloud Storage, meeting the security team's requirement for customer-managed keys. CMEK keys are created and managed in Cloud KMS, and you can control key rotation, access, and lifecycle, ensuring compliance with regulatory mandates for customer-managed encryption.

Answer

Cloud HSM

Answer

Default encryption (Google-managed)

Answer

Customer-supplied encryption keys (CSEK)

Question 3

A company is migrating a legacy monolithic application to Google Cloud. The application runs on a single VM and contains both the web server and backend processes. The team wants to separate concerns and deploy the web tier on Cloud Run and the backend on Compute Engine. They need to allow the Cloud Run service to initiate HTTPS connections to the backend VM. What is the most secure way to accomplish this?

Accepted Answer

Use Serverless VPC Access to connect Cloud Run to the VPC, and keep the VM internal. Serverless VPC Access creates a direct, private connection between Cloud Run and your VPC, allowing the Cloud Run service to reach the backend VM using its internal IP address. This avoids exposing the VM to the public internet, which is the most secure approach for initiating HTTPS connections between the two tiers.

Answer

Assign a public IP to the backend VM and configure firewall rules to allow HTTPS from any source

Answer

Set up a VPN tunnel between Cloud Run and the VPC

Answer

Use Cloud NAT to provide outbound internet access to Cloud Run

Question 4

A company has a VPC with several Compute Engine instances that only have internal IPs. These instances need to download updates from the internet. What is the recommended method to provide internet access without assigning external IPs to each instance?

Accepted Answer

Configure Cloud NAT in the same region and subnet.. Cloud NAT (Network Address Translation) allows instances with only internal IPs to initiate outbound connections to the internet, while preventing inbound connections from the internet. It translates the internal IPs to a shared external IP address, enabling secure internet access without assigning external IPs to each instance. This is the recommended method for providing internet access to private instances in Google Cloud.

Answer

Use VPC Network Peering with a public network.

Answer

Set up a Cloud VPN gateway to route traffic to on-premises.

Answer

Place the instances behind an external HTTP(S) load balancer.

Question 5

A company wants to deploy a containerized web application on Google Kubernetes Engine (GKE) with minimal operational overhead. They require automatic scaling based on CPU utilization. Which resource should they configure?

Accepted Answer

HorizontalPodAutoscaler. The HorizontalPodAutoscaler (HPA) is the correct resource because it automatically scales the number of pod replicas in a GKE deployment based on observed CPU utilization (or other custom metrics). This directly meets the requirement for automatic scaling with minimal operational overhead, as HPA is a native Kubernetes controller that adjusts replica counts without manual intervention.

Answer

Cluster autoscaler

Answer

VerticalPodAutoscaler

Answer

Node auto-provisioning

Question 6

Refer to the exhibit. A user runs `gcloud compute instances list` in Cloud Shell and gets the output 'Listed 0 items.' The user expects to see the VM they just created via the Console. What is the most likely cause?

Accepted Answer

The Cloud Shell is in a different project. The `gcloud compute instances list` command lists VM instances in the currently configured project (set via `gcloud config set project`). If the Cloud Shell is pointing to a different project than the one where the VM was created via the Console, the command will return 'Listed 0 items' even though the VM exists. This is the most likely cause because the user expects to see the VM but the command is scoped to a different project context.

Answer

The VM was created in a different region

Answer

The VM is stopping

Answer

The user does not have compute.instances.list permission

Question 7

Arrange the steps to create a Compute Engine instance with a custom service account in the correct order.

Accepted Answer

First create the custom service account, then grant the appropriate IAM roles to it, and finally create the Compute Engine instance specifying that service account.. The service account must exist before attaching to an instance; instance creation is the final step.

Answer

First grant IAM roles to a service account, then create the service account, and finally create the Compute Engine instance with that service account.

Answer

First create the Compute Engine instance, then create the custom service account, and finally grant IAM roles to the service account.

Answer

First create the custom service account, then create the Compute Engine instance with that service account, and finally grant IAM roles to the service account.

Question 8

Refer to the exhibit. A user attempts to create a Deployment Manager deployment that references a service account. What is the most likely issue?

Accepted Answer

The user does not have the roles/iam.serviceAccountUser role on the service account. When a Deployment Manager deployment references a service account, the user must have the `roles/iam.serviceAccountUser` role on that service account to impersonate it. Without this role, the deployment fails even if the user has `deploymentmanager.deployments.create` permission, because the service account is used to execute the deployment's resources. Option B correctly identifies this missing IAM binding as the most likely issue.

Answer

The user does not have deploymentmanager.deployments.create permission

Answer

The service account is disabled

Answer

The service account does not exist

Question 9

Order the steps to attach a persistent disk to a running Compute Engine instance and format/mount it.

Accepted Answer

Attach the disk to the instance, SSH into the instance, format the disk (if needed), then mount the disk.. The correct sequence for attaching a persistent disk to a running Compute Engine instance and formatting/mounting it is: first attach the disk to the instance using gcloud or the console, then SSH into the instance, format the disk (e.g., with mkfs) if it is new, and finally mount it to a directory (e.g., using mount). This ensures the disk is available and prepared for use.

Answer

Format the disk, attach the disk to the instance, SSH into the instance, then mount the disk.

Answer

SSH into the instance, attach the disk, format the disk, then mount the disk.

Answer

Attach the disk, SSH into the instance, mount the disk, then format the disk.

Question 10

A user wants to use gcloud to create a Cloud Storage bucket but receives a permission denied error. What is the most likely cause?

Accepted Answer

The user does not have storage.buckets.create permission. C is correct because Cloud Storage uses IAM permissions to control access to bucket creation. The specific permission required is `storage.buckets.create`, which must be granted at the project level. Without this permission, the gcloud command will fail with a permission denied error, even if the user is authenticated and billing is enabled.

Answer

The bucket name is already taken

Answer

The user is not authenticated

Answer

The project does not have billing enabled

Question 11

A company wants to migrate an on-premises MySQL database to Cloud SQL with minimal downtime. Which service should they use?

Accepted Answer

Database Migration Service. Database Migration Service (DMS) is the correct choice because it is specifically designed to migrate on-premises MySQL databases to Cloud SQL with minimal downtime using continuous replication. It handles schema conversion, data transfer, and ongoing sync until you cut over, ensuring near-zero downtime without manual intervention.

Answer

Cloud SQL for MySQL

Answer

Cloud SQL with external replicas

Answer

Compute Engine with MySQL installed

Question 12

A company is running a batch processing job on Compute Engine every night. The job usually completes in 2 hours, but recently it has been taking over 4 hours. The CPU utilization on the VM is consistently below 20%. What is the most likely cause?

Accepted Answer

The VM is running out of memory and swapping to disk.. When CPU utilization is below 20% but job execution time has doubled, the bottleneck is likely I/O, not compute. Swapping to disk occurs when the VM runs out of memory, causing the kernel to page memory to the persistent disk, which is orders of magnitude slower than RAM. This I/O wait directly increases job duration without raising CPU utilization.

Answer

The VM is using a shared-core machine type.

Answer

The VM's machine type is too small.

Answer

The VM's persistent disk is in a different zone.

Question 13

A developer wants to use Cloud Shell to create a Compute Engine VM but receives an error 'API not enabled'. What should the developer do first?

Accepted Answer

Enable the Compute Engine API. The error 'API not enabled' indicates that the Compute Engine API has not been activated for the developer's Google Cloud project. Cloud Shell uses the gcloud CLI, which requires the Compute Engine API to be enabled before it can create VM instances. The correct first step is to enable the Compute Engine API via the Cloud Console or the `gcloud services enable compute.googleapis.com` command.

Answer

Switch to a different region

Answer

Use gcloud auth login

Answer

Increase project quota

Question 14

A company uses preemptible VMs for batch processing. Which TWO best practices should be implemented to improve resilience and manageability? (Choose 2)

Accepted Answer

Use instance metadata to pass configuration parameters.. Instance metadata is a key-value store that can be used to pass configuration parameters to preemptible VMs at boot time. Since preemptible VMs can be terminated at any time, using metadata ensures that new instances can be recreated with the same configuration without manual intervention. This improves manageability by centralizing configuration and resilience by enabling automated re-provisioning.

Answer

Use persistent disks to store application state.

Answer

Use Cloud Functions to monitor instance termination.

Answer

Use persistent disk snapshots for backup.

Question 15

A team is deploying a stateful application on GKE that requires each pod to have its own persistent disk. Which TWO Kubernetes resources are essential for this deployment? (Choose two.)

Accepted Answer

StatefulSet. A StatefulSet is essential because it provides stable, unique network identifiers and ordered, graceful deployment and scaling for stateful applications, ensuring each pod maintains its identity and persistent storage binding across rescheduling. A PersistentVolumeClaim (PVC) is required to request and bind a persistent disk to each pod, enabling the pod to retain its data independently of other pods in the set.

Answer

Deployment

Answer

ConfigMap

Answer

Ingress