Google ACE Practice Test 31 — 15 Questions

Question 1

A developer wants to automate the creation of a service account and assign it a role using the gcloud command-line tool. Which TWO commands are needed? (Choose 2 answers.)

Accepted Answer

gcloud projects add-iam-policy-binding. First, you create the service account with `gcloud iam service-accounts create`. Then, you grant a role to the service account by adding an IAM policy binding to the project.

Answer

gcloud iam service-accounts keys create

Answer

gcloud projects set-iam-policy

Answer

gcloud iam roles create

Question 2

A company needs to audit all actions that modify a Cloud Storage bucket. Which TWO steps should they take to enable this? (Choose 2 answers.)

Accepted Answer

Use Log Explorer to filter logs by the Cloud Storage service and the 'data_access' log type.. To audit data access modifications, you need to enable Data Access audit logs for the storage service and then view those logs in Log Explorer. Admin Activity logs record configuration changes (like creating a bucket), but data modifications (like uploading objects) require Data Access logs.

Answer

Create a VPC Service Controls perimeter.

Answer

Enable Admin Activity audit logs for the Cloud Storage service.

Answer

Assign the roles/logging.viewer role to the security team.

Question 3

A security team wants to restrict access to a Cloud Storage bucket so that only objects encrypted with a specific CMEK key can be uploaded. Which three actions are needed? (Choose 3)

Accepted Answer

Grant authorized users the roles/cloudkms.cryptoKeyEncrypterDecrypter role.. Setting the CMEK key on the bucket, creating a bucket-level policy denying uploads without the key, and granting the encrypt/decrypt role to users are required.

Answer

Grant all users the roles/cloudkms.cryptoKeyEncrypterDecrypter role.

Answer

Enable Uniform Bucket-Level Access.

Question 4

A company uses Cloud DNS for internal DNS resolution. They recently added a new VPC and need to ensure that instances in this VPC can resolve private DNS names that are hosted in another project. What must be configured?

Accepted Answer

Set up a DNS peering zone between the new VPC and the VPC that hosts the private zone.. Cloud DNS peering allows a VPC in one project to resolve private DNS names hosted in a private zone in another project without requiring the zones to be shared or exported. DNS peering establishes a direct query path between the peered VPCs, enabling the new VPC to resolve names in the private zone as if they were local, while the zone remains private and managed in its original project.

Answer

Use Cloud DNS inbound server policy to forward queries to the other VPC.

Answer

Export the private zone as a public zone and create a delegation.

Answer

Create a Private DNS zone in the new project with forwarding to the on-premises DNS.

Question 5

A startup runs its application entirely on Cloud Run. They want to use a custom domain (api.mycompany.com) instead of the default Cloud Run URL. Which GCP feature maps a custom domain to a Cloud Run service?

Accepted Answer

Cloud Run Domain Mappings or a Global Load Balancer with a Serverless NEG. Cloud Run Domain Mappings provide a native, managed way to map a custom domain to a Cloud Run service without additional infrastructure. Alternatively, a Global Load Balancer with a Serverless NEG (Network Endpoint Group) can also route traffic from a custom domain to Cloud Run, offering advanced features like SSL termination and traffic splitting. Both approaches are officially supported by Google Cloud for custom domain mapping.

Answer

Cloud DNS — create a CNAME record pointing to the Cloud Run URL

Answer

Cloud Endpoints with an API gateway configuration

Answer

Firebase Hosting rewrites to Cloud Run

Question 6

A developer needs to allow a CI/CD system to deploy applications to Cloud Run. The CI/CD system uses a service account. Which two roles should be granted to that service account?

Accepted Answer

roles/iam.serviceAccountUser. Option D (roles/run.admin) is correct because deploying a new Cloud Run service or revision requires permissions such as run.services.create, run.services.update, and run.services.setIamPolicy, which are all contained in the Cloud Run Admin role. Option C (roles/iam.serviceAccountUser) is correct because Cloud Run deployments run under a runtime service account, and the deploying identity must have iam.serviceAccounts.actAs on that service account, which is granted by the Service Account User role. Option A (roles/cloudbuild.builds.builder) is not required since it only grants permissions to execute Cloud Build builds, not to deploy to Cloud Run. Option B (roles/run.invoker) only allows invoking a deployed Cloud Run service and does not permit deployment. Option E (roles/storage.objectViewer) only grants read access to Cloud Storage objects and is unrelated to Cloud Run deployment.

Answer

roles/cloudbuild.builds.builder

Answer

roles/run.invoker

Answer

roles/storage.objectViewer

Question 7

An organization needs to import a SQL dump file from a Cloud Storage bucket into an existing Cloud SQL for PostgreSQL instance. Which command should they use?

Accepted Answer

gcloud sql import sql my-instance gs://bucket/dump.sql --database=mydb. The correct command is 'gcloud sql import sql my-instance gs://bucket/dump.sql --database=mydb', which imports a SQL dump file from a Cloud Storage bucket into an existing Cloud SQL instance and specifies the target database. The 'gcloud sql import sql' subcommand is designed for importing SQL dump files, and the --database flag is required when the dump does not specify the database. This matches the requirement to import into an existing PostgreSQL instance.

Answer

gcloud sql export sql my-instance gs://bucket/dump.sql

Answer

gcloud sql instances import my-instance gs://bucket/dump.sql

Answer

gcloud sql import csv my-instance gs://bucket/dump.sql --database=mydb

Question 8

A developer needs to set up a Google Cloud environment for a new project. Which TWO actions are required to enable billing and APIs for the project?

Accepted Answer

Enable the required APIs using the Cloud Console or gcloud.. Option A is correct because enabling the required APIs is a mandatory step to make Google Cloud services available for the project; this can be done via the Cloud Console or with the gcloud command (for example, gcloud services enable). Option C is correct because a project must be associated with an active billing account to use billable services, which is done by creating a billing account and linking it to the project. Option B is incorrect because firewall rules are only needed for specific networking configurations and are not a prerequisite for enabling billing or APIs. Option D is incorrect because VPC networks are not required for all regions and are unrelated to enabling billing and APIs. Option E is incorrect because assigning IAM roles globally to all users is not a requirement and would violate least-privilege principles.

Answer

Configure firewall rules before enabling any APIs.

Answer

Set up VPC networks for all regions.

Answer

Assign IAM roles to all users globally.

Question 9

A company wants to migrate a monolithic application to Google Cloud with minimal changes to the application code. Which compute option is most suitable?

Accepted Answer

Compute Engine. Compute Engine (C) is the most suitable option because it provides Infrastructure as a Service (IaaS) virtual machines that can run the monolithic application with minimal code changes. The application can be migrated by simply lifting and shifting the existing VM or container image to a Compute Engine instance, preserving the OS, runtime, and dependencies without refactoring.

Answer

Google Kubernetes Engine

Answer

App Engine (Flexible Environment)

Answer

Cloud Functions

Question 10

Microservices in a GKE cluster need to discover each other by name without using public DNS. Service A calls Service B at `http://service-b.production.svc.cluster.local`. Which GCP/Kubernetes feature provides this internal DNS resolution?

Accepted Answer

Kubernetes cluster DNS (CoreDNS) resolving Service names within the cluster. Kubernetes cluster DNS, typically implemented by CoreDNS, is the built-in mechanism that resolves Service names like `service-b.production.svc.cluster.local` to the corresponding ClusterIP. This allows Pods to discover each other by name without relying on external or public DNS. CoreDNS runs as a Deployment in the kube-system namespace and automatically creates DNS records for every Service based on its name and namespace.

Answer

Cloud DNS private zone configured for the cluster's namespace

Answer

Anthos Service Mesh — required for service-to-service DNS

Answer

A custom /etc/hosts entry on each Pod

Question 11

You need to export all logs from Cloud Logging to a BigQuery dataset for long-term analysis. The export should include logs from all projects in the organization. Which TWO actions should you take? (Choose two.)

Accepted Answer

Create a log sink with destination type BigQuery dataset. Option B is correct because a log sink's destination must be set to a BigQuery dataset to route log entries into BigQuery for long-term analysis; the sink uses the BigQuery destination and requires a dataset to exist. Option D is correct because creating the sink at the organization level allows it to aggregate and export logs from all projects in the organization in a single sink, which matches the requirement to include logs from all projects. Option A is incorrect because a Cloud Storage bucket destination exports logs to Cloud Storage, not BigQuery. Option C is incorrect because log-based metrics create metric data for monitoring/alerting, not raw log export to BigQuery. Option E is incorrect because project-level sinks would need to be created per project and would not provide a single organization-wide export as required.

Answer

Create a log sink with destination type Cloud Storage bucket

Answer

Create a log-based metric to filter the logs

Answer

Create the sink at the project level for each project individually

Question 12

A developer deployed a new version of a Compute Engine instance but the startup script fails to run. The developer needs to debug the startup script. Which step should be taken first?

Accepted Answer

Review the serial port 1 output in the Google Cloud console.. Serial port 1 output in the Google Cloud console captures the instance's serial console logs, including startup script execution output and any errors. This is the first and most direct step to debug a failing startup script because it shows the script's stdout, stderr, and any system messages during boot, without requiring network access or additional tools.

Answer

RDP into the instance and check the system logs.

Answer

Check the instance's metadata for startup script errors.

Answer

Recreate the instance with a new image.

Question 13

Your company uses BigQuery for analytics. Users frequently run queries against a large, date-partitioned table containing sales data. The table has 10 TB of data and is partitioned by the 'order_date' column. Queries often filter on the 'customer_id' and 'region' columns in addition to the date range. You observe that queries are slow and expensive, even when scanning only a few partitions. Which optimization should you implement first?

Accepted Answer

Enable clustering on the 'customer_id' and 'region' columns.. Clustering on 'customer_id' and 'region' organizes the data within each partition based on these filter columns, allowing BigQuery to perform block-level pruning and skip irrelevant data even when scanning only a few partitions. This directly addresses the slowness and cost by reducing the amount of data read per query, without requiring additional storage or maintenance overhead.

Answer

Create materialized views for common queries.

Answer

Create views for each combination of filters.

Answer

Change partitioning to use ingestion time instead of 'order_date'.

Question 14

A network team is creating a new VPC and must decide between auto mode and custom mode. Why would they choose custom mode?

Accepted Answer

Custom mode allows full control over which regions have subnets and what CIDR ranges are used. Custom mode VPCs give the network team full control over the IP address range (CIDR block) and the ability to create subnets in any region, unlike auto mode VPCs which automatically create subnets in every region with a fixed /20 range per region. This is essential when you need to avoid overlapping CIDRs with on-premises networks or other VPCs, or when you want to restrict subnets to specific regions for compliance or cost reasons.

Answer

Auto mode VPCs cost more per subnet than custom mode

Answer

Auto mode VPCs cannot be used with GKE clusters

Answer

Custom mode VPCs support more IP addresses per subnet than auto mode

Question 15

Which service should be used to manage billing budgets and alerts?

Accepted Answer

Cloud Billing Budgets. Cloud Billing Budgets is the correct service because it is specifically designed to allow you to set spending limits (budgets) on your Google Cloud projects, billing accounts, or folders, and to configure alerts (e.g., email notifications or Pub/Sub messages) when actual or forecasted costs exceed those thresholds. This directly addresses the requirement to manage billing budgets and alerts, whereas other services focus on monitoring infrastructure performance or logging operational data.

Answer

Cloud Monitoring

Answer

Cloud Billing Reports

Answer

Cloud Logging