Google ACE Practice Test 45 — 15 Questions

Question 1

A company wants to allow developers to create and manage secrets in Secret Manager, but prevent them from viewing secret values. Which TWO predefined roles should be combined to achieve this?

Accepted Answer

roles/secretmanager.secretManager. The roles/secretmanager.admin role includes permissions to create and manage secrets but not to access secret versions (i.e., view values). However, it includes the permission to access versions. Actually, the admin role includes secretmanager.versions.access, so it can view values. To separate manage from view, you need roles/secretmanager.secretVersionManager (manage versions without access) and roles/secretmanager.secretManager (manage secrets). Wait, the correct combination is roles/secretmanager.secretVersionManager (create/disable/destroy versions) and roles/secretmanager.secretManager (create/update/delete secrets). Neither includes secretmanager.versions.access. The roles/secretmanager.viewer allows viewing metadata but not values. The roles/secretmanager.secretAccessor allows accessing versions. To manage without viewing, combine roles that exclude access. Check accurate roles: roles/secretmanager.admin includes all permissions including access. roles/secretmanager.secretManager includes manage secrets but not access versions? Let's verify: roles/secretmanager.secretManager has permissions: secretmanager.secrets.create, secretmanager.secrets.delete, secretmanager.secrets.get, secretmanager.secrets.update, secretmanager.secrets.list. It does NOT include secretmanager.versions.access. roles/secretmanager.secretVersionManager has permissions: secretmanager.versions.create, secretmanager.versions.disable, secretmanager.versions.destroy, secretmanager.versions.enable, secretmanager.versions.get, secretmanager.versions.list. It does NOT include secretmanager.versions.access. So combining these two roles allows managing secrets and versions but not accessing the payload. roles/secretmanager.viewer allows viewing metadata but not accessing payload. roles/secretmanager.secretAccessor allows accessing payload. So the correct two are secretManager and secretVersionManager.

Answer

roles/secretmanager.admin

Answer

roles/secretmanager.secretAccessor

Answer

roles/secretmanager.viewer

Question 2

A developer wants to automate the creation of a service account and assign it a role using the gcloud command-line tool. Which TWO commands are needed? (Choose 2 answers.)

Accepted Answer

gcloud projects add-iam-policy-binding. First, you create the service account with `gcloud iam service-accounts create`. Then, you grant a role to the service account by adding an IAM policy binding to the project.

Answer

gcloud iam service-accounts keys create

Answer

gcloud projects set-iam-policy

Answer

gcloud iam roles create

Question 3

A company needs to audit all actions that modify a Cloud Storage bucket. Which TWO steps should they take to enable this? (Choose 2 answers.)

Accepted Answer

Use Log Explorer to filter logs by the Cloud Storage service and the 'data_access' log type.. To audit data access modifications, you need to enable Data Access audit logs for the storage service and then view those logs in Log Explorer. Admin Activity logs record configuration changes (like creating a bucket), but data modifications (like uploading objects) require Data Access logs.

Answer

Create a VPC Service Controls perimeter.

Answer

Enable Admin Activity audit logs for the Cloud Storage service.

Answer

Assign the roles/logging.viewer role to the security team.

Question 4

A security team wants to restrict access to a Cloud Storage bucket so that only objects encrypted with a specific CMEK key can be uploaded. Which three actions are needed? (Choose 3)

Accepted Answer

Grant authorized users the roles/cloudkms.cryptoKeyEncrypterDecrypter role.. Setting the CMEK key on the bucket, creating a bucket-level policy denying uploads without the key, and granting the encrypt/decrypt role to users are required.

Answer

Grant all users the roles/cloudkms.cryptoKeyEncrypterDecrypter role.

Answer

Enable Uniform Bucket-Level Access.

Question 5

A company uses Cloud DNS for internal DNS resolution. They recently added a new VPC and need to ensure that instances in this VPC can resolve private DNS names that are hosted in another project. What must be configured?

Accepted Answer

Set up a DNS peering zone between the new VPC and the VPC that hosts the private zone.. Cloud DNS peering allows a VPC in one project to resolve private DNS names hosted in a private zone in another project without requiring the zones to be shared or exported. DNS peering establishes a direct query path between the peered VPCs, enabling the new VPC to resolve names in the private zone as if they were local, while the zone remains private and managed in its original project.

Answer

Use Cloud DNS inbound server policy to forward queries to the other VPC.

Answer

Export the private zone as a public zone and create a delegation.

Answer

Create a Private DNS zone in the new project with forwarding to the on-premises DNS.

Question 6

A startup runs its application entirely on Cloud Run. They want to use a custom domain (api.mycompany.com) instead of the default Cloud Run URL. Which GCP feature maps a custom domain to a Cloud Run service?

Accepted Answer

Cloud Run Domain Mappings or a Global Load Balancer with a Serverless NEG. Cloud Run Domain Mappings provide a native, managed way to map a custom domain to a Cloud Run service without additional infrastructure. Alternatively, a Global Load Balancer with a Serverless NEG (Network Endpoint Group) can also route traffic from a custom domain to Cloud Run, offering advanced features like SSL termination and traffic splitting. Both approaches are officially supported by Google Cloud for custom domain mapping.

Answer

Cloud DNS — create a CNAME record pointing to the Cloud Run URL

Answer

Cloud Endpoints with an API gateway configuration

Answer

Firebase Hosting rewrites to Cloud Run

Question 7

Your application exposes a REST API that external partners consume. You need rate limiting per partner (API key), usage analytics, and developer portal for onboarding. Traffic is currently 1,000 requests/day but expected to grow to 10M/day within a year. Which GCP service best fits these requirements?

Accepted Answer

Apigee API Management. Apigee API Management is correct because it provides built-in rate limiting per API key (via quota policies), detailed analytics dashboards for usage tracking, and a developer portal for partner onboarding and key management. Unlike simpler API gateways, Apigee is designed for enterprise-grade API management at scale, handling growth from 1,000 to 10M requests/day with features like monetization, traffic management, and security policies.

Answer

Cloud Endpoints with Extensible Service Proxy

Answer

Cloud Armor with rate limiting rules

Answer

API Gateway with a backend Cloud Run service

Question 8

A company wants to migrate a monolithic application to Google Cloud with minimal changes to the application code. Which compute option is most suitable?

Accepted Answer

Compute Engine. Compute Engine (C) is the most suitable option because it provides Infrastructure as a Service (IaaS) virtual machines that can run the monolithic application with minimal code changes. The application can be migrated by simply lifting and shifting the existing VM or container image to a Compute Engine instance, preserving the OS, runtime, and dependencies without refactoring.

Answer

Google Kubernetes Engine

Answer

App Engine (Flexible Environment)

Answer

Cloud Functions

Question 9

Microservices in a GKE cluster need to discover each other by name without using public DNS. Service A calls Service B at `http://service-b.production.svc.cluster.local`. Which GCP/Kubernetes feature provides this internal DNS resolution?

Accepted Answer

Kubernetes cluster DNS (CoreDNS) resolving Service names within the cluster. Kubernetes cluster DNS, typically implemented by CoreDNS, is the built-in mechanism that resolves Service names like `service-b.production.svc.cluster.local` to the corresponding ClusterIP. This allows Pods to discover each other by name without relying on external or public DNS. CoreDNS runs as a Deployment in the kube-system namespace and automatically creates DNS records for every Service based on its name and namespace.

Answer

Cloud DNS private zone configured for the cluster's namespace

Answer

Anthos Service Mesh — required for service-to-service DNS

Answer

A custom /etc/hosts entry on each Pod

Question 10

A developer deployed a new version of a Compute Engine instance but the startup script fails to run. The developer needs to debug the startup script. Which step should be taken first?

Accepted Answer

Review the serial port 1 output in the Google Cloud console.. Serial port 1 output in the Google Cloud console captures the instance's serial console logs, including startup script execution output and any errors. This is the first and most direct step to debug a failing startup script because it shows the script's stdout, stderr, and any system messages during boot, without requiring network access or additional tools.

Answer

RDP into the instance and check the system logs.

Answer

Check the instance's metadata for startup script errors.

Answer

Recreate the instance with a new image.

Question 11

Your company uses BigQuery for analytics. Users frequently run queries against a large, date-partitioned table containing sales data. The table has 10 TB of data and is partitioned by the 'order_date' column. Queries often filter on the 'customer_id' and 'region' columns in addition to the date range. You observe that queries are slow and expensive, even when scanning only a few partitions. Which optimization should you implement first?

Accepted Answer

Enable clustering on the 'customer_id' and 'region' columns.. Clustering on 'customer_id' and 'region' organizes the data within each partition based on these filter columns, allowing BigQuery to perform block-level pruning and skip irrelevant data even when scanning only a few partitions. This directly addresses the slowness and cost by reducing the amount of data read per query, without requiring additional storage or maintenance overhead.

Answer

Create materialized views for common queries.

Answer

Create views for each combination of filters.

Answer

Change partitioning to use ingestion time instead of 'order_date'.

Question 12

A network team is creating a new VPC and must decide between auto mode and custom mode. Why would they choose custom mode?

Accepted Answer

Custom mode allows full control over which regions have subnets and what CIDR ranges are used. Custom mode VPCs give the network team full control over the IP address range (CIDR block) and the ability to create subnets in any region, unlike auto mode VPCs which automatically create subnets in every region with a fixed /20 range per region. This is essential when you need to avoid overlapping CIDRs with on-premises networks or other VPCs, or when you want to restrict subnets to specific regions for compliance or cost reasons.

Answer

Auto mode VPCs cost more per subnet than custom mode

Answer

Auto mode VPCs cannot be used with GKE clusters

Answer

Custom mode VPCs support more IP addresses per subnet than auto mode

Question 13

Which service should be used to manage billing budgets and alerts?

Accepted Answer

Cloud Billing Budgets. Cloud Billing Budgets is the correct service because it is specifically designed to allow you to set spending limits (budgets) on your Google Cloud projects, billing accounts, or folders, and to configure alerts (e.g., email notifications or Pub/Sub messages) when actual or forecasted costs exceed those thresholds. This directly addresses the requirement to manage billing budgets and alerts, whereas other services focus on monitoring infrastructure performance or logging operational data.

Answer

Cloud Monitoring

Answer

Cloud Billing Reports

Answer

Cloud Logging

Question 14

Your Cloud SQL for MySQL primary instance in `us-central1` has failed. Cloud SQL HA automatically fails over to the standby. After the failover, your application is experiencing intermittent connection errors. What is the most likely cause and solution?

Accepted Answer

Application connection pools hold stale connections to the failed primary; configure pools to validate connections and reconnect after failure.. After a Cloud SQL HA failover, the standby instance becomes the new primary with the same IP address, but existing application connections that were established to the old primary are now broken. Connection pools that do not validate connections before reuse will attempt to use these stale connections, causing intermittent errors. Configuring the pool to test connections (e.g., via `SELECT 1` or JDBC `connectionTestQuery`) and automatically reconnect resolves this by discarding dead connections and establishing fresh ones to the new primary.

Answer

The standby instance has a different IP address; update the connection string.

Answer

The standby replica must be manually promoted before it can accept connections.

Answer

The MySQL binary log is incomplete after failover; run `mysqlcheck` to repair tables.

Question 15

You notice that your Cloud SQL for PostgreSQL instance's `pg_stat_activity` shows many connections in `idle in transaction` state, and the connection count is near the max_connections limit. Application threads are blocking waiting for connections. What is the most effective solution to manage database connections for a GKE-hosted application?

Accepted Answer

Deploy PgBouncer as a sidecar or deployment to pool connections to Cloud SQL in transaction mode.. PgBouncer is a lightweight connection pooler that can be deployed as a sidecar or separate deployment in GKE to manage connections to Cloud SQL for PostgreSQL. By operating in transaction mode, it holds database connections only for the duration of a transaction, not for the entire client session, which drastically reduces the number of concurrent connections to the database. This directly addresses the `idle in transaction` connections and the near-max_connections issue without requiring application code changes.

Answer

Increase `max_connections` in the Cloud SQL PostgreSQL instance flags.

Answer

Switch from Cloud SQL to Cloud Spanner, which has no connection limits.

Answer

Restart the Cloud SQL instance to clear idle connections.