Google ACE Practice Test 37 — 15 Questions

Question 1

An engineer wants to create a Google-managed SSL certificate for an HTTPS load balancer. Which command should they use?

Accepted Answer

gcloud compute ssl-certificates create my-cert --domains example.com. To create a Google-managed SSL certificate, use 'gcloud compute ssl-certificates create' with the '--domains' flag. The other commands are for other purposes or require manual certificate provisioning.

Answer

gcloud compute ssl-policies create my-policy --profile MODERN

Answer

gcloud compute ssl-certificates create my-cert --certificate cert.pem --private-key key.pem

Answer

gcloud compute target-https-proxies create my-proxy --ssl-certificates my-cert

Question 2

You need to perform a rolling update of a GKE deployment and ensure that during the update, the new pods are ready before terminating the old ones. You have already set the update strategy to RollingUpdate. Which kubectl command sequence should you use to update the image and monitor the rollout?

Accepted Answer

kubectl set image deployment/myapp myapp=gcr.io/myproject/myapp:v2; kubectl rollout status deployment/myapp. kubectl set image updates the image; kubectl rollout status monitors the progress. If the rollout fails, kubectl rollout undo rolls back.

Answer

gcloud container clusters upgrade my-cluster; kubectl get deployments

Answer

kubectl edit deployment myapp; kubectl get pods; kubectl delete pod old-pod

Answer

kubectl apply -f deployment.yaml; kubectl rollout undo deployment/myapp

Question 3

A Cloud Run service named 'my-service' is currently serving 100% traffic to revision 'rev1'. You deploy a new revision 'rev2' and want to gradually shift traffic so that rev2 receives 10% of requests. Which command should you use?

Accepted Answer

gcloud run services update-traffic my-service --to-revisions=rev2=10,rev1=90. gcloud run services update-traffic allows you to set traffic percentages per revision. The syntax is --to-revisions=REVISION=PERCENTAGE.

Answer

gcloud run services update my-service --traffic=rev2=10%

Answer

gcloud run deploy my-service --image=... --traffic=rev2=10

Answer

gcloud run revisions update rev2 --traffic=10

Question 4

A company has multiple firewall rules. Rule A (priority 1000) allows TCP 80 from 0.0.0.0/0. Rule B (priority 500) denies TCP 80 from 10.0.0.0/8. An instance with IP 10.0.0.1 tries to connect to TCP 80. What happens?

Accepted Answer

Traffic is denied because Rule B has higher priority.. Firewall rules are evaluated in order of priority (lower number = higher priority). Rule B with priority 500 will be evaluated first and denies the traffic, so Rule A is not applied.

Answer

The result depends on the order of creation.

Answer

Traffic is allowed because Rule A allows all sources.

Answer

Both rules are applied and traffic is allowed.

Question 5

A security team wants to audit all Data Access attempts in a project for a specific Cloud Storage bucket, including who accessed which object and when. Which configuration is required?

Accepted Answer

Enable Data Access audit logs for Cloud Storage in the project's IAM audit config. Data Access audit logs must be enabled for Cloud Storage at the project level via IAM audit config. Admin Activity logs are always enabled but only record configuration changes, not data access. VPC Flow Logs record network metadata, not object-level access. Cloud Monitoring does not provide audit logs.

Answer

Configure VPC Flow Logs on the VPC network

Answer

Set up Cloud Monitoring alerts on the bucket

Answer

Enable Admin Activity audit logs for Cloud Storage in the project

Question 6

You need to add an IAM binding for a user to a project using the gcloud command. Which command should you use?

Accepted Answer

gcloud projects add-iam-policy-binding. The command `gcloud projects add-iam-policy-binding --member user: --role ` adds an IAM policy binding to a project.

Answer

gcloud iam service-accounts add-iam-policy-binding

Answer

gcloud projects set-iam-policy

Answer

gcloud iam roles update

Question 7

Which of the following is required to enable Private Google Access on a subnet?

Accepted Answer

Configuring the subnet with --enable-private-ip-google-access. Private Google Access is enabled at the subnet level using the '--enable-private-ip-google-access' flag. A Cloud NAT is not required for Private Google Access, though it is commonly used together. Cloud Router and VPC peering are not prerequisites.

Answer

A Cloud Router in the same region

Answer

A Cloud NAT gateway

Answer

VPC peering with a Google-managed network

Question 8

An engineer needs to create a firewall rule that allows incoming HTTPS traffic only from a specific IP range to instances tagged 'web-server'. Which command should they use?

Accepted Answer

gcloud compute firewall-rules create allow-https --allow tcp:443 --source-ranges 192.168.0.0/16 --target-tags web-server. The correct command creates a firewall rule allowing TCP port 443 from the specified source range to instances with the target tag 'web-server'.

Answer

gcloud compute firewall-rules create allow-https --allow tcp:443 --source-tags web-server

Answer

gcloud compute firewall-rules create allow-https --allow udp:443 --source-ranges 192.168.0.0/16 --target-tags web-server

Answer

gcloud compute firewall-rules create allow-https --allow tcp:443 --source-ranges 0.0.0.0/0 --target-tags web-server

Question 9

A team is using Cloud Shell to manage resources. They notice that their home directory is persistent across sessions, but they want to ensure that configuration files and scripts are also available after they stop and restart Cloud Shell. What should they do?

Accepted Answer

Store files in the home directory (~). Cloud Shell's home directory persists 5 GB of data. As long as files are stored in the home directory ($HOME), they will persist across sessions.

Answer

Use gcloud config configurations and save scripts in a Cloud Storage bucket

Answer

Create a startup script that runs every time Cloud Shell starts

Answer

Store files in /tmp

Question 10

A company has a Google Cloud organization with multiple folders and projects. The security team wants to audit all actions that create or modify IAM policies across the entire organization. Which type of audit log should they examine?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all API calls that modify the configuration or metadata of resources, including IAM policy changes. These logs are enabled by default and cannot be disabled. Data Access logs record read operations and are not enabled by default. System Event logs cover GCP infrastructure events, not IAM changes.

Answer

System Event audit logs

Answer

Data Access audit logs

Answer

VPC Flow Logs

Question 11

An organization has a hierarchy: Organization -> Folder A -> Project 1. An IAM policy at the organization level grants roles/editor to user@example.com. A policy at Folder A denies roles/editor to the same user. What is the effective role for the user in Project 1?

Accepted Answer

The user does not have the editor role in Project 1 because the deny policy at the folder level blocks it.. IAM policies are additive, but deny policies can override allow policies. If a deny policy is set at a higher level and applies to the user, it denies the permission even if granted at a lower level. However, if the deny policy is at the folder level, it denies the role in all resources under that folder, including Project 1.

Answer

The user has the editor role only in resources directly under the organization, not under Folder A.

Answer

The user has the editor role because organization-level grants override folder-level denials.

Answer

The user has the editor role in Project 1 unless there is a specific project-level deny.

Question 12

An engineer needs to grant a service account the ability to impersonate another service account when making API calls. Which IAM role should be assigned to the impersonating service account?

Accepted Answer

roles/iam.serviceAccountUser. The roles/iam.serviceAccountUser role allows a principal to impersonate a service account (by getting an access token for that account). roles/iam.serviceAccountTokenCreator allows creating tokens but not full impersonation. roles/serviceusage.serviceUsageConsumer is for service usage, not impersonation. roles/iam.serviceAccountAdmin allows administrative actions but not impersonation.

Answer

roles/iam.serviceAccountAdmin

Answer

roles/serviceusage.serviceUsageConsumer

Answer

roles/iam.serviceAccountTokenCreator

Question 13

A company is deploying a stateless web application on Compute Engine. The application is served by a managed instance group with autoscaling behind an HTTP(S) load balancer. To minimize instance startup time and ensure that the application is ready to serve traffic as soon as an instance is created, which two steps should the company take? (Choose two.)

Accepted Answer

Use a container-optimized OS and deploy the application as a Docker container via the startup script.. (container-optimized OS) enables the application to run as a Docker container, which starts quickly if the image is cached, minimizing instance startup time. Option E (custom machine image) includes the application and all dependencies, eliminating the need to install them at boot. Option A (increasing health check delay) delays traffic serving, not startup time. Option B (startup script) adds installation time. Option C (autohealing) addresses health, not startup time.

Answer

Increase the initial delay for the load balancer health check to 5 minutes.

Answer

Configure a startup script in the instance template that installs dependencies and starts the application.

Answer

Set the managed instance group's autohealing to replace unhealthy instances based on the load balancer health check.

Question 14

An engineer is configuring a Cloud NAT to allow private Compute Engine instances to access the internet. After creating the Cloud Router and NAT gateway, the instances still cannot connect to the internet. What is the most likely missing configuration?

Accepted Answer

The VPC does not have a default route (0.0.0.0/0) to the default internet gateway.. Cloud NAT requires that the subnet has Private Google Access enabled for certain Google APIs, but for general internet access, the instances must have a default route to the internet gateway (0.0.0.0/0 next hop to default internet gateway). If this route is missing, traffic won't be sent to NAT. The other options are possible but less common.

Answer

The firewall rules do not allow egress traffic.

Answer

The Cloud Router is in a different region.

Answer

The instances are not assigned a network tag used by the NAT.

Question 15

What is the primary benefit of using a Google-managed SSL certificate for an HTTPS Load Balancer?

Accepted Answer

It automatically renews the certificate before expiration.. Google-managed certificates automatically provision and renew SSL/TLS certificates, reducing manual effort and preventing expiration issues.

Answer

It is free of charge.

Answer

It can be used with any type of load balancer.

Answer

It provides stronger encryption than self-managed certificates.