Google ACE Practice Test 33 — 15 Questions

Question 1

You are managing Terraform state for a GCP infrastructure project shared by a team of 5 engineers. You need to prevent simultaneous `terraform apply` operations from causing state corruption. What is the recommended backend configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the `gcs` backend in Terraform, pointing to a Cloud Storage bucket with versioning enabled.. The `gcs` backend with versioning enabled provides both remote state storage and built-in state locking via Cloud Storage's object-level consistency model. When one engineer runs `terraform apply`, the backend acquires a lock by writing a lock file to the bucket; other concurrent operations are blocked until the lock is released, preventing state corruption. Versioning further protects against accidental state deletion or corruption by allowing rollback to previous state versions.

Answer

Store state locally on each engineer's machine and merge state files manually after each apply.

Answer

Use Terraform Cloud (HashiCorp) as the backend for state locking.

Answer

Use a Cloud Source Repository to store state files with branch-based locking.

Question 2

A company wants to deploy a web application on Compute Engine. They expect variable traffic and want to automatically add or remove virtual machine instances based on CPU utilization. What is the recommended approach?

Accepted Answer

Use a managed instance group with an autoscaling policy based on CPU utilization. A managed instance group (MIG) with an autoscaling policy based on CPU utilization is the recommended approach because it automatically adjusts the number of VM instances in response to real-time CPU load, ensuring the application can handle variable traffic without manual intervention. This aligns with Google Cloud's best practices for elastic scaling of stateless web applications on Compute Engine.

Answer

Use a single large instance and rely on Cloud Load Balancing

Answer

Use an unmanaged instance group and manually add or remove instances

Answer

Deploy the application on App Engine Standard environment

Question 3

You want to switch between multiple GCP projects frequently using the gcloud CLI. What is the recommended approach?

Accepted Answer

Create multiple configuration profiles and activate them as needed.. gcloud supports named configuration profiles, each holding its own project, account, region, and zone settings. Creating multiple configurations and activating the relevant one with 'gcloud config configurations activate <name>' lets you switch contexts instantly without re-authenticating or re-initializing. This is the officially recommended approach for developers who work across many projects.

Answer

Open separate terminal windows for each project.

Answer

Run gcloud init every time you switch projects.

Answer

Use gcloud config set project each time you switch.

Question 4

A team has a streaming pipeline built with Apache Beam that reads from Cloud Pub/Sub and writes transformed data to BigQuery. Which GCP service executes this pipeline with managed autoscaling?

Accepted Answer

Cloud Dataflow. Cloud Dataflow is the correct service because it is a fully managed, autoscaling service specifically designed to execute Apache Beam pipelines. It handles the reading from Cloud Pub/Sub and writing to BigQuery, automatically scaling worker resources based on the pipeline's processing demands.

Answer

Cloud Composer

Answer

Cloud Dataproc

Answer

Cloud Data Fusion

Question 5

A team is using Terraform to manage infrastructure. They want to store the Terraform state file remotely in a GCS bucket for team collaboration. Which Terraform backend configuration is correct?

Accepted Answer

terraform {
  backend "gcs" {
    bucket = "my-terraform-state"
  }
}. Both options A and B are valid Terraform backend configurations for GCS. Option A uses the minimal required argument 'bucket'. Option B adds the optional 'prefix' argument to organize state files within the bucket. The 'gcs' backend supports both. Options C and D are invalid because 'storage' and 'gcloud' are not valid backend types.

Answer

terraform {
  backend "storage" {
    bucket = "my-terraform-state"
  }
}

Answer

terraform {
  backend "gcloud" {
    bucket = "my-terraform-state"
  }
}

Question 6

A team runs a critical production project and wants to prevent anyone — including project owners and organization admins — from accidentally deleting it. Which mechanism provides this protection?

Accepted Answer

Create a project lien using the Cloud Resource Manager API or gcloud. A project lien is the correct mechanism because it explicitly prevents the deletion of a Google Cloud project by blocking the `resourcemanager.projects.delete` operation until the lien is removed. This protection works regardless of the user's role, including project owners and organization admins, and is managed via the Cloud Resource Manager API or `gcloud` command. It is designed specifically for accidental deletion prevention, not for access control.

Answer

Remove the Owner role from all users in the project

Answer

Set an organization policy denying the resourcemanager.projects.delete permission

Answer

Enable deletion protection in the project's IAM settings in the Console

Question 7

You need to set an organization policy that prevents any project from creating Cloud SQL instances with a public IP address. The constraint you need is `sql.restrictPublicIp`. What type of constraint is this, and how do you enable it?

Accepted Answer

Boolean constraint — set `enforce: true` in the organization policy.. `sql.restrictPublicIp` is a boolean constraint in Google Cloud Organization Policies. Boolean constraints have a simple `enforce: true` or `enforce: false` setting, and setting it to `true` prevents projects from creating Cloud SQL instances with public IP addresses. This is the standard method to enforce this restriction across the organization.

Answer

List constraint — add `CLOUD_SQL_INSTANCE` to the `deniedValues` list.

Answer

Custom constraint — define a CEL expression that evaluates the Cloud SQL instance's IP configuration.

Answer

List constraint — add `0.0.0.0/0` to the `deniedValues` list.

Question 8

Arrange the steps to deploy a containerized application to Google Kubernetes Engine (GKE) using a Deployment and expose it via a Service.

Accepted Answer

Create GKE cluster, then create Deployment, then expose Deployment as a Service. The correct sequence for deploying a containerized application to GKE is to first create a GKE cluster (the underlying infrastructure), then deploy your application using a Kubernetes Deployment, and finally expose that Deployment via a Service to allow external access. This order ensures all dependencies are met: the cluster must exist before any workloads are created, and the Service references an existing Deployment.

Answer

Create Deployment, then create GKE cluster, then expose Deployment as a Service

Answer

Expose Deployment as a Service, then create GKE cluster, then create Deployment

Answer

Create GKE cluster, then expose Deployment as a Service, then create Deployment

Question 9

After deploying a Kubernetes Deployment named 'web-app', a developer wants to expose it externally on a static IP address. Which kubectl command should they use?

Accepted Answer

kubectl expose deployment web-app --type=LoadBalancer --port=80 --target-port=8080. The `kubectl expose deployment` command creates a Service from an existing Deployment, and `--type=LoadBalancer` provisions an external load balancer with a stable, externally reachable IP (on GKE, a Google Cloud network load balancer). The `--port=80` sets the Service port and `--target-port=8080` maps traffic to the container's listening port, which is exactly what's needed to expose the app externally on a static IP.

Answer

kubectl create service clusterip web-app --tcp=80:8080

Answer

gcloud compute forwarding-rules create web-app --port=80

Answer

kubectl expose deployment web-app --type=NodePort --port=80

Question 10

An organization needs a NoSQL document database with real-time synchronization across multiple client devices. Which Google Cloud service should they use?

Accepted Answer

Firestore. Firestore is a NoSQL document database with real-time synchronization across client devices, making it ideal for mobile and web apps that need live updates. It provides SDKs for offline support and automatic data sync.

Answer

Cloud SQL

Answer

Cloud Bigtable

Answer

Cloud Datastore

Question 11

A team needs to deploy a microservice that processes events from Pub/Sub and writes the results to Firestore. The service is stateless and should not incur cost when idle. The expected load is low but can spike unpredictably. Which compute service is the most cost-effective and operationally simple?

Accepted Answer

Cloud Functions (2nd gen) triggered by Pub/Sub. Cloud Functions (2nd gen) is a fully managed, event-driven serverless compute service that scales to zero when idle and is triggered natively by Pub/Sub. It is stateless by design, requires no cluster or instance management, and charges only for invocations and compute time, making it the most cost-effective and operationally simple choice for low, spiky workloads.

Answer

GKE Standard with a cluster autoscaler and a Pub/Sub sidecar

Answer

Compute Engine with a managed instance group and autoscaling based on Pub/Sub queue depth

Answer

Cloud Run for Anthos on-premises

Question 12

You deployed a Cloud Run service with gcloud run deploy --image gcr.io/my-project/my-image --platform managed --region us-central1 --allow-unauthenticated. Users report intermittent 503 errors. What is the most likely cause?

Accepted Answer

The service is hitting the maximum number of concurrent requests per container instance (default 80) and needs more instances.. Cloud Run scales based on concurrent requests per container instance, with a default concurrency limit of 80. When a container instance reaches this limit, additional requests are queued or rejected; if the service cannot scale out fast enough (e.g., due to cold starts or instance limits), users experience intermittent 503 errors. The most likely cause is that the service is hitting this concurrency limit and needs more instances or a higher concurrency setting.

Answer

The region us-central1 does not support Cloud Run.

Answer

The container image is not compatible with the managed platform.

Answer

The --allow-unauthenticated flag causes IAM permission errors.

Question 13

A company has a VPC with custom mode and needs to connect to an on-premises network via HA VPN. They have two on-premises VPN devices, each with a static public IP address. What is the correct way to configure the HA VPN gateway on Google Cloud?

Accepted Answer

Create one HA VPN gateway with two interfaces in the same region, and create two tunnels, each connecting one cloud interface to one on-premises device. For HA VPN with two on-premises devices, you create one HA VPN gateway with two interfaces in the same region, and then create two tunnels, each connecting one cloud interface to one on-premises device. This provides redundancy and meets the HA requirements.

Answer

Create one classic VPN gateway with two tunnels to the two on-premises devices

Answer

Create two separate VPN gateways, each with one interface, and assign each to a different region

Answer

Create one HA VPN gateway in one region and one classic VPN gateway in another region

Question 14

You notice that a deployment in your GKE cluster is running an outdated image. You need to update the deployment to use the new image 'gcr.io/my-project/my-app:v2'. Which kubectl command should you use?

Accepted Answer

kubectl set image deployment/my-deployment my-app=gcr.io/my-project/my-app:v2. The correct command to update a deployment's container image is 'kubectl set image', which updates the image for a specific container within the deployment. The syntax 'deployment/my-deployment my-app=gcr.io/my-project/my-app:v2' specifies the deployment name and the container name with the new image. This triggers a rolling update.

Answer

kubectl rollout restart deployment my-deployment --image gcr.io/my-project/my-app:v2

Answer

kubectl update deployment my-deployment --image gcr.io/my-project/my-app:v2

Answer

kubectl replace deployment my-deployment --image gcr.io/my-project/my-app:v2

Question 15

A data analyst needs to run complex analytical queries on a large dataset (10 TB) stored in Cloud Storage. They want to use a serverless query engine that charges based on the amount of data processed. Which Google Cloud service should they use?

Accepted Answer

BigQuery. BigQuery is Google Cloud's fully managed, serverless data warehouse that supports ANSI SQL analytical queries over petabyte-scale datasets and charges on-demand based on bytes processed. It is designed exactly for the scenario of running complex analytics on large datasets without provisioning infrastructure. Its columnar storage and Dremel engine deliver high-performance queries at scale.

Answer

Cloud SQL

Answer

Bigtable

Answer

Dataproc