Google ACE Practice Test 35 — 15 Questions

Question 1

Refer to the exhibit. The Terraform plan above returns the error: Error: "member" is required. What is the issue?

Accepted Answer

The member argument should be 'member' (singular) not 'members'.. The Terraform error 'Error: "member" is required' indicates that the resource block is using the plural argument 'members' instead of the singular 'member'. In the Google Cloud Terraform provider, the google_project_iam_member resource expects a single 'member' argument (e.g., 'user:email@example.com'), not a list. The correct syntax is 'member = "user:email@example.com"', not 'members = ["user:email@example.com"]'. This is a common syntax error when transitioning from other IAM resources that accept lists.

Answer

The Terraform provider version is outdated.

Answer

The project ID is incorrect.

Answer

The member argument must be a service account, not a user.

Question 2

A small business is deploying a web application on Compute Engine and wants to ensure high availability. They have set up two instances in different zones behind a TCP load balancer. What should they also configure to detect and route traffic away from unhealthy instances?

Accepted Answer

Configure a health check on the load balancer.. A health check is required for the TCP load balancer to monitor the backend instances. It periodically probes the instances on a specified port and path, marking them as unhealthy if they fail to respond. The load balancer then stops routing new traffic to unhealthy instances, ensuring high availability by directing traffic only to healthy backends.

Answer

Set a firewall rule to allow traffic only on port 80.

Answer

Use a global HTTP(S) load balancer instead.

Answer

Create a snapshot schedule for the persistent disks.

Question 3

A team is using Terraform to manage infrastructure in Google Cloud. After running terraform apply, they receive an error: 'Error 409: Resource already exists'. The team needs to resolve this without deleting and recreating the resource. What should they do?

Accepted Answer

Import the existing resource into Terraform state with 'terraform import'.. Option B is correct because the 'Error 409: Resource already exists' indicates that the resource was created outside of Terraform or the state file lost track of it. Running 'terraform import' brings the existing resource under Terraform management by adding its current attributes to the state file, allowing subsequent operations without deletion or recreation.

Answer

Run 'terraform refresh' to update the state file.

Answer

Set the 'create_before_destroy' lifecycle rule on the resource.

Answer

Change the resource name in the Terraform configuration.

Question 4

A company wants to monitor the CPU utilization of their Compute Engine instances and receive an alert if utilization exceeds 80% for 5 minutes. Which services should they combine?

Accepted Answer

Cloud Monitoring and Cloud Pub/Sub.. Cloud Monitoring collects CPU utilization metrics from Compute Engine instances and can evaluate them against a threshold-based alerting policy. When the condition (CPU > 80% for 5 minutes) is met, the alert fires and sends a notification to a Cloud Pub/Sub topic, which can then trigger downstream actions such as sending emails or invoking serverless functions. This combination provides the metric ingestion, alert evaluation, and event-driven notification pipeline required for the use case.

Answer

Cloud Functions and Cloud Tasks.

Answer

Cloud Audit Logs and Cloud Storage.

Answer

Cloud Logging and Cloud Functions.

Question 5

A DevOps team notices that a Compute Engine instance running a critical application has been terminated unexpectedly. The team wants to ensure the instance restarts automatically if it stops. Which configuration should they use?

Accepted Answer

Enable the 'Automatic restart' flag on the instance template.. Option C is correct because enabling the 'Automatic restart' flag on the instance template ensures that Compute Engine automatically restarts the VM if it terminates due to a non-user-initiated failure (e.g., hardware failure, system crash). This is the native mechanism for automatic recovery without requiring external scripts or manual intervention.

Answer

Configure a startup script that checks for termination and restarts the instance.

Answer

Set the 'On host maintenance' policy to 'Migrate VM instance'.

Answer

Create a firewall rule to allow health check traffic from the load balancer.

Question 6

Which TWO practices help ensure the reliability of a Cloud Functions deployment? (Choose two.)

Accepted Answer

Use Cloud Tasks to decouple function invocations.. Option D is correct because Cloud Tasks decouples function invocations by queuing requests and delivering them asynchronously, which improves reliability by handling spikes in traffic without dropping requests and providing automatic retries on failure. Option E is correct because implementing retry policies for background functions (e.g., Cloud Functions triggered by Pub/Sub or Cloud Storage) ensures that transient failures are automatically retried, increasing the overall reliability of the deployment.

Answer

Deploy functions in a single region to minimize latency.

Answer

Configure a VPC connector for all functions.

Answer

Set maximum instances to 1 to avoid resource contention.

Question 7

The company wants to change the storage class of these log files to Nearline to reduce costs while still retaining the ability to access them without restoration fees. Which command should be used?

Accepted Answer

gsutil rewrite -s NEARLINE gs://my-bucket/logs/*.log. Option B is correct because the `gsutil rewrite` command is specifically designed to change the storage class of existing objects without incurring restoration fees. It rewrites the object metadata to the new storage class (Nearline) while keeping the object in place, and the operation does not require retrieving the object from cold storage, so no restoration charges apply.

Answer

gsutil cp -s NEARLINE gs://my-bucket/logs/*.log

Answer

gsutil setmeta -s NEARLINE gs://my-bucket/logs/*.log

Answer

gsutil mv -s NEARLINE gs://my-bucket/logs/*.log

Question 8

A company needs to store structured data with strong consistency and global distribution for a global user base. Which Google Cloud database service is best suited?

Accepted Answer

Cloud Spanner. Cloud Spanner is the correct choice because it provides strong consistency, horizontal scalability, and global distribution via synchronous replication across regions. It supports SQL queries and ACID transactions, making it ideal for structured data that requires both consistency and global access.

Answer

Bigtable

Answer

Cloud SQL

Answer

Firestore

Question 9

A Compute Engine instance cannot connect to a Cloud SQL (MySQL) instance using the private IP address. Both are in the same Google Cloud VPC network. What is the most likely cause?

Accepted Answer

The VPC network is not peered with the Cloud SQL service.. When a Compute Engine instance cannot connect to a Cloud SQL instance using a private IP address within the same VPC network, the most likely cause is that the VPC network is not peered with the Cloud SQL service. Cloud SQL uses a separate, Google-managed VPC for its instances, and private connectivity requires a VPC peering connection between the customer's VPC and the Cloud SQL service's VPC. Without this peering, the private IP address of the Cloud SQL instance is not routable from the Compute Engine instance, even if both are in the same VPC network.

Answer

The Cloud SQL instance is not in the same region.

Answer

The Compute Engine instance lacks an external IP address.

Answer

The firewall rule does not allow ingress on port 3306.

Question 10

A company uses preemptible VMs for batch processing. Which TWO best practices should be implemented to improve resilience and manageability? (Choose 2)

Accepted Answer

Use instance metadata to pass configuration parameters.. Option B is correct because instance metadata is a key-value store that can be used to pass configuration parameters to preemptible VMs at boot time. Since preemptible VMs can be terminated at any time, using metadata ensures that new instances can be recreated with the same configuration without manual intervention. This improves manageability by centralizing configuration and resilience by enabling automated re-provisioning.

Answer

Use persistent disks to store application state.

Answer

Use Cloud Functions to monitor instance termination.

Answer

Use persistent disk snapshots for backup.

Question 11

What action does the condition in the IAM policy restrict the user from performing?

Accepted Answer

Performing any compute.admin action on disks in us-central1-a with names starting with 'disk-'. The condition `resource.name.startsWith('disk-')` combined with the `compute.disks.delete` action and the zone constraint `us-central1-a` restricts the user to deleting only disks whose names begin with 'disk-' in that specific zone. Option C correctly identifies this as the allowed action, meaning the policy restricts the user from performing any `compute.admin` action on disks in `us-central1-a` with names starting with 'disk-' — but the question asks what action the condition restricts the user from performing, so the inverse is true: the user is restricted from performing any `compute.admin` action on disks that do not match the condition (i.e., disks not starting with 'disk-' or in other zones). However, the answer choices frame it as the condition restricting the user from performing the action described in C, which is the exact action the policy allows, making C the correct answer because the policy's condition explicitly permits that action, and the question's phrasing is a trap.

Answer

Deleting disks that do not start with 'disk-'

Answer

Performing any action on compute instances

Answer

Creating disks in any zone other than us-central1-a

Question 12

Refer to the exhibit. A user 'admin@example.com' attempts to create a Compute Engine instance but fails with a permission error. Which permission is missing?

Accepted Answer

iam.serviceAccounts.actAs. The error occurs because when a user creates a Compute Engine instance with a service account, they need the `iam.serviceAccounts.actAs` permission on that service account. This permission allows the user to impersonate the service account and delegate its identity to the instance. Without it, the creation fails even if the user has `compute.instances.create`.

Answer

compute.instances.get

Answer

compute.instances.create

Answer

compute.instances.setServiceAccount

Question 13

A team is using Cloud Deployment Manager to define infrastructure as code. They need to ensure that a Cloud Storage bucket is created before a Compute Engine instance that uses the bucket. How should they accomplish this?

Accepted Answer

Set a dependency using the 'dependsOn' field in the instance resource definition. In Cloud Deployment Manager, you can define explicit dependencies between resources using the `dependsOn` field within the resource definition. This ensures that the Cloud Storage bucket is fully created before the Compute Engine instance that references it, preventing race conditions or deployment failures. The `dependsOn` field accepts a list of resource names or selfLinks, and Deployment Manager waits for the depended-on resource to reach a DONE state before creating the dependent resource.

Answer

Use a dependsOn metadata annotation in the instance template

Answer

Reference the bucket's selfLink in the instance template metadata

Answer

Create the bucket and instance in separate deployments and run them sequentially

Question 14

A company is using Cloud NAT to allow private instances to access the internet. However, they notice that traffic from different instances appears to come from the same external IP address. What is the reason?

Accepted Answer

Cloud NAT uses a single external IP by default unless you specify multiple.. Cloud NAT uses a source network address translation (SNAT) configuration that, by default, maps all outbound traffic from instances in a VPC network to a single external IP address. This is the expected behavior unless you explicitly configure multiple NAT IP addresses in a NAT gateway or use a Cloud Router with custom SNAT settings. Option B correctly identifies that Cloud NAT defaults to a single external IP unless you specify multiple.

Answer

Cloud NAT is not configured correctly; traffic should come from different IPs.

Answer

The instances are using a shared VPC so NAT IP is shared.

Answer

Each instance is assigned a unique external IP by Cloud NAT.

Question 15

Your application runs on Compute Engine instances behind a regional external HTTP(S) load balancer. Users report intermittent timeouts during periods of high traffic. Health checks show all instances as healthy. Which two configuration parameters should you review first?

Accepted Answer

Review connection draining and session affinity settings. B is correct because connection draining (drain mode) and session affinity settings directly affect how the load balancer handles in-flight requests and distributes traffic during high load. Connection draining ensures existing connections complete before an instance is removed, preventing abrupt timeouts. Session affinity (sticky sessions) can cause uneven traffic distribution if misconfigured, leading to overloaded instances and intermittent timeouts even when health checks pass.

Answer

Check SSL certificate expiration

Answer

Increase instance machine type (size)

Answer

Enable Cloud CDN

Google ACE Practice Test 35 — 15 Questions

Exhibit

Google ACE Practice Test 35 — 15 Questions

Exhibit