Google ACE Practice Test 43 — 15 Questions

Question 1

A team is designing a data pipeline: Cloud Storage → Pub/Sub → Dataflow → BigQuery. They expect 50 GB of data per hour. Dataflow jobs must automatically scale workers based on pipeline backlog. Which Dataflow feature provides automatic horizontal scaling of worker VMs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Dataflow Horizontal Autoscaling — automatically adds/removes workers based on pipeline lag. Dataflow Horizontal Autoscaling is the correct feature because it automatically adds or removes worker VMs based on the pipeline's backlog (lag), which directly matches the requirement for automatic horizontal scaling. This feature uses the Cloud Monitoring service to track the number of unprocessed elements and adjusts worker count accordingly, ensuring efficient resource usage without manual intervention.

Answer

Vertical scaling — Dataflow automatically increases worker machine types under load

Answer

GKE cluster autoscaler — Dataflow runs on GKE and inherits its autoscaling

Answer

Cloud Monitoring alerting policy that triggers worker additions via gcloud

Question 2

An organization needs to separate development, staging, and production environments using the GCP resource hierarchy. Which approach is most effective?

Accepted Answer

Create folders for dev, staging, and prod under the organization, then place projects in each folder. Folders under the organization node allow you to group projects by environment and apply IAM policies and organizational policies at the folder level, which are inherited by all projects within. This creates a clean separation of dev, staging, and prod while enabling centralized governance. It is the most effective use of the GCP resource hierarchy for environment isolation.

Answer

Use labels on projects to denote environment, but keep all in one folder

Answer

Create separate projects for each environment without folders

Answer

Create a single project and use separate VPC networks per environment

Question 3

You are configuring a Cloud NAT to allow private Compute Engine instances to access the internet for updates. What other resource is required to set up Cloud NAT?

Accepted Answer

A Cloud Router. Cloud NAT requires a Cloud Router to provide the control plane for NAT translation. The Cloud Router is used to program the NAT gateway with translation rules and to manage the IP addresses used for NAT. Without a Cloud Router, you cannot configure Cloud NAT.

Answer

A Cloud VPN tunnel

Answer

An interconnect attachment

Answer

A VPC peering connection

Question 4

Your GKE cluster is running an older version of Kubernetes. You need to upgrade the cluster's control plane and node pools. Which two steps should you perform? (Choose two.)

Accepted Answer

Upgrade the cluster's control plane using gcloud container clusters upgrade. Option D is correct because the control plane of a GKE cluster is upgraded with the gcloud container clusters upgrade command, which targets the cluster's master components to the desired Kubernetes version. Option E is correct because node pools are upgraded separately using gcloud container node-pools upgrade, which rolls out the new node version pool by pool while respecting surge and drain settings. These two steps match GKE's standard upgrade model: first the control plane, then the node pools. Option A is not required because in-place upgrades are supported and recreating the cluster is unnecessary. Option B is not a required step because GKE handles node draining automatically during a node pool upgrade. Option C is incorrect because kubelet versions on GKE nodes are managed by the node pool upgrade process, not by manual per-node changes.

Answer

Create a new cluster with the desired version and migrate workloads

Answer

Drain all nodes using kubectl drain before upgrading

Answer

Manually update the kubelet version on each node

Question 5

A company wants to store archival data that is accessed less than once a year. The data must be preserved for 10 years. Which Cloud Storage storage class is most cost-effective?

Accepted Answer

Archive. Google Cloud Storage Archive storage class is the most cost-effective for data accessed less than once a year and retained for 10 years. Archive has the lowest storage cost but higher retrieval costs and a minimum storage duration of 365 days. It is designed for long-term archival of data that is rarely accessed, making it ideal for this use case.

Answer

Standard

Answer

Nearline

Answer

Coldline

Question 6

You have a Compute Engine instance that is running a CPU-intensive workload. After monitoring, you realize the machine type needs to be upgraded to a larger CPU. What is the correct sequence to change the machine type?

Accepted Answer

Stop the instance, run gcloud compute instances set-machine-type, then start the instance. Changing a Compute Engine instance's machine type requires the instance to be stopped first, because the machine type determines the underlying host resources. The correct sequence is to stop the instance, run `gcloud compute instances set-machine-type`, then start the instance.

Answer

Run gcloud compute instances set-machine-type while the instance is running

Answer

Delete the instance and create a new one with the desired machine type

Answer

Use gcloud compute instances update to change the machine type

Question 7

You need to alert when the CPU utilization of your Compute Engine instance exceeds 80% for 5 minutes. What should you create in Cloud Monitoring?

Accepted Answer

A metric threshold alerting policy. Alerting on a sustained CPU utilization threshold (over 80% for 5 minutes) requires a metric threshold alerting policy in Cloud Monitoring. This policy evaluates the CPU utilization metric against a threshold over a defined duration and triggers notifications when the condition is met. It is the standard mechanism for resource-based alerting.

Answer

An uptime check

Answer

A log-based alert

Answer

A dashboard chart

Question 8

An administrator needs to create a custom IAM role that allows listing projects and viewing billing accounts. Which TWO permissions should be included?

Accepted Answer

billing.accounts.list. Option A, billing.accounts.list, is correct because viewing billing accounts requires the Cloud Billing permission billing.accounts.list, which allows the role to enumerate the billing accounts the principal has access to. Option D, resourcemanager.projects.list, is correct because listing projects is governed by the Resource Manager permission resourcemanager.projects.list, which permits reading the set of projects visible to the caller. Option B, billing.accounts.create, is not needed since the task only requires viewing, not creating, billing accounts. Option C, resourcemanager.projects.create, and Option E, resourcemanager.projects.delete, are also unnecessary because creating or deleting projects is outside the stated scope of listing projects and viewing billing accounts.

Answer

billing.accounts.create

Answer

resourcemanager.projects.create

Answer

resourcemanager.projects.delete

Question 9

A company wants to ensure that only users from a specific domain (@example.com) can access Cloud Storage buckets in a project. Which two steps should be taken? (Choose two.)

Accepted Answer

Set an organization policy to restrict allowed domains for IAM.. The organization policy constraint `iam.allowedPolicyMemberDomains` restricts which domains can be used as members in IAM policies across the entire project. This ensures that only principals from @example.com can be granted access to any resource, including Cloud Storage buckets. Option E is correct because a Cloud Identity group containing only @example.com users can be granted IAM roles on the bucket, and membership in the group is controlled by the domain, effectively limiting access to that domain.

Answer

Use VPC Service Controls to restrict access.

Answer

Enable domain restricted sharing in Cloud Storage settings.

Answer

Add an IAM condition to the bucket policy to require that the user's domain is @example.com.

Question 10

Your GKE cluster is running a deployment with a container image my-app:v1. You need to update it to my-app:v2 and monitor the rollout progress. Which commands should you use?

Accepted Answer

kubectl set image deployment/my-app my-app=my-app:v2 followed by kubectl rollout status deployment/my-app. The correct approach uses `kubectl set image` to declaratively update the container image in the deployment, which triggers a rolling update, followed by `kubectl rollout status` to watch the rollout progress until completion. This is the standard Kubernetes-native workflow for image updates and monitoring.

Answer

gcloud compute instances update-container and kubectl get events

Answer

kubectl edit deployment/my-app and change the image, then kubectl rollout undo if needed

Answer

gcloud container clusters upgrade and kubectl get pods

Question 11

A new engineer wants to set up their local environment to interact with Google Cloud. Which command initializes the gcloud CLI and configures the project, region, and zone?

Accepted Answer

gcloud init. The `gcloud init` command is the interactive setup wizard that authenticates the user, lets them select or create a Cloud project, and sets default compute region and zone in one flow. It writes these values into the active gcloud configuration so subsequent commands use them automatically. This is the canonical first-run command for a new engineer's workstation.

Answer

gcloud auth login

Answer

gcloud auth application-default login

Answer

gcloud config set project my-project

Question 12

You need to list all projects in your organization using the gcloud CLI. Which command is correct?

Accepted Answer

gcloud projects list. The correct command to list all projects in an organization is gcloud projects list. This command queries the Cloud Resource Manager API and returns projects the user has access to, optionally filtered by organization or folder. It is the standard way to enumerate projects via the gcloud CLI.

Answer

gcloud compute projects list

Answer

gcloud config list

Answer

gcloud resource-manager projects list

Question 13

A company is using Cloud Run for a stateless application. The application sometimes fails with HTTP 503 errors when traffic spikes. Which action should the team take to improve reliability?

Accepted Answer

Increase the maximum number of container instances.. HTTP 503 errors during traffic spikes indicate that Cloud Run is scaling out but hitting the maximum number of container instances limit, causing new requests to be rejected. Increasing the maximum number of container instances allows Cloud Run to spin up more concurrent containers to handle the burst, directly improving reliability under load.

Answer

Configure a liveness probe with a higher initial delay.

Answer

Use Cloud Functions instead of Cloud Run.

Answer

Enable HTTP load balancing with Cloud CDN.

Question 14

An engineer needs to create a Cloud SQL MySQL instance with 4 vCPUs, 15 GB of RAM, and a root password. The instance should be in the us-east1 region. Which command should the engineer run?

Accepted Answer

gcloud sql instances create my-instance --database-version=MYSQL_8_0 --tier=db-custom-4-15360 --region=us-east1 --root-password=myPassword. The correct command must specify a custom machine type matching 4 vCPUs and 15 GB RAM, which is `db-custom-4-15360` (the format is db-custom--). It must also include the root password and target the us-east1 region (not a zone). Option D is the only command that includes all required parameters: MYSQL_8_0, the correct custom tier, the region, and the root password.

Answer

gcloud sql instances create my-instance --database-version=MYSQL_8_0 --tier=db-custom-4-15360 --region=us-east1

Answer

gcloud sql instances create my-instance --database-version=MYSQL_5_7 --tier=db-n1-standard-4 --region=us-east1-a --root-password=myPassword

Answer

gcloud sql instances create my-instance --database-version=MYSQL_8_0 --tier=db-custom-2-7680 --region=us-east1 --root-password=myPassword

Question 15

An engineer wants to create a Google-managed SSL certificate for an HTTPS load balancer. Which command should they use?

Accepted Answer

gcloud compute ssl-certificates create my-cert --domains example.com. Google-managed SSL certificates are created with `gcloud compute ssl-certificates create` and only require the `--domains` flag; Google provisions and renews the certificate automatically. The absence of `--certificate` and `--private-key` is what distinguishes a Google-managed cert from a self-managed one. The resulting certificate resource can then be attached to a target HTTPS proxy.

Answer

gcloud compute ssl-policies create my-policy --profile MODERN

Answer

gcloud compute ssl-certificates create my-cert --certificate cert.pem --private-key key.pem

Answer

gcloud compute target-https-proxies create my-proxy --ssl-certificates my-cert