Google ACE Practice Test 49 — 15 Questions

Question 1

Order the steps to set up a Cloud IAM policy that grants a user the 'roles/compute.admin' role on a specific project.

Accepted Answer

Step 1: Identify the user (email) and the project ID.
Step 2: Use gcloud to add IAM policy binding: `gcloud projects add-iam-policy-binding PROJECT_ID --member=user:EMAIL --role=roles/compute.admin`
Step 3: Verify the binding using `gcloud projects get-iam-policy PROJECT_ID`.
Step 4: Test access by having the user attempt to use Compute Engine resources.. The correct sequence is: first identify the user and project, then grant the role using 'gcloud projects add-iam-policy-binding', followed by verification with 'get-iam-policy', and finally test access. This ensures the policy is applied correctly and can be validated.

Answer

Step 1: Use gcloud to set the IAM policy by reading the current policy, modifying it locally, and writing it back.
Step 2: Identify the user and project.
Step 3: Verify the binding.
Step 4: Test access.

Answer

Step 1: Verify the binding using `gcloud projects get-iam-policy`.
Step 2: Identify the user and project.
Step 3: Use gcloud to add IAM policy binding.
Step 4: Test access.

Answer

Step 1: Identify the user and project.
Step 2: Test access to confirm no current access.
Step 3: Use gcloud to add IAM policy binding.
Step 4: Verify the binding.

Question 2

A managed instance group (MIG) is configured with autohealing using a health check. During a rolling update, several VMs become unhealthy before the new application version starts responding to health checks. The MIG deletes and recreates these VMs repeatedly, causing a deployment loop. How should you fix this?

Accepted Answer

Increase the `initialDelaySec` in the autohealing policy to give VMs time to start before health checks are evaluated.. Increasing `initialDelaySec` in the autohealing policy gives the new application version sufficient time to start and become healthy before the health check begins evaluating the VM. This prevents the MIG from prematurely marking VMs as unhealthy during the rolling update, breaking the deployment loop where VMs are repeatedly deleted and recreated.

Answer

Disable autohealing during rolling updates by removing the health check.

Answer

Switch from rolling update to canary update to reduce the number of affected VMs.

Answer

Reduce the health check interval and timeout to detect unhealthy VMs faster.

Question 3

Match each Google Cloud deployment tool to its purpose.

Accepted Answer

Cloud Deployment Manager: Declarative infrastructure management using templates. Cloud Deployment Manager and Terraform are infrastructure-as-code tools, with Cloud Deployment Manager being GCP-native and Terraform multi-cloud. The Cloud Console and gcloud CLI provide GUI and command-line interfaces for GCP management.

Answer

Cloud Deployment Manager: Manages containerized applications on GKE

Answer

Terraform: Only works with Google Cloud

Question 4

A GKE cluster hosts multiple teams' workloads in separate namespaces. One team's pods should not be able to make API calls to Google Cloud services (e.g., they should not call BigQuery or Cloud Storage). The pods currently use the node's service account via the Compute Engine metadata server. How do you restrict these specific pods from accessing GCP APIs while allowing other pods on the same node to continue using GCP APIs?

Accepted Answer

Apply a Kubernetes NetworkPolicy in the team's namespace blocking egress to `169.254.169.254` (the metadata server).. The Compute Engine metadata server (169.254.169.254) is the endpoint that provides the node's service account credentials to pods. By applying a Kubernetes NetworkPolicy that blocks egress to this IP in the team's namespace, you prevent those pods from reaching the metadata server, thus denying them access to GCP APIs. Other pods on the same node are unaffected because NetworkPolicy is namespace-scoped and does not apply to them.

Answer

Revoke all IAM roles from the node's service account.

Answer

Set `automountServiceAccountToken: false` on the restricted team's pods.

Answer

Use a Kubernetes ResourceQuota to limit the team's namespace API access.

Question 5

A data science team needs a VM with 96 vCPUs and 624 GB of RAM. No predefined GCP machine type matches these exact specifications. What is the recommended approach?

Accepted Answer

Create a custom machine type with exactly 96 vCPUs and 624 GB RAM. Google Cloud allows you to create custom machine types when predefined machine types do not meet your exact requirements. Custom machine types let you specify the exact number of vCPUs (up to 96) and memory (up to 624 GB) for a VM, providing flexibility without over-provisioning resources.

Answer

Select the closest larger predefined N2 machine type

Answer

Split the workload across multiple smaller VMs and coordinate manually

Answer

Contact Google Cloud support to request a new predefined machine type

Question 6

You need to grant a third-party monitoring vendor's service account `roles/monitoring.viewer` on your project, but only for the next 90 days. After 90 days, the access should automatically expire. Which IAM feature enables time-limited access?

Accepted Answer

Add an IAM Condition with a date/time expression that expires the binding after 90 days.. IAM Conditions allow you to attach a time-based expression to a role binding, such as `request.time < timestamp('2025-01-01T00:00:00Z')`, which automatically revokes the binding after the specified date. This is the native, auditable, and policy-driven way to enforce time-limited access in Google Cloud without manual intervention or resource lifecycle management.

Answer

Set a session duration limit in the vendor's service account settings.

Answer

Grant the role and set a reminder to manually revoke it in 90 days.

Answer

Use a temporary service account that is automatically deleted after 90 days via a Cloud Scheduler job.

Question 7

A Cloud Run service handles payment processing. A monitoring alert shows the service is experiencing 3-second P99 latency, up from its normal 200ms. The team wants to find the slowest individual requests in the last hour. Which tool provides per-request latency data?

Accepted Answer

Cloud Trace — sort traces by latency in the last hour. Cloud Trace is designed to capture end-to-end latency for individual requests, allowing you to sort and identify the slowest requests in a specific time range. The P99 latency increase indicates a tail-latency problem, and Trace provides per-request granularity to pinpoint the exact slow requests. This makes it the correct tool for finding the slowest individual requests in the last hour.

Answer

Cloud Monitoring — check the request_latencies metric distribution

Answer

Cloud Logging — filter for requests with duration > 3s

Answer

Cloud Profiler — view the slowest functions in the last hour

Question 8

A company uses VPC Service Controls to protect Cloud Storage. They have a service perimeter that includes the storage API and the project where the stored data resides. Users inside the perimeter can access the data, but users outside cannot. However, a group of users outside the perimeter are able to access the data using a signed URL generated by a service inside the perimeter. Why does this happen?

Accepted Answer

VPC Service Controls do not apply to signed URLs.. VPC Service Controls are designed to restrict access to Google Cloud resources based on the network origin of requests, but they do not evaluate or block requests made using signed URLs. Signed URLs are authenticated via cryptographic signatures, not IAM or network context, so they bypass the perimeter check entirely. This is by design, as signed URLs are intended for temporary, out-of-band access.

Answer

Signed URLs bypass VPC Service Controls.

Answer

The service perimeter is misconfigured, missing signed URL restrictions.

Answer

The users have been granted IAM roles that override the perimeter.

Question 9

You need to ensure that Cloud DLP scans all data uploaded to a specific Cloud Storage bucket and redacts any Social Security Numbers (SSNs) before storing the data. Which Cloud DLP feature and trigger enables this pattern?

Accepted Answer

Configure Pub/Sub notifications on the bucket to trigger a Cloud Function that calls Cloud DLP to redact SSNs before the file is readable.. Cloud DLP cannot directly intercept and redact data at the point of upload to Cloud Storage. Instead, you must use Pub/Sub notifications on the bucket to trigger a Cloud Function, which calls the Cloud DLP API to inspect and redact SSNs before the file is stored or made readable. This pattern ensures redaction happens in near real-time as part of the upload pipeline.

Answer

Enable Cloud DLP auto-redaction on the Cloud Storage bucket via the GCS settings.

Answer

Use Cloud DLP's scheduled inspection job to scan the bucket daily and flag SSNs.

Answer

Apply an org policy that prevents storing SSNs in Cloud Storage.

Question 10

A GKE cluster hosts both a public-facing web application and an internal data processing service. The data processing service should only accept traffic from the web application Pods, not from the internet. Which Kubernetes feature enforces this policy?

Accepted Answer

Kubernetes NetworkPolicy restricting ingress to the data service to only Pods with the web app label. Kubernetes NetworkPolicy is the native Kubernetes resource that controls traffic flow at the IP address or port level (OSI layer 3 or 4). By defining an ingress rule that allows traffic only from Pods with a specific label (e.g., 'app: web-app'), you can restrict access to the data processing service exclusively to the web application Pods, regardless of whether the service is exposed via ClusterIP, NodePort, or LoadBalancer. This is the correct and recommended approach for pod-level network segmentation within a cluster.

Answer

A VPC firewall rule blocking external traffic to the data service's Node IPs

Answer

IAP (Identity-Aware Proxy) configured on the data service

Answer

Using a private ClusterIP Service for the data service — it's automatically private

Question 11

A company runs a batch processing workload on Compute Engine that completes in 30 minutes. The workload is CPU-intensive and runs once daily. The company wants to minimize costs while maintaining performance. Which of the following is the most cost-effective compute option?

Accepted Answer

Use a preemptible custom machine type with 4 vCPUs and 8 GB memory.. A preemptible custom machine type with 4 vCPUs and 8 GB memory is the most cost-effective option because the workload is batch, CPU-intensive, fault-tolerant (runs once daily and can be restarted), and completes in 30 minutes — well within the 24-hour maximum preemptible VM lifetime. Preemptible instances offer up to 80% cost savings over standard instances, and a custom machine type avoids paying for unused resources, making this the cheapest viable compute option.

Answer

Use a sole-tenant node with a machine type that matches the workload.

Answer

Use an N1 standard-4 machine without discounts.

Answer

Purchase a 1-year committed use discount for the appropriate machine type.

Question 12

You are designing a GKE cluster for a workload that requires high-memory instances (768 GB RAM) for in-memory analytics. Standard machine types in GCP don't offer this configuration. Which machine family should you select for the node pool?

Accepted Answer

Memory-optimized (M1 or M2) machine family. The M1 and M2 memory-optimized machine families are specifically designed for workloads requiring large amounts of RAM, such as in-memory analytics, with configurations offering up to 12 TB of memory. Standard machine types like N2 do not provide 768 GB RAM instances, making memory-optimized families the correct choice for this high-memory requirement.

Answer

N2 machine family with custom vCPU and memory configuration

Answer

Compute-optimized (C2) machine family

Answer

Accelerator-optimized (A2) machine family

Question 13

A deployment pipeline runs `kubectl logs` to capture output from a crashed Pod's previous container instance. Which flag retrieves logs from the previous (terminated) container instance rather than the current one?

Accepted Answer

kubectl logs api-pod --previous. The `--previous` flag in `kubectl logs` retrieves logs from the previous (terminated) container instance of a Pod. This is essential for debugging crashes where the current container has restarted, as the logs from the failed instance are preserved and accessible only with this flag.

Answer

kubectl logs api-pod --terminated

Answer

kubectl logs api-pod --all-containers --since-crash

Answer

kubectl describe pod api-pod | grep -A 50 'Last State'

Question 14

Your company uses Google Workspace for email. You need to set up GCP for a new team that includes contractors who use non-Google email addresses. Which identity solution allows contractors to authenticate to GCP without a Google Workspace license?

Accepted Answer

Provision contractor accounts using Cloud Identity Free, independent of Google Workspace.. Cloud Identity Free provides identity management for users without requiring a Google Workspace license. It allows contractors with non-Google email addresses to authenticate to GCP using their existing email as a Google account, enabling IAM role assignment without additional licensing costs. This is the correct solution because it decouples identity from Google Workspace, supporting external users while maintaining centralized access control.

Answer

Issue each contractor a Gmail account and add it directly to IAM.

Answer

Create service accounts for each contractor and share the key JSON files.

Answer

Add contractor email addresses as external users and grant them project-level IAM roles.

Question 15

A company has a Compute Engine instance that needs to access the internet for software updates, but the instance only has an internal IP address. Which TWO steps are required to enable outbound internet connectivity while keeping the instance private?

Accepted Answer

Create a firewall rule that allows egress traffic to the internet. Cloud NAT allows instances with only internal IP addresses to access the internet for outbound connections. You also need to configure firewall rules to allow egress traffic (e.g., allow HTTP/HTTPS). A NAT gateway without firewall rules will not work.

Answer

Create a VPC peering connection to a network with internet access

Answer

Attach the instance to a load balancer

Answer

Assign a public IP address to the instance