Google ACE Practice Test 46 — 15 Questions

Question 1

A team wants to automatically restart any GKE Pod that fails a liveness probe three consecutive times. The probe should check HTTP GET /healthz on port 8080, starting after 30 seconds and checking every 10 seconds. Which Pod spec configuration implements this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

livenessProbe: httpGet: path: /healthz port: 8080 initialDelaySeconds: 30 periodSeconds: 10 failureThreshold: 3. A livenessProbe with an HTTP GET on /healthz at port 8080, configured with initialDelaySeconds: 30, periodSeconds: 10, and failureThreshold: 3, will cause the kubelet to restart the Pod after three consecutive failed checks. This directly matches the requirement to restart on liveness probe failures, as liveness probes are specifically designed to determine if a container should be restarted.

Answer

readinessProbe: httpGet: path: /healthz port: 8080 initialDelaySeconds: 30 periodSeconds: 10 failureThreshold: 3

Answer

startupProbe: httpGet: path: /healthz port: 8080 failureThreshold: 3

Answer

lifecycle: postStart: httpGet: path: /healthz port: 8080

Question 2

A developer runs `gcloud projects list` and receives the error: `ERROR: (gcloud.projects.list) PERMISSION_DENIED: The caller does not have permission`. The developer has the Viewer role on several projects. What is the most likely cause?

Accepted Answer

The developer lacks `resourcemanager.projects.list` at the organization or folder level.. The `gcloud projects list` command requires the `resourcemanager.projects.list` permission, which is granted at the organization or folder level, not at the individual project level. Even with the Viewer role on several projects, the developer lacks this specific permission at the resource hierarchy level above the projects, causing the PERMISSION_DENIED error.

Answer

The developer does not have multi-factor authentication enabled.

Answer

The gcloud SDK is outdated and must be updated.

Answer

The developer's account has been suspended by the billing administrator.

Question 3

A developer accidentally exposed their gcloud application default credentials (ADC) file. They need to immediately revoke these credentials. Which command revokes the active application default credentials?

Accepted Answer

gcloud auth application-default revoke. `gcloud auth application-default revoke` is the specific command designed to revoke the Application Default Credentials (ADC) that were set via `gcloud auth application-default login`. This command invalidates the OAuth 2.0 refresh token stored in the ADC file, ensuring the credentials can no longer be used for authentication to Google Cloud APIs.

Answer

gcloud auth revoke [ACCOUNT_EMAIL]

Answer

Delete the ~/.config/gcloud/application_default_credentials.json file manually

Answer

gcloud config unset auth/application_default_credentials

Question 4

Your application runs on Compute Engine instances behind a regional external HTTP(S) load balancer. Users report intermittent timeouts during periods of high traffic. Health checks show all instances as healthy. Which two configuration parameters should you review first?

Accepted Answer

Review connection draining and session affinity settings. B is correct because connection draining (drain mode) and session affinity settings directly affect how the load balancer handles in-flight requests and distributes traffic during high load. Connection draining ensures existing connections complete before an instance is removed, preventing abrupt timeouts. Session affinity (sticky sessions) can cause uneven traffic distribution if misconfigured, leading to overloaded instances and intermittent timeouts even when health checks pass.

Answer

Check SSL certificate expiration

Answer

Increase instance machine type (size)

Answer

Enable Cloud CDN

Question 5

A developer reports that a Cloud Function is failing with '403 Forbidden' when calling the BigQuery API. The function's service account has the BigQuery Data Viewer role. What is a likely additional requirement that may be missing?

Accepted Answer

The BigQuery API may not be enabled in the Cloud Functions' project. The 403 Forbidden error indicates that the Cloud Function's service account lacks the necessary permissions to call the BigQuery API. Even with the correct IAM role (BigQuery Data Viewer), the BigQuery API must be explicitly enabled in the project where the Cloud Function is running, as Google Cloud requires APIs to be activated per project before they can be used. Without enabling the API, any API call from the function will be rejected with a 403, regardless of IAM roles.

Answer

The Cloud Function must be deployed in the same region as the BigQuery dataset

Answer

Cloud Functions cannot call BigQuery — it must use Dataflow or BigQuery scheduled queries instead

Answer

The service account needs the BigQuery Admin role instead of Data Viewer to make API calls

Question 6

A developer creates a Cloud Storage bucket and sets a uniform bucket-level access policy. What is the implication?

Accepted Answer

Object ACLs are disabled. When uniform bucket-level access is enabled on a Cloud Storage bucket, all access control is managed exclusively through IAM policies at the bucket level. Object ACLs are disabled, meaning individual object permissions cannot be set or evaluated. This ensures consistent access control across all objects in the bucket.

Answer

Only object ACLs are used

Answer

Bucket permissions override object ACLs

Answer

Both bucket IAM and object ACLs are used

Question 7

An organization is deploying a stateful application on Google Kubernetes Engine (GKE). The application requires persistent storage with high read/write performance and must be available across multiple zones for disaster recovery. Which storage solution should they use?

Accepted Answer

Regional persistent disk. Regional persistent disks provide synchronous replication across two zones in the same region, ensuring data availability during a zonal failure. They offer high read/write performance suitable for stateful applications and can be attached to GKE pods via PersistentVolumeClaims, meeting the requirement for multi-zone disaster recovery.

Answer

Cloud Filestore

Answer

Local SSD

Answer

Zonal persistent disk

Question 8

You need to allow a Cloud Function to write logs to Cloud Logging. The function uses a default service account. What IAM role should you grant to the service account?

Accepted Answer

roles/logging.logWriter. The Cloud Function's default service account needs the `roles/logging.logWriter` role to write logs to Cloud Logging. This role grants the `logging.logEntries.create` permission, which is the minimum required for writing log entries. Without it, the function cannot send logs to Logging, even though it may have other permissions.

Answer

roles/cloudfunctions.serviceAgent

Answer

roles/logging.admin

Answer

roles/logging.viewer

Question 9

A developer wants to deploy a containerized web application that can scale to zero when not in use, and only pay for request processing time. Which compute service should they choose?

Accepted Answer

Cloud Run. Cloud Run is the correct choice because it is a managed compute platform that runs containerized applications in a serverless environment, automatically scaling to zero when there are no requests and charging only for the resources used during request processing (billed in 100-millisecond increments). This matches the requirement for a containerized web app that scales to zero and has pay-per-use pricing.

Answer

App Engine Flexible Environment

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE)

Question 10

A GKE application Pod needs a sidecar container that proxies all outbound network requests through an audit logger before they reach the internet. Both containers share the same network namespace. Which Kubernetes pattern implements this?

Accepted Answer

Add the audit logger as a second container in the same Pod spec (sidecar pattern). The sidecar pattern allows two containers to share the same network namespace within a single Pod, enabling the audit logger to intercept all outbound traffic from the application container before it reaches the internet. This is achieved by configuring the application container to route its outbound requests through the sidecar (e.g., via a localhost proxy or iptables rules), ensuring all traffic is logged without external network hops.

Answer

Run the audit logger as a separate Deployment and route traffic via a Service

Answer

Use a DaemonSet for the audit logger on each node to intercept node-level traffic

Answer

Add an initContainer to start the audit logger before the main application

Question 11

A company runs a batch job on Compute Engine that processes large files from Cloud Storage. The job is taking longer than expected. The instances are using standard persistent disks. Which change would most likely improve I/O performance?

Accepted Answer

Replace standard persistent disks with SSD persistent disks.. Standard persistent disks (pd-standard) are backed by HDDs and have lower IOPS and throughput compared to SSD persistent disks (pd-ssd). Since the batch job processes large files from Cloud Storage, the bottleneck is likely disk I/O performance. Upgrading to SSD persistent disks provides higher IOPS and throughput, directly improving I/O performance for read/write operations.

Answer

Use regional persistent disks instead of zonal.

Answer

Increase the machine type to have more vCPUs.

Answer

Add local SSDs to the instances.

Question 12

A company wants to deploy a new version of their application with zero downtime. They are using a managed instance group (MIG) behind a load balancer. Which deployment method should they use?

Accepted Answer

Perform a rolling update using a new instance template, with a health check. A rolling update using a new instance template allows the managed instance group (MIG) to gradually replace instances with the new version while health checks ensure each new instance is healthy before proceeding. This maintains the desired capacity and avoids downtime, as the load balancer automatically directs traffic only to healthy instances throughout the process.

Answer

Create a new MIG, then update the load balancer's backend service

Answer

Delete the current MIG and create a new one with the updated template

Answer

Update the instance template and restart all instances

Question 13

A team is deploying a Cloud Function that requires a private environment variable containing an API key. They want the key stored securely and automatically injected at runtime. Which approach follows GCP best practices?

Accepted Answer

Store the key in Secret Manager and reference it as a secret environment variable in the function deployment. Secret Manager is the GCP-native service designed to securely store API keys and other sensitive data. By referencing a secret as an environment variable in the Cloud Function deployment configuration, the key is automatically decrypted and injected at runtime without exposing it in source code or configuration files. This follows the principle of least privilege and ensures the secret is encrypted at rest and in transit.

Answer

Hardcode the API key in the function source code

Answer

Pass the API key as a plain-text environment variable in the function configuration

Answer

Store the API key in a Cloud Storage bucket and download it at function startup

Question 14

Your organization uses VPC Service Controls to protect BigQuery and Cloud Storage. A data pipeline service account needs to read from a protected Cloud Storage bucket and write results to a protected BigQuery dataset. Both resources are in the same perimeter. The service account is outside the perimeter (it runs in a Cloud Run service in a different project). How do you grant the pipeline access?

Accepted Answer

Create an Ingress Rule in the VPC-SC perimeter that allows the service account from the external project to access the specific BigQuery and Storage resources.. VPC Service Controls (VPC-SC) allow you to define ingress rules that grant access to protected resources from identities outside the perimeter. In this scenario, the service account running in Cloud Run is outside the perimeter, so an ingress rule must explicitly permit that service account to access the specific BigQuery dataset and Cloud Storage bucket. This approach maintains the security boundary while enabling the required data pipeline access.

Answer

Add the Cloud Run project to the VPC Service Controls perimeter.

Answer

Grant the service account `roles/bigquery.admin` and `roles/storage.admin` to bypass the perimeter restrictions.

Answer

Move the Cloud Run service into a VPC and set up VPC peering to the perimeter VPC.

Question 15

You are managing Terraform state for a GCP infrastructure project shared by a team of 5 engineers. You need to prevent simultaneous `terraform apply` operations from causing state corruption. What is the recommended backend configuration?

Accepted Answer

Configure the `gcs` backend in Terraform, pointing to a Cloud Storage bucket with versioning enabled.. The `gcs` backend with versioning enabled provides both remote state storage and built-in state locking via Cloud Storage's object-level consistency model. When one engineer runs `terraform apply`, the backend acquires a lock by writing a lock file to the bucket; other concurrent operations are blocked until the lock is released, preventing state corruption. Versioning further protects against accidental state deletion or corruption by allowing rollback to previous state versions.

Answer

Store state locally on each engineer's machine and merge state files manually after each apply.

Answer

Use Terraform Cloud (HashiCorp) as the backend for state locking.

Answer

Use a Cloud Source Repository to store state files with branch-based locking.