Google ACE Practice Test 49 — 15 Questions

Question 1

A team builds a document processing pipeline: files are uploaded to Cloud Storage, then analyzed by Cloud Vision AI, results stored in Firestore, and a confirmation email sent. Each step depends on the previous. Which GCP service orchestrates these sequential, dependent steps reliably?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cloud Workflows. Cloud Workflows is designed to orchestrate sequential, dependent steps with built-in retry, error handling, and state management. It directly models the pipeline as a series of steps where each step's output feeds the next, without requiring manual chaining or intermediate messaging infrastructure.

Answer

Cloud Pub/Sub with a subscription per step

Answer

Cloud Tasks with per-step queues

Answer

Cloud Functions chained via HTTP calls

Question 2

An engineer is tasked with creating a new VPC network for a production environment. The company requires the VPC to support multiple regions and allow custom IP address ranges for each subnet. Which VPC network mode should the engineer use?

Accepted Answer

Custom mode VPC. Custom mode VPC is correct because it allows the engineer to create subnets with user-defined IP address ranges in each region, giving full control over the network topology. Unlike auto mode, custom mode does not automatically create subnets in every region, so the engineer can tailor subnet placement and CIDR blocks to production requirements. This flexibility is essential for multi-region deployments where specific IP ranges are needed for each subnet.

Answer

Shared VPC

Answer

Auto mode VPC

Answer

Legacy mode VPC

Question 3

A developer wants to deploy a containerized application on Cloud Run from a source code repository, without building a container image manually. The application is written in Node.js and includes a Dockerfile. Which command should the developer use to deploy directly from source?

Accepted Answer

gcloud run deploy my-service --source . --region=us-central1 --platform managed. The `gcloud run deploy` command with the `--source .` flag instructs Cloud Run to build the container image automatically using Cloud Build (via Buildpacks or the provided Dockerfile) and then deploy it. This is the only option that deploys directly from source to Cloud Run without requiring a pre-built image. The `--platform managed` flag confirms a fully managed Cloud Run service.

Answer

gcloud run deploy --image=gcr.io/my-project/my-image --region=us-central1

Answer

gcloud app deploy --source .

Answer

gcloud functions deploy my-function --runtime nodejs14 --trigger-http --source .

Question 4

A company is implementing cost optimization for their Google Cloud resources. Which two practices are recommended? (Choose two.)

Accepted Answer

Use committed use discounts for predictable workloads.. Committed use discounts (CUDs) are recommended for cost optimization because they provide significant discounts (up to 70% for vCPUs and memory) in exchange for a commitment to use a minimum level of resources (e.g., 1-year or 3-year term) for predictable workloads. This aligns costs with actual usage patterns, reducing waste from on-demand pricing. Deleting unused static external IP addresses is also recommended because each static IP incurs a small hourly charge (e.g., $0.005/hour for a regional IP) even when not attached to a resource, so removing them eliminates unnecessary costs.

Answer

Keep all resources in a single region to avoid data transfer costs.

Answer

Always use premium-tier networking for all traffic.

Answer

Use preemptible VMs for all batch jobs irrespective of fault tolerance.

Question 5

To meet compliance requirements, a company must encrypt all data at rest in Cloud SQL using customer-managed encryption keys (CMEK). What is required to enable CMEK on a Cloud SQL instance?

Accepted Answer

Specify the key during instance creation using --disk-encryption-key, and ensure the Cloud SQL service account has encryption/decryption permissions on the key. CMEK on Cloud SQL requires the key to be specified at instance creation time via the --disk-encryption-key flag (or the equivalent API/console field), and the Cloud SQL service account for the project must be granted roles/cloudkms.cryptoKeyEncrypterDecrypter on the key. Without both, the instance creation fails or falls back to Google-managed encryption.

Answer

Create the instance without encryption, then use gcloud sql instances patch to add CMEK later

Answer

Enable CMEK by setting an organization policy that requires CMEK for all Cloud SQL instances

Answer

Use the default encryption; CMEK is not supported for Cloud SQL

Question 6

You need to ensure that a Cloud Run service can only be invoked by specific Cloud Scheduler jobs and not from the public internet, while still receiving HTTP requests. The Cloud Run service currently allows unauthenticated invocations. What configuration changes are required?

Accepted Answer

Disable unauthenticated invocations on the Cloud Run service, grant `roles/run.invoker` to the Scheduler SA, and configure Scheduler to use OIDC authentication.. Cloud Run services that require authentication must have unauthenticated invocations disabled, and the Cloud Scheduler service account must be granted the `roles/run.invoker` role. Additionally, Cloud Scheduler must be configured to use OIDC authentication, which allows it to present an identity token signed by Google to the Cloud Run service, ensuring only authorized scheduler jobs can invoke the service.

Answer

Add a Cloud Armor security policy to the Cloud Run service blocking all IPs except Cloud Scheduler.

Answer

Deploy the Cloud Run service in a VPC and use a VPC firewall rule to block all traffic except Cloud Scheduler.

Answer

Add a secret header to Cloud Scheduler requests and validate it in the Cloud Run application code.

Question 7

You have a managed instance group (MIG) with instances that need to run a startup script to configure monitoring agents. You created the instance template without a startup script. Which action should you take to add the startup script?

Accepted Answer

Create a new instance template with the startup script, then update the MIG to use the new template via a rolling update.. Instance templates are immutable; you cannot modify them. You must create a new instance template with the startup script and update the MIG to use it via rolling update or by setting the template.

Answer

Use gcloud compute instances add-metadata to add the startup script to each running instance.

Answer

Delete the MIG and recreate it with a new template; you cannot change the template of an existing MIG.

Answer

Edit the existing instance template and add the startup script under 'metadata'.

Question 8

An engineer wants to create a Google-managed SSL certificate for a domain and attach it to an HTTPS load balancer. Which gcloud command should they use to create the certificate?

Accepted Answer

gcloud compute ssl-certificates create --domains example.com. The gcloud command 'gcloud compute ssl-certificates create --domains example.com' creates a Google-managed SSL certificate, which is automatically provisioned and renewed by Google Cloud. The --domains flag specifies the domain names for which the certificate should be issued, and Google handles the certificate lifecycle without requiring the user to provide a private key or certificate file. This is the correct command for creating a Google-managed certificate to attach to an HTTPS load balancer.

Answer

gcloud compute target-https-proxies create --ssl-certificates

Answer

gcloud compute ssl-policies create

Answer

gcloud compute ssl-certificates create --certificate example.crt --private-key example.key

Question 9

A Cloud Run service is experiencing high latency. You suspect one revision is causing the issue. The service is configured to split traffic 90% to revision A and 10% to revision B. You want to gradually shift traffic back to revision A only. Which command should you use?

Accepted Answer

gcloud run services update-traffic my-service --to-revisions=my-service-00001=100. The `gcloud run services update-traffic` command is the correct tool for adjusting traffic distribution across Cloud Run revisions. Using `--to-revisions=my-service-00001=100` assigns 100% of traffic to revision A (my-service-00001), effectively removing revision B from the serving path. This is the supported, declarative way to shift traffic on a Cloud Run service without redeploying.

Answer

kubectl set traffic my-service --revision=my-service-00001=100

Answer

gcloud run revisions delete my-service-00002

Answer

gcloud run services update my-service --set-revision my-service-00001

Question 10

A data warehouse team queries a 10 TB BigQuery table containing billions of events with a date column. Most queries filter by a date range (e.g., last 30 days). Without any partitioning, queries scan the full 10 TB every time. Which BigQuery feature eliminates unnecessary data scanning for date-range queries?

Accepted Answer

Date/timestamp partitioned table on the date column. Partitioning a BigQuery table by the date column allows the query engine to prune entire partitions that fall outside the specified date range, so only the relevant partitions (e.g., last 30 days) are scanned instead of the full 10 TB. This directly reduces data scanned and cost, making option C the correct choice for eliminating unnecessary scanning in date-range queries.

Answer

BigQuery table clustering on the date column

Answer

Creating a materialized view for the last 30 days

Answer

Increasing BigQuery slot reservations for faster full-table scans

Question 11

A company is migrating an on-premises MySQL database to Cloud SQL. Which TWO steps are necessary for setting up ongoing replication from on-premises to Cloud SQL? (Choose 2)

Accepted Answer

Enable binary logging on the on-premises MySQL server.. MySQL's native replication relies on binary logs (binlogs) to capture all changes on the primary server. Enabling binary logging on the on-premises MySQL server is essential to generate the change stream that Cloud SQL will read and apply for ongoing replication.

Answer

Set up a Dataflow pipeline to stream changes.

Answer

Use pg_dump to export the database.

Answer

Establish a Cloud VPN connection between on-premises and Google Cloud.

Question 12

An organization has a folder hierarchy with multiple projects. They want to grant a support team the ability to view all IAM policies across the entire folder. What is the most efficient way?

Accepted Answer

Grant roles/iam.securityReviewer at the folder level.. Granting roles/iam.securityReviewer at the folder level is the most efficient approach because IAM policies in Google Cloud are hierarchical and inherited. A single binding at the folder level automatically applies to every project and resource beneath it, so the support team gains visibility into all IAM policies across all projects without per-project configuration. This follows the principle of least privilege while minimizing administrative overhead.

Answer

Grant roles/iam.securityReviewer on each project individually.

Answer

Grant roles/owner at the folder level.

Answer

Grant roles/viewer at the folder level.

Question 13

An engineer created a VPC with a subnet in us-central1 and enabled Private Google Access on that subnet. Compute Engine instances in that subnet can reach Google APIs and services using internal IPs. However, the instances cannot reach external IP addresses on the internet. What should the engineer configure to allow internet access while minimizing cost and management overhead?

Accepted Answer

Create a Cloud NAT gateway using a Cloud Router. Cloud NAT on a Cloud Router provides managed, outbound-only internet access for instances with internal IPs, without assigning external IPs or running a NAT VM. It integrates with the VPC and scales automatically, minimizing cost and operational overhead. Private Google Access can remain enabled alongside Cloud NAT.

Answer

Disable Private Google Access and assign external IPs to the instances

Answer

Add a NAT instance (a Compute Engine VM configured as a NAT gateway)

Answer

Create a Cloud VPN tunnel to a third-party NAT service

Question 14

You want to export a subset of Cloud Logging logs to BigQuery for long-term analysis. Which method should you use?

Accepted Answer

Create a log sink with a filter and destination BigQuery. A log sink is the native Cloud Logging mechanism for routing log entries to supported destinations, and BigQuery is a first-class sink destination. By attaching an inclusion filter to the sink, you can export only the subset of logs you care about, and Cloud Logging handles the delivery and schema management automatically. This is the designed, serverless, and most operationally sound approach for long-term log analysis in BigQuery.

Answer

Create a log-based metric and export the metric to BigQuery

Answer

Set up a Cloud Function that triggers on logs and inserts into BigQuery

Answer

Use gcloud logging read and pipe to bq load

Question 15

You need to allow inbound HTTP traffic to a set of Compute Engine instances that have the tag 'web-server'. All other inbound traffic should be denied. Which firewall rule configuration should you create?

Accepted Answer

Create an allow rule for tcp:80 with source range 0.0.0.0/0 and target tags 'web-server'. No deny rule is needed.. In Google Cloud VPC firewall rules, you create an allow rule for tcp:80 with source range 0.0.0.0/0 and target tags 'web-server'. GCP firewall rules are stateful and use an implied deny-all ingress rule at the lowest priority (65535), so no explicit deny rule is needed — all traffic not matching an allow rule is automatically denied. This satisfies the requirement to allow HTTP to tagged instances while denying everything else.

Answer

Create an allow rule for tcp:80 with target tags 'web-server' and source range 0.0.0.0/0, and a deny rule for all other traffic.

Answer

Create an allow rule for tcp:80 with source range 0.0.0.0/0 and apply to all instances.

Answer

Create a deny rule for all ports except tcp:80 with target tags 'web-server'.