Google ACE Practice Test 47 — 15 Questions

Question 1

A company wants to deploy a web application on Compute Engine. They expect variable traffic and want to automatically add or remove virtual machine instances based on CPU utilization. What is the recommended approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a managed instance group with an autoscaling policy based on CPU utilization. A managed instance group (MIG) with an autoscaling policy based on CPU utilization is the recommended approach because it automatically adjusts the number of VM instances in response to real-time CPU load, ensuring the application can handle variable traffic without manual intervention. This aligns with Google Cloud's best practices for elastic scaling of stateless web applications on Compute Engine.

Answer

Use a single large instance and rely on Cloud Load Balancing

Answer

Use an unmanaged instance group and manually add or remove instances

Answer

Deploy the application on App Engine Standard environment

Question 2

A team has a streaming pipeline built with Apache Beam that reads from Cloud Pub/Sub and writes transformed data to BigQuery. Which GCP service executes this pipeline with managed autoscaling?

Accepted Answer

Cloud Dataflow. Cloud Dataflow is the correct service because it is a fully managed, autoscaling service specifically designed to execute Apache Beam pipelines. It handles the reading from Cloud Pub/Sub and writing to BigQuery, automatically scaling worker resources based on the pipeline's processing demands.

Answer

Cloud Composer

Answer

Cloud Dataproc

Answer

Cloud Data Fusion

Question 3

A team runs a critical production project and wants to prevent anyone — including project owners and organization admins — from accidentally deleting it. Which mechanism provides this protection?

Accepted Answer

Create a project lien using the Cloud Resource Manager API or gcloud. A project lien is the correct mechanism because it explicitly prevents the deletion of a Google Cloud project by blocking the `resourcemanager.projects.delete` operation until the lien is removed. This protection works regardless of the user's role, including project owners and organization admins, and is managed via the Cloud Resource Manager API or `gcloud` command. It is designed specifically for accidental deletion prevention, not for access control.

Answer

Remove the Owner role from all users in the project

Answer

Set an organization policy denying the resourcemanager.projects.delete permission

Answer

Enable deletion protection in the project's IAM settings in the Console

Question 4

A company wants to use Cloud NAT to allow private instances in a VPC to send outbound traffic to the internet and to receive inbound responses. Which two resources must be configured to set up Cloud NAT?

Accepted Answer

Cloud Router and NAT gateway. Cloud NAT requires a Cloud Router (to manage dynamic routing and NAT IP allocation) and a NAT gateway (the actual NAT service). The Cloud Router is a separate resource that must be created in the same region as the NAT gateway. The NAT gateway configuration includes the Cloud Router name.

Answer

Cloud Router only

Answer

Cloud VPN and Cloud NAT

Answer

Cloud Interconnect and Cloud NAT

Question 5

You need to set an organization policy that prevents any project from creating Cloud SQL instances with a public IP address. The constraint you need is `sql.restrictPublicIp`. What type of constraint is this, and how do you enable it?

Accepted Answer

Boolean constraint — set `enforce: true` in the organization policy.. `sql.restrictPublicIp` is a boolean constraint in Google Cloud Organization Policies. Boolean constraints have a simple `enforce: true` or `enforce: false` setting, and setting it to `true` prevents projects from creating Cloud SQL instances with public IP addresses. This is the standard method to enforce this restriction across the organization.

Answer

List constraint — add `CLOUD_SQL_INSTANCE` to the `deniedValues` list.

Answer

Custom constraint — define a CEL expression that evaluates the Cloud SQL instance's IP configuration.

Answer

List constraint — add `0.0.0.0/0` to the `deniedValues` list.

Question 6

Arrange the steps to deploy a containerized application to Google Kubernetes Engine (GKE) using a Deployment and expose it via a Service.

Accepted Answer

Create GKE cluster, then create Deployment, then expose Deployment as a Service. The correct sequence for deploying a containerized application to GKE is to first create a GKE cluster (the underlying infrastructure), then deploy your application using a Kubernetes Deployment, and finally expose that Deployment via a Service to allow external access. This order ensures all dependencies are met: the cluster must exist before any workloads are created, and the Service references an existing Deployment.

Answer

Create Deployment, then create GKE cluster, then expose Deployment as a Service

Answer

Expose Deployment as a Service, then create GKE cluster, then create Deployment

Answer

Create GKE cluster, then expose Deployment as a Service, then create Deployment

Question 7

Instead of granting IAM roles to 50 individual developer email addresses, a team wants to manage access by team membership. When a developer joins or leaves, access updates automatically. What is the recommended approach?

Accepted Answer

Grant IAM roles to a Google Group containing all team members. Google Groups act as identity containers that can be granted IAM roles at the project or resource level. When developers are added to or removed from the group, their IAM permissions automatically update without requiring manual role changes for each individual user. This aligns with the principle of least privilege and simplifies access management at scale.

Answer

Create a service account shared by all developers on the team

Answer

Create a GCP project per developer and use cross-project IAM bindings

Answer

Use Cloud Identity-Aware Proxy to manage team membership

Question 8

An engineer needs to allow a set of Compute Engine instances (with tag 'web-server') to receive traffic on port 443 from the internet. The VPC has a default network with default firewall rules. Which TWO actions should the engineer take? (Choose TWO)

Accepted Answer

Create a firewall rule allowing ingress from 0.0.0.0/0 on port 443 with target tag 'web-server' and priority 1000.. To allow ingress on port 443 to instances with tag 'web-server', the engineer must create a firewall rule allowing that traffic. The default rules are already there but may not include port 443; the default-allow-https rule exists but only for instances with tag 'https-server', not 'web-server'. So a new rule is needed. The engineer should not modify the default rule (cannot be modified) or delete it. Creating a rule with priority 1000 is appropriate.

Answer

Create a firewall rule allowing ingress from 0.0.0.0/0 on port 443 with target tag 'https-server' and priority 1000.

Answer

Modify the default-allow-https rule to change the target tag to 'web-server'.

Answer

Delete the default-allow-https rule to avoid conflicts.

Question 9

A new engineer needs to enable the Compute Engine API for a project using the gcloud command-line tool. Which command should they run?

Accepted Answer

gcloud services enable compute.googleapis.com. The correct command to enable an API is `gcloud services enable`, specifying the service name. For Compute Engine the service name is `compute.googleapis.com`.

Answer

gcloud compute enable-api

Answer

gcloud projects enable compute.googleapis.com

Answer

gcloud api enable compute

Question 10

A team is migrating from Google Container Registry (gcr.io) to Artifact Registry. Existing automation scripts use `gcr.io/my-project/myimage`. To avoid updating all scripts immediately, which Artifact Registry feature allows gcr.io-addressed pulls to work with Artifact Registry backends?

Accepted Answer

Enable the gcr.io compatibility redirect in Artifact Registry settings so gcr.io URLs route to Artifact Registry. Artifact Registry offers a gcr.io compatibility redirect feature that automatically routes requests originally targeting `gcr.io/my-project/myimage` to the corresponding Artifact Registry repository. This allows existing automation scripts to continue using the old `gcr.io` hostname without modification, while the underlying storage and image management are handled by Artifact Registry. The redirect is configured at the project level and works transparently for pull operations, eliminating the need for immediate script updates.

Answer

Artifact Registry has no gcr.io compatibility — all scripts must be updated immediately

Answer

Use a Cloud DNS private zone to redirect gcr.io to Artifact Registry

Answer

Both Container Registry and Artifact Registry can be active simultaneously with no configuration

Question 11

A Kubernetes namespace is shared by multiple teams. The platform team wants to ensure no single team's workloads can consume more than 10 CPU cores and 20 GB memory in that namespace. Which Kubernetes resource enforces this constraint?

Accepted Answer

ResourceQuota scoped to the namespace. ResourceQuota is the Kubernetes resource that enforces aggregate resource consumption limits at the namespace level. By configuring a ResourceQuota with spec.hard.cpu: 10 and spec.hard.memory: 20Gi, the platform team can cap the total CPU and memory usage across all Pods in the namespace, preventing any single team from exceeding those limits.

Answer

LimitRange — sets per-Pod CPU and memory limits

Answer

PodDisruptionBudget limiting the number of running Pods

Answer

Network Policy restricting namespace traffic to avoid resource contention

Question 12

Match each Cloud Storage storage class to its typical use case.

Accepted Answer

Standard Storage: Frequently accessed data (e.g., active website content). The correct matches are: Standard for frequent access, Nearline for monthly access, Coldline for quarterly access, and Archive for long-term archival storage. Common confusions involve mixing access frequency requirements.

Answer

Standard Storage: Data accessed less than once a year

Answer

Coldline Storage: Frequently accessed data (e.g., active game assets)

Question 13

A monitoring alert fires at 3 AM — the team's GKE Pods are being evicted. Investigation shows node memory is at 98%. Pods without resource requests are being evicted first. What is the long-term fix to prevent evictions?

Accepted Answer

Add explicit memory requests (and optionally limits) to all Pod specs. B is correct because setting explicit memory requests ensures the Kubernetes scheduler can accurately place Pods on nodes with sufficient resources, preventing the node from being overcommitted. Without requests, Pods are treated as burstable or best-effort, making them the first candidates for eviction under the kubelet's Quality of Service (QoS) classes when node memory pressure hits 98%. This is a long-term fix because it enforces proper resource governance at the scheduling level, not just a reactive measure.

Answer

Set higher memory limits on the Pods being evicted

Answer

Disable node-level eviction by modifying kubelet configuration

Answer

Add more nodes to the cluster to increase available memory

Question 14

A DevOps team notices that a Compute Engine instance running a critical application has been terminated unexpectedly. The team wants to ensure the instance restarts automatically if it stops. Which configuration should they use?

Accepted Answer

Enable the 'Automatic restart' flag on the instance template.. Enabling the 'Automatic restart' flag on the instance template ensures that Compute Engine automatically restarts the VM if it terminates due to a non-user-initiated failure (e.g., hardware failure, system crash). This is the native mechanism for automatic recovery without requiring external scripts or manual intervention.

Answer

Configure a startup script that checks for termination and restarts the instance.

Answer

Set the 'On host maintenance' policy to 'Migrate VM instance'.

Answer

Create a firewall rule to allow health check traffic from the load balancer.

Question 15

A new developer tries to create a project using gcloud projects create but receives the error shown in the exhibit. Which action should the administrator take to resolve the issue?

Accepted Answer

Assign the Project Creator role (roles/resourcemanager.projectCreator) to the user.. The error indicates the user lacks the `resourcemanager.projects.create` permission, which is granted by the Project Creator role (`roles/resourcemanager.projectCreator`). Option B is incorrect because enabling the Cloud Resource Manager API does not grant permissions; it only enables the API service. Option C is incorrect because the Billing Account Creator role is for creating billing accounts, not projects. Option D is a workaround but does not resolve the underlying permission issue for the developer.

Answer

Enable the Cloud Resource Manager API.

Answer

Assign the Billing Account Creator role to the user.

Answer

Create the project manually and share the project ID.