Google ACE Practice Test 2 — 30 Questions

Question 1

Two GCP projects, A and B, have VPC peering configured. Project A is peered with B, and Project B is peered with Project C. Can VMs in Project A reach VMs in Project C through Project B?

Accepted Answer

No — VPC peering is non-transitive; A and C must be directly peered to communicate. VPC peering in Google Cloud is non-transitive. This means that if Project A is peered with Project B and Project B is peered with Project C, traffic from Project A cannot flow through Project B to reach Project C. Each peering connection is a direct, point-to-point link, and there is no routing of traffic across multiple peered networks unless explicitly configured with a separate mechanism like a VPN or a third-party appliance. Therefore, VMs in Project A and Project C must be directly peered to communicate.

Answer

Yes — VPC peering automatically enables transitive routing through intermediate peered networks

Answer

Yes — if Project B has IP forwarding enabled, it acts as a router between A and C

Answer

It depends on the firewall rules in Project B's VPC

Question 2

Your application is deployed on GKE and experiencing increased latency. You suspect a memory leak causing the JVM to run frequent garbage collection cycles. Cloud Monitoring shows high memory usage but you need to understand the garbage collection behavior over time. Which GCP tool provides JVM-level profiling including memory allocation data?

Accepted Answer

Cloud Profiler with heap profiling enabled for the JVM application.. Cloud Profiler with heap profiling enabled captures JVM-level memory allocation data and garbage collection behavior over time, allowing you to identify memory leaks and GC frequency. Unlike generic memory monitoring, it provides per-method allocation snapshots and GC pause analysis specific to the JVM.

Answer

Cloud Trace

Answer

Cloud Monitoring with JVM MBeans metrics exported via the Ops Agent.

Answer

Error Reporting filtered for OutOfMemoryError exceptions.

Question 3

You want to allow a vendor to upload files to a specific Cloud Storage bucket in your project without creating a GCP account for them. The upload URL should expire after 24 hours. Which mechanism should you use?

Accepted Answer

Generate a Signed URL with a 24-hour expiration for the specific bucket path.. A signed URL allows time-limited, permissionless access to a specific Cloud Storage object or bucket path without requiring a GCP identity. The URL is cryptographically signed using a service account key, and the 24-hour expiration is set via the `expires` parameter. This meets the requirement of allowing the vendor to upload files without creating a GCP account.

Answer

Create a GCP service account for the vendor and share the key JSON file.

Answer

Make the Cloud Storage bucket publicly writable and share the bucket URL.

Answer

Add the vendor's email to the bucket's IAM policy with Storage Object Creator role.

Question 4

A DevOps team deploys a MIG (Managed Instance Group) with autohealing configured. The health check probes `/health` on port 8080 with a 30-second initial delay. After deployment, new VMs are failing the health check and being immediately recreated — causing a restart loop. What is the most likely cause?

Accepted Answer

The initial delay is too short — the application hasn't finished starting before the health check probes begin. The 30-second initial delay is too short for the application to complete its startup sequence. When the health check begins probing before the application is ready, it immediately fails, causing the MIG autohealing mechanism to treat the VM as unhealthy and recreate it, leading to a restart loop. The initial delay must be set to a value that exceeds the application's typical startup time.

Answer

The health check HTTP path `/health` doesn't exist — the application uses `/healthz`

Answer

Autohealing is incompatible with autoscaling — they cannot be used together

Answer

The MIG does not support HTTP health checks — TCP checks must be used instead

Question 5

A Cloud SQL production instance experiences a spike in connections during business hours, causing 'too many connections' errors. The application uses 50 microservices each maintaining 10 connections. What is the recommended solution to reduce connection count without rewriting the application?

Accepted Answer

Deploy a connection pooler (e.g., PgBouncer) between the microservices and Cloud SQL. Deploying a connection pooler like PgBouncer between the microservices and Cloud SQL allows many application connections to be multiplexed over a smaller number of actual database connections. This directly reduces the total connection count on the Cloud SQL instance without requiring any application code changes, as the pooler transparently manages the connection lifecycle and reuses idle connections.

Answer

Increase the Cloud SQL instance's max_connections database flag to 10,000

Answer

Enable Cloud SQL HA — the standby will handle the connection overflow

Answer

Add a read replica — microservices can connect to the replica instead of the primary

Question 6

A team's Cloud Storage bucket has fine-grained access control (ACLs) enabled. They want to switch to a simpler model where IAM policies alone control access, and object-level ACLs are ignored. What should they enable?

Accepted Answer

Enable Uniform Bucket-Level Access (UBLA) on the bucket. Enabling Uniform Bucket-Level Access (UBLA) on the bucket disables object-level ACLs and enforces IAM policies as the sole access control mechanism. This simplifies management by ignoring any existing ACLs on objects, ensuring that only bucket-level IAM permissions are evaluated for access decisions.

Answer

Delete all ACLs on each object and set them to 'authenticated-read'

Answer

Enable VPC Service Controls on the bucket

Answer

Set the bucket's default object ACL to `projectPrivate` and apply it to all objects

Question 7

A microservices application has intermittent high latency. The team wants to identify which specific service-to-service call in the request chain is causing the slowdown. Which Cloud Operations tool is designed for this?

Accepted Answer

Cloud Trace. Cloud Trace is designed to capture latency data for individual service-to-service calls in a distributed request chain. It provides end-to-end tracing by collecting trace spans from each microservice, allowing you to pinpoint which specific call is causing the slowdown. This makes it the correct tool for identifying the exact service-to-service latency bottleneck.

Answer

Cloud Monitoring Metrics Explorer

Answer

Cloud Logging log viewer

Answer

Cloud Profiler

Question 8

A junior developer needs read-only access to all GCP resources in a project. Which IAM role grants the minimum permissions required?

Accepted Answer

Viewer. The Viewer role (roles/viewer) grants read-only access to all GCP resources in a project, including existing and future resources, without allowing any modifications. This is the minimum permissions required for read-only access, as it provides exactly the necessary permissions (e.g., resourcemanager.projects.get, storage.objects.list) without any write or administrative capabilities.

Answer

Editor

Answer

Owner

Answer

Browser

Question 9

A project is being decommissioned. You need to delete it but want to ensure there is a 30-day window during which the deletion can be cancelled if needed. What happens when you delete a GCP project?

Accepted Answer

The project enters a 30-day pending deletion period; resources are inaccessible but the project can be restored within this window.. When you delete a GCP project, it enters a 30-day pending deletion period. During this time, all resources are inaccessible, but the project and its data can be fully restored if needed. This ensures a safety window before permanent deletion, aligning with the requirement for a 30-day cancellation window.

Answer

The project is immediately and permanently deleted along with all resources.

Answer

The project is archived but billing continues for 30 days before final deletion.

Answer

All resources are deleted immediately but the project ID is reserved for 90 days.

Question 10

A developer attempts to create a Cloud SQL instance but receives the error: 'API [sqladmin.googleapis.com] not enabled.' What is the correct resolution?

Accepted Answer

Enable the Cloud SQL Admin API via APIs & Services > Library in the Console. The error 'API [sqladmin.googleapis.com] not enabled' indicates that the Cloud SQL Admin API has not been activated for the project. The correct resolution is to enable the API via APIs & Services > Library in the Google Cloud Console, as this is a prerequisite for creating any Cloud SQL instance. Assigning IAM roles or requesting quota increases does not enable the underlying API service.

Answer

Assign the developer the Cloud SQL Admin IAM role

Answer

Request a quota increase for Cloud SQL in the project

Answer

Create a new project — Cloud SQL is enabled by default in new projects

Question 11

An application architect is comparing Cloud SQL (PostgreSQL) and Cloud Spanner for a new global e-commerce platform. The platform must serve customers on three continents with <50ms latency for reads and strong consistency for inventory updates. Which service best fits?

Accepted Answer

Cloud Spanner multi-region configuration. Cloud Spanner multi-region configuration is the correct choice because it provides strong global consistency with <50ms read latency across continents, which is essential for an e-commerce platform requiring real-time inventory updates. Spanner uses TrueTime and Paxos-based replication to ensure ACID transactions globally, meeting both the latency and consistency requirements simultaneously.

Answer

Cloud SQL with one primary instance and cross-region read replicas

Answer

Cloud Firestore in multi-region mode

Answer

Cloud SQL with Cloud Memorystore caching layer for reads

Question 12

A regulated financial company must ensure that all GCP API calls made by employees are logged with full request and response payloads for audit purposes. Which combination of Cloud Audit Log types captures this?

Accepted Answer

Admin Activity logs + Data Access logs (DATA_READ and DATA_WRITE). Admin Activity logs capture administrative actions like creating or modifying resources, but not the data within API calls. Data Access logs (DATA_READ and DATA_WRITE) capture the request and response payloads for API calls that read or write data, which is required for full audit logging. Together, they cover both the administrative context and the data-level payloads mandated for regulated financial companies.

Answer

Admin Activity logs only

Answer

VPC Flow Logs + Cloud Monitoring metrics

Answer

System event logs + Data Access logs

Question 13

A team is creating a new GCP project for a sensitive workload. They need to ensure the project is linked to the correct billing account, placed in the correct folder, and has specific APIs enabled — all reproducibly. They want to automate this via Infrastructure as Code. Which approach is most appropriate?

Accepted Answer

Use Terraform with `google_project`, `google_project_service`, and billing account linkage resources.. Terraform is an Infrastructure as Code (IaC) tool that allows you to define the entire project setup—including folder placement, billing account linkage, and API enablement—in declarative configuration files. This ensures reproducibility, version control, and automation, which aligns with the requirement for a sensitive workload that must be set up consistently every time.

Answer

Use a gcloud script with `gcloud projects create`, `gcloud beta billing projects link`, and `gcloud services enable`.

Answer

Use Cloud Console to manually create the project, then document the steps in a runbook.

Answer

Use Cloud Deployment Manager with a Python template to create the project.

Question 14

A developer wants to see the details of a specific GKE Pod including its events, container status, and resource requests/limits. Which kubectl command provides this?

Accepted Answer

kubectl describe pod [POD_NAME]. B is correct because `kubectl describe pod` provides a comprehensive view of a pod, including its events (e.g., scheduling, pulling images), container status (e.g., waiting, running, terminated with reasons), and resource requests/limits (CPU and memory). This command aggregates detailed information from the Kubernetes API, making it the standard tool for debugging pod issues.

Answer

kubectl get pod [POD_NAME] -o wide

Answer

kubectl inspect pod [POD_NAME]

Answer

kubectl get pod [POD_NAME] -o json

Question 15

A mobile app needs a managed database to store user profiles with flexible nested structures that evolve frequently — new fields are added without schema migrations. Which GCP database service is most appropriate?

Accepted Answer

Cloud Firestore. Cloud Firestore is a NoSQL document database that supports flexible, nested data structures and automatically handles schema evolution. New fields can be added to documents at any time without requiring migrations, making it ideal for user profiles that change frequently. It also provides real-time synchronization and offline support, which are common requirements for mobile apps.

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Bigtable

Answer

Cloud Spanner

Question 16

You have pushed a new container image to Artifact Registry. The image is tagged `us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0`. You need to deploy this specific image version to Cloud Run in production. Which command deploys this exact image?

Accepted Answer

`gcloud run deploy app --image us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0 --region us-central1`. The `gcloud run deploy` command with the `--image` flag explicitly specifies the exact container image URI from Artifact Registry, including the tag `v2.0`. This ensures that Cloud Run deploys that precise version of the image, and the `--region` flag targets the correct regional service. The full URI is required because Cloud Run must pull the image from the exact repository path and tag.

Answer

`gcloud run services update app --tag v2.0 --region us-central1`

Answer

`docker push us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0` followed by a Cloud Run auto-deploy.

Answer

`gcloud run deploy app --image app:v2.0 --region us-central1`

Question 17

You need to deploy a containerized application to GKE that stores user session data. The application has 3 replicas. Session data must not be lost if a replica is restarted. All replicas share the same session store. Which architecture handles this correctly?

Accepted Answer

Store sessions in Cloud Memorystore (Redis) shared by all replicas.. Cloud Memorystore (Redis) provides a centralized, persistent, and highly available session store that all replicas can access. This ensures session data survives pod restarts and is shared across all replicas, meeting the requirement for no data loss and shared access.

Answer

Store sessions in each pod's memory; use session affinity on the load balancer to route users to the same pod.

Answer

Use an emptyDir volume shared between replicas for session storage.

Answer

Store sessions in a Cloud SQL table with a connection pool per replica.

Question 18

An organization has a policy requiring all new GCP projects to be created within specific folders and linked to approved billing accounts only. Which combination of features enforces this at scale?

Accepted Answer

Organization policies to restrict allowed billing accounts + granting Project Creator role only at approved folder level. It combines two enforcement mechanisms: Organization policies (specifically the `constraints/compute.restrictBillingAccounts` constraint) to limit which billing accounts can be attached to projects, and granting the Project Creator role (`roles/resourcemanager.projectCreator`) only at the folder level (not the organization level). This ensures that new projects can only be created within the approved folders and must use an approved billing account, enforcing the policy at scale across the entire organization.

Answer

IAM deny policies on the organization + VPC Service Controls

Answer

Cloud Asset Inventory alerts + manual review of new projects

Answer

Requiring multi-factor authentication for all project creators

Question 19

You are on-call and receive a PagerDuty alert: `Cloud SQL CPU utilization > 90% for 15 minutes`. Checking `pg_stat_activity`, you find 200 connections with many in `idle` state and 15 queries running for > 5 minutes each. The long queries are table scans on a 500 GB unindexed table. What should you do IMMEDIATELY to restore service, and what is the root cause fix?

Accepted Answer

Terminate the long-running table scan queries immediately, then add indexes on the frequently queried columns as the root cause fix.. Terminating the long-running table scans immediately stops the CPU-intensive queries, restoring service. The root cause is the missing index on the 500 GB table, which forces sequential scans and high CPU usage. Adding indexes on frequently queried columns eliminates the need for full table scans, preventing recurrence.

Answer

Restart the Cloud SQL instance to clear all connections and queries.

Answer

Increase Cloud SQL's CPU to a larger machine type to handle the current load.

Answer

Reduce `max_connections` to prevent new connections from adding load.

Question 20

A security team discovers that a service account key was accidentally committed to a public GitHub repository 48 hours ago. What should be the immediate steps to remediate this incident?

Accepted Answer

Delete the leaked key immediately, audit Cloud Audit Logs for unauthorized activity using the key, then create a new key or switch to keyless authentication. The immediate priority is to revoke the compromised key's access by deleting it, which invalidates it instantly. Auditing Cloud Audit Logs is essential to detect any unauthorized usage that occurred during the 48-hour exposure window. Finally, creating a new key or switching to keyless authentication (e.g., workload identity federation) restores secure access without relying on long-lived static credentials.

Answer

Rotate the service account key to generate a new one, keeping the old key active briefly for transition

Answer

Change the service account's display name and email to invalidate the leaked key

Answer

Remove all IAM roles from the service account to deny all actions until the investigation completes