Google ACE Practice Test 40 — 15 Questions

Question 1

Your company runs a critical web application on Google Kubernetes Engine (GKE) with a regional cluster. The application uses a Cloud SQL instance for database. Recently, users have been experiencing intermittent connection timeouts. The application logs show database connection errors, but the Cloud SQL instance's CPU and memory usage are low. The GKE cluster and Cloud SQL are in the same region. You notice that the Cloud SQL instance is configured with a private IP address. What is the most likely cause of the timeouts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The GKE cluster's nodes are in a different VPC subnet than the Cloud SQL instance.. Cloud SQL private IP connectivity is provided by Private Services Access, which creates a VPC peering connection to the Service Networking API. Private Service Connect is an alternative, not a requirement. If the GKE nodes are in a different VPC network/subnet than the Cloud SQL private IP allocation, they do not have a route to that private IP, so connections from the application time out even though the Cloud SQL instance itself is healthy.

Answer

The Cloud SQL instance is not configured with automatic failover.

Answer

The Cloud SQL instance's connection pool size is too small.

Answer

The GKE cluster is not using a Private Service Connect endpoint to reach Cloud SQL.

Question 2

A team is using Terraform to deploy infrastructure. They want to ensure that the Terraform state file is encrypted at rest using a customer-managed encryption key (CMEK). What should they configure?

Accepted Answer

Use a Cloud Storage bucket with CMEK enabled by default; no Terraform configuration needed. To use CMEK with the GCS backend, you have two valid approaches: 1) Use an existing Cloud Storage bucket that already has CMEK enabled by default—no Terraform encryption configuration is needed because the bucket itself enforces encryption. 2) When creating a new bucket via the `google_storage_bucket` resource, set the `encryption` block with a `default_kms_key_name` to specify a CMEK key. The provider block does not have a `kms_key` argument, and the `terraform` backend block does not support a `kms_key` argument for GCS. Both options A and B are correct.

Answer

Set the kms_key argument in the google provider block

Answer

Set the kms_key argument in the terraform backend block

Question 3

Your company uses Google Workspace for email. You need to set up GCP for a new team that includes contractors who use non-Google email addresses. Which identity solution allows contractors to authenticate to GCP without a Google Workspace license?

Accepted Answer

Provision contractor accounts using Cloud Identity Free, independent of Google Workspace.. Cloud Identity Free provides identity management for users without requiring a Google Workspace license. It allows contractors with non-Google email addresses to authenticate to GCP using their existing email as a Google account, enabling IAM role assignment without additional licensing costs. This is the correct solution because it decouples identity from Google Workspace, supporting external users while maintaining centralized access control.

Answer

Issue each contractor a Gmail account and add it directly to IAM.

Answer

Create service accounts for each contractor and share the key JSON files.

Answer

Add contractor email addresses as external users and grant them project-level IAM roles.

Question 4

A company has a Compute Engine instance that needs to access the internet for software updates, but the instance only has an internal IP address. Which TWO steps are required to enable outbound internet connectivity while keeping the instance private?

Accepted Answer

Create a firewall rule that allows egress traffic to the internet. Cloud NAT allows instances with only internal IP addresses to access the internet for outbound connections. You also need to configure firewall rules to allow egress traffic (e.g., allow HTTP/HTTPS). A NAT gateway without firewall rules will not work.

Answer

Create a VPC peering connection to a network with internet access

Answer

Attach the instance to a load balancer

Answer

Assign a public IP address to the instance

Question 5

A team deploys an application on GKE and needs it to be accessible at https://api.company.com with automatic TLS certificate provisioning. They use a Global external Application Load Balancer. What handles the TLS certificate?

Accepted Answer

A Google-managed SSL certificate attached to the load balancer's HTTPS target proxy. A Global external Application Load Balancer uses an HTTPS target proxy to terminate TLS. To automatically provision and renew TLS certificates for a custom domain, you attach a Google-managed SSL certificate to that target proxy. Google manages the entire lifecycle, including domain verification via Cloud DNS, so no manual certificate generation or third-party tools are needed.

Answer

The GKE cluster automatically generates a self-signed TLS certificate for the domain

Answer

Cloud DNS automatically provisions a TLS certificate when a domain is added

Answer

cert-manager in GKE automatically obtains Let's Encrypt certificates for the Ingress

Question 6

A company is designing a globally distributed application with a web tier and a database tier that requires low-latency communication within the same region but can tolerate eventual consistency across regions. The database must be fully managed and scale globally. Which combination of networking and database is most appropriate?

Accepted Answer

Global VPC with Cloud Bigtable. Cloud Bigtable is a fully managed, globally scalable NoSQL database that provides low-latency access within a region and eventual consistency across regions, making it ideal for the described workload. A Global VPC allows the web and database tiers to communicate privately and with low latency within the same region, while Bigtable's native replication handles cross-region eventual consistency without application complexity.

Answer

Global VPC with Cloud Spanner

Answer

VPC peering with Cloud SQL

Answer

Shared VPC with Cloud Datastore

Question 7

You are configuring Identity-Aware Proxy (IAP) for a web application running on Compute Engine. Users authenticate through IAP and are granted access based on their email addresses. However, some users report that they are prompted to sign in multiple times during the same session. What is the most likely cause?

Accepted Answer

The IAP session timeout is set too low.. The IAP session timeout determines how long a user's authenticated session remains valid before requiring re-authentication. If this timeout is set too low, users will be prompted to sign in multiple times during a single session, even if they are actively using the application. The default IAP session timeout is 1 hour, but it can be configured up to 24 hours; a low value directly causes repeated login prompts.

Answer

The backend service is missing the IAP session cookie validation.

Answer

The users are accessing the application via different browsers.

Answer

The backend service does not support HTTPS.

Question 8

A production GKE service processes payments and must maintain at least 3 replicas running at all times, even during node upgrades or Pod evictions. How should this be enforced?

Accepted Answer

Create a PodDisruptionBudget with minAvailable: 3 targeting the payment service Pods. A PodDisruptionBudget (PDB) with `minAvailable: 3` ensures that at least 3 replicas of the payment service remain available during voluntary disruptions like node upgrades or Pod evictions. The Kubernetes scheduler respects the PDB by blocking evictions that would drop the number of healthy Pods below the specified threshold, guaranteeing continuous service availability even when nodes are being drained.

Answer

Set the Deployment replica count to 6 — node upgrades will only affect half at a time

Answer

Add node affinity rules pinning all 3 replicas to specific long-lived nodes

Answer

Enable cluster autoscaler with minNodeCount=3 — this preserves Pod availability

Question 9

A Cloud Run service calls external third-party APIs that have rate limits. Under burst traffic, the service spawns many concurrent instances, each making direct API calls, causing rate limit errors. What GCP pattern reduces API call volume without adding infrastructure?

Accepted Answer

Cache third-party API responses in Cloud Memorystore (Redis) with appropriate TTL. Caching third-party API responses in Cloud Memorystore (Redis) with an appropriate TTL reduces the number of outbound API calls by serving cached data to multiple concurrent Cloud Run instances. This directly addresses rate-limit errors without adding new infrastructure, as Memorystore is a managed in-memory cache that integrates seamlessly with Cloud Run via a VPC connector.

Answer

Set Cloud Run max-concurrency to 1 so each instance handles one request

Answer

Enable Cloud CDN on the Cloud Run service to cache outbound requests

Answer

Migrate to Cloud Functions with a lower default concurrency limit

Question 10

A company is planning a lift-and-shift migration of an on-premises monolithic application to Google Cloud. The application runs on a single server and requires a specific kernel module that is not supported by Google Cloud's container-optimized OS. Which compute service should they use?

Accepted Answer

Compute Engine. Compute Engine offers full control over the VM, including choice of OS and kernel modules. GKE and Cloud Run use container-optimized OS, and Cloud Functions is serverless and unsuitable for a monolithic app.

Answer

Google Kubernetes Engine (GKE)

Answer

Cloud Run

Answer

Cloud Functions

Question 11

A team is building a mobile app backend that requires real-time data synchronization across devices and offline support. The data model is simple and document-based. Which database service should they use?

Accepted Answer

Firestore. Firestore is a NoSQL document database that provides real-time synchronization and offline support for mobile and web applications. It is designed for mobile app backends with simple document-based data models, offering automatic scaling and strong consistency. Firestore's real-time listeners and offline persistence make it ideal for this use case.

Answer

Cloud Bigtable

Answer

BigQuery

Answer

Cloud SQL

Question 12

An engineer needs to create a Cloud Storage bucket for storing archival data that will be accessed less than once a year. The data must be stored durably and cost-effectively. Which storage class should the engineer use?

Accepted Answer

Archive. Archive is the correct choice because it is Google Cloud's lowest-cost storage class, designed for data accessed less than once per year. It offers the same 99.999999999% (11 nines) durability as other Cloud Storage classes, so the archival data remains highly durable. Its retrieval costs and minimum storage duration (365 days) align with the infrequent access pattern, making it the most cost-effective option for this use case.

Answer

Coldline

Answer

Standard

Answer

Nearline

Question 13

A team wants to deploy a container image at 'gcr.io/myproject/api:v2' as a Cloud Run service named 'api-service' in us-east1, accessible without authentication. Which command is correct?

Accepted Answer

gcloud run deploy api-service --image=gcr.io/myproject/api:v2 --region=us-east1 --allow-unauthenticated. It uses the `gcloud run deploy` command with the `--image` flag to specify the container image, `--region=us-east1` to target the correct region, and `--allow-unauthenticated` to make the service publicly accessible without authentication. This matches the exact requirements for deploying a Cloud Run service with public access.

Answer

gcloud run create api-service --image=gcr.io/myproject/api:v2 --zone=us-east1 --public

Answer

gcloud cloud-run deploy api-service --container=gcr.io/myproject/api:v2 --region=us-east1

Answer

gcloud run deploy --name=api-service --image=gcr.io/myproject/api:v2 --region=us-east1 --no-auth

Question 14

You are designing an environment where a CI/CD pipeline running in GitHub Actions needs to deploy Cloud Run services without storing any long-lived service account keys. Your organization's security policy prohibits downloading SA keys. Which approach meets these requirements?

Accepted Answer

Use Workload Identity Federation to allow GitHub Actions to impersonate a service account using OIDC tokens.. Workload Identity Federation allows GitHub Actions to exchange OIDC tokens from GitHub's identity provider for Google Cloud service account impersonation, eliminating the need to download and store long-lived service account keys. This approach satisfies the security policy by using short-lived, automatically rotated tokens that are valid for only one hour, and it integrates directly with GitHub's OIDC provider without requiring any secret key material.

Answer

Create a service account key, base64-encode it, and store it as a GitHub Actions secret.

Answer

Grant the GitHub Actions runner VM's default service account the necessary roles.

Answer

Use Cloud Build triggers instead of GitHub Actions to avoid key management.

Question 15

A new developer tries to create a project using gcloud projects create but receives the error shown in the exhibit. Which action should the administrator take to resolve the issue?

Accepted Answer

Assign the Project Creator role (roles/resourcemanager.projectCreator) to the user.. The error occurs because the developer lacks the IAM permission to create projects. The Project Creator role (roles/resourcemanager.projectCreator) grants the resourcemanager.projects.create permission at the organization or folder level, which is exactly what is needed to run 'gcloud projects create'. Assigning this role to the user resolves the permission denied error.

Answer

Enable the Cloud Resource Manager API.

Answer

Assign the Billing Account Creator role to the user.

Answer

Create the project manually and share the project ID.