Google ACE Practice Test 3 — 10 Questions

Question 1

A Cloud Run service needs to access a database password at runtime. Where should the password be stored according to GCP security best practices?

Accepted Answer

In Secret Manager, referenced as a mounted secret or accessed via the API at runtime. Secret Manager is the GCP-native service designed to securely store sensitive data like database passwords. It provides encryption at rest and in transit, fine-grained access control via IAM, and supports both mounting secrets as volumes and accessing them via the API at runtime. This aligns with GCP security best practices by avoiding exposure of secrets in plain text, configuration files, or container images.

Answer

As a plain-text environment variable in the Cloud Run service configuration

Answer

In a Cloud Storage bucket accessible to the service account

Answer

Baked into the container image at build time

Question 2

A team is designing a system where two GCP projects — a shared services project and an application project — need their VMs to communicate using private IPs. Both projects are in the same organization. Which networking option best enables this with centralized network management?

Accepted Answer

Shared VPC (XPN) with the shared services project as the host. Shared VPC (XPN) allows an organization to centrally manage networking across multiple projects from a single host project, enabling VMs in the shared services project and the application project to communicate via private IPs without needing separate peering or VPN configurations. This is the best option because it provides centralized network administration and policy enforcement, which aligns with the requirement for centralized network management.

Answer

VPC Peering between the two projects' VPCs

Answer

Cloud VPN between the two projects' default VPCs

Answer

Using external IPs with TLS — private IP communication isn't necessary between GCP projects

Question 3

You need to design a solution where a Cloud Function is triggered by HTTP requests from the internet, but it must also privately access a Cloud SQL instance that has no public IP. The Cloud Function should not expose the Cloud SQL instance to public traffic. Which configuration enables this?

Accepted Answer

Configure a Serverless VPC Access connector and attach it to the Cloud Function to access Cloud SQL via private IP.. A Serverless VPC Access connector allows a Cloud Function to connect to a Cloud SQL instance via its private IP, enabling private network communication without exposing the database to the internet. The connector bridges the serverless environment to a VPC, and the Cloud SQL instance must have private IP enabled. This satisfies the requirement of private access while the function itself remains publicly triggerable via HTTP.

Answer

Enable a public IP on the Cloud SQL instance and restrict access using Cloud SQL authorized networks.

Answer

Use Cloud SQL Auth Proxy on a Compute Engine VM as a jump host between the function and the database.

Answer

Deploy the Cloud Function in the same project as Cloud SQL; same-project resources can access each other privately by default.

Question 4

A Cloud Run service requires access to a private Cloud SQL instance in the same VPC. The Cloud SQL instance is not publicly accessible. How should the Cloud Run service connect to Cloud SQL without using the Cloud SQL Auth Proxy separately?

Accepted Answer

Configure the Cloud Run service with `--add-cloudsql-instances` to connect via the built-in Auth Proxy. The Cloud Run service can use the `--add-cloudsql-instances` flag, which automatically deploys a built-in Cloud SQL Auth Proxy sidecar container within the same pod. This proxy establishes a secure, encrypted connection to the private Cloud SQL instance using the instance's private IP, without requiring the instance to have a public IP or the user to manage a separate proxy. The proxy authenticates via the service account attached to the Cloud Run service, enabling seamless and secure connectivity.

Answer

Use the Cloud SQL public IP with SSL required — Cloud Run can reach public IPs

Answer

Deploy a separate Cloud SQL Auth Proxy container in the same Cloud Run service as a sidecar

Answer

Enable Serverless VPC Access connector to route Cloud Run traffic to the private Cloud SQL IP

Question 5

A team's Cloud SQL for PostgreSQL instance is running out of disk space. Automated storage increase is disabled. A monitoring alert fires at 90% disk usage. What is the fastest safe action to increase storage?

Accepted Answer

Increase storage capacity using `gcloud sql instances patch --storage-size=[NEW_SIZE]` without downtime. Cloud SQL for PostgreSQL supports online storage resizing without downtime. Using `gcloud sql instances patch --storage-size=[NEW_SIZE]` allows you to increase the allocated disk capacity while the instance remains fully operational, making it the fastest safe action when automated storage increase is disabled.

Answer

Delete old records from the database to free space — no instance changes needed

Answer

Create a new larger Cloud SQL instance and migrate data with Cloud Database Migration Service

Answer

Enable automatic storage increase and wait — Cloud SQL will expand the disk retroactively

Question 6

A financial application requires all database transactions to be durable even if the primary Cloud SQL instance fails mid-transaction. The RPO (Recovery Point Objective) must be near-zero. Which Cloud SQL feature achieves this?

Accepted Answer

Cloud SQL High Availability with synchronous standby replica in a different zone. Cloud SQL High Availability (HA) uses a synchronous standby replica in a different zone to ensure that every write is committed to both the primary and standby before acknowledging the transaction. This provides near-zero RPO because if the primary fails mid-transaction, the standby has the exact same data and can take over without data loss.

Answer

Cloud SQL read replica with synchronous replication

Answer

Cloud SQL with automated daily backups and point-in-time recovery

Answer

Cloud Spanner — it automatically replicates synchronously across zones

Question 7

You are designing a data pipeline that reads from Cloud Storage, transforms data, and writes to BigQuery. The pipeline must process data exactly when new files land (event-driven), handle files up to 5 GB, and complete within 10 minutes. Which approach best meets these requirements?

Accepted Answer

Configure a Cloud Storage Pub/Sub notification → Cloud Function that launches a Dataflow job for each new file.. Cloud Storage Pub/Sub notifications provide event-driven triggers for each new file, and launching a Dataflow job via a Cloud Function allows processing of up to 5 GB files within the 10-minute window. Dataflow’s autoscaling and streaming capabilities handle large files efficiently, while the Cloud Function acts as a lightweight orchestrator without processing the data itself.

Answer

Use a Cloud Scheduler cron job that scans Cloud Storage every minute and processes new files with Dataflow.

Answer

Use Cloud Functions triggered by GCS events to read and transform the 5 GB file directly.

Answer

Use BigQuery Data Transfer Service to load files from Cloud Storage on a schedule.

Question 8

A team needs to run a simple containerized script that processes a batch of files once per night and exits when done — no HTTP endpoint needed. Which GCP service is most appropriate?

Accepted Answer

Cloud Run Jobs triggered by Cloud Scheduler. Cloud Run Jobs is the correct choice because it is designed for batch workloads that run to completion, with no requirement for an HTTP endpoint. It can handle long-running tasks (up to 24 hours) and can be triggered by Cloud Scheduler for nightly execution, making it ideal for processing files once per night.

Answer

Cloud Run Services with a timeout set to 24 hours

Answer

Cloud Functions with a 540-second maximum timeout

Answer

App Engine Standard with a background service

Question 9

A network security team wants to capture metadata about all TCP flows entering and leaving VMs in a specific subnet — source IP, destination IP, port, and bytes transferred — for security analysis. Which GCP feature collects this data?

Accepted Answer

VPC Flow Logs enabled on the subnet. VPC Flow Logs capture metadata (source/destination IP, port, protocol, bytes transferred) for all TCP (and UDP/ICMP) flows entering and leaving VM instances in a subnet. This feature is specifically designed for network monitoring and security analysis, recording flow-level logs without inspecting packet payloads. Enabling VPC Flow Logs on the subnet directly meets the requirement to collect the specified metadata for all TCP flows.

Answer

Cloud Armor security policies with logging enabled

Answer

Cloud Packet Mirroring — captures all traffic for deep packet inspection

Answer

Firewall Rules Logging on each firewall rule

Question 10

Two GCP projects, A and B, have VPC peering configured. Project A is peered with B, and Project B is peered with Project C. Can VMs in Project A reach VMs in Project C through Project B?

Accepted Answer

No — VPC peering is non-transitive; A and C must be directly peered to communicate. VPC peering in Google Cloud is non-transitive. This means that if Project A is peered with Project B and Project B is peered with Project C, traffic from Project A cannot flow through Project B to reach Project C. Each peering connection is a direct, point-to-point link, and there is no routing of traffic across multiple peered networks unless explicitly configured with a separate mechanism like a VPN or a third-party appliance. Therefore, VMs in Project A and Project C must be directly peered to communicate.

Answer

Yes — VPC peering automatically enables transitive routing through intermediate peered networks

Answer

Yes — if Project B has IP forwarding enabled, it acts as a router between A and C

Answer

It depends on the firewall rules in Project B's VPC