Google ACE Practice Test 36 — 15 Questions

Question 1

What is the purpose of the gcloud init command?

Accepted Answer

To set up a new gcloud configuration and authenticate.. The gcloud init command is the primary setup utility for the Google Cloud CLI. It performs two core tasks: it creates a new named configuration (or reinitializes an existing one) and then walks the user through authentication via gcloud auth login, followed by selecting a default project and optionally a default Compute Engine zone/region. This ensures the CLI is ready for use with the correct credentials and project context.

Answer

To create a billing account.

Answer

To initialize a new project in Google Cloud.

Answer

To enable APIs for a project.

Question 2

An engineer deployed a new version of their application on GKE using a Deployment. Users report that the new version has a bug. The engineer wants to quickly revert to the previous version. How can they achieve this?

Accepted Answer

Run kubectl rollout undo deployment/. The `kubectl rollout undo` command is specifically designed to revert a Deployment to a previous revision. When you run `kubectl rollout undo deployment/`, Kubernetes updates the Deployment's pod template to match the previous ReplicaSet, triggering a new rollout that restores the old version. This is the fastest and most reliable way to roll back a bad deployment.

Answer

Scale the deployment to zero and then scale back up

Answer

Run kubectl delete deployment and re-apply the old manifest

Answer

Run kubectl rollout history deployment/<deployment-name>

Question 3

An engineer wants to ensure that no one in their organization can create VMs with public IP addresses. Which Google Cloud tool should they use to enforce this restriction?

Accepted Answer

Organization policies. Organization policies in Google Cloud are hierarchical constraints applied at the organization, folder, or project level that restrict what resources can be created or configured. The predefined constraint constraints/compute.vmExternalIpAccess can be set to deny, preventing any VM in the scope from receiving an external IP. This is enforced by the resource manager before the VM is created, making it the correct tool for a hard organizational restriction.

Answer

Labels

Answer

IAM roles

Answer

Quotas

Question 4

Which gcloud command creates a regional GKE cluster named 'my-cluster' with 3 nodes per zone in the 'us-central1' region?

Accepted Answer

gcloud container clusters create my-cluster --region us-central1 --num-nodes 3. The correct command uses --region us-central1 to create a regional cluster and --num-nodes 3 to set three nodes per zone. A regional GKE cluster replicates nodes across all zones in the region, so --num-nodes specifies the count per zone. This matches the requirement of a regional cluster with 3 nodes per zone.

Answer

gcloud container clusters create my-cluster --zone us-central1 --num-nodes 3

Answer

gcloud container clusters create my-cluster --zone us-central1-a --num-nodes 3

Answer

gcloud container clusters create my-cluster --region us-central1 --nodes 3

Question 5

Your organization wants to enforce that all Compute Engine instances are created only in us-central1 and europe-west1. You need to implement this constraint across all projects in the organization. What should you do?

Accepted Answer

Apply an organization policy with constraint gcp.resourceLocations to allow only us-central1 and europe-west1.. The correct approach is to apply an organization policy with the constraint gcp.resourceLocations (also known as Location Restriction) at the organization level, specifying allowed locations us-central1 and europe-west1. This constraint is enforced by the Organization Policy Service and prevents the creation of Compute Engine instances (and other resources) outside the allowed regions, regardless of IAM permissions. It provides centralized, preventive control across all projects in the organization.

Answer

Use VPC Service Controls to restrict access to Compute Engine API from other regions.

Answer

Use labels to tag instances and run a script to delete non-compliant ones.

Answer

Create an IAM policy denying the compute.instances.create permission in all other regions.

Question 6

An organization needs to deploy a regional Cloud SQL MySQL instance with 4 vCPUs and 15 GB of memory. The instance should be highly available within a single region. Which gcloud command should they use?

Accepted Answer

gcloud sql instances create my-instance --tier=db-n1-standard-4 --region=us-central1 --database-version=MYSQL_8_0 --root-password=password123 --availability-type=REGIONAL. A regional (highly available) Cloud SQL instance requires the `--availability-type=REGIONAL` flag, which provisions a standby in a different zone within the same region and enables automatic failover. Option A includes this flag along with the correct tier, region, database version, and root password, making it the only command that satisfies all stated requirements.

Answer

gcloud sql instances create my-instance --tier=db-n1-highmem-4 --region=us-central1 --database-version=MYSQL_8_0

Answer

gcloud sql instances create my-instance --tier=db-n1-standard-4 --region=us-central1 --database-version=MYSQL_8_0 --root-password=password123

Answer

gcloud sql instances create my-instance --tier=db-n1-standard-4 --region=us-central1

Question 7

An engineer wants to deploy a Python function that processes messages from a Pub/Sub topic. The function should be triggered whenever a message is published to the topic. Which command should the engineer use to deploy the function?

Accepted Answer

gcloud functions deploy my-function --runtime python39 --trigger-topic my-topic --entry-point main --region=us-central1. The correct command uses --trigger-topic my-topic to bind the function to a Pub/Sub topic, and --entry-point main (singular) to name the function entry point. This deploys a background function that Cloud Functions invokes whenever a message is published to the topic. The runtime and region flags are also correctly specified.

Answer

gcloud functions deploy my-function --runtime python39 --trigger-http --entry-point main --region=us-central1

Answer

gcloud functions deploy my-function --runtime python39 --trigger-topic my-topic --entry-points main --region=us-central1

Answer

gcloud functions deploy my-function --runtime python39 --trigger-bucket my-bucket --entry-point main --region=us-central1

Question 8

What is the purpose of creating a Cloud NAT gateway?

Accepted Answer

To enable private instances to reach the internet for updates and patches.. Cloud NAT allows instances without external IP addresses to access the internet for outbound connections, while preventing inbound connections from the internet.

Answer

To allow VPN connections to on-premises networks.

Answer

To provide a static IP address for inbound traffic.

Answer

To provide DNS resolution for VPC networks.

Question 9

A team is migrating from Google Container Registry (gcr.io) to Artifact Registry. Existing automation scripts use `gcr.io/my-project/myimage`. To avoid updating all scripts immediately, which Artifact Registry feature allows gcr.io-addressed pulls to work with Artifact Registry backends?

Accepted Answer

Enable the gcr.io compatibility redirect in Artifact Registry settings so gcr.io URLs route to Artifact Registry. Artifact Registry offers a gcr.io compatibility redirect feature that automatically routes requests originally targeting `gcr.io/my-project/myimage` to the corresponding Artifact Registry repository. This allows existing automation scripts to continue using the old `gcr.io` hostname without modification, while the underlying storage and image management are handled by Artifact Registry. The redirect is configured at the project level and works transparently for pull operations, eliminating the need for immediate script updates.

Answer

Artifact Registry has no gcr.io compatibility — all scripts must be updated immediately

Answer

Use a Cloud DNS private zone to redirect gcr.io to Artifact Registry

Answer

Both Container Registry and Artifact Registry can be active simultaneously with no configuration

Question 10

A Kubernetes namespace is shared by multiple teams. The platform team wants to ensure no single team's workloads can consume more than 10 CPU cores and 20 GB memory in that namespace. Which Kubernetes resource enforces this constraint?

Accepted Answer

ResourceQuota scoped to the namespace. ResourceQuota is the Kubernetes resource that enforces aggregate resource consumption limits at the namespace level. By configuring a ResourceQuota with spec.hard.cpu: 10 and spec.hard.memory: 20Gi, the platform team can cap the total CPU and memory usage across all Pods in the namespace, preventing any single team from exceeding those limits.

Answer

LimitRange — sets per-Pod CPU and memory limits

Answer

PodDisruptionBudget limiting the number of running Pods

Answer

Network Policy restricting namespace traffic to avoid resource contention

Question 11

A DevOps team notices that a Compute Engine instance running a critical application has been terminated unexpectedly. The team wants to ensure the instance restarts automatically if it stops. Which configuration should they use?

Accepted Answer

Enable the 'Automatic restart' flag on the instance template.. Enabling the 'Automatic restart' flag on the instance template ensures that Compute Engine automatically restarts the VM if it terminates due to a non-user-initiated failure (e.g., hardware failure, system crash). This is the native mechanism for automatic recovery without requiring external scripts or manual intervention.

Answer

Configure a startup script that checks for termination and restarts the instance.

Answer

Set the 'On host maintenance' policy to 'Migrate VM instance'.

Answer

Create a firewall rule to allow health check traffic from the load balancer.

Question 12

A company has a Compute Engine instance in the us-west1 region that does not have a public IP address. The instance is part of a VPC network that has a Cloud NAT gateway configured in the us-east1 region. The Cloud NAT gateway is configured to allow all traffic from the VPC subnet. The VPC has a default route (0.0.0.0/0) pointing to the default internet gateway. Firewall rules allow all egress traffic. The instance is unable to download updates from the internet. What is the most likely cause of this problem?

Accepted Answer

The Cloud NAT gateway is in a different region than the instance.. Cloud NAT is a regional resource; a NAT gateway in us-east1 cannot provide NAT for an instance in us-west1. The instance's subnet must have a NAT gateway in the same region to translate its private IP to a public one for internet egress.

Answer

The instance's firewall rules block egress traffic to port 80.

Answer

The instance's service account does not have the compute.instances.update permission.

Answer

The VPC does not have a route for the instance's subnet to the internet gateway.

Question 13

A GCP project needs to allow outbound internet access from VMs that have only private IP addresses, without exposing those VMs to inbound internet traffic. Which GCP service provides this?

Accepted Answer

Cloud NAT configured on the VPC's Cloud Router. Cloud NAT (Network Address Translation) is the correct service because it allows VMs with only private IP addresses to initiate outbound connections to the internet while preventing any inbound connections from the internet. It works by translating the private source IP addresses of outbound packets to a set of ephemeral public IP addresses managed by Google, using the VPC's Cloud Router to dynamically allocate NAT IPs and ports. This meets the requirement of outbound-only internet access without exposing the VMs to inbound traffic.

Answer

Cloud VPN connecting the VPC to the internet

Answer

A VPC firewall rule allowing egress to 0.0.0.0/0 on all ports

Answer

An internal load balancer with internet routing enabled

Question 14

A company wants to track and forecast GCP spending across different departments. They have already set up labels on resources to indicate the department. Which additional step should they take to analyze costs by department in BigQuery?

Accepted Answer

Enable billing export to BigQuery in the Cloud Billing console. Enabling billing export to BigQuery in the Cloud Billing console is the native, supported mechanism that streams detailed cost and usage data — including labels — into a BigQuery dataset. Once enabled, department labels are available as columns, allowing cost analysis and forecasting by department. This is the standard first step before any BigQuery-based cost reporting.

Answer

Use the Cloud Billing API to programmatically fetch cost data and write it to BigQuery

Answer

Run a scheduled query in BigQuery that calls the Cloud Billing API

Answer

Create a Cloud Function that captures billing events and inserts them into BigQuery

Question 15

A small team is setting up a new Google Cloud project for a web application. They need to ensure that they can manage costs and receive alerts when spending exceeds a threshold. What is the simplest way to achieve this?

Accepted Answer

Set up a budget alert in the Google Cloud Console for the project.. Google Cloud budget alerts are configured directly in the Billing section of the Console, where you set a budget amount and threshold percentages (e.g., 50%, 90%, 100%) and attach email or Pub/Sub notifications. This requires no data export, no external tooling, and no per-user billing accounts, making it the simplest path to cost visibility and alerting. It satisfies the requirement with a few clicks and is the native, recommended approach.

Answer

Export billing data to BigQuery and create custom dashboards.

Answer

Use the Google Cloud Pricing Calculator to estimate costs and set manual alerts.

Answer

Create a billing account for each team member and link it to the project.