Google ACE Practice Test 31 — 15 Questions

Question 1

A developer wants to authenticate to GCP from their local machine using their own user account to run gcloud commands that interact with a project. They have already installed the Cloud SDK. Which command should they use to authenticate with their Google account?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

gcloud auth login. `gcloud auth login` authenticates using a user account (OAuth 2.0) and is appropriate for interactive use. `gcloud auth application-default login` is for application credentials.

Answer

gcloud init

Answer

gcloud auth activate-service-account

Answer

gcloud auth application-default login

Question 2

A company plans to run a stateful application on Compute Engine that requires high random I/O performance and the ability to resize the persistent disk without downtime. The application is running on a Linux VM. Which persistent disk type and configuration should the engineer choose?

Accepted Answer

Extreme persistent disk (pd-extreme). Extreme persistent disks are designed for high random I/O workloads, offering up to 120,000 IOPS and the ability to resize without downtime. They are SSD-based and suitable for databases.

Answer

Balanced persistent disk (pd-balanced)

Answer

SSD persistent disk (pd-ssd)

Answer

Standard persistent disk (pd-standard)

Question 3

A security team wants to ensure that a service account created for an application cannot create new service accounts or modify IAM policies within the project. Which IAM role restriction achieves this?

Accepted Answer

Grant the service account only the specific roles its application requires — omitting IAM admin roles. The principle of least privilege dictates that a service account should only be granted the specific roles required for its application's functionality. By deliberately omitting roles that include IAM administrative permissions (such as roles/iam.serviceAccountAdmin or roles/iam.serviceAccountUser with the iam.serviceAccounts.create permission, or roles/resourcemanager.projectIamAdmin), the service account is inherently restricted from creating new service accounts or modifying IAM policies. This approach avoids the complexity of deny policies and aligns with Google Cloud's recommended IAM best practices.

Answer

Create an IAM deny policy blocking iam.serviceAccounts.create and iam.projects.setIamPolicy for the service account

Answer

Set an organization policy constraint restricting service account creation to admin users only

Answer

Disable the IAM API for the project so service accounts cannot manage IAM

Question 4

An organization needs a NoSQL document database with real-time synchronization across multiple client devices. Which Google Cloud service should they use?

Accepted Answer

Firestore. Firestore is a NoSQL document database that provides real-time listeners for syncing data across devices, making it ideal for mobile and web applications requiring live updates.

Answer

Cloud SQL

Answer

Cloud Bigtable

Answer

Cloud Datastore

Question 5

A company has a private VPC with instances that have only internal IP addresses. These instances need to download updates from the internet. Which Google Cloud service should they use to provide outbound internet connectivity?

Accepted Answer

Cloud NAT. Cloud NAT allows private instances to access the internet outbound while preventing inbound connections. Cloud VPN is for hybrid connectivity. Public IP addresses would expose the instances. IAP is for SSH/RDP access.

Answer

Cloud VPN

Answer

Assign public IP addresses to the instances

Answer

Identity-Aware Proxy (IAP)

Question 6

A data analyst needs to run complex analytical queries on a large dataset (10 TB) stored in Cloud Storage. They want to use a serverless query engine that charges based on the amount of data processed. Which Google Cloud service should they use?

Accepted Answer

BigQuery. BigQuery is a serverless data warehouse that charges based on queries processed (on-demand) or flat-rate. It can query external data in Cloud Storage via federated queries.

Answer

Cloud SQL

Answer

Bigtable

Answer

Dataproc

Question 7

An organization stores sensitive data in Cloud Storage. They need to ensure that objects are encrypted at rest using a key that they manage and rotate themselves. Which Cloud Storage encryption option should they use?

Accepted Answer

Use customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) allow you to manage your own keys via Cloud KMS. Google-managed keys are default. Client-side encryption is done before upload. Supplied keys are also customer-provided but not managed via KMS.

Answer

Use customer-supplied encryption keys (CSEK)

Answer

Use client-side encryption

Answer

Use Google-managed encryption keys

Question 8

An application running on Compute Engine needs to be accessible from the internet on port 443. The instance has an internal IP only. Which steps are necessary to allow internet traffic?

Accepted Answer

Use Cloud Load Balancing with an HTTPS load balancer to forward traffic to the instance. An internal-only VM cannot be reached directly from the internet. You need to use a Cloud NAT for outbound traffic, but for inbound traffic, you must either assign an external IP to the VM or use a load balancer. The most secure and scalable approach is to use an external HTTPS load balancer.

Answer

Configure a VPN from the internet to the VPC

Answer

Create a Cloud NAT gateway and a firewall rule allowing ingress on port 443

Answer

Assign an external IP to the VM and create a firewall rule allowing ingress from 0.0.0.0/0 on port 443

Question 9

A team needs to deploy a microservice that processes events from Pub/Sub and writes the results to Firestore. The service is stateless and should not incur cost when idle. The expected load is low but can spike unpredictably. Which compute service is the most cost-effective and operationally simple?

Accepted Answer

Cloud Functions (2nd gen) triggered by Pub/Sub. Cloud Functions is event-driven, scales automatically, and charges only while code is executing. It can be triggered by Pub/Sub messages, making it ideal for this use case. It scales to zero and handles spikes.

Answer

GKE Standard with a cluster autoscaler and a Pub/Sub sidecar

Answer

Compute Engine with a managed instance group and autoscaling based on Pub/Sub queue depth

Answer

Cloud Run for Anthos on-premises

Question 10

An organization wants to set up a hybrid cloud connection between their on-premises data center and Google Cloud VPC. They need high availability (99.99% SLA) and support for dynamic routing. Which connection method should they use?

Accepted Answer

HA VPN with BGP. HA VPN provides a 99.99% SLA, supports dynamic routing via BGP, and offers two tunnels for redundancy. Dedicated Interconnect also offers high availability but is a physical connection with higher cost. Partner Interconnect is similar to HA VPN but also physical. Classic VPN has no SLA.

Answer

Cloud NAT

Answer

Dedicated Interconnect

Answer

Classic VPN with static routing

Question 11

A company has a VPC with custom mode and needs to connect to an on-premises network via HA VPN. They have two on-premises VPN devices, each with a static public IP address. What is the correct way to configure the HA VPN gateway on Google Cloud?

Accepted Answer

Create one HA VPN gateway with two interfaces in the same region, and create two tunnels, each connecting one cloud interface to one on-premises device. HA VPN requires two external interfaces (cloud VPN gateways) for redundancy. Each interface is assigned a public IP. You configure two tunnels: each tunnel connects one cloud interface to one on-premises device. The on-premises devices must be configured to accept connections from both cloud IPs.

Answer

Create one classic VPN gateway with two tunnels to the two on-premises devices

Answer

Create two separate VPN gateways, each with one interface, and assign each to a different region

Answer

Create one HA VPN gateway in one region and one classic VPN gateway in another region

Question 12

A company is migrating a legacy monolithic application to Google Cloud. The application consists of a web frontend, a business logic layer, and a MySQL database. They want to minimise operational overhead and use managed services where possible. Which two services should they choose? (Choose TWO.)

Accepted Answer

Cloud SQL for MySQL to host the database. Cloud SQL provides a managed MySQL database, eliminating database administration. Cloud Run or GKE can host the frontend and logic, but Cloud Run is serverless and reduces overhead. Compute Engine would require more management.

Answer

Cloud Functions for the business logic

Answer

Compute Engine to host the frontend and business logic

Answer

Cloud Spanner for the database

Question 13

A company wants to migrate an on-premises PostgreSQL database to Google Cloud. They require automated backups, point-in-time recovery, and a 99.95% availability SLA. Which service should they choose?

Accepted Answer

Cloud SQL for PostgreSQL. Cloud SQL for PostgreSQL provides automated backups, point-in-time recovery (PITR), and a 99.95% SLA for single-zone instances. It is fully managed, reducing operational overhead.

Answer

Compute Engine with self-managed PostgreSQL

Answer

Cloud SQL for MySQL

Answer

Cloud Spanner

Question 14

You deployed a Cloud Run service with gcloud run deploy --image gcr.io/my-project/my-image --platform managed --region us-central1 --allow-unauthenticated. Users report intermittent 503 errors. What is the most likely cause?

Accepted Answer

The service is hitting the maximum number of concurrent requests per container instance (default 80) and needs more instances.. Cloud Run services have a default maximum number of concurrent requests per container instance (default 80). If traffic exceeds that, new instances are created, but if there is a sudden spike or the container takes too long to start, requests may be dropped with 503. Increasing max instances or concurrency settings can help.

Answer

The region us-central1 does not support Cloud Run.

Answer

The container image is not compatible with the managed platform.

Answer

The --allow-unauthenticated flag causes IAM permission errors.

Question 15

A company needs to store and serve user-generated content such as images and videos. The data must be accessible globally with low latency. Which Google Cloud storage service should they use?

Accepted Answer

Cloud Storage. Cloud Storage is object storage designed for global accessibility, with low-latency access and multiple storage classes. It supports serving content via CDN integration.

Answer

Persistent Disk

Answer

Cloud Filestore

Answer

Local SSD