Google ACE Practice Test 30 — 15 Questions

Question 1

You want to create a log-based metric to count errors from your application logs. Which TWO resources are required? (Select 2)

Accepted Answer

A filter that matches the error log entries. You need a filter to match error logs and a metric descriptor that defines the metric type.

Answer

An alerting policy

Answer

A log sink

Answer

A notification channel

Question 2

An engineer needs to create an alerting policy in Cloud Monitoring that sends a notification when the 99th percentile latency of a service exceeds 500 ms for 5 minutes. Which metric type should they use?

Accepted Answer

Metric threshold. A metric threshold alert uses a numeric metric and triggers when the value crosses a threshold. Log-based alerts are for when a specific log entry appears. Uptime checks monitor availability, not latency percentiles.

Answer

Log-based metric

Answer

Uptime check

Answer

Cloud Audit Logs

Question 3

An engineer needs to monitor the external HTTP availability of a web application hosted on Compute Engine. Which Cloud Monitoring feature should they use?

Accepted Answer

Uptime check. Uptime checks are designed to verify that a resource is accessible and measure response latency from various locations. They can check HTTP/HTTPS/TCP endpoints.

Answer

Dashboard

Answer

Metric Explorer

Answer

Log-based alert

Question 4

A company wants to export all Cloud Logging logs to BigQuery for long-term analysis. They create a log sink with a BigQuery dataset as the destination. After a few days, they notice that some logs are missing in BigQuery. What is the most likely reason?

Accepted Answer

The sink's inclusion filter is too restrictive. Log sinks have a buffer period of up to a few minutes, but they guarantee delivery. However, if the sink's filter excludes certain logs (e.g., by resource type or severity), those logs are not exported. Missing logs usually indicate a filter misconfiguration.

Answer

Logs older than 30 days cannot be exported

Answer

The sink's destination is a table, not a dataset

Answer

BigQuery dataset is in a different region

Question 5

An engineer needs to update a Kubernetes Deployment's container image to version v2. They run 'kubectl set image deployment/my-app my-container=gcr.io/my-project/my-image:v2'. After a few minutes, they check the rollout status and see a failure. They want to revert to the previous image. Which command should they use?

Accepted Answer

kubectl rollout undo deployment/my-app. 'kubectl rollout undo' reverts the Deployment to the previous revision. 'kubectl rollout status' shows status but does not revert. 'kubectl set image' with v1 would manually set the old image, but 'undo' is the standard rollback command.

Answer

kubectl rollout status deployment/my-app

Answer

kubectl delete deployment/my-app --cascade=false

Answer

kubectl set image deployment/my-app my-container=gcr.io/my-project/my-image:v1

Question 6

An engineer needs to enable autoscaling on an existing node pool in a GKE cluster. Which command should they use?

Accepted Answer

gcloud container node-pools update --enable-autoscaling. 'gcloud container node-pools update' with '--enable-autoscaling' enables autoscaling. 'gcloud container clusters update' updates cluster-level settings, not node pools. 'kubectl autoscale' is for workloads, not node pools. 'gcloud compute instance-groups' is not used for GKE node pools.

Answer

gcloud compute instance-groups set-autoscaling

Answer

kubectl autoscale node-pool

Answer

gcloud container clusters update

Question 7

A company wants to split traffic between two revisions of a Cloud Run service: 90% to revision 'green' and 10% to revision 'blue'. Which command should they use?

Accepted Answer

gcloud run services update-traffic. 'gcloud run services update-traffic' is the correct command to manage traffic splitting between revisions. 'gcloud run revisions list' only lists revisions. 'gcloud run services update' does not handle traffic directly. 'gcloud run deploy' with --no-traffic is for initial deployment.

Answer

gcloud run revisions list

Answer

gcloud run services update

Answer

gcloud run deploy

Question 8

An engineer is troubleshooting a Compute Engine instance that is unreachable via SSH. They suspect a firewall rule is blocking traffic. Which TWO actions should they take to diagnose the issue? (Choose 2)

Accepted Answer

View Cloud Logging for firewall rule logs. In Cloud Logging, you can view firewall logs (if VPC flow logs are enabled, but firewall rules logging can be enabled per rule). Checking VPC firewall rules in the Cloud Console allows you to verify the rules. Cloud Trace is for latency, Cloud Monitoring for metrics, and gcloud compute ssh is for connecting, not diagnosing firewall rules.

Answer

Create a Cloud Monitoring alert for packet loss

Answer

Run gcloud compute ssh --dry-run

Answer

Use Cloud Trace to analyze network latency

Question 9

A developer needs to query BigQuery using the bq command-line tool with standard SQL. Which flag should they include?

Accepted Answer

--use_legacy_sql=false. The '--use_legacy_sql=false' flag enables standard SQL. By default, bq uses legacy SQL. '--format' controls output format, not SQL dialect. '--project_id' specifies project. '--sync' is not a valid bq flag.

Answer

--format

Answer

--project_id

Answer

--sync

Question 10

An engineer needs to attach an existing persistent disk to a Compute Engine instance. They have created the disk using 'gcloud compute disks create'. Which command should they use to attach it?

Accepted Answer

gcloud compute instances attach-disk. 'gcloud compute instances attach-disk' attaches a disk to an instance. 'gcloud compute disks attach' does not exist. 'gcloud compute instances add-disk' is not a valid command. 'gcloud compute disks resize' resizes the disk.

Answer

gcloud compute disks resize

Answer

gcloud compute instances add-disk

Answer

gcloud compute disks attach

Question 11

An application is experiencing intermittent high latency. Using Cloud Trace, an engineer identifies that the bottleneck is a Pub/Sub subscription with a large backlog. Which action would MOST directly help reduce the backlog?

Accepted Answer

Increase the number of subscribers. Increasing the number of subscribers (e.g., scaling out the subscriber application) will increase the processing rate and reduce backlog. Increasing the retention duration keeps messages longer, not reducing backlog. The ack deadline and message size are not the primary causes of backlog.

Answer

Increase the ack deadline

Answer

Increase the maximum message size

Answer

Increase the message retention duration

Question 12

A company wants to automate the response to specific log entries by triggering a Cloud Function. Which THREE components are required? (Choose 3)

Accepted Answer

Cloud Function (Pub/Sub trigger). Log entries must be routed to a Pub/Sub topic via a log sink. The Cloud Function subscribes to that topic (triggered by Pub/Sub). The log sink is the exporter, Pub/Sub is the intermediary, and Cloud Function is the action. A notification channel is for alerts, not triggers. BigQuery is not needed.

Answer

BigQuery dataset

Answer

Cloud Monitoring notification channel

Question 13

An engineer needs to create a Cloud Monitoring dashboard that displays CPU utilization for all Compute Engine instances in a project. Which TWO steps are required? (Choose 2)

Accepted Answer

Add the chart to a dashboard. First, use Metric Explorer to create a chart with the CPU utilization metric. Then, add that chart to a dashboard. Dashboards can have charts from Metric Explorer. You do not need to create an alert or export logs.

Answer

Create an uptime check

Answer

Create a log-based metric

Answer

Set up a notification channel

Question 14

You want to create a monitoring dashboard that shows a time-series chart of CPU utilization for a specific Compute Engine instance. Which THREE components do you need to configure? (Choose three.)

Accepted Answer

Choose a time aggregation function (e.g., mean, max). In Cloud Monitoring, to create a chart you need to select a metric, a resource, and a time aggregation function.

Answer

Create a log-based metric for CPU utilization

Answer

Set up a notification channel to send alerts

Question 15

A company wants to allow developers to create and manage secrets in Secret Manager, but prevent them from viewing secret values. Which TWO predefined roles should be combined to achieve this?

Accepted Answer

roles/secretmanager.secretManager. The roles/secretmanager.admin role includes permissions to create and manage secrets but not to access secret versions (i.e., view values). However, it includes the permission to access versions. Actually, the admin role includes secretmanager.versions.access, so it can view values. To separate manage from view, you need roles/secretmanager.secretVersionManager (manage versions without access) and roles/secretmanager.secretManager (manage secrets). Wait, the correct combination is roles/secretmanager.secretVersionManager (create/disable/destroy versions) and roles/secretmanager.secretManager (create/update/delete secrets). Neither includes secretmanager.versions.access. The roles/secretmanager.viewer allows viewing metadata but not values. The roles/secretmanager.secretAccessor allows accessing versions. To manage without viewing, combine roles that exclude access. Check accurate roles: roles/secretmanager.admin includes all permissions including access. roles/secretmanager.secretManager includes manage secrets but not access versions? Let's verify: roles/secretmanager.secretManager has permissions: secretmanager.secrets.create, secretmanager.secrets.delete, secretmanager.secrets.get, secretmanager.secrets.update, secretmanager.secrets.list. It does NOT include secretmanager.versions.access. roles/secretmanager.secretVersionManager has permissions: secretmanager.versions.create, secretmanager.versions.disable, secretmanager.versions.destroy, secretmanager.versions.enable, secretmanager.versions.get, secretmanager.versions.list. It does NOT include secretmanager.versions.access. So combining these two roles allows managing secrets and versions but not accessing the payload. roles/secretmanager.viewer allows viewing metadata but not accessing payload. roles/secretmanager.secretAccessor allows accessing payload. So the correct two are secretManager and secretVersionManager.

Answer

roles/secretmanager.admin

Answer

roles/secretmanager.secretAccessor

Answer

roles/secretmanager.viewer