Google ACE Practice Test 34 — 15 Questions

Question 1

A company needs to store and serve user-generated content such as images and videos. The data must be accessible globally with low latency. Which Google Cloud storage service should they use?

Accepted Answer

Cloud Storage. Cloud Storage is correct because it is Google Cloud's object storage service, designed to store and serve unstructured content like images and videos at global scale with low latency via edge caching and multi-region buckets. It offers HTTP/HTTPS access, signed URLs, and integration with Cloud CDN, making it the standard choice for user-generated media. No other listed service provides globally distributed object storage with this accessibility.

Answer

Persistent Disk

Answer

Cloud Filestore

Answer

Local SSD

Question 2

A team is deploying a microservice to Cloud Run that needs to process messages from Pub/Sub. The service should only be invocable by Pub/Sub push deliveries, not by unauthenticated HTTP requests. What should the team do?

Accepted Answer

Deploy with --no-allow-unauthenticated and configure the Pub/Sub subscription to use a service account that has the roles/run.invoker role on the Cloud Run service. Deploying Cloud Run with `--no-allow-unauthenticated` enforces IAM authentication on the service, and configuring the Pub/Sub push subscription to use a service account with `roles/run.invoker` on that service lets Pub/Sub present a valid OIDC token that Cloud Run accepts. This ensures only Pub/Sub push deliveries can invoke the service.

Answer

Deploy with --allow-unauthenticated and set up a Pub/Sub subscription with OIDC token audience

Answer

Deploy with --no-allow-unauthenticated and create a VPC connector to allow Pub/Sub internal traffic

Answer

Use Cloud Functions instead, which is more secure for Pub/Sub triggers

Question 3

An engineer needs to SSH into a Compute Engine instance using OS Login. What must be enabled first?

Accepted Answer

Enable OS Login in the project metadata. OS Login must first be enabled at the project (or instance) level by setting the `enable-oslogin` metadata key to TRUE. Only after OS Login is enabled can IAM roles like `roles/compute.osLogin` be granted and take effect. Enabling OS Login is the prerequisite configuration step that changes how SSH authentication is managed on the instance.

Answer

Create an SSH key and upload to the instance

Answer

Grant the compute.osLogin role to the user

Answer

Add SSH keys to the project metadata

Question 4

You want to deploy a Cloud Function triggered by HTTP requests. The function is written in Node.js and the entry point function is named 'helloHttp'. Which command should you use?

Accepted Answer

gcloud functions deploy my-function --runtime nodejs16 --trigger-http --entry-point=helloHttp --region=us-central1. The correct command uses `gcloud functions deploy` with the required positional NAME argument (`my-function`), specifies `--runtime nodejs16`, uses `--trigger-http` for an HTTP-triggered function, and sets `--entry-point=helloHttp` to match the exported Node.js function name. The `--region` flag is also valid and commonly required for deterministic deployment. This combination satisfies all requirements stated in the question.

Answer

gcloud functions deploy --source . --runtime nodejs16 --trigger-http --entry-point=helloHttp

Answer

gcloud run deploy my-function --source . --runtime nodejs16 --entry-point=helloHttp

Answer

gcloud functions deploy my-function --runtime nodejs16 --trigger-topic my-topic --entry-point=helloHttp

Question 5

You have a Cloud Run service that experiences intermittent high latency. You want to analyze the latency of specific request paths to identify bottlenecks. You enable Cloud Trace and instrument your application with OpenTelemetry. Which tool or feature should you use to view a waterfall diagram of latencies across services for a single request?

Accepted Answer

Cloud Trace Trace List and Trace Details. Cloud Trace Trace List and Trace Details provide a waterfall diagram that visualizes the latency of each request as it propagates through different services. This allows you to pinpoint bottlenecks by seeing the duration of each span in the trace. OpenTelemetry instrumentation enriches traces with custom spans, making this the correct tool for analyzing request paths.

Answer

Error Reporting

Answer

Cloud Monitoring Metrics Explorer

Answer

Cloud Logging Logs Explorer

Question 6

Your BigQuery query is taking longer than expected. You want to estimate the query cost before running it and get a preview of how many bytes will be processed. Which bq command should you use?

Accepted Answer

bq query --use_legacy_sql=false --dry_run 'SELECT ...'. The bq query --dry_run flag validates the query and returns the estimated number of bytes that will be processed without actually executing it or incurring charges. This is the standard way to preview BigQuery query cost before running it, since on-demand pricing is based on bytes scanned. The --use_legacy_sql=false flag ensures standard SQL syntax is used.

Answer

bq show --format=prettyjson mydataset.mytable

Answer

bq ls --format=prettyjson mydataset

Answer

bq query --use_legacy_sql=false --batch 'SELECT ...'

Question 7

A developer wants to create a service account for an application running on Compute Engine. The application needs to access Cloud Storage. What is the best practice for granting this access?

Accepted Answer

Create a service account, grant it the Cloud Storage roles, and attach it to the instance using the --service-account flag.. The best practice is to create a dedicated user-managed service account, grant it only the required Cloud Storage IAM roles (e.g., roles/storage.objectViewer), and attach it directly to the Compute Engine instance via the --service-account flag. This follows the principle of least privilege and avoids long-lived credentials. Attaching the service account to the instance lets the application obtain short-lived access tokens automatically from the metadata server.

Answer

Use Workload Identity Federation to grant access.

Answer

Use the default Compute Engine service account and grant it Cloud Storage roles.

Answer

Create a service account, download its key, and store it on the instance.

Question 8

You need to export logs from Cloud Logging to a BigQuery dataset for long-term analysis. What should you create?

Accepted Answer

A log sink with BigQuery as the destination. To export logs from Cloud Logging to BigQuery, you create a log sink with BigQuery as the destination. Log sinks are the mechanism in Google Cloud for routing log entries to supported destinations, including BigQuery, Cloud Storage, and Pub/Sub. This allows for long-term storage and analysis.

Answer

An alerting policy with a log-based trigger

Answer

A log-based metric

Answer

An export job in BigQuery

Question 9

A company has an organization with multiple folders and projects. They want to audit all IAM policy changes across the entire organization. Which approach meets the requirement with minimal effort?

Accepted Answer

View Admin Activity audit logs in Logs Explorer, which are enabled by default.. Admin Activity audit logs are enabled by default for all Google Cloud projects and organizations, and they automatically capture IAM policy changes (e.g., SetIamPolicy calls) at the organization, folder, and project levels. Because they are always on and aggregated at the organization level, you can view them in Logs Explorer without enabling anything or configuring per-project sinks. This meets the audit requirement with minimal effort.

Answer

Use Organization Policy to deny IAM policy changes and monitor violations.

Answer

Enable Data Access audit logs for all services in the organization.

Answer

Enable audit logging on each project individually using gcloud logging sinks.

Question 10

Which gcloud command is used to set the default project for a configuration profile?

Accepted Answer

gcloud config set project. The command `gcloud config set project` is used to set the default project for the active configuration profile. It updates the `core/project` property in the active configuration, so subsequent gcloud commands use that project unless overridden. This is the standard way to change the default project without reinitializing the entire configuration.

Answer

gcloud init

Answer

gcloud projects set

Answer

gcloud projects list

Question 11

A company wants to automate the rotation of encryption keys for Cloud Storage buckets every 30 days. Which key type should be used?

Accepted Answer

Customer-Managed Encryption Keys (CMEK). Customer-Managed Encryption Keys (CMEK) allow the customer to control the key lifecycle, including rotation, through Cloud KMS. Because the customer owns and manages the key in KMS, they can set a rotation schedule (e.g., every 30 days) and automate it. Google-managed keys are rotated automatically by Google on a schedule the customer cannot control, and CSEK keys are supplied per-request and cannot be rotated by a schedule.

Answer

Google-managed encryption keys

Answer

Key Access Justification

Answer

Customer-Supplied Encryption Keys (CSEK)

Question 12

A company wants to migrate an on-premises PostgreSQL database to Google Cloud. They require automated backups, point-in-time recovery, and a 99.95% availability SLA. Which service should they choose?

Accepted Answer

Cloud SQL for PostgreSQL. Cloud SQL for PostgreSQL is a fully managed database service that supports automated backups, point-in-time recovery (PITR), and offers a 99.95% availability SLA when configured with high availability (HA). It is specifically designed for PostgreSQL workloads, making it the ideal choice for migrating an on-premises PostgreSQL database to Google Cloud while meeting the stated requirements. The service handles routine tasks like patching, replication, and backups, allowing the company to focus on their application.

Answer

Compute Engine with self-managed PostgreSQL

Answer

Cloud SQL for MySQL

Answer

Cloud Spanner

Question 13

A developer wants to run a one-time query on a large dataset stored in Cloud Storage using BigQuery without loading the data into a table. Which feature should they use?

Accepted Answer

Use a BigQuery federated query with an external table definition. BigQuery federated queries (external tables) let you query data stored outside BigQuery — such as CSV, JSON, Avro, or Parquet files in Cloud Storage — without loading it into a native BigQuery table. This is exactly the one-time query use case described. The external table definition points at the GCS URI, and BigQuery reads the data at query time.

Answer

Create a permanent table and load the data using gcloud bq load

Answer

Use Cloud SQL to query the data via federated query

Answer

Use gcloud sql import to load data into BigQuery

Question 14

A Cloud Shell user wants to persist Terraform state files across sessions. What is the best approach?

Accepted Answer

Store them in the home directory ($HOME). In Google Cloud Shell, the home directory ($HOME) is persistent across sessions, while other locations like /tmp are ephemeral and cleared when the session ends. Storing Terraform state files in $HOME ensures they persist and are available in subsequent Cloud Shell sessions without additional setup.

Answer

Store them in /tmp

Answer

Store them in a Cloud Storage bucket and mount via gcsfuse

Answer

Store them on the instance's local SSD

Question 15

You need to collect and analyze latency traces for a microservices application running on GKE. You want to identify which services are contributing to overall latency. Which Google Cloud service should you enable and use?

Accepted Answer

Cloud Trace. Cloud Trace is Google Cloud's distributed tracing service, designed to collect latency data across microservices and visualize trace waterfalls so you can pinpoint which service contributes to end-to-end latency. It integrates natively with GKE and supports OpenTelemetry and the Cloud Trace agent.

Answer

Cloud Logging

Answer

Cloud Profiler

Answer

Cloud Monitoring