Google ACE Practice Test 38 — 15 Questions

Question 1

A new engineer needs to set up the gcloud CLI on their local machine and authenticate with a user account. Which command should they run after installing the SDK?

Accepted Answer

gcloud init. The 'gcloud init' command is the standard way to initialize the gcloud CLI, authenticate with a user account, set the default project, and configure other initial settings. It walks the user through the authentication flow and sets up the local configuration for subsequent gcloud commands.

Answer

gcloud auth application-default login

Answer

gcloud config set account

Answer

gcloud auth login

Question 2

A company runs a big data processing pipeline on a Dataproc cluster. To reduce costs, they use a primary cluster with one master node (standard) and 20 worker nodes all using preemptible VMs. Recently, jobs running during peak business hours are failing with 'Task failed' errors. You notice that many preemptible VMs are reclaimed during the middle of these jobs. The jobs are long-running MapReduce tasks that write intermediate results to the cluster's HDFS. What should you do to improve job reliability without significantly increasing costs?

Accepted Answer

Enable graceful decommissioning for the preemptible instances.. Enabling graceful decommissioning for preemptible instances allows YARN to handle node loss more gracefully. When a preemptible VM is reclaimed, YARN can wait for running containers to finish before shutting down the node, reducing task failures. This improves job reliability without adding cost, as it leverages existing preemptible VMs more effectively.

Answer

Increase the number of preemptible worker nodes to 40.

Answer

Use a higher preemptible instance type (e.g., n1-highmem-2 instead of n1-standard-2).

Answer

Switch to standard worker nodes with committed use discounts.

Question 3

A company needs to store 50 TB of access logs that are rarely accessed (once a year) and must be retained for 7 years. Which storage option is the most cost-effective?

Accepted Answer

Archive Storage. Archive Storage is the most cost-effective option for data that is accessed less than once a year and must be retained for 7 years. It offers the lowest storage cost among Google Cloud storage classes, specifically designed for long-term, infrequently accessed data with a 365-day minimum storage duration and a higher retrieval cost, which is acceptable given the rare access pattern.

Answer

Nearline Storage

Answer

Regional persistent disk

Answer

Coldline Storage

Question 4

Your company runs a stateful web application on a managed instance group (MIG) in us-central1 across three zones. The application uses a TCP health check on port 8080. Recently, instances have been recreated frequently due to health check failures, though the application logs show no errors and instances are accessible via SSH. The firewall rules allow traffic from the health check ranges (130.211.0.0/22 and 35.191.0.0/16) to port 8080. You have verified that the application is listening on 0.0.0.0:8080. Which of the following is the most likely cause of the health check failures?

Accepted Answer

The firewall rule allowing health check probes is not applied to the instances due to missing network tags.. GCP health check probes originate from specific source ranges (130.211.0.0/22 and 35.191.0.0/16), and firewall rules that allow them must be applied to the target instances via network tags or service accounts. If the rule exists but the instances lack the matching tag, the probes are silently dropped, causing the MIG to mark instances unhealthy and recreate them — even though SSH and application logs look fine. This matches the symptom of healthy-looking instances being cycled by the autohealer.

Answer

The health check is using the HTTP protocol instead of TCP.

Answer

The MIG's autohealing policy is set to a too-aggressive initial delay.

Answer

The application is only listening on the localhost interface.

Question 5

Your company wants to track costs per department. Each department has its own project. You need to set up a budget alert in the billing account for each project. What is the most efficient approach?

Accepted Answer

Create one budget per project by selecting the project in the 'Scoped to' field.. In GCP, a Cloud Billing budget can be scoped to a specific project using the 'Scoped to' field, allowing you to create one budget per project directly from the billing account without needing to enable billing separately or export data. This is the most efficient native approach because budgets support project-level scoping out of the box. It avoids the overhead of BigQuery export and custom monitoring setup.

Answer

Use Billing Export to BigQuery and create custom alerts using Cloud Monitoring.

Answer

Create a budget for each project by manually enabling billing for each project.

Answer

Create a single budget for the entire billing account and rely on labels.

Question 6

A team is using Terraform to manage Google Cloud resources. They want to store the Terraform state file in a Cloud Storage bucket with versioning enabled. Which backend configuration should they use?

Accepted Answer

terraform {
  backend "gcs" {
    bucket = "my-terraform-state-bucket"
    prefix = "terraform/state"
  }
}. The correct backend block for Google Cloud Storage in Terraform is backend "gcs", and the bucket argument must be the bare bucket name (e.g., "my-terraform-state-bucket") without the gs:// scheme prefix. Terraform's GCS backend automatically uses the Google Cloud Storage API and supports object versioning natively when enabled on the bucket. This configuration stores the state file at gs://my-terraform-state-bucket/terraform/state/default.tfstate.

Answer

terraform {
  backend "cloud" {
    bucket = "my-terraform-state-bucket"
    prefix = "terraform/state"
  }
}

Answer

terraform {
  backend "gcs" {
    bucket = "gs://my-terraform-state-bucket"
    prefix = "terraform/state"
  }
}

Answer

terraform {
  backend "remote" {
    hostname = "app.terraform.io"
    organization = "my-org"
    workspaces { name = "my-workspace" }
  }
}

Question 7

Order the steps to set up a Cloud IAM policy that grants a user the 'roles/compute.admin' role on a specific project.

Accepted Answer

Step 1: Identify the user (email) and the project ID.
Step 2: Use gcloud to add IAM policy binding: `gcloud projects add-iam-policy-binding PROJECT_ID --member=user:EMAIL --role=roles/compute.admin`
Step 3: Verify the binding using `gcloud projects get-iam-policy PROJECT_ID`.
Step 4: Test access by having the user attempt to use Compute Engine resources.. The correct sequence is: first identify the user and project, then grant the role using 'gcloud projects add-iam-policy-binding', followed by verification with 'get-iam-policy', and finally test access. This ensures the policy is applied correctly and can be validated.

Answer

Step 1: Use gcloud to set the IAM policy by reading the current policy, modifying it locally, and writing it back.
Step 2: Identify the user and project.
Step 3: Verify the binding.
Step 4: Test access.

Answer

Step 1: Verify the binding using `gcloud projects get-iam-policy`.
Step 2: Identify the user and project.
Step 3: Use gcloud to add IAM policy binding.
Step 4: Test access.

Answer

Step 1: Identify the user and project.
Step 2: Test access to confirm no current access.
Step 3: Use gcloud to add IAM policy binding.
Step 4: Verify the binding.

Question 8

You have a GKE cluster with a node pool that needs to scale automatically based on load. The cluster was created with autoscaling disabled. Which command enables autoscaling on an existing node pool?

Accepted Answer

gcloud container node-pools update my-pool --cluster=my-cluster --enable-autoscaling --min-nodes=1 --max-nodes=10. The correct command is `gcloud container node-pools update` with `--enable-autoscaling` and min/max node flags, because autoscaling is a property of the node pool, not the cluster, and it must be enabled on an existing pool via the update verb. The `--cluster` flag identifies the parent cluster, and `--min-nodes`/`--max-nodes` define the scaling bounds. This is the only option that both targets an existing node pool and uses the correct gcloud subcommand.

Answer

gcloud container node-pools create my-pool --enable-autoscaling

Answer

kubectl autoscale node-pool my-pool --min=1 --max=10

Answer

gcloud container clusters update my-cluster --enable-autoscaling

Question 9

A monitoring alert fires at 3 AM — the team's GKE Pods are being evicted. Investigation shows node memory is at 98%. Pods without resource requests are being evicted first. What is the long-term fix to prevent evictions?

Accepted Answer

Add explicit memory requests (and optionally limits) to all Pod specs. B is correct because setting explicit memory requests ensures the Kubernetes scheduler can accurately place Pods on nodes with sufficient resources, preventing the node from being overcommitted. Without requests, Pods are treated as burstable or best-effort, making them the first candidates for eviction under the kubelet's Quality of Service (QoS) classes when node memory pressure hits 98%. This is a long-term fix because it enforces proper resource governance at the scheduling level, not just a reactive measure.

Answer

Set higher memory limits on the Pods being evicted

Answer

Disable node-level eviction by modifying kubelet configuration

Answer

Add more nodes to the cluster to increase available memory

Question 10

A managed instance group (MIG) is configured with autohealing using a health check. During a rolling update, several VMs become unhealthy before the new application version starts responding to health checks. The MIG deletes and recreates these VMs repeatedly, causing a deployment loop. How should you fix this?

Accepted Answer

Increase the `initialDelaySec` in the autohealing policy to give VMs time to start before health checks are evaluated.. Increasing `initialDelaySec` in the autohealing policy gives the new application version sufficient time to start and become healthy before the health check begins evaluating the VM. This prevents the MIG from prematurely marking VMs as unhealthy during the rolling update, breaking the deployment loop where VMs are repeatedly deleted and recreated.

Answer

Disable autohealing during rolling updates by removing the health check.

Answer

Switch from rolling update to canary update to reduce the number of affected VMs.

Answer

Reduce the health check interval and timeout to detect unhealthy VMs faster.

Question 11

Match each Google Cloud deployment tool to its purpose.

Accepted Answer

Cloud Deployment Manager: Declarative infrastructure management using templates. Cloud Deployment Manager and Terraform are infrastructure-as-code tools, with Cloud Deployment Manager being GCP-native and Terraform multi-cloud. The Cloud Console and gcloud CLI provide GUI and command-line interfaces for GCP management.

Answer

Cloud Deployment Manager: Manages containerized applications on GKE

Answer

Terraform: Only works with Google Cloud

Question 12

A GKE cluster hosts multiple teams' workloads in separate namespaces. One team's pods should not be able to make API calls to Google Cloud services (e.g., they should not call BigQuery or Cloud Storage). The pods currently use the node's service account via the Compute Engine metadata server. How do you restrict these specific pods from accessing GCP APIs while allowing other pods on the same node to continue using GCP APIs?

Accepted Answer

Apply a Kubernetes NetworkPolicy in the team's namespace blocking egress to `169.254.169.254` (the metadata server).. The Compute Engine metadata server (169.254.169.254) is the endpoint that provides the node's service account credentials to pods. By applying a Kubernetes NetworkPolicy that blocks egress to this IP in the team's namespace, you prevent those pods from reaching the metadata server, thus denying them access to GCP APIs. Other pods on the same node are unaffected because NetworkPolicy is namespace-scoped and does not apply to them.

Answer

Revoke all IAM roles from the node's service account.

Answer

Set `automountServiceAccountToken: false` on the restricted team's pods.

Answer

Use a Kubernetes ResourceQuota to limit the team's namespace API access.

Question 13

A developer needs to run a one-time SQL query against a large dataset stored in Cloud Storage in Parquet format. The query result will be used for ad-hoc analysis. They want to minimize cost and avoid provisioning any servers. Which service should they use?

Accepted Answer

BigQuery external table query. BigQuery external table query allows you to query data stored in Cloud Storage (including Parquet) directly without loading it, using BigQuery's serverless infrastructure. This minimizes cost because you only pay for the data scanned by the query, and you avoid provisioning any servers. It is ideal for one-time ad-hoc analysis of large datasets.

Answer

Cloud SQL import

Answer

Dataproc cluster

Answer

Compute Engine with Apache Spark installed

Question 14

A company is migrating a legacy on-premises application to Google Cloud. The application stores structured transactional data in a relational database. The database currently handles 2,000 transactions per second (TPS) and is expected to grow to 10,000 TPS over the next year. The database size is 500 GB. The application requires strong consistency and the ability to run complex JOIN queries. Which Google Cloud database service should the company choose?

Accepted Answer

Cloud Spanner. Cloud Spanner is the correct choice because it is a fully managed relational database that provides strong global consistency, supports complex SQL joins, and scales horizontally to easily handle 10,000 TPS. Cloud SQL, while supporting joins and ACID, is limited to vertical scaling and read replicas, which do not address the write throughput required at 10,000 TPS. Therefore, Cloud Spanner meets the application's requirements for high TPS, strong consistency, and complex queries.

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Bigtable

Answer

Cloud Firestore

Question 15

A data science team needs a VM with 96 vCPUs and 624 GB of RAM. No predefined GCP machine type matches these exact specifications. What is the recommended approach?

Accepted Answer

Create a custom machine type with exactly 96 vCPUs and 624 GB RAM. Google Cloud allows you to create custom machine types when predefined machine types do not meet your exact requirements. Custom machine types let you specify the exact number of vCPUs (up to 96) and memory (up to 624 GB) for a VM, providing flexibility without over-provisioning resources.

Answer

Select the closest larger predefined N2 machine type

Answer

Split the workload across multiple smaller VMs and coordinate manually

Answer

Contact Google Cloud support to request a new predefined machine type