Google ACE Practice Test 46 — 15 Questions

Question 1

You are managing a project and need to create a custom IAM role that allows only the permissions compute.instances.list and compute.instances.get. What is the correct way to create this role using gcloud?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

gcloud iam roles create viewer --project=my-project --permissions="compute.instances.list,compute.instances.get". The correct command to create a custom IAM role with specific permissions is 'gcloud iam roles create' with the --project flag and a comma-separated list of permissions. This creates a project-level custom role with exactly the permissions specified. The syntax matches the gcloud iam roles create command structure.

Answer

gcloud iam service-accounts create viewer --permissions="compute.instances.list,compute.instances.get"

Answer

gcloud iam roles create viewer --organization=123456 --permissions="compute.instances.*"

Answer

gcloud iam custom-roles create viewer --project=my-project --permissions='compute.instances.list,compute.instances.get'

Question 2

A developer needs to create a Compute Engine VM with 4 vCPUs, 15 GB of memory, and a Debian 10 boot disk. Which gcloud compute instances create command is correct?

Accepted Answer

gcloud compute instances create my-vm --machine-type=n1-standard-4 --image-family=debian-10 --image-project=debian-cloud. The `n1-standard-4` machine type provides exactly 4 vCPUs and 15 GB of memory, matching the requirement. Combined with `--image-family=debian-10` and `--image-project=debian-cloud`, this command creates a Debian 10 VM with the correct specs. The `n1-standard` family is the general-purpose line with a 1:3.75 vCPU-to-memory ratio.

Answer

gcloud compute instances create my-vm --machine-type=n1-highmem-4 --image-family=debian-10 --image-project=debian-cloud

Answer

gcloud compute instances create my-vm --machine-type=n1-standard-4 --image-family=ubuntu-1804 --image-project=ubuntu-os-cloud

Answer

gcloud compute instances create my-vm --machine-type=n1-standard-4

Question 3

A user wants to estimate the monthly cost of running a Compute Engine VM with 8 vCPUs, 32 GB of memory, and a 100 GB persistent disk in us-central1 for one year. They plan to use the VM 24/7. Which tool should they use?

Accepted Answer

Google Cloud Pricing Calculator. The Google Cloud Pricing Calculator is the official tool for estimating future costs of GCP resources before deployment. It lets you configure VM machine type, region, disk size, and committed-use or sustained-use discounts to produce a monthly and yearly estimate. Cloud Billing reports, by contrast, show historical actual spend, not projections.

Answer

Cloud Asset Inventory

Answer

Cloud Billing reports

Answer

Cloud Monitoring

Question 4

A developer wants to use gcloud CLI with application default credentials (ADC) to authenticate to Google APIs from their local machine. Which command should they run first?

Accepted Answer

gcloud auth application-default login. Application Default Credentials (ADC) are separate from the user credentials stored by 'gcloud auth login'. To set up ADC for local development, the developer must run 'gcloud auth application-default login', which writes credentials to a well-known location (e.g., ~/.config/gcloud/application_default_credentials.json) that client libraries automatically discover. This is the first step required before using ADC with Google APIs locally.

Answer

gcloud auth login

Answer

gcloud init

Answer

gcloud config set auth/application_default true

Question 5

A developer is using Cloud Shell and wants to ensure that their gcloud configuration persists after the Cloud Shell session ends. They have set the compute and access settings using `gcloud config set`. What should they do to keep these settings for future sessions?

Accepted Answer

The settings are automatically preserved because Cloud Shell's home directory persists. Cloud Shell provides a persistent $HOME directory backed by a 5 GB persistent disk that survives across sessions. Because gcloud configuration is stored in $HOME/.config/gcloud, any `gcloud config set` changes are written there and automatically restored when the user reconnects. No additional action is required.

Answer

They need to create a startup script to apply the settings each time

Answer

They must run `gcloud config configurations save default` before ending the session

Answer

They must use `gcloud config set --persist` flag

Question 6

Your application uses Pub/Sub to process orders. You notice that the subscription backlog is growing. Which tool should you use to analyze the latency of each step in the processing pipeline?

Accepted Answer

Cloud Trace. Cloud Trace is designed to analyze latency and performance of distributed applications, including Pub/Sub processing pipelines. It provides detailed trace data showing the time taken by each step, helping identify bottlenecks. Cloud Monitoring provides metrics but not per-step latency breakdown, while Cloud Profiler is for code-level profiling and Cloud Logging for log analysis.

Answer

Cloud Monitoring

Answer

Cloud Profiler

Answer

Cloud Logging

Question 7

You have a Cloud Run service that you want to update to use a new container image. You also want to keep the previous revision available in case you need to roll back. Which command should you use?

Accepted Answer

gcloud run deploy my-service --image gcr.io/my-project/my-app:v2. The command 'gcloud run deploy my-service --image gcr.io/my-project/my-app:v2' deploys a new revision of the Cloud Run service using the specified container image. By default, Cloud Run keeps previous revisions, allowing rollback. This is the standard and correct way to update a service.

Answer

gcloud run revisions update my-service --image gcr.io/my-project/my-app:v2

Answer

gcloud run services update --image gcr.io/my-project/my-app:v2

Answer

kubectl set image service/my-service my-app=gcr.io/my-project/my-app:v2

Question 8

A company wants to deploy a containerized application on Cloud Run that is built from source code in a local directory. They want Cloud Run to automatically build the container image using Cloud Build. Which command should be used?

Accepted Answer

gcloud run deploy my-service --source . --region us-central1. The command gcloud run deploy my-service --source . --region us-central1 uses the --source flag to indicate that Cloud Run should build the container image from the local source code using Cloud Build, then deploy it. This is the correct way to deploy from source.

Answer

gcloud app deploy --source .

Answer

gcloud run deploy my-service --image . --region us-central1

Answer

gcloud builds submit --tag gcr.io/my-project/my-image . && gcloud run deploy my-service --image gcr.io/my-project/my-image

Question 9

A company wants to deploy a microservice on GKE. The deployment requires 3 replicas, and the service must be accessible via a fixed public IP address. Which Kubernetes resource should be used to expose the deployment?

Accepted Answer

Service of type LoadBalancer. A Kubernetes Service of type LoadBalancer provisions a cloud provider load balancer with an external IP that routes to the pods backing the deployment. On GKE, this creates a Google Cloud external passthrough Network Load Balancer with a stable public IP, which matches the fixed public IP requirement.

Answer

Ingress resource

Answer

Service of type ClusterIP

Answer

Service of type NodePort

Question 10

You are using Cloud Run and want to split traffic so that 10% of requests go to revision v2 and 90% go to revision v1. Which command should you use?

Accepted Answer

gcloud run services update-traffic --to-revisions v1=90,v2=10. The correct command to split traffic between Cloud Run revisions is `gcloud run services update-traffic` with the `--to-revisions` flag, specifying the revision names and percentages. This command updates the traffic allocation for a service. The syntax `--to-revisions v1=90,v2=10` correctly assigns 90% to v1 and 10% to v2.

Answer

gcloud run deploy --image my-image --traffic v1=90,v2=10

Answer

gcloud run services update --traffic v1=90,v2=10

Answer

gcloud run revisions update v2 --traffic 10

Question 11

An organization wants to use Cloud Storage to host a static website. The bucket name must match the domain name. They already own the domain 'example.com' and want to serve the site from 'www.example.com'. Which bucket name should they create?

Accepted Answer

www.example.com. For Cloud Storage static website hosting, the bucket name must exactly match the domain used to serve the site. Since the site will be served from 'www.example.com', the bucket must be named 'www.example.com'. GCS requires globally unique bucket names, and the CNAME/A record for the domain must point to the bucket.

Answer

example.com

Answer

www_example_com

Answer

example-com-bucket

Question 12

A Cloud Run service named 'my-service' is currently serving 100% traffic to revision 'rev1'. You deploy a new revision 'rev2' and want to gradually shift traffic so that rev2 receives 10% of requests. Which command should you use?

Accepted Answer

gcloud run services update-traffic my-service --to-revisions=rev2=10,rev1=90. `gcloud run services update-traffic` is the dedicated command for changing traffic allocation between revisions, and the `--to-revisions=rev2=10,rev1=90` syntax assigns 10% to rev2 and 90% to rev1. This performs a gradual traffic shift without redeploying the service. It is the correct way to implement a canary or gradual rollout on Cloud Run.

Answer

gcloud run services update my-service --traffic=rev2=10%

Answer

gcloud run deploy my-service --image=... --traffic=rev2=10

Answer

gcloud run revisions update rev2 --traffic=10

Question 13

What is the primary benefit of using a Google-managed SSL certificate for an HTTPS Load Balancer?

Accepted Answer

It automatically renews the certificate before expiration.. Google-managed SSL certificates are provisioned and renewed automatically by Google, eliminating the operational burden of manual renewal and reducing the risk of expiration-related outages. The primary benefit is this automated lifecycle management, which ensures the certificate stays valid without intervention.

Answer

It is free of charge.

Answer

It can be used with any type of load balancer.

Answer

It provides stronger encryption than self-managed certificates.

Question 14

You want to enable the Kubernetes Engine API for your project using the command line. Which gcloud command should you use?

Accepted Answer

gcloud services enable container.googleapis.com. The `gcloud services enable container.googleapis.com` command enables the Kubernetes Engine API for the active project. Service enablement is done through the Service Usage API, and `gcloud services enable` is the correct CLI wrapper. Creating a cluster or setting a project does not enable the API.

Answer

gcloud container clusters create my-cluster

Answer

gcloud config set project my-project

Answer

gcloud auth login

Question 15

A DevOps engineer wants to set up budget alerts for a GCP project so that the finance team is notified when costs reach 50% and 90% of the budget. Which two configurations are required? (Choose TWO.)

Accepted Answer

Create a budget in the Cloud Billing console. Option B is correct because a Cloud Billing budget must first be created in the Cloud Billing console (or via the Billing Budgets API) before any cost-based notifications can be triggered; the budget defines the scope (project, folder, or billing account) and the amount against which spend is measured. Option D is correct because within that budget you must configure alert thresholds — setting them at 50% and 90% of the budget amount — which causes GCP to send email notifications (to billing admins and users, or to a Pub/Sub topic) when actual or forecasted spend crosses those percentages. Option A is not required: BigQuery billing export is only needed for detailed cost analysis and custom reporting, not for standard budget alerts. Option C is not required because budget alerts are a native Cloud Billing feature and do not need a Cloud Function to poll or monitor costs. Option E is not required because the roles/billing.admin role grants broad billing account administration, whereas budget alert recipients are configured through the budget's notification settings rather than by granting that IAM role.

Answer

Enable billing export to BigQuery

Answer

Set up a Cloud Function to monitor billing

Answer

Assign the roles/billing.admin IAM role to the finance team