Google ACE Practice Test 5 — 10 Questions

Question 1

A regulated financial company must ensure that all GCP API calls made by employees are logged with full request and response payloads for audit purposes. Which combination of Cloud Audit Log types captures this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Admin Activity logs + Data Access logs (DATA_READ and DATA_WRITE). Admin Activity logs capture administrative actions like creating or modifying resources, but not the data within API calls. Data Access logs (DATA_READ and DATA_WRITE) capture the request and response payloads for API calls that read or write data, which is required for full audit logging. Together, they cover both the administrative context and the data-level payloads mandated for regulated financial companies.

Answer

Admin Activity logs only

Answer

VPC Flow Logs + Cloud Monitoring metrics

Answer

System event logs + Data Access logs

Question 2

A team is creating a new GCP project for a sensitive workload. They need to ensure the project is linked to the correct billing account, placed in the correct folder, and has specific APIs enabled — all reproducibly. They want to automate this via Infrastructure as Code. Which approach is most appropriate?

Accepted Answer

Use Terraform with `google_project`, `google_project_service`, and billing account linkage resources.. Terraform is an Infrastructure as Code (IaC) tool that allows you to define the entire project setup—including folder placement, billing account linkage, and API enablement—in declarative configuration files. This ensures reproducibility, version control, and automation, which aligns with the requirement for a sensitive workload that must be set up consistently every time.

Answer

Use a gcloud script with `gcloud projects create`, `gcloud beta billing projects link`, and `gcloud services enable`.

Answer

Use Cloud Console to manually create the project, then document the steps in a runbook.

Answer

Use Cloud Deployment Manager with a Python template to create the project.

Question 3

A developer wants to see the details of a specific GKE Pod including its events, container status, and resource requests/limits. Which kubectl command provides this?

Accepted Answer

kubectl describe pod [POD_NAME]. B is correct because `kubectl describe pod` provides a comprehensive view of a pod, including its events (e.g., scheduling, pulling images), container status (e.g., waiting, running, terminated with reasons), and resource requests/limits (CPU and memory). This command aggregates detailed information from the Kubernetes API, making it the standard tool for debugging pod issues.

Answer

kubectl get pod [POD_NAME] -o wide

Answer

kubectl inspect pod [POD_NAME]

Answer

kubectl get pod [POD_NAME] -o json

Question 4

A mobile app needs a managed database to store user profiles with flexible nested structures that evolve frequently — new fields are added without schema migrations. Which GCP database service is most appropriate?

Accepted Answer

Cloud Firestore. Cloud Firestore is a NoSQL document database that supports flexible, nested data structures and automatically handles schema evolution. New fields can be added to documents at any time without requiring migrations, making it ideal for user profiles that change frequently. It also provides real-time synchronization and offline support, which are common requirements for mobile apps.

Answer

Cloud SQL for PostgreSQL

Answer

Cloud Bigtable

Answer

Cloud Spanner

Question 5

You have pushed a new container image to Artifact Registry. The image is tagged `us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0`. You need to deploy this specific image version to Cloud Run in production. Which command deploys this exact image?

Accepted Answer

`gcloud run deploy app --image us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0 --region us-central1`. The `gcloud run deploy` command with the `--image` flag explicitly specifies the exact container image URI from Artifact Registry, including the tag `v2.0`. This ensures that Cloud Run deploys that precise version of the image, and the `--region` flag targets the correct regional service. The full URI is required because Cloud Run must pull the image from the exact repository path and tag.

Answer

`gcloud run services update app --tag v2.0 --region us-central1`

Answer

`docker push us-central1-docker.pkg.dev/my-project/my-repo/app:v2.0` followed by a Cloud Run auto-deploy.

Answer

`gcloud run deploy app --image app:v2.0 --region us-central1`

Question 6

You need to deploy a containerized application to GKE that stores user session data. The application has 3 replicas. Session data must not be lost if a replica is restarted. All replicas share the same session store. Which architecture handles this correctly?

Accepted Answer

Store sessions in Cloud Memorystore (Redis) shared by all replicas.. Cloud Memorystore (Redis) provides a centralized, persistent, and highly available session store that all replicas can access. This ensures session data survives pod restarts and is shared across all replicas, meeting the requirement for no data loss and shared access.

Answer

Store sessions in each pod's memory; use session affinity on the load balancer to route users to the same pod.

Answer

Use an emptyDir volume shared between replicas for session storage.

Answer

Store sessions in a Cloud SQL table with a connection pool per replica.

Question 7

An organization has a policy requiring all new GCP projects to be created within specific folders and linked to approved billing accounts only. Which combination of features enforces this at scale?

Accepted Answer

Organization policies to restrict allowed billing accounts + granting Project Creator role only at approved folder level. It combines two enforcement mechanisms: Organization policies (specifically the `constraints/compute.restrictBillingAccounts` constraint) to limit which billing accounts can be attached to projects, and granting the Project Creator role (`roles/resourcemanager.projectCreator`) only at the folder level (not the organization level). This ensures that new projects can only be created within the approved folders and must use an approved billing account, enforcing the policy at scale across the entire organization.

Answer

IAM deny policies on the organization + VPC Service Controls

Answer

Cloud Asset Inventory alerts + manual review of new projects

Answer

Requiring multi-factor authentication for all project creators

Question 8

You are on-call and receive a PagerDuty alert: `Cloud SQL CPU utilization > 90% for 15 minutes`. Checking `pg_stat_activity`, you find 200 connections with many in `idle` state and 15 queries running for > 5 minutes each. The long queries are table scans on a 500 GB unindexed table. What should you do IMMEDIATELY to restore service, and what is the root cause fix?

Accepted Answer

Terminate the long-running table scan queries immediately, then add indexes on the frequently queried columns as the root cause fix.. Terminating the long-running table scans immediately stops the CPU-intensive queries, restoring service. The root cause is the missing index on the 500 GB table, which forces sequential scans and high CPU usage. Adding indexes on frequently queried columns eliminates the need for full table scans, preventing recurrence.

Answer

Restart the Cloud SQL instance to clear all connections and queries.

Answer

Increase Cloud SQL's CPU to a larger machine type to handle the current load.

Answer

Reduce `max_connections` to prevent new connections from adding load.

Question 9

A security team discovers that a service account key was accidentally committed to a public GitHub repository 48 hours ago. What should be the immediate steps to remediate this incident?

Accepted Answer

Delete the leaked key immediately, audit Cloud Audit Logs for unauthorized activity using the key, then create a new key or switch to keyless authentication. The immediate priority is to revoke the compromised key's access by deleting it, which invalidates it instantly. Auditing Cloud Audit Logs is essential to detect any unauthorized usage that occurred during the 48-hour exposure window. Finally, creating a new key or switching to keyless authentication (e.g., workload identity federation) restores secure access without relying on long-lived static credentials.

Answer

Rotate the service account key to generate a new one, keeping the old key active briefly for transition

Answer

Change the service account's display name and email to invalidate the leaked key

Answer

Remove all IAM roles from the service account to deny all actions until the investigation completes

Question 10

A compliance archive stores legal documents accessed at most once per quarter. Which Cloud Storage class minimizes storage cost while meeting that access pattern?

Accepted Answer

Coldline. Coldline storage is designed for data accessed less than once per quarter, offering lower storage costs than Standard or Nearline while still providing millisecond access when needed. For a compliance archive accessed at most once per quarter, Coldline minimizes storage cost without incurring the higher retrieval fees or minimum storage durations of Archive storage.

Answer

Standard

Answer

Nearline

Answer