Google ACE Practice Test 38 — 15 Questions

Question 1

You need to set up an alerting policy to notify your team via email and Slack when a Compute Engine instance's CPU utilization exceeds 80% for 5 minutes. Which two resources must you configure? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A metric threshold condition on the 'compute.googleapis.com/instance/cpu/utilization' metric. To create an alerting policy, you need a metric threshold condition (e.g., CPU utilization > 80% for 5 minutes) and notification channels (email, Slack). Uptime checks are for availability, not performance metrics. Log-based alerts are for log events, not metrics.

Answer

A Cloud Function to check CPU and send Slack message

Answer

An uptime check for the external IP of the instance

Answer

A log-based alert for the 'compute.googleapis.com/instance' log

Question 2

A developer wants to allow a Compute Engine instance to access Cloud Storage without using a service account key file. What is the recommended approach?

Accepted Answer

Create a service account, grant it the required roles, and attach it to the instance using the --service-account flag.. The recommended approach is to create a service account, grant it the necessary roles, and attach it to the instance. The instance can then use the service account via the metadata server without needing keys.

Answer

Use Application Default Credentials with a user account.

Answer

Download a service account key and store it on the instance.

Answer

Set up a VPN connection to Cloud Storage.

Question 3

An engineer needs to enable the Compute Engine API for a project using the CLI. Which command should they run?

Accepted Answer

gcloud services enable compute.googleapis.com. The 'gcloud services enable' command enables APIs in a project. The service name for Compute Engine is compute.googleapis.com.

Answer

gcloud compute enable

Answer

gcloud services enable compute

Answer

gcloud api enable compute.googleapis.com

Question 4

You are using Cloud Shell and need to access a file you created two weeks ago. What is the persistence behavior of Cloud Shell home directories?

Accepted Answer

Cloud Shell home directories persist across sessions, with 5 GB of storage.. Cloud Shell provides 5 GB of persistent home storage backed by Cloud Filestore or persistent disk. It persists across sessions, even if Cloud Shell is idle. However, it is not backed up; if the instance is reset, data may be lost. But under normal use, data persists.

Answer

Cloud Shell home directories are stored in Cloud Storage and are always available.

Answer

Cloud Shell home directories persist for 30 days after last use.

Answer

Cloud Shell home directories are temporary and are deleted after each session.

Question 5

An engineer wants to ensure that no one in their organization can create VMs with public IP addresses. Which Google Cloud tool should they use to enforce this restriction?

Accepted Answer

Organization policies. Organization policies (Org Policies) allow setting constraints at the organization, folder, or project level to restrict configurations.

Answer

Labels

Answer

IAM roles

Answer

Quotas

Question 6

An engineer needs to choose a location for a new GCP project's resources to maximize availability and minimize latency for users in Europe and Asia. Which three actions should they take? (Choose THREE)

Accepted Answer

Use a global load balancer to distribute traffic. Using multiple regions, load balancing, and a global resource like Cloud CDN can help achieve high availability and low latency.

Answer

Set the project default region to us-central1

Answer

Use a single zone in europe-west1 for simplicity

Question 7

A team wants to export GCP billing data for detailed analysis using SQL. Which three steps are necessary? (Choose THREE)

Accepted Answer

Create a BigQuery dataset. Billing export to BigQuery requires enabling BigQuery, creating a dataset, and configuring the export from billing.

Answer

Enable Cloud Billing API

Answer

Create a Cloud Storage bucket

Question 8

A Cloud Function needs to be triggered whenever a message is published to a Pub/Sub topic. Which 'gcloud functions deploy' command flag is required to set the trigger?

Accepted Answer

--trigger-topic. The --trigger-topic flag configures a Cloud Function to be triggered by Pub/Sub messages.

Answer

--trigger-http

Answer

--trigger-event

Answer

--trigger-bucket

Question 9

A new engineer wants to set up their local environment to interact with Google Cloud. Which command initializes the gcloud CLI and configures the project, region, and zone?

Accepted Answer

gcloud init. The 'gcloud init' command initializes the SDK, sets default project, region, and zone interactively. 'gcloud auth login' only handles authentication. 'gcloud config set' sets individual properties but doesn't initialize. 'gcloud auth application-default login' is for application default credentials.

Answer

gcloud auth login

Answer

gcloud auth application-default login

Answer

gcloud config set project my-project

Question 10

A company wants to manage multiple GCP projects with different configurations (e.g., different regions and accounts) on the same workstation. Which gcloud feature should they use to switch between these configurations?

Accepted Answer

Configuration profiles. Configuration profiles allow setting different sets of properties (project, region, account) and switching between them with 'gcloud config configurations activate'.

Answer

Environment variables

Answer

gcloud init each time

Answer

Multiple gcloud installations

Question 11

You want to enable the Kubernetes Engine API for your project using the command line. Which gcloud command should you use?

Accepted Answer

gcloud services enable container.googleapis.com. 'gcloud services enable container.googleapis.com' enables the required API. 'gcloud auth login' authenticates. 'gcloud config set' sets project. 'gcloud container clusters create' creates a cluster but doesn't enable the API.

Answer

gcloud container clusters create my-cluster

Answer

gcloud config set project my-project

Answer

gcloud auth login

Question 12

You need to grant a user the ability to create and manage Compute Engine instances in a specific project. You want to follow the principle of least privilege. Which IAM role should you assign?

Accepted Answer

roles/compute.instanceAdmin.v1. roles/compute.instanceAdmin.v1 provides full control over Compute Engine instances but not other services. roles/editor is broader. roles/owner is too permissive. roles/compute.admin includes all compute resources, not just instances.

Answer

roles/compute.admin

Answer

roles/editor

Answer

roles/owner

Question 13

You are configuring a new project and need to enable the Compute Engine API. However, the command 'gcloud services enable compute.googleapis.com' fails with a permission error. Your user has the role roles/editor on the project. What is the likely cause?

Accepted Answer

The project does not have a billing account associated.. The role roles/editor includes serviceusage.services.enable permission, so it should work. However, if the organization has an org policy 'constraints/compute.restrictResourceCreation' that restricts API usage, it might block. But the most common issue is that the project is new and the billing account is not associated, preventing API enablement. Editor role has permission, but billing must be active.

Answer

The Compute Engine API is already enabled.

Answer

The user needs to authenticate again.

Answer

The user does not have the serviceusage.services.enable permission.

Question 14

You need to list all projects in your organization using the gcloud CLI. Which command is correct?

Accepted Answer

gcloud projects list. 'gcloud projects list' lists projects accessible to the authenticated user. To list all projects in an organization, you need the --filter or use organizations. But 'gcloud projects list' with appropriate permissions shows all projects. The other commands are incorrect: 'gcloud config list' shows config, 'gcloud compute projects list' doesn't exist, 'gcloud resource-manager projects list' is not a command.

Answer

gcloud compute projects list

Answer

gcloud config list

Answer

gcloud resource-manager projects list

Question 15

Your organization wants to enforce that all Compute Engine instances are created only in us-central1 and europe-west1. You need to implement this constraint across all projects in the organization. What should you do?

Accepted Answer

Apply an organization policy with constraint gcp.resourceLocations to allow only us-central1 and europe-west1.. Organization policies can enforce constraints on resource locations. The constraint 'gcp.resourceLocations' restricts allowed locations. You set this at the organization level so it applies to all projects. IAM roles don't enforce location. VPC Service Controls control data exfiltration, not location restrictions. Labels don't enforce location.

Answer

Use VPC Service Controls to restrict access to Compute Engine API from other regions.

Answer

Use labels to tag instances and run a script to delete non-compliant ones.

Answer

Create an IAM policy denying the compute.instances.create permission in all other regions.