Google ACE Practice Test 44 — 15 Questions

Question 1

A company wants to expose a web application running on Compute Engine instances behind a managed instance group. They need a single IP address that distributes incoming HTTP traffic across instances. Which type of load balancer should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

External HTTP(S) Load Balancer. The External HTTP(S) Load Balancer is a regional or global, proxy-based Layer 7 load balancer that provides a single external IP address for distributing incoming HTTP traffic across Compute Engine instances in a managed instance group. It supports HTTP and HTTPS protocols, health checks, and autoscaling, making it ideal for web applications.

Answer

Internal TCP/UDP Load Balancer

Answer

External TCP/UDP Network Load Balancer

Answer

SSL Proxy Load Balancer

Question 2

An engineer is configuring a GKE cluster and wants to enable Horizontal Pod Autoscaling (HPA) for a deployment named 'web-frontend'. The deployment currently has 3 replicas. The engineer wants to automatically scale the number of pods based on CPU utilization, targeting 50% average CPU utilization. Which command should the engineer run?

Accepted Answer

kubectl autoscale deployment web-frontend --cpu-percent=50 --min=3 --max=10. The correct command is 'kubectl autoscale deployment web-frontend --cpu-percent=50 --min=3 --max=10', which creates an HPA targeting 50% average CPU utilization with a minimum of 3 and maximum of 10 replicas. The 'kubectl autoscale' subcommand is the standard imperative way to create an HPA for a deployment. The flags --cpu-percent, --min, and --max are the correct parameters for this command.

Answer

gcloud container clusters autoscale web-frontend --target-cpu-utilization=0.5 --min-nodes=3 --max-nodes=10

Answer

kubectl autoscale deployment web-frontend --max-cpu=50 --min=3 --max=10

Answer

kubectl autoscale deployment web-frontend --cpu=50 --min=3 --max=10

Question 3

A company wants to set up a budget alert at 50% and 90% of their projected monthly spending. Which service should they use?

Accepted Answer

Cloud Billing budgets. Cloud Billing budgets allow you to set budget amounts and configure alert thresholds at specific percentages (e.g., 50% and 90%) of your projected or actual spending. When spending exceeds these thresholds, alerts are triggered via email or Pub/Sub notifications. This is the native service for budget monitoring and alerting in Google Cloud.

Answer

Cost breakdown reports

Answer

Cloud Scheduler

Answer

Cloud Monitoring alerts

Question 4

A company runs an App Engine Standard application with multiple versions. They want to gradually roll out new features by sending a small percentage of traffic to a new version. How should they implement this?

Accepted Answer

Use App Engine's traffic splitting feature to assign a percentage of traffic to the new version. App Engine Standard provides built-in traffic splitting, allowing you to assign a percentage of incoming requests to different versions of the same service. This is the simplest and most direct way to gradually roll out a new feature by sending a small percentage of traffic to the new version without needing external load balancers or additional services.

Answer

Deploy the new version and delete the old version

Answer

Use Cloud Load Balancing to distribute traffic between versions

Answer

Create a new service for the new version and use a custom domain

Question 5

A team needs a GKE cluster named 'prod-cluster' in the us-central1 region with cluster autoscaling enabled, scaling between 3 and 10 nodes. Which command achieves this?

Accepted Answer

gcloud container clusters create prod-cluster --region=us-central1 --num-nodes=3 --enable-autoscaling --min-nodes=3 --max-nodes=10. It uses the `gcloud container clusters create` command with the `--enable-autoscaling` flag, which enables cluster autoscaler for the GKE cluster. The `--min-nodes=3` and `--max-nodes=10` flags define the scaling range, while `--num-nodes=3` sets the initial node count, ensuring the cluster starts with 3 nodes and can scale up to 10 as needed. The `--region=us-central1` specifies a regional cluster, which is appropriate for production workloads requiring high availability across zones.

Answer

gcloud kubernetes clusters create prod-cluster --location=us-central1 --autoscale=3:10

Answer

gcloud container cluster create prod-cluster --zone=us-central1 --scaling=3-10

Answer

kubectl create cluster prod-cluster --region=us-central1 --autoscale --min=3 --max=10

Question 6

A batch processing job runs on preemptible VMs in a managed instance group. The job frequently fails due to preemption. Which design change would most effectively improve the job's resilience?

Accepted Answer

Use a managed instance group with distribution across multiple zones and enable autoscaling.. Distributing the managed instance group across multiple zones and enabling autoscaling ensures that when preemptible VMs are terminated in one zone, the autoscaler can provision replacement VMs in another zone that still has capacity. This architecture leverages the fact that preemption events are often zone-specific, so multi-zone distribution combined with autoscaling provides resilience without requiring persistent resources.

Answer

Use committed use discounts (1-year or 3-year).

Answer

Add GPUs to the instances.

Answer

Use sole-tenant nodes.

Question 7

A company is deploying a multi-region application on Google Kubernetes Engine (GKE) with clusters in us-central1 and europe-west1. They want to route user traffic to the closest healthy cluster using a global load balancer with SSL termination. Which load balancing service should they use?

Accepted Answer

External HTTPS Load Balancer with a global backend service (using NEGs). D is correct because the External HTTPS Load Balancer with a global backend service using Network Endpoint Groups (NEGs) provides global anycast IP, SSL termination, and traffic routing to the closest healthy GKE cluster via Google's global network. This meets the requirement for multi-region GKE clusters with automatic failover and low latency.

Answer

Internal Load Balancer

Answer

SSL Proxy Load Balancer

Answer

External TCP/UDP Network Load Balancer

Question 8

An organization has deployed a Compute Engine VM instance running a web server. The web server is not responding to HTTP requests from the internet. The firewall rules allow ingress traffic on port 80 and 443 from any source (0.0.0.0/0). The VM has a public IP address and is in a VPC network with default subnets. What is the most likely cause of the issue?

Accepted Answer

The web server service is not running on the VM.. The most likely cause of the web server not responding to HTTP requests, despite correct firewall rules and a public IP, is that the web server service (e.g., Apache, Nginx) is not running on the VM. Firewall rules only control network traffic; they do not ensure that the application process is listening on the specified ports. A simple `sudo systemctl status apache2` or `netstat -tlnp` would confirm whether the service is active.

Answer

The VM does not have an HTTP health check configured.

Answer

The VPC network's default firewall rule blocks ingress traffic.

Answer

The VM is not in the same region as the global load balancer.

Question 9

Which GCP service protects internet-facing applications against SQL injection, cross-site scripting (XSS), and other OWASP Top 10 attacks?

Accepted Answer

Cloud Armor WAF with preconfigured OWASP Core Rule Set. Cloud Armor WAF with the preconfigured OWASP Core Rule Set (CRS) is specifically designed to protect internet-facing applications from web application attacks, including SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. It operates at the edge of Google's network, inspecting HTTP/HTTPS traffic against a set of rules that match known attack patterns, and can be integrated with Cloud Load Balancing to filter malicious requests before they reach the backend.

Answer

Cloud Firewall (VPC firewall rules)

Answer

Security Command Center's Web Security Scanner

Answer

Cloud Identity-Aware Proxy (IAP)

Question 10

An engineer needs to create a new GCP project using the Cloud SDK. They have already installed and initialized gcloud with a user account that has Billing Account Administrator and Project Creator roles. Which command creates the project 'my-new-project'?

Accepted Answer

gcloud projects create my-new-project. The correct command is 'gcloud projects create my-new-project', which creates a new GCP project under the currently authenticated account. Since the user already has Project Creator and Billing Account Administrator roles, they have the necessary permissions to create the project and associate billing. The command is part of the stable gcloud projects command group.

Answer

gcloud config set project my-new-project

Answer

gcloud alpha projects create my-new-project

Answer

gcloud init my-new-project

Question 11

An engineer is setting up Cloud Shell for the first time. They notice that their home directory persists across sessions. How much storage is allocated to the home directory in Cloud Shell?

Accepted Answer

5 GB. Google Cloud Shell provides 5 GB of persistent storage for the home directory, which is mounted across sessions so files survive VM recycling. This persistent disk is separate from the ephemeral boot disk that hosts the Cloud Shell VM itself. The 5 GB limit is the documented allocation for the $HOME directory.

Answer

10 GB

Answer

1 GB

Answer

20 GB

Question 12

An organization has multiple GCP projects and wants to centralize billing analysis across all projects. They need to export detailed billing data (e.g., cost per SKU per project) to a BigQuery dataset. Which billing export option should they configure?

Accepted Answer

Export detailed billing data to BigQuery. To centralize billing analysis across multiple projects with detailed cost-per-SKU-per-project data, you configure the detailed billing data export to BigQuery. This export writes granular cost and usage data (including SKU, project, labels, and credits) into a BigQuery dataset that can be queried with SQL for cross-project analysis.

Answer

Export to CSV to Cloud Storage

Answer

Export to Cloud Billing report

Answer

Export to a Pub/Sub topic

Question 13

A team is using gcloud configurations to manage multiple projects. They want to create a new configuration for a production project. How can they achieve this?

Accepted Answer

Run 'gcloud config configurations create prod' then 'gcloud config set project prod-project'. The correct command sequence is 'gcloud config configurations create prod' followed by 'gcloud config set project prod-project'. This creates a new named configuration and sets the active project within it. The 'gcloud config configurations create' command is specifically designed for this purpose.

Answer

Run 'gcloud init' and select 'Create a new configuration'

Answer

Run 'gcloud config set project prod-project' with a flag to create new config

Answer

Edit the gcloud config file manually

Question 14

An organization stores sensitive data in Cloud Storage. They need to ensure that objects are encrypted at rest using a key that they manage and rotate themselves. Which Cloud Storage encryption option should they use?

Accepted Answer

Use customer-managed encryption keys (CMEK). Customer-managed encryption keys (CMEK) in Cloud Storage let the customer create, manage, and rotate keys via Cloud KMS while Google handles the actual encryption and decryption of objects at rest. This satisfies the requirement for customer-controlled key management and rotation without the customer handling raw key material directly.

Answer

Use customer-supplied encryption keys (CSEK)

Answer

Use client-side encryption

Answer

Use Google-managed encryption keys

Question 15

A developer wants to authenticate to GCP from their local machine using their own user account to run gcloud commands that interact with a project. They have already installed the Cloud SDK. Which command should they use to authenticate with their Google account?

Accepted Answer

gcloud auth login. The 'gcloud auth login' command authenticates a user account with Google and stores credentials for use by gcloud CLI commands. It opens a browser window for OAuth 2.0 consent, and after successful authentication, the user's credentials are cached locally and used for subsequent gcloud commands that interact with GCP projects. This is the correct command for a developer authenticating with their own Google account from a local machine.

Answer

gcloud init

Answer

gcloud auth activate-service-account

Answer

gcloud auth application-default login