Google ACE Practice Test 30 — 15 Questions

Question 1

A company wants to expose a web application running on Compute Engine instances behind a managed instance group. They need a single IP address that distributes incoming HTTP traffic across instances. Which type of load balancer should they use?

Accepted Answer

External HTTP(S) Load Balancer. Option D is correct because the External HTTP(S) Load Balancer is a regional or global, proxy-based Layer 7 load balancer that provides a single external IP address for distributing incoming HTTP traffic across Compute Engine instances in a managed instance group. It supports HTTP and HTTPS protocols, health checks, and autoscaling, making it ideal for web applications.

Answer

Internal TCP/UDP Load Balancer

Answer

External TCP/UDP Network Load Balancer

Answer

SSL Proxy Load Balancer

Question 2

A company is deploying a microservices application on Google Kubernetes Engine (GKE). They want to expose their services to the internet using a single external IP address and route traffic based on the request path. Which resource should they use?

Accepted Answer

An Ingress resource. An Ingress resource is the correct choice because it provides HTTP(S) layer 7 routing, allowing you to expose multiple services behind a single external IP address and route traffic based on request paths (e.g., /api to one service, /web to another). This meets the requirement of using one external IP and path-based routing, which a Service alone cannot achieve.

Answer

A Service of type NodePort

Answer

A Service of type LoadBalancer for each microservice

Answer

A Network Endpoint Group (NEG)

Question 3

An organization needs to deploy a batch job that runs every hour on Compute Engine. The job requires a VM with 16 vCPUs and 64 GB of memory. The job takes approximately 20 minutes to complete. The team wants to minimize costs while ensuring the job completes reliably. Which deployment strategy should they use?

Accepted Answer

Use spot VMs with a restart policy configured in the instance template. Option A (sustained-use discount) is for always-on VMs, not suitable for hourly jobs. Option B (preemptible VMs) are cheaper but can be terminated, risking job failure. Option D (committed use discounts) require 1- or 3-year commitments, which is overkill. Option C (spot VMs with a restart policy) is correct: Spot VMs are similar to preemptible but more affordable, and configuring a restart policy ensures the job resumes if interrupted.

Answer

Use committed use discounts for the VM

Answer

Create an always-on VM and use sustained-use discounts

Answer

Use preemptible VMs and accept the risk of termination

Question 4

A company runs a big data processing pipeline on a Dataproc cluster. To reduce costs, they use a primary cluster with one master node (standard) and 20 worker nodes all using preemptible VMs. Recently, jobs running during peak business hours are failing with 'Task failed' errors. You notice that many preemptible VMs are reclaimed during the middle of these jobs. The jobs are long-running MapReduce tasks that write intermediate results to the cluster's HDFS. What should you do to improve job reliability without significantly increasing costs?

Accepted Answer

Enable graceful decommissioning for the preemptible instances.. Option A is correct because enabling graceful decommissioning for preemptible instances allows YARN to handle node loss more gracefully. When a preemptible VM is reclaimed, YARN can wait for running containers to finish before shutting down the node, reducing task failures. This improves job reliability without adding cost, as it leverages existing preemptible VMs more effectively.

Answer

Increase the number of preemptible worker nodes to 40.

Answer

Use a higher preemptible instance type (e.g., n1-highmem-2 instead of n1-standard-2).

Answer

Switch to standard worker nodes with committed use discounts.

Question 5

Which THREE steps are part of deploying a containerized application to Google Kubernetes Engine (GKE) using a CI/CD pipeline? (Choose three.)

Accepted Answer

Apply a Deployment manifest to the cluster. A typical CI/CD pipeline for GKE includes: building a container image, pushing it to Container Registry, and applying a Kubernetes manifest to deploy. Option B (create a Compute Engine instance) is not part of GKE deployment; Option C (create an instance template) is for MIGs. Option E (set up Cloud NAT) is for outbound networking, not deployment. So A, D, and F are correct.

Answer

Configure Cloud NAT for the cluster

Answer

Create a Compute Engine instance for the pipeline

Answer

Create an instance template for the node pool

Question 6

A team manages multiple Kubernetes Engine clusters across different projects. They need to enforce that all clusters have the same security policies, including private cluster settings and workload identity. Which approach is most scalable?

Accepted Answer

Use Terraform with a module that defines the standard cluster configuration, and apply it to each project.. Option D is correct because Terraform, combined with a reusable module, provides an Infrastructure as Code (IaC) approach that enforces consistent cluster configurations across multiple projects declaratively. This method is scalable as it allows you to define the standard security policies (private cluster settings, Workload Identity) once in a module and apply it to any number of clusters, ensuring drift is prevented and changes are auditable.

Answer

Use Cloud Asset Inventory to compare configurations and alert on differences.

Answer

Retrieve cluster configuration for each cluster using gcloud container clusters describe and apply changes manually.

Answer

Use Config Connector with deployment scripts to manage cluster resources as Kubernetes custom resources.

Question 7

An application running on Compute Engine writes logs to a local file. The operations team wants to centralize these logs in Cloud Logging with minimal code changes. What is the recommended approach?

Accepted Answer

Install and configure the Cloud Logging agent on the instance.. Option B is correct because the Cloud Logging agent automatically collects local log files and sends them to Cloud Logging without code changes. Option A requires code changes. Option C and D are manual and not recommended.

Answer

Use Cloud Scheduler to tail the log file and send entries to Logging.

Answer

Set up a scheduled cron job to upload the log file via gcloud logging write.

Answer

Modify the application to use the Cloud Logging client library.

Question 8

A company is running a batch processing job on Compute Engine every night. The job usually completes in 2 hours, but recently it has been taking over 4 hours. The CPU utilization on the VM is consistently below 20%. What is the most likely cause?

Accepted Answer

The VM is running out of memory and swapping to disk.. The correct answer is C. When CPU utilization is below 20% but job execution time has doubled, the bottleneck is likely I/O, not compute. Swapping to disk occurs when the VM runs out of memory, causing the kernel to page memory to the persistent disk, which is orders of magnitude slower than RAM. This I/O wait directly increases job duration without raising CPU utilization.

Answer

The VM is using a shared-core machine type.

Answer

The VM's machine type is too small.

Answer

The VM's persistent disk is in a different zone.

Question 9

A company's Google Kubernetes Engine cluster has experienced a sudden increase in latency. The team suspects a misconfigured node pool is causing resource contention. They want to verify the node's resource usage. Which command or tool should they use?

Accepted Answer

Run 'kubectl top nodes'.. B is correct because 'kubectl top nodes' directly displays real-time CPU and memory usage for each node in the cluster, which is the fastest way to identify resource contention causing latency. This command leverages the metrics-server to aggregate resource metrics from kubelets, giving immediate insight into node-level utilization without additional overhead.

Answer

Run 'gcloud container clusters describe cluster-name'.

Answer

Use the Cloud Console Monitoring page to view node metrics.

Answer

Run 'kubectl describe node node-name'.

Question 10

A developer deployed a new version of a Compute Engine instance but the startup script fails to run. The developer needs to debug the startup script. Which step should be taken first?

Accepted Answer

Review the serial port 1 output in the Google Cloud console.. Serial port 1 output in the Google Cloud console captures the instance's serial console logs, including startup script execution output and any errors. This is the first and most direct step to debug a failing startup script because it shows the script's stdout, stderr, and any system messages during boot, without requiring network access or additional tools.

Answer

RDP into the instance and check the system logs.

Answer

Check the instance's metadata for startup script errors.

Answer

Recreate the instance with a new image.

Question 11

A company is using BigQuery for analytics. They notice that queries are slow and expensive. The data is loaded daily into a single table. Which action would most improve performance and reduce cost?

Accepted Answer

Partition the table by date and cluster by frequently filtered columns.. Partitioning the table by date allows BigQuery to prune partitions during query execution, scanning only the relevant daily data instead of the entire table. Clustering on frequently filtered columns further reduces the data scanned by sorting data within partitions. This directly reduces both query cost (pay-per-byte) and latency, addressing the core issue of slow, expensive queries on a large daily-loaded table.

Answer

Use a flat-rate reservation to improve query concurrency.

Answer

Denormalize the table to reduce joins.

Answer

Increase the number of slots available for the project.

Question 12

Which THREE are best practices for monitoring and alerting in Google Cloud?

Accepted Answer

Use Cloud Audit Logs to monitor administrative actions and data access.. Option B is correct because Cloud Audit Logs provide a comprehensive record of administrative actions (Admin Activity logs) and data access (Data Access logs) within Google Cloud. Monitoring these logs is a best practice for security, compliance, and operational troubleshooting, as they capture who did what, where, and when across services like IAM, Compute Engine, and Cloud Storage.

Answer

Configure budget alerts in Cloud Billing to notify when costs exceed a threshold.

Answer

Enable VPC Flow Logs for all subnets to capture all network traffic metadata.

Question 13

A company runs a batch job on Compute Engine that processes large files from Cloud Storage. The job is taking longer than expected. The instances are using standard persistent disks. Which change would most likely improve I/O performance?

Accepted Answer

Replace standard persistent disks with SSD persistent disks.. Standard persistent disks (pd-standard) are backed by HDDs and have lower IOPS and throughput compared to SSD persistent disks (pd-ssd). Since the batch job processes large files from Cloud Storage, the bottleneck is likely disk I/O performance. Upgrading to SSD persistent disks provides higher IOPS and throughput, directly improving I/O performance for read/write operations.

Answer

Use regional persistent disks instead of zonal.

Answer

Increase the machine type to have more vCPUs.

Answer

Add local SSDs to the instances.

Question 14

A developer is using Cloud Build to deploy a containerized application to Cloud Run. The deployment fails with an error 'Permission denied' when pulling the container from Container Registry. What is the most likely cause?

Accepted Answer

The Cloud Build service account lacks the Storage Object Viewer role on the container registry bucket.. Option C is correct because Cloud Build needs the Storage Object Viewer role to pull images from Container Registry. Option A is wrong because the Cloud Run service agent is for runtime, not build time. Option B is wrong because Cloud Run Invoker is for invoking services. Option D is wrong because Container Registry Service Agent is a different role but not typically granted to Cloud Build.

Answer

The Cloud Build service account lacks the Cloud Run Invoker role.

Answer

The Cloud Run service agent does not have the Cloud Run Invoker role.

Answer

The Container Registry is not configured to work with Cloud Run.

Question 15

Which THREE configurations are required to allow a Compute Engine instance in VPC A (without external IP) to send emails through a third-party SMTP server on the internet? (Choose three.)

Accepted Answer

A Cloud NAT gateway attached to VPC A.. Option A is correct because a Cloud NAT gateway allows instances without external IP addresses to initiate outbound connections to the internet, translating their private IPs to a public IP for the SMTP server. Without Cloud NAT, the instance in VPC A cannot reach the third-party SMTP server on the internet because it lacks a public IP and the VPC has no outbound internet path.

Answer

A VPC firewall rule allowing ingress from the SMTP server.

Answer

An external IP address on the instance.