Google ACE Practice Test 34 — 15 Questions

Question 1

A company is deploying a multi-region application on Google Kubernetes Engine (GKE) with clusters in us-central1 and europe-west1. They want to route user traffic to the closest healthy cluster using a global load balancer with SSL termination. Which load balancing service should they use?

Accepted Answer

External HTTPS Load Balancer with a global backend service (using NEGs). D is correct because the External HTTPS Load Balancer with a global backend service using Network Endpoint Groups (NEGs) provides global anycast IP, SSL termination, and traffic routing to the closest healthy GKE cluster via Google's global network. This meets the requirement for multi-region GKE clusters with automatic failover and low latency.

Answer

Internal Load Balancer

Answer

SSL Proxy Load Balancer

Answer

External TCP/UDP Network Load Balancer

Question 2

A company is deploying a stateful application on Google Kubernetes Engine (GKE) that requires persistent storage. Each pod needs its own dedicated persistent disk that is not shared. Which Kubernetes resource should be used to manage the deployment?

Accepted Answer

StatefulSet with volumeClaimTemplates. Option D is correct because a StatefulSet with volumeClaimTemplates is designed for stateful applications where each pod requires its own dedicated PersistentVolume (PV) that is not shared. The volumeClaimTemplates automatically generate a unique PersistentVolumeClaim (PVC) for each pod replica, ensuring each pod gets a separate, stable persistent disk that persists across rescheduling. This matches the requirement for a stateful application on GKE where pods need dedicated, non-shared storage.

Answer

Job with PersistentVolume

Answer

DaemonSet with hostPath volumes

Answer

Deployment with PersistentVolumeClaim template

Question 3

A company wants to deploy a web application on Compute Engine. They expect variable traffic and want to automatically add or remove virtual machine instances based on CPU utilization. What is the recommended approach?

Accepted Answer

Use a managed instance group with an autoscaling policy based on CPU utilization. A managed instance group (MIG) with an autoscaling policy based on CPU utilization is the recommended approach because it automatically adjusts the number of VM instances in response to real-time CPU load, ensuring the application can handle variable traffic without manual intervention. This aligns with Google Cloud's best practices for elastic scaling of stateless web applications on Compute Engine.

Answer

Use a single large instance and rely on Cloud Load Balancing

Answer

Use an unmanaged instance group and manually add or remove instances

Answer

Deploy the application on App Engine Standard environment

Question 4

A company is extending its on-premises network to Google Cloud using a Cloud VPN tunnel with dynamic routing (BGP). They have set up a Cloud Router in the VPN region. Which additional step is required for the Cloud Router to exchange routes with the on-premises router?

Accepted Answer

Configure a BGP session on the Cloud Router with the on-premises router's ASN and IP address. For a Cloud VPN with dynamic routing (BGP), the Cloud Router must have a BGP session configured with the on-premises router. This session requires the on-premises router's ASN and its BGP peer IP address to exchange routes. Without this explicit BGP session configuration, the Cloud Router cannot establish a peering relationship or advertise/learn routes dynamically.

Answer

Create a static route for the on-premises network on the VPC

Answer

Assign an external IP address to the Cloud Router

Answer

Enable the IP forwarding feature on the VPN gateway

Question 5

A company runs an App Engine Standard application with multiple versions. They want to gradually roll out new features by sending a small percentage of traffic to a new version. How should they implement this?

Accepted Answer

Use App Engine's traffic splitting feature to assign a percentage of traffic to the new version. App Engine Standard provides built-in traffic splitting, allowing you to assign a percentage of incoming requests to different versions of the same service. This is the simplest and most direct way to gradually roll out a new feature by sending a small percentage of traffic to the new version without needing external load balancers or additional services.

Answer

Deploy the new version and delete the old version

Answer

Use Cloud Load Balancing to distribute traffic between versions

Answer

Create a new service for the new version and use a custom domain

Question 6

A data engineering team is deploying a streaming Dataflow pipeline that reads from Pub/Sub and writes to BigQuery. They need to ensure that each event is processed exactly once, even in the event of failures. Which Dataflow feature should they use?

Accepted Answer

Rely on Dataflow's exactly-once processing guarantees. Dataflow's streaming engine provides built-in exactly-once processing guarantees for sources like Pub/Sub and sinks like BigQuery. This is achieved through a combination of checkpointing, deterministic replay, and idempotent writes, ensuring that each record is processed exactly once even during worker failures or pipeline updates. No additional configuration or external deduplication is required.

Answer

Enable at-least-once delivery on the Pub/Sub subscription

Answer

Set the Dataflow pipeline to use the 'exactly_once' parameter in the pipeline options

Answer

Use Cloud Functions to deduplicate messages before sending to Dataflow

Question 7

A startup is building a web application using Cloud Run. They want to deploy multiple independent services that can communicate with each other internally, but each service should be deployed and scaled independently. Which deployment strategy should they use?

Accepted Answer

Create multiple Cloud Run services and use internal endpoints for communication. Cloud Run natively supports deploying multiple independent services, each with its own URL and scaling configuration. Internal communication between these services can be achieved using Cloud Run's built-in internal endpoints (e.g., using the `run.app` domain with internal traffic routing), which avoids exposing services to the public internet. This approach allows each service to scale independently based on its own request load, meeting the startup's requirement for independent deployment and scaling.

Answer

Deploy the application to App Engine Standard Environment

Answer

Use a single GKE cluster with multiple deployments and services

Answer

Deploy a single Cloud Run service with multiple containers

Question 8

Which TWO configurations are required to deploy a stateful workload on a regional managed instance group in Compute Engine? (Choose two.)

Accepted Answer

Define a stateful configuration that includes persistent disk. Option A is correct because a stateful workload requires persistent data that survives instance restarts or failures. A stateful configuration in a regional managed instance group (MIG) must include a persistent disk definition to ensure that the disk is preserved and reattached to the new instance when the instance is recreated, maintaining state across instance lifecycle events.

Answer

Assign static internal IPs to each instance

Answer

Attach a GPU to the instance template

Answer

Enable autoscaling

Question 9

Which TWO statements are correct about deploying an application with an HTTP(S) load balancer on Compute Engine?

Accepted Answer

A network load balancer can be used for UDP traffic.. Option A is correct because a network load balancer (external) operates at Layer 4 and can forward UDP traffic, unlike HTTP(S) load balancers which only handle HTTP/HTTPS at Layer 7. This makes it suitable for UDP-based applications such as DNS, gaming, or streaming.

Answer

A TCP proxy load balancer can only be used for non-HTTP traffic.

Answer

SSL proxy load balancers cannot terminate HTTPS traffic.

Answer

Internal load balancers require a proxy instance.

Question 10

A company uses Cloud DNS for internal DNS resolution. They recently added a new VPC and need to ensure that instances in this VPC can resolve private DNS names that are hosted in another project. What must be configured?

Accepted Answer

Set up a DNS peering zone between the new VPC and the VPC that hosts the private zone.. Option C is correct because Cloud DNS peering allows a VPC in one project to resolve private DNS names hosted in a private zone in another project without requiring the zones to be shared or exported. DNS peering establishes a direct query path between the peered VPCs, enabling the new VPC to resolve names in the private zone as if they were local, while the zone remains private and managed in its original project.

Answer

Use Cloud DNS inbound server policy to forward queries to the other VPC.

Answer

Export the private zone as a public zone and create a delegation.

Answer

Create a Private DNS zone in the new project with forwarding to the on-premises DNS.

Question 11

A company runs a multi-tier web application on Compute Engine: a frontend instance group (us-east1) and a backend instance group (us-east1) that stores data on persistent disks. They recently experienced a zone failure in us-east1-b, causing all instances in that zone to go down. The application was unavailable for 2 hours. The team is now required to design a solution that provides high availability across multiple zones within the us-east1 region and minimizes data loss. The frontend is stateless, but the backend holds critical state data on persistent disks. The team considers: (A) Migrate backend to use regional persistent disks and distribute backend instances across zones using a regional MIG. (B) Use a zonal MIG in us-east1-b with snapshots to another zone. (C) Move the entire application to a single zone in us-central1 with more resources. (D) Use Cloud SQL for backend data and keep Compute Engine instances in a single zone. Which option best meets the requirements?

Accepted Answer

Use regional persistent disks for backend data and deploy a regional managed instance group for backend instances across us-east1-a and us-east1-b. Option D is correct because it uses regional persistent disks (which replicate data synchronously across two zones in the same region) combined with a regional managed instance group (MIG) that distributes backend instances across us-east1-a and us-east1-b. This architecture ensures that if one zone fails, the backend instances in the other zone can immediately attach the same regional persistent disk, minimizing data loss and providing high availability without requiring manual snapshot recovery.

Answer

Replace backend Compute Engine instances with Cloud SQL for data storage and keep frontend as is

Answer

Move all instances to a single zone in us-central1 with larger machine types

Answer

Keep the backend in a zonal MIG in us-east1-b but take hourly snapshots of persistent disks to a different zone

Question 12

Which TWO actions should be taken to reduce latency for users accessing a global application hosted on Compute Engine? (Choose two.)

Accepted Answer

Deploy instances in multiple regions behind a global load balancer.. Deploying instances in multiple regions behind a global load balancer (Option B) reduces latency by directing user traffic to the closest healthy backend, minimizing network round-trip time. Using Cloud CDN with a backend bucket (Option E) caches static content at edge locations worldwide, serving users from a nearby cache and offloading origin requests. Together, these actions ensure both dynamic and static content are delivered with minimal latency across a global user base.

Answer

Use a single region with more instances.

Answer

Enable Cloud Armor to filter traffic.

Answer

Use Cloud Interconnect for connectivity.

Question 13

An organization has a VPC with subnets in us-central1 and europe-west1. They want to allow traffic from a specific on-premises IP range to reach a Compute Engine instance in europe-west1, but only through a single Cloud VPN tunnel attached to the us-central1 gateway. What configuration is required?

Accepted Answer

Create a route in us-central1 with the on-premises range and next hop set to the VPN tunnel. Add a firewall rule allowing the traffic.. Option A is correct because the VPN tunnel is attached to the us-central1 gateway, and a static route in us-central1 with the on-premises IP range as the destination and the VPN tunnel as the next hop directs traffic from the on-premises network to the VPC. Since the VPC is global, the route applies to all regions, and the Compute Engine instance in europe-west1 is reachable as long as the traffic enters the VPC through the us-central1 tunnel. A firewall rule is required to allow the inbound traffic from the on-premises range to the instance.

Answer

Use policy-based routing on the Cloud VPN gateway to route the traffic to europe-west1.

Answer

Create a static route for the on-premises range in the europe-west1 subnet pointing to the VPN tunnel in us-central1.

Answer

Configure the VPN tunnel with BGP to advertise the on-premises range to both regions.

Question 14

A developer receives a "Permission 'cloudfunctions.functions.call' denied" error when trying to invoke a Cloud Function from another service. What is the most likely cause?

Accepted Answer

The service account of the caller lacks the Cloud Functions Invoker role.. The error 'Permission cloudfunctions.functions.call denied' indicates that the Identity and Access Management (IAM) policy does not grant the caller the required permission to invoke the function. The Cloud Functions Invoker role (roles/cloudfunctions.invoker) specifically allows the `cloudfunctions.functions.call` permission, which is necessary for HTTP-triggered functions. Without this role on the caller's service account, any invocation attempt will be denied, regardless of other configurations.

Answer

The function is not deployed to the correct region.

Answer

The Cloud Function has a CORS misconfiguration.

Answer

The VPC connector is not configured correctly.

Question 15

A company is using Cloud Run for a stateless application. The application sometimes fails with HTTP 503 errors when traffic spikes. Which action should the team take to improve reliability?

Accepted Answer

Increase the maximum number of container instances.. HTTP 503 errors during traffic spikes indicate that Cloud Run is scaling out but hitting the maximum number of container instances limit, causing new requests to be rejected. Increasing the maximum number of container instances allows Cloud Run to spin up more concurrent containers to handle the burst, directly improving reliability under load.

Answer

Configure a liveness probe with a higher initial delay.

Answer

Use Cloud Functions instead of Cloud Run.

Answer

Enable HTTP load balancing with Cloud CDN.