Google ACE Practice Test 45 — 15 Questions

Question 1

A company has a private VPC with instances that have only internal IP addresses. These instances need to download updates from the internet. Which Google Cloud service should they use to provide outbound internet connectivity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud NAT. Cloud NAT (Network Address Translation) allows instances with only internal IP addresses to initiate outbound connections to the internet without exposing them to inbound traffic. It performs many-to-one IP translation and is the Google-recommended service for egress-only internet access from private VPC subnets.

Answer

Cloud VPN

Answer

Assign public IP addresses to the instances

Answer

Identity-Aware Proxy (IAP)

Question 2

You want to monitor the uptime of an external HTTP endpoint from multiple locations around the world. Which TWO steps should you take? (Choose two.)

Accepted Answer

Select multiple locations (e.g., us-west1, europe-west1, asia-east1) for the uptime check. Option D is correct because a Cloud Monitoring uptime check is the native resource designed to probe an HTTP(S) endpoint from Google-managed probers and report up/down status and latency. Option C is correct because an uptime check lets you select multiple geographic regions (e.g., us-west1, europe-west1, asia-east1) so the endpoint is tested from several locations worldwide, which is exactly the requirement. Option A is not appropriate because a log-based metric derives values from log entries and does not itself perform external HTTP probing from multiple regions. Option B is not appropriate because a Pub/Sub notification channel only delivers alerts; it does not create the monitoring check or provide multi-region probing. Option E is not appropriate because VPC flow logs capture IP traffic metadata within a VPC and cannot monitor an external HTTP endpoint's uptime.

Answer

Create a log-based metric for the endpoint response time

Answer

Create a notification channel of type Pub/Sub

Answer

Enable VPC flow logs for the endpoint

Question 3

A site reliability engineer needs to be notified immediately when the error rate of a production microservice exceeds 5% over a 5-minute window. Which type of alerting policy should be used?

Accepted Answer

Metric threshold alert. A metric threshold alert is the correct choice because it triggers when a specific metric (error rate) crosses a defined threshold (5%) over a specified time window (5 minutes). This type of alerting policy is designed for monitoring numeric metrics and firing alerts based on conditions, making it ideal for this requirement.

Answer

Uptime check alert

Answer

Pub/Sub notification hook

Answer

Log-based alert (log metric trigger)

Question 4

You want to monitor the uptime of an external HTTP endpoint every minute and receive an email notification if the endpoint is unavailable for more than two consecutive checks. What should you do?

Accepted Answer

Create an uptime check in Cloud Monitoring, then create an alerting policy with condition 'metric threshold' for 'check_failed' and set notification channel to email. Cloud Monitoring uptime checks are purpose-built to probe external HTTP/HTTPS/TCP endpoints on a schedule (as frequent as once per minute), and alerting policies can trigger on the 'check_failed' metric with a threshold and duration that maps to 'two consecutive failures.' Email notification channels are natively supported, making this the correct, managed solution without custom code.

Answer

Create a log-based alert in Cloud Logging that triggers on network errors

Answer

Use Cloud Functions to periodically call the endpoint and send an email on failure

Answer

Configure a TCP health check on the load balancer

Question 5

A company wants to run a stateful application on Compute Engine with persistent storage that can be attached to another instance in case of failure. Which storage option should they use?

Accepted Answer

Persistent Disk. Persistent Disk is the correct choice because it provides durable, block storage that can be attached to Compute Engine instances and detached and reattached to another instance in case of failure. This makes it suitable for stateful applications requiring persistent storage that can survive instance failures.

Answer

Filestore

Answer

Cloud Storage bucket

Answer

Local SSD

Question 6

An organization uses Organization Policies to restrict the use of certain IAM roles. The security team wants to audit all modifications to IAM policies across the organization, including at the project level. Which log type should be enabled and analyzed?

Accepted Answer

Admin Activity audit logs. Admin Activity audit logs record all API calls or other actions that modify the configuration or metadata of resources, including IAM policy changes. They are enabled by default and cannot be disabled. To audit modifications to IAM policies at the organization and project level, Admin Activity logs are the correct choice.

Answer

System Event audit logs

Answer

Data Access audit logs (READ)

Answer

Data Access audit logs (WRITE)

Question 7

You are deploying a GKE cluster with node autoscaling enabled. The cluster runs batch jobs that are sensitive to startup latency. You notice that during scale-up, new nodes take several minutes to become ready. Which action can reduce the time it takes for new nodes to join the cluster?

Accepted Answer

Use a custom image with pre-installed dependencies. Using a custom image with pre-installed dependencies reduces the time new nodes spend pulling and installing container images or configuring software after the node boots. By baking dependencies into the node image, the node can join the cluster and start running workloads faster, directly addressing the startup latency issue for batch jobs.

Answer

Increase the initial node pool size

Answer

Set the --max-nodes-per-pool flag to a higher value

Answer

Enable cluster autoscaler with --enable-autorepair

Question 8

You create a new Google Cloud project using the Cloud Console. After creating the project, you need to enable the Compute Engine API. What is the correct command to do this using the Cloud Shell?

Accepted Answer

gcloud services enable compute.googleapis.com. The correct command to enable an API in a Google Cloud project is 'gcloud services enable <API_NAME>'. For Compute Engine, the API name is compute.googleapis.com, so the full command is 'gcloud services enable compute.googleapis.com'. This uses the Service Usage API under the hood to enable the specified service for the active project.

Answer

gcloud projects enable compute.googleapis.com

Answer

gcloud compute enable compute.googleapis.com

Answer

gcloud api enable compute

Question 9

You have a Compute Engine VM that is running a critical application. You need to change its machine type from n1-standard-4 to n2-standard-8. What is the correct procedure?

Accepted Answer

Stop the instance, then use gcloud compute instances set-machine-type, then start the instance. To change the machine type of a running Compute Engine VM, you must stop the instance, use the set-machine-type command (or console) to change the machine type, and then start the instance. This is because the machine type determines the virtual hardware, and changing it requires the instance to be stopped.

Answer

Use gcloud compute instances update --machine-type n2-standard-8 while the instance is running

Answer

Delete the instance and create a new one with the desired machine type

Answer

Use gcloud compute instances resize --machine-type n2-standard-8 without stopping

Question 10

You need to be notified when the CPU utilization of any Compute Engine instance in your project exceeds 80% for 5 minutes. Which Cloud Monitoring feature should you use?

Accepted Answer

Metric threshold alerting policy. Metric threshold alerting policies in Cloud Monitoring evaluate time-series data (such as compute.googleapis.com/instance/cpu/utilization) against a threshold condition over a defined duration. To alert when CPU exceeds 80% for 5 minutes, you create an alerting policy with a threshold condition on the CPU utilization metric and set the duration window to 5 minutes. This is the native mechanism for firing notifications based on metric values crossing thresholds.

Answer

Uptime check

Answer

Log-based alert

Answer

Dashboard

Question 11

You need to drain a GKE node for maintenance. The node is running a DaemonSet and some pods with emptyDir volumes. Which kubectl command should you use to safely drain the node without causing errors?

Accepted Answer

kubectl drain node-name --ignore-daemonsets --delete-emptydir-data. The correct drain command must account for both DaemonSet-managed pods (which cannot be evicted and require --ignore-daemonsets) and pods using emptyDir volumes (which hold local data and require --delete-emptydir-data to allow eviction). Combining both flags lets kubectl drain the node without erroring on these two conditions.

Answer

kubectl drain node-name --force

Answer

kubectl drain node-name --ignore-daemonsets

Answer

kubectl cordon node-name && kubectl delete pods --all --grace-period=0

Question 12

Which Google Cloud service is a fully managed, serverless data warehouse for analytics at petabyte scale, with built-in machine learning capabilities and automatic scaling?

Accepted Answer

BigQuery. BigQuery is Google Cloud's fully managed, serverless data warehouse designed for petabyte-scale analytics. It offers built-in machine learning through BigQuery ML and automatically scales compute and storage resources without manual intervention. This makes it the correct choice for analytics at scale with ML capabilities.

Answer

Cloud Storage

Answer

Dataproc

Answer

Cloud SQL

Question 13

A developer wants to store a database password securely and make it accessible to a Compute Engine instance. Which Google Cloud service should be used?

Accepted Answer

Secret Manager. Secret Manager is Google Cloud's dedicated service for storing, managing, and accessing sensitive data such as API keys, passwords, and certificates. It provides versioning, IAM-based access control, audit logging, and automatic encryption. Applications on Compute Engine can retrieve secrets via the Secret Manager API using their attached service account.

Answer

Cloud Storage

Answer

Cloud Filestore

Answer

Cloud KMS

Question 14

A company has a Cloud SQL instance with CMEK enabled. The Cloud KMS key used for encryption is accidentally disabled. What is the impact on the Cloud SQL instance?

Accepted Answer

The instance becomes unavailable and cannot be started until the key is re-enabled.. When a Cloud KMS key used for CMEK is disabled, the Cloud SQL instance cannot access the key to decrypt its data. As a result, the instance becomes unavailable and cannot be started until the key is re-enabled. This is because the instance requires the key for both read and write operations.

Answer

The instance will be automatically deleted after 30 days.

Answer

A read replica can be promoted to replace the primary.

Answer

The instance continues to operate normally, but new data cannot be encrypted.

Question 15

An organization needs to audit all data access (read/write) to a Cloud Storage bucket for compliance. Which type of audit log should they enable?

Accepted Answer

Data Access audit logs. Data Access audit logs record read and write operations on user data, including Cloud Storage object reads (e.g., storage.objects.get) and writes (e.g., storage.objects.create). They are specifically designed for auditing data access, unlike Admin Activity logs which capture configuration changes. Therefore, to audit all data access to a bucket, Data Access audit logs must be enabled.

Answer

System Event audit logs

Answer

Access Transparency logs

Answer

Admin Activity audit logs