Google ACE Practice Test 41 — 15 Questions

Question 1

An engineer needs to view the current IAM policy for a project in JSON format. Which gcloud command should they use?

Accepted Answer

gcloud projects get-iam-policy PROJECT_ID --format json. The `gcloud projects get-iam-policy` command retrieves the IAM policy attached to a project and returns it in the requested format. Adding `--format json` outputs the policy as a JSON document, which is exactly what the engineer needs. This is the standard read-only command for inspecting project-level IAM bindings.

Answer

gcloud iam projects describe-iam-policy PROJECT_ID --format json

Answer

gcloud projects add-iam-policy-binding PROJECT_ID --format json

Answer

gcloud projects set-iam-policy PROJECT_ID --format json

Question 2

You need to create a service account for a Compute Engine instance to allow it to access Cloud Storage objects. The service account should have minimal permissions. What is the recommended approach?

Accepted Answer

Create a service account, grant it the required roles, and specify it when creating the instance using the --service-account flag. The recommended approach is to create a dedicated service account, grant it only the required roles (e.g., roles/storage.objectViewer for read access), and attach it to the instance at creation time using the --service-account flag. This ensures the instance uses the least-privilege identity from the start and avoids the risks of default accounts or downloaded keys.

Answer

Create a service account and assign it to the instance using gcloud compute instances set-service-account after creation

Answer

Use the default compute engine service account and grant it roles/storage.objectAdmin

Answer

Create a service account, download a JSON key, and store it on the instance's local disk

Question 3

Your company runs a data processing pipeline on Cloud Dataproc. The pipeline reads data from Cloud Storage, processes it with Spark, and writes results to BigQuery. Recently, the pipeline has been failing with errors indicating insufficient disk space on the worker nodes. The cluster is configured with standard worker nodes with 100 GB of standard persistent disk. The data size being processed has grown from 50 GB to 150 GB. What is the most cost-effective way to resolve the disk space issue?

Accepted Answer

Enable automatic disk resizing for the cluster.. Cloud Dataproc's automatic disk resizing feature dynamically increases the size of persistent disks on worker nodes when disk usage exceeds a threshold (default 90%). This resolves the insufficient disk space issue without manual intervention or additional cost for unused capacity, making it the most cost-effective solution for handling the increased data volume from 50 GB to 150 GB.

Answer

Increase the size of the persistent disks on the worker nodes to 200 GB.

Answer

Use local SSDs instead of persistent disks for temporary storage.

Answer

Increase the number of worker nodes in the cluster.

Question 4

A team deploys a Cloud Run service that must access resources in a private VPC (a private Cloud SQL instance and a Redis instance on Memorystore). The Cloud Run service has no public IP connectivity requirements for these resources. What must be configured?

Accepted Answer

Configure a Serverless VPC Access connector and specify it in the Cloud Run service deployment. Cloud Run is a serverless compute platform that runs in a Google-managed VPC, not the customer's VPC. To access private resources like Cloud SQL and Memorystore (Redis) within a customer VPC, you must configure a Serverless VPC Access connector. This connector bridges the serverless environment to the specified VPC, enabling private, internal IP communication without public internet exposure.

Answer

Enable VPC Service Controls around Cloud Run to connect it to the VPC

Answer

Assign an external IP to the Cloud SQL and Memorystore instances — Cloud Run can reach them via public internet

Answer

Cloud Run automatically connects to any VPC resource in the same project via project-level networking

Question 5

A team runs a Kubernetes Deployment with 3 replicas behind a Service. They want to expose it externally with HTTPS and route traffic based on URL paths (/api → backend service, / → frontend service). Which Kubernetes resource handles path-based routing at Layer 7?

Accepted Answer

A Kubernetes Ingress resource with path rules. A Kubernetes Ingress resource is the native API object designed for Layer 7 (HTTP/HTTPS) routing, including path-based routing. It allows you to define rules that map URL paths (e.g., /api, /) to different backend Services, and it typically works with an Ingress controller (e.g., NGINX, HAProxy) that terminates TLS and performs the routing. This directly meets the requirement for external HTTPS exposure and path-based traffic splitting.

Answer

A LoadBalancer Service with path routing rules

Answer

A NodePort Service with iptables path routing rules

Answer

Multiple ClusterIP Services with DNS SRV records for path routing

Question 6

Which THREE actions are recommended to ensure the successful operation of a Compute Engine instance running a production workload?

Accepted Answer

Enable deletion protection on the instance.. Option A is correct because enabling deletion protection on the instance prevents accidental deletion of a production VM, which is a recommended safeguard for critical workloads. Option B is correct because configuring a health check with an autohealing policy on the managed instance group automatically recreates unhealthy instances, maintaining availability and reliability of the production service. Option D is correct because scheduled snapshots with a retention policy provide durable, point-in-time backups of persistent disks, enabling recovery from data corruption or failures. Option C is not recommended because placing a production subnet in a single zone creates a single point of failure; a multi-zone or regional design is preferred for high availability. Option E is not a general recommendation because attaching a GPU is only relevant for specific accelerated workloads such as ML inference, not for ensuring the successful operation of a typical production instance.

Answer

Use a custom VPC with a subnet in a single zone.

Answer

Attach a GPU for machine learning inference.

Question 7

A Cloud Run service needs to read secrets from Secret Manager. The service is deployed with a custom runtime service account. Which IAM role should be granted to the runtime service account, and on which resource?

Accepted Answer

Grant `roles/secretmanager.secretAccessor` on the specific secret resource.. The principle of least privilege dictates that the runtime service account should only have the minimum permissions required to access the specific secret. The `roles/secretmanager.secretAccessor` role provides exactly the `secretmanager.versions.access` permission needed to read the secret value, and granting it on the specific secret resource (rather than the project) scopes the permission to that secret only, preventing broader access.

Answer

Grant `roles/secretmanager.admin` on the project.

Answer

Grant `roles/viewer` on the project.

Answer

Grant `roles/secretmanager.secretVersionManager` on the secret.

Question 8

Your team is planning a GKE cluster for a microservices application. Some services process sensitive payment data and must run on dedicated nodes that no other workloads can access. The rest of the application can share nodes. How should you configure the cluster?

Accepted Answer

Apply taints to the dedicated node pool and tolerations to payment service pod specs.. Taints on dedicated node pools prevent pods without matching tolerations from being scheduled on those nodes, ensuring that only payment service pods (which include the corresponding tolerations) can run on the dedicated nodes. This isolates sensitive workloads at the node level without requiring separate clusters, which would add operational overhead and complexity.

Answer

Use separate GKE clusters: one for payment services and one for everything else.

Answer

Use Kubernetes NetworkPolicy to restrict network access between payment pods and other pods.

Answer

Set resource requests and limits so payment services consume all resources on their nodes.

Question 9

A project has the following IAM bindings: User A has `roles/editor` at the project level, and a folder-level policy denies `roles/editor` to User A. Which effective permission does User A have on the project?

Accepted Answer

User A is denied Editor permissions because IAM Deny policies at a parent resource override allow grants at child resources.. In Google Cloud, IAM Deny policies at a parent resource (like a folder) override allow bindings at a child resource (like a project). Even though User A has `roles/editor` granted at the project level, the folder-level Deny policy explicitly denies that role, so the effective permission is denial. This follows the principle that Deny policies are evaluated before Allow bindings and take precedence.

Answer

User A has Editor permissions because project-level IAM takes precedence over folder-level.

Answer

User A has no permissions because conflicting policies result in no access.

Answer

User A has Editor permissions because folder-level policies don't apply to individual projects.

Question 10

A developer wants to deploy a containerized web application that receives HTTP requests and can scale to zero when not in use. The application is stateless and has a startup time of less than 2 seconds. Which Google Cloud compute option is the most cost-effective?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform that runs stateless containers and automatically scales to zero when there is no traffic, meaning you pay nothing when idle. It natively handles HTTP requests and supports rapid scaling based on incoming requests, making it ideal for a stateless web app with sub-2-second startup. The other options either do not scale to zero or require manual scaling configuration, leading to higher costs for sporadic workloads.

Answer

Compute Engine with managed instance group and autoscaling

Answer

Google Kubernetes Engine (GKE) Standard

Answer

App Engine Standard with manual scaling

Question 11

A team stores sensitive configuration files in Cloud Storage that internal services download at startup. External partners occasionally need time-limited access to specific files without creating GCP accounts. Which feature grants temporary access without modifying bucket permissions?

Accepted Answer

Generate a Signed URL for the specific files with the required expiration time. Signed URLs provide time-limited, granular access to specific Cloud Storage objects without altering the underlying bucket permissions. The partner receives a URL that embeds authentication information and an expiration time, enabling secure, temporary downloads without requiring a GCP account or IAM role.

Answer

Make the specific files publicly readable and share the direct URL

Answer

Create a temporary GCP service account for the partner and share its JSON key

Answer

Enable uniform bucket-level access and create a public IAM binding for 24 hours

Question 12

An engineer needs to deploy a containerized web application that receives HTTP requests and should scale to zero when not in use. The application is stateless and has a lightweight container image. Which Google Cloud compute service should be used?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform that scales to zero when no requests are coming in, and bills per request. It is ideal for stateless HTTP-triggered container workloads.

Answer

Compute Engine with a single VM

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE) Standard cluster

Question 13

A company is running a stateful application on a Compute Engine instance with a 200 GB persistent disk. They want to reduce costs by moving the disk to a lower-cost storage class, but the disk is currently in use. They plan to take a snapshot of the disk and create a new disk from the snapshot with the new storage class. However, they need minimal downtime. What is the correct approach?

Accepted Answer

Take a snapshot of the disk, create a new disk from the snapshot with the new storage class, then detach the old disk and attach the new disk to the same VM. To change the storage class of a persistent disk, you cannot directly change it; you must create a new disk from a snapshot. To minimize downtime, you can create a snapshot while the VM is running (crash-consistent if on a live instance), then create a new disk with the desired storage class, stop the VM, detach the old disk, attach the new disk, and start the VM. This results in a brief downtime but is the standard method.

Answer

Use the 'gcloud compute disks update' command to change the storage class while the disk is attached to a running VM

Answer

Create a new disk with the new storage class and use rsync to copy data from the old disk while both are attached to the same VM

Answer

Stop the VM, take a snapshot, create a new disk with the new storage class, and start the VM with the new disk

Question 14

An administrator needs to create a Cloud SQL for PostgreSQL instance with 16 vCPUs and 60 GB of memory. Which tier should they specify?

Accepted Answer

db-custom-16-61440. Cloud SQL tiers follow the pattern db-custom-#vcpus-#memoryMB. 16 vCPUs and 60 GB (61440 MB) uses db-custom-16-61440.

Answer

db-custom-16-60

Answer

db-n1-standard-16

Answer

db-custom-16-60000

Question 15

A company wants to use Cloud Run to deploy a containerized API that requires up to 8 GB of memory per request. The API experiences unpredictable traffic spikes. They want to minimize cost while ensuring fast cold starts. Which configuration should they use?

Accepted Answer

Set min-instances to 1 and max-instances to a value that handles peak traffic with CPU throttled. Cloud Run supports up to 8 GB memory per container (as of 2024). Setting min-instances to a small number (e.g., 1) reduces cold starts, while max-instances limits costs during spikes. CPU boost can also speed up cold starts. Using CPU always allocated increases costs, so CPU throttled (default) is fine. The question emphasizes cost minimization, so setting a minimal min-instances is appropriate.

Answer

Use Cloud Run jobs instead of Cloud Run service

Answer

Deploy the container to GKE Autopilot with a single pod

Answer

Set max-instances to a high number and min-instances to 0 with CPU always allocated