Google ACE Practice Test 30 — 15 Questions

Question 1

A data engineering team is deploying a streaming Dataflow pipeline that reads from Pub/Sub and writes to BigQuery. They need to ensure that each event is processed exactly once, even in the event of failures. Which Dataflow feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rely on Dataflow's exactly-once processing guarantees. Dataflow's streaming engine provides built-in exactly-once processing guarantees for sources like Pub/Sub and sinks like BigQuery. This is achieved through a combination of checkpointing, deterministic replay, and idempotent writes, ensuring that each record is processed exactly once even during worker failures or pipeline updates. No additional configuration or external deduplication is required.

Answer

Enable at-least-once delivery on the Pub/Sub subscription

Answer

Set the Dataflow pipeline to use the 'exactly_once' parameter in the pipeline options

Answer

Use Cloud Functions to deduplicate messages before sending to Dataflow

Question 2

An organization needs to set up a new Google Cloud project with restricted access to only approved IP ranges for SSH into VMs. Which Google Cloud service should be used?

Accepted Answer

VPC Firewall Rules. VPC Firewall Rules (Option C) are the correct choice because they allow you to restrict inbound SSH (TCP port 22) traffic to specific source IP ranges by defining ingress rules at the VPC network level. This directly enforces IP-based access control for SSH into VM instances without additional services or proxies.

Answer

Cloud Armor

Answer

Cloud NAT

Answer

Identity-Aware Proxy (IAP) TCP forwarding

Question 3

A company needs to store structured data with strong consistency and global distribution for a global user base. Which Google Cloud database service is best suited?

Accepted Answer

Cloud Spanner. Cloud Spanner is the correct choice because it provides strong consistency, horizontal scalability, and global distribution via synchronous replication across regions. It supports SQL queries and ACID transactions, making it ideal for structured data that requires both consistency and global access.

Answer

Bigtable

Answer

Cloud SQL

Answer

Firestore

Question 4

Which TWO actions should a DevOps engineer take to reduce egress costs when transferring large amounts of data from Compute Engine to Cloud Storage in the same region?

Accepted Answer

Use internal IP addresses for the Compute Engine instances.. Using internal IP addresses for Compute Engine instances ensures that traffic to Cloud Storage stays within Google's internal network, avoiding internet egress charges. When instances communicate with Cloud Storage using external IPs, the traffic is routed over the public internet, incurring egress costs. Internal IPs keep the data transfer on Google's backbone, which is free for same-region transfers.

Answer

Set up a VPN between the instances and Cloud Storage.

Answer

Use a multi-regional Cloud Storage bucket.

Answer

Configure a Cloud NAT gateway.

Question 5

Which THREE are valid ways to authenticate a user for gcloud commands? (Choose three.)

Accepted Answer

OAuth2 access token. An OAuth2 access token can be used to authenticate gcloud commands by passing it with the `--access-token-file` flag or via the `gcloud auth print-access-token` command. This token is obtained from an authorization server and provides temporary, scoped access to Google Cloud resources without requiring a long-lived credential like a service account key.

Answer

API key

Answer

IdP token

Question 6

A service account needs to be able to create snapshots of disks in a specific project and store them in a different project. What is the correct IAM policy configuration?

Accepted Answer

Grant roles/compute.snapshotAdmin on the source project and roles/storage.objectAdmin on the target bucket. Creating snapshots in one project and storing them in another requires distinct permissions: `roles/compute.snapshotAdmin` on the source project allows the service account to create snapshots, while `roles/storage.objectAdmin` on the target bucket (within the destination project) grants the necessary permissions to write snapshot data into the bucket. This separation follows the principle of least privilege and aligns with the cross-project snapshot workflow.

Answer

Grant roles/compute.storageAdmin on both projects

Answer

Grant roles/viewer on both projects

Answer

Grant roles/compute.instanceAdmin on the source project and roles/storage.objectAdmin on the target bucket

Question 7

Which console page would you use to create and manage custom IAM roles?

Accepted Answer

IAM & Admin > Roles. The IAM & Admin > Roles page in the Google Cloud Console is the dedicated interface for creating, editing, and managing custom IAM roles. Custom roles allow you to define a precise set of permissions that are not available in predefined roles, giving you granular control over access to Google Cloud resources. This page also lists all predefined and custom roles, and allows you to clone, delete, or update role definitions.

Answer

IAM & Admin > Audit Logs

Answer

IAM & Admin > Organization Policies

Answer

IAM & Admin > Service Accounts

Question 8

Which THREE options are valid methods to authenticate a service account when making calls to Google Cloud APIs from a Compute Engine instance?

Accepted Answer

Using a JSON key file downloaded for the service account.. A JSON key file downloaded for a service account contains the private key necessary to create a signed JWT assertion, which is exchanged for an OAuth 2.0 access token via the Google OAuth 2.0 token endpoint (https://oauth2.googleapis.com/token). This is a standard authentication method for service accounts outside of Google Cloud, but it is also valid from a Compute Engine instance, though less secure than using the metadata server.

Answer

Using a user account's OAuth2 tokens obtained via a web browser.

Answer

Using an API key generated from the Cloud Console.

Question 9

An organization wants to enforce encryption at rest for all data in Cloud Storage using Customer-Managed Encryption Keys (CMEK). They have created a Cloud KMS key ring and key. What additional step is required when creating a new bucket to use CMEK?

Accepted Answer

Use the `--default-encryption-key` flag with the KMS key resource ID in the `gsutil mb` command.. When creating a bucket with CMEK, you must specify the `--default-encryption-key` flag with the KMS key resource ID. This sets the default encryption key for objects stored in the bucket.

Answer

Use the `--encryption-key` flag in the `gsutil mb` command.

Answer

Assign the Cloud KMS CryptoKey Encrypter/Decrypter role to the Cloud Storage service account.

Answer

Enable CMEK in the Cloud Console under the bucket's encryption settings after creation.

Question 10

You need to store application configuration data that changes infrequently (e.g., feature flags, database connection strings). Multiple services need to read this configuration at startup, and values must never appear in application code or container images. Updates to configuration should not require redeploying services. Which GCP service is most appropriate?

Accepted Answer

Use Cloud Secret Manager to store and retrieve configuration at runtime.. Secret Manager is designed exactly for storing sensitive configuration (connection strings, API keys, feature flags with sensitive values). Secrets can be accessed via API or SDK at runtime without being embedded in code or images. Secret Manager supports versioning, automatic rotation triggers, and IAM-controlled access. When a secret value changes, services can be configured to reload it without redeployment using Secret Manager's notification integration.

Answer

Store configuration in environment variables set at deployment time.

Answer

Store configuration in a Cloud Storage bucket readable by all services.

Answer

Use Cloud Firestore to store configuration documents that services read on startup.

Question 11

Order the steps to configure a Cloud Load Balancer (HTTP/S) in front of a Compute Engine instance group.

Accepted Answer

Create instance group, then health check, then backend service, then URL map, then target proxy, then forwarding rule.. Instance group and health check must exist before backend service; then frontend components.

Answer

Create backend service, then health check, then instance group, then URL map, then target proxy, then forwarding rule.

Answer

Create health check, then instance group, then backend service, then target proxy, then URL map, then forwarding rule.

Answer

Create forwarding rule, then target proxy, then URL map, then backend service, then health check, then instance group.

Question 12

A team is using gcloud configurations to manage multiple projects. They want to create a new configuration for a production project. How can they achieve this?

Accepted Answer

Run 'gcloud config configurations create prod' then 'gcloud config set project prod-project'. Manage configurations with 'gcloud config configurations create' and then set properties. Switching is done with 'gcloud config configurations activate'.

Answer

Run 'gcloud init' and select 'Create a new configuration'

Answer

Run 'gcloud config set project prod-project' with a flag to create new config

Answer

Edit the gcloud config file manually

Question 13

Arrange the steps to create a Cloud Pub/Sub topic, subscription, and publish a message.

Accepted Answer

Create topic -> Create subscription -> Publish message -> Pull message. The correct sequence ensures the topic and subscription exist before any messages are published, and messages are retrieved only after they have been published. This order prevents errors and message loss in Google Cloud Pub/Sub.

Answer

Create subscription -> Create topic -> Publish message -> Pull message

Answer

Create topic -> Publish message -> Create subscription -> Pull message

Answer

Create topic -> Create subscription -> Pull message -> Publish message

Question 14

A security auditor needs read-only access to Compute Engine instance metadata but should not be able to start or stop instances. Which predefined IAM role should be assigned?

Accepted Answer

roles/compute.viewer. The roles/compute.viewer role grants read-only access to Compute Engine resources, including instance metadata, without allowing write operations such as starting or stopping instances. This matches the requirement for read-only metadata access while preventing instance lifecycle changes.

Answer

roles/compute.instanceAdmin.v1

Answer

roles/compute.admin

Answer

roles/compute.networkAdmin

Question 15

Refer to the exhibit. After applying this IAM policy to a bucket, what access is granted?

Accepted Answer

Anyone authenticated with a Google account can list and read objects. The IAM policy grants the `roles/storage.objectViewer` role to `allAuthenticatedUsers`, which includes any identity authenticated with a Google account (including non-GCP accounts). The condition `resource.name.startsWith('projects/_/buckets/example-bucket/objects/public/')` restricts the grant to objects whose path starts with `public/`, so only those objects can be listed and read. This is why option A is correct.

Answer

No access is granted because the condition is missing

Answer

Only users in the same GCP project can read objects

Answer

Anyone on the internet can list and read objects