Google ACE Practice Test 47 — 15 Questions

Question 1

An engineer needs to create a new project and set up the environment. They are using the gcloud command-line tool. Which two commands are required to create a project and link it to a billing account? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

gcloud billing projects link PROJECT_ID --billing-account=BILLING_ACCOUNT_ID. Option B, `gcloud projects create PROJECT_ID`, is correct because it is the gcloud command that actually creates a new Google Cloud project under the current account or specified organization/folder, returning the new PROJECT_ID. Option A, `gcloud billing projects link PROJECT_ID --billing-account=BILLING_ACCOUNT_ID`, is correct because it is the command that associates an existing billing account with the newly created project, which is required to enable billing for that project. Option C, `gcloud alpha billing accounts create`, is not needed here because it creates a brand-new billing account rather than linking an existing one to a project. Option D, `gcloud services enable cloudbilling.googleapis.com`, is unnecessary since the Cloud Billing API is enabled by default and enabling it is not part of the create-and-link workflow. Option E, `gcloud config set project PROJECT_ID`, only sets the default project for the current gcloud configuration and does not create a project or link billing.

Answer

gcloud alpha billing accounts create

Answer

gcloud services enable cloudbilling.googleapis.com

Answer

gcloud config set project PROJECT_ID

Question 2

An engineer needs to enable the Compute Engine API for a project using the gcloud command line. Which command should they run?

Accepted Answer

gcloud services enable compute.googleapis.com. The `gcloud services enable` command is the correct way to enable APIs for a project, and `compute.googleapis.com` is the service name for the Compute Engine API. The full command `gcloud services enable compute.googleapis.com` enables the API at the project level, which is required before creating Compute Engine resources.

Answer

gcloud compute instances enable-api

Answer

gcloud services list --enabled

Answer

gcloud api enable compute

Question 3

A gaming company's GKE cluster uses a mix of node pools: a standard on-demand pool for stateful database pods, and a Spot VM pool for compute-intensive but fault-tolerant game simulation pods. The simulation pods occasionally get preempted. How should the Deployment be configured to route simulation pods to the Spot pool only?

Accepted Answer

Add a nodeSelector: cloud.google.com/gke-spot: 'true' to the simulation Deployment spec. GKE uses the node label `cloud.google.com/gke-spot` to identify Spot VMs. Adding a `nodeSelector` with that exact key-value pair ensures the simulation Deployment is scheduled exclusively on Spot nodes, which is the intended behavior for fault-tolerant, preemptible workloads.

Answer

Set podAffinity to prefer nodes where Spot pods are running

Answer

Set requests.cpu and requests.memory to very high values — GKE will route them to Spot nodes

Answer

Name the simulation Deployment with a 'spot-' prefix — GKE routes prefixed deployments to Spot pools

Question 4

A team needs to run a containerized HTTP API that scales to zero when idle and requires zero cluster or server management. Which GCP compute platform is the best fit?

Accepted Answer

Cloud Run. Cloud Run is the best fit because it is a fully managed serverless platform that automatically scales your containerized HTTP API to zero when idle, meaning you pay only for resources used during request processing. It requires no cluster or server management, as it abstracts away the underlying infrastructure entirely, unlike other options that still involve some level of node or instance management.

Answer

Compute Engine with a managed instance group

Answer

Google Kubernetes Engine Autopilot

Answer

App Engine Flexible

Question 5

A developer wants to create a Compute Engine instance with the container-optimized OS image in the default network. Which command should they use?

Accepted Answer

gcloud compute instances create my-instance --image-family=cos-stable --image-project=cos-cloud. The command 'gcloud compute instances create my-instance --image-family=cos-stable --image-project=cos-cloud' correctly specifies both the image family (cos-stable) and the image project (cos-cloud) where Container-Optimized OS images reside. Both flags are required because image families are scoped to a project. This creates an instance with the COS image in the default network (default network is used when --network is omitted).

Answer

gcloud compute instances create my-instance --image-family=ubuntu-2004-lts --image-project=ubuntu-os-cloud

Answer

gcloud compute instances create my-instance --image-family=cos-stable

Answer

gcloud compute instances create my-instance --image=cos-stable --image-project=cos-cloud

Question 6

Refer to the exhibit. An application running on this instance is unable to write to a Cloud Storage bucket. What is the most likely cause?

Accepted Answer

The access scopes only allow read access to Cloud Storage. When an instance is created with access scopes, these scopes restrict the API methods that the instance's credentials can use, regardless of the IAM permissions granted to the attached service account. The exhibit shows that the access scopes are set to 'Read Only' for Cloud Storage, which means the application can only call read methods (e.g., storage.objects.get) and cannot perform write operations (e.g., storage.objects.insert). This overrides any IAM role that would otherwise allow write access.

Answer

The application is using the wrong authentication method

Answer

The Cloud Storage bucket is in a different project

Answer

The service account does not have the storage.objectAdmin IAM role

Question 7

Which of the following is true about Cloud Shell?

Accepted Answer

Cloud Shell has 5 GB of persistent home directory storage.. Cloud Shell provides a persistent 5 GB home directory ($HOME) that survives across sessions, so files stored there are retained even after the VM is recycled. This is a core feature of Cloud Shell that distinguishes it from a purely ephemeral terminal. The gcloud CLI, kubectl, and many other tools are pre-installed and pre-authenticated, so no manual setup is required.

Answer

Cloud Shell requires installation of gcloud and kubectl manually.

Answer

Cloud Shell only supports the gcloud CLI, not kubectl.

Answer

Cloud Shell provides a persistent VM that can run for hours.

Question 8

An engineer wants to view the current IAM policy for a project in JSON format. Which command should they use?

Accepted Answer

gcloud projects get-iam-policy my-project --format json. The command 'gcloud projects get-iam-policy my-project --format json' retrieves the IAM policy bound to a project and outputs it in JSON. This is the correct gcloud command for viewing a project's IAM policy, which lists bindings between members and roles. The --format json flag ensures machine-readable JSON output.

Answer

gcloud resource-manager folders get-iam-policy my-project --format json

Answer

gcloud projects describe my-project --format json

Answer

gcloud iam policies get my-project --format json

Question 9

You have a Cloud Run service configured with `min-instances: 0`. During load testing you notice the first request after a period of inactivity takes 3–5 seconds instead of the normal 100ms. Subsequent requests are fast. What is causing this, and what is the most cost-effective fix?

Accepted Answer

Set `min-instances: 1` to keep a warm instance running and eliminate the cold start latency.. With `min-instances: 0`, Cloud Run scales to zero when idle, so the first request must trigger a cold start — provisioning a container instance, pulling the image, and initializing the runtime, which accounts for the 3–5 second delay. Setting `min-instances: 1` keeps one instance warm and ready, eliminating cold start latency while still being the cheapest option compared to always-on alternatives.

Answer

The Cloud Run service's container image is too large; reduce image size.

Answer

Switch from Cloud Run to GKE, which doesn't have cold starts.

Answer

Increase Cloud Run's request timeout to 30 seconds to accommodate cold starts.

Question 10

A developer wants to deploy a containerized application to Cloud Run that should be publicly accessible over the internet. The container image is stored in Container Registry. Which gcloud command should they use?

Accepted Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --region us-central1 --platform managed --allow-unauthenticated. The correct gcloud command uses --platform managed, which is the required value for Cloud Run (fully managed). The --allow-unauthenticated flag makes the service publicly accessible. Option B includes both correct flags. Option A uses --platform cloud-run, which is invalid; the accepted values are managed or gke. Option C uses --platform gke, which would deploy to a GKE cluster, not Cloud Run. Option D omits --allow-unauthenticated, so the service would require authentication, not public.

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --region us-central1 --platform cloud-run --allow-unauthenticated

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --region us-central1 --platform gke --allow-unauthenticated

Answer

gcloud run deploy my-service --image gcr.io/my-project/my-image --region us-central1 --platform managed

Question 11

A new engineer needs to enable the Compute Engine API for a project using the gcloud command-line tool. Which command should they run?

Accepted Answer

gcloud services enable compute.googleapis.com. The correct command is 'gcloud services enable compute.googleapis.com' because the gcloud CLI uses the 'services' command group to manage API enablement, and the Compute Engine API is identified by its service name 'compute.googleapis.com'. This is the standard, documented syntax for enabling any Google Cloud API via gcloud.

Answer

gcloud compute enable-api

Answer

gcloud projects enable compute.googleapis.com

Answer

gcloud api enable compute

Question 12

A team needs a database backup job to run every day at 2 AM UTC. The job calls an HTTP endpoint to trigger the backup. The endpoint requires no complex orchestration — just a timed HTTP call. Which GCP service handles this most simply?

Accepted Answer

Cloud Scheduler with an HTTP target pointing to the backup endpoint. Cloud Scheduler is the simplest GCP service for a recurring HTTP call because it is a fully managed cron job service that directly supports HTTP targets. You configure a schedule (e.g., '0 2 * * *' for daily at 2 AM UTC) and point it to the backup endpoint URL. No additional code, queue, or orchestration is needed, making it the most straightforward solution for this use case.

Answer

Cloud Tasks with a daily task enqueued by a Cloud Function

Answer

Cloud Composer DAG running at 2 AM UTC

Answer

Cloud Run Jobs triggered by a Cloud Monitoring alert at 2 AM

Question 13

A DevOps engineer is configuring a managed instance group (MIG) for a stateless web application. They want to ensure that when new instances are created via rolling update or autoscaling, a startup script runs to install security patches and deploy the latest application code from a Cloud Storage bucket. What is the BEST way to achieve this?

Accepted Answer

Add the script to the instance template using the metadata key 'startup-script'. The best way to ensure a startup script runs on every new instance in a MIG is to embed it in the instance template using the metadata key 'startup-script'. The template is the blueprint for all instances created by the MIG, so any instance launched by autoscaling or rolling update automatically executes the script on boot.

Answer

Create a custom image with pre-installed patches and code, and use that image in the template

Answer

After the MIG is created, use gcloud compute ssh to run the script on each instance

Answer

Store the script in Cloud Storage and use gcloud compute instances add-metadata on each instance

Question 14

Refer to the exhibit. An administrator wants to grant a service account read-only access to all Compute Engine instances in a project, but only those with label 'environment=production'. Which IAM policy configuration should be used?

Accepted Answer

roles/compute.viewer with condition 'resource.labels.environment == "production"'. Roles/compute.viewer provides read-only access to Compute Engine resources, and the condition 'resource.labels.environment == "production"' restricts that access to only instances with the specified label. This satisfies the requirement of granting read-only access to production-labeled instances without granting broader permissions.

Answer

roles/compute.instanceAdmin with condition 'resource.labels.environment == "production"'

Answer

roles/compute.imageUser with condition 'resource.labels.environment == "production"'

Answer

roles/compute.viewer with condition 'request.host == "production"'

Question 15

An organization wants to deploy a containerized web application on Google Cloud with minimum operational overhead. The application should scale to zero when not in use and only incur costs when serving requests. Which service should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless container platform that scales to zero when there is no traffic and charges only for resources consumed during request handling. It abstracts away cluster management, making it the lowest-operational-overhead choice for a containerized web app that must scale to zero.

Answer

App Engine Flexible Environment

Answer

Google Kubernetes Engine (GKE)

Answer

Compute Engine with container-optimized OS