Google ACE Practice Test 48 — 15 Questions

Question 1

A GCP project needs to allow outbound internet access from VMs that have only private IP addresses, without exposing those VMs to inbound internet traffic. Which GCP service provides this?

Accepted Answer

Cloud NAT configured on the VPC's Cloud Router. Cloud NAT (Network Address Translation) is the correct service because it allows VMs with only private IP addresses to initiate outbound connections to the internet while preventing any inbound connections from the internet. It works by translating the private source IP addresses of outbound packets to a set of ephemeral public IP addresses managed by Google, using the VPC's Cloud Router to dynamically allocate NAT IPs and ports. This meets the requirement of outbound-only internet access without exposing the VMs to inbound traffic.

Answer

Cloud VPN connecting the VPC to the internet

Answer

A VPC firewall rule allowing egress to 0.0.0.0/0 on all ports

Answer

An internal load balancer with internet routing enabled

Question 2

A team wants to grant a contractor the Storage Object Viewer role on a specific bucket path, but only during business hours (Monday–Friday, 9am–5pm local time). Which IAM feature supports these conditions?

Accepted Answer

IAM Conditions on the role binding. IAM Conditions allow you to define time-based constraints on role bindings using the `request.time` attribute. By setting a condition that restricts access to Monday–Friday, 9am–5pm, the contractor is granted the Storage Object Viewer role only during those hours. This is the native IAM feature designed for such fine-grained, attribute-based access control.

Answer

IAM deny policies scoped to non-business hours

Answer

VPC Service Controls with a time-based access policy

Answer

Cloud Scheduler removing and re-adding the IAM binding on a schedule

Question 3

You want to ensure that all Cloud Storage buckets in your organization require customer-managed encryption keys (CMEK). What is the most efficient way to enforce this?

Accepted Answer

Create an Organization Policy with constraint 'storage.requireCustomerManagedEncryption'.. The Organization Policy constraint 'storage.requireCustomerManagedEncryption' is a centralized, scalable way to enforce CMEK across all Cloud Storage buckets in the organization. This policy is applied at the organization or folder level and automatically prevents the creation of new buckets without CMEK, while also blocking updates to existing non-compliant buckets. It is the most efficient method as it requires no per-bucket configuration or ongoing monitoring.

Answer

Use Cloud Audit Logs to monitor for non-compliant buckets.

Answer

Use a service account to encrypt all objects with CMEK.

Answer

Set a bucket policy on each bucket to require CMEK.

Question 4

A global web application serves static assets (images, JavaScript, CSS) from a Cloud Storage bucket via an HTTPS load balancer. Users in Asia report slow load times compared to users in the US where the bucket resides. What is the most effective solution?

Accepted Answer

Enable Cloud CDN on the load balancer backend pointing to the Cloud Storage bucket. Enabling Cloud CDN on the load balancer backend that points to the Cloud Storage bucket caches static assets at Google's globally distributed edge caches. This reduces latency for Asian users by serving content from a nearby point of presence (PoP) rather than from the origin bucket in the US, without requiring any bucket relocation or replication.

Answer

Move the Cloud Storage bucket to a multi-region bucket in Asia

Answer

Replicate the Cloud Storage bucket to multiple regions using storage transfer

Answer

Use Cloud Interconnect to provide dedicated bandwidth to Asian users

Question 5

A developer has an App Engine Standard application ready to deploy. The app.yaml file is in the current working directory. Which command deploys the application?

Accepted Answer

gcloud app deploy. The `gcloud app deploy` command is the correct way to deploy an App Engine Standard application when the `app.yaml` file is present in the current working directory. This command automatically detects the configuration file and uploads the application code to the specified App Engine service, handling the deployment process including staging, versioning, and traffic migration.

Answer

gcloud app create --config=app.yaml

Answer

gcloud appengine deploy app.yaml

Answer

gcloud run deploy --platform=appengine

Question 6

A company uses Cloud CDN to accelerate content delivery. They notice that some requests are not being cached, despite the cache-control headers being set correctly. The origin is a Compute Engine instance behind an HTTP load balancer. What is a likely cause?

Accepted Answer

The origin returns a Set-Cookie header, which prevents caching by default.. Cloud CDN will not cache responses that include a Set-Cookie header by default, even if Cache-Control headers are correctly set. This is because Set-Cookie indicates user-specific or session-specific content, and caching it could lead to serving private data to other users. The origin (Compute Engine behind an HTTP load balancer) returning Set-Cookie effectively disables caching for those responses.

Answer

The cache key includes the query string, causing too many variations.

Answer

The load balancer is using HTTP/2, which disables caching.

Answer

The content type is not supported by Cloud CDN.

Question 7

You have a GKE cluster with a node pool that needs to scale automatically based on load. The cluster was created with autoscaling disabled. Which command enables autoscaling on an existing node pool?

Accepted Answer

gcloud container node-pools update my-pool --cluster=my-cluster --enable-autoscaling --min-nodes=1 --max-nodes=10. gcloud container node-pools update with --enable-autoscaling and min/max node parameters enables autoscaling.

Answer

gcloud container node-pools create my-pool --enable-autoscaling

Answer

kubectl autoscale node-pool my-pool --min=1 --max=10

Answer

gcloud container clusters update my-cluster --enable-autoscaling

Question 8

You want to receive email notifications when your GCP project's billing reaches 50%, 80%, and 100% of a monthly budget. Which GCP feature should you configure?

Accepted Answer

Cloud Billing Budget with alert thresholds at 50%, 80%, and 100%.. Cloud Billing Budgets allow you to set a budget amount for a GCP project and define alert threshold percentages (e.g., 50%, 80%, 100%). When the actual cost or forecasted cost reaches any threshold, Cloud Billing automatically sends email notifications to Billing Administrators and users you specify. This is the native, purpose-built feature for budget-based billing alerts.

Answer

Cloud Monitoring alerting policies on billing metrics.

Answer

Set a project spending limit in the Cloud Console billing settings.

Answer

Enable billing export to BigQuery and create a scheduled query that sends alert emails.

Question 9

Which TWO of the following are valid ways to grant IAM roles to a service account for accessing a Cloud Storage bucket? (Select 2 correct answers)

Accepted Answer

Use gcloud storage buckets add-iam-policy-binding to grant the role directly on the bucket.. IAM roles can be granted at the bucket level using gcloud storage buckets add-iam-policy-binding (or gsutil iam ch) or at the project level which applies to all buckets in the project. The other options are incorrect: gcloud iam roles create creates a custom role definition, not a grant; gcloud iam service-accounts add-iam-policy-binding grants roles on the service account itself; and gcloud projects set-iam-policy replaces the entire policy, not a granular add.

Answer

Use gcloud projects set-iam-policy with a policy file that includes the binding.

Answer

Use gcloud iam roles create to assign the role to the service account.

Answer

Use gcloud iam service-accounts add-iam-policy-binding.

Question 10

An organization wants to enable Data Access audit logs for all Cloud Storage buckets in a project. Which step is necessary?

Accepted Answer

Configure an organization policy or IAM audit config to enable Data Access logs for Cloud Storage.. Data Access audit logs must be enabled at the organization or project level using IAM audit config, and can be scoped to specific services like Cloud Storage.

Answer

Use gcloud logging to create a log sink for Cloud Storage.

Answer

Enable Data Access logs in each bucket's settings.

Answer

Add an IAM binding with the roles/logging.admin role to a user.

Question 11

A global web application needs HTTPS traffic routed to backend services in multiple regions, directing each user to the nearest healthy endpoint. Which load balancer type should be used?

Accepted Answer

Global external Application Load Balancer. The Global external Application Load Balancer (ALB) is the correct choice because it provides cross-regional load balancing for HTTPS traffic, routing each user to the nearest healthy backend based on anycast IP and client location. This is essential for a global web application requiring low latency and high availability across multiple regions.

Answer

Regional external Network Load Balancer

Answer

Regional internal Application Load Balancer

Answer

Regional internal TCP/UDP load balancer

Question 12

A media company ingests 500,000 events per second from IoT sensors and needs to store them for time-series analytics queries that scan billions of rows. Which storage service is most appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is the most appropriate service because it is a fully managed, scalable NoSQL database designed for high-throughput, low-latency workloads like IoT sensor data ingestion at 500,000 events per second. It supports time-series analytics queries scanning billions of rows via its wide-column storage model and integration with BigQuery for complex analytics, while providing sub-10ms latency for point lookups and efficient range scans.

Answer

Cloud Firestore

Answer

Cloud SQL for MySQL

Answer

BigQuery streaming inserts

Question 13

A new engineer needs to set up the gcloud CLI on their local machine and authenticate with a user account. Which command should they run after installing the SDK?

Accepted Answer

gcloud init. The 'gcloud init' command initializes the SDK, sets properties, and runs auth login. Alternatively, 'gcloud auth login' only authenticates without setting project/defaults.

Answer

gcloud auth application-default login

Answer

gcloud config set account

Answer

gcloud auth login

Question 14

A company runs a big data processing pipeline on a Dataproc cluster. To reduce costs, they use a primary cluster with one master node (standard) and 20 worker nodes all using preemptible VMs. Recently, jobs running during peak business hours are failing with 'Task failed' errors. You notice that many preemptible VMs are reclaimed during the middle of these jobs. The jobs are long-running MapReduce tasks that write intermediate results to the cluster's HDFS. What should you do to improve job reliability without significantly increasing costs?

Accepted Answer

Enable graceful decommissioning for the preemptible instances.. Enabling graceful decommissioning for preemptible instances allows YARN to handle node loss more gracefully. When a preemptible VM is reclaimed, YARN can wait for running containers to finish before shutting down the node, reducing task failures. This improves job reliability without adding cost, as it leverages existing preemptible VMs more effectively.

Answer

Increase the number of preemptible worker nodes to 40.

Answer

Use a higher preemptible instance type (e.g., n1-highmem-2 instead of n1-standard-2).

Answer

Switch to standard worker nodes with committed use discounts.

Question 15

A company needs to store 50 TB of access logs that are rarely accessed (once a year) and must be retained for 7 years. Which storage option is the most cost-effective?

Accepted Answer

Archive Storage. Archive Storage is the most cost-effective option for data that is accessed less than once a year and must be retained for 7 years. It offers the lowest storage cost among Google Cloud storage classes, specifically designed for long-term, infrequently accessed data with a 365-day minimum storage duration and a higher retrieval cost, which is acceptable given the rare access pattern.

Answer

Nearline Storage

Answer

Regional persistent disk

Answer

Coldline Storage