Google ACE Practice Test 50 — 15 Questions

Question 1

A team deploys an application on GKE and needs it to be accessible at https://api.company.com with automatic TLS certificate provisioning. They use a Global external Application Load Balancer. What handles the TLS certificate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Google-managed SSL certificate attached to the load balancer's HTTPS target proxy. A Global external Application Load Balancer uses an HTTPS target proxy to terminate TLS. To automatically provision and renew TLS certificates for a custom domain, you attach a Google-managed SSL certificate to that target proxy. Google manages the entire lifecycle, including domain verification via Cloud DNS, so no manual certificate generation or third-party tools are needed.

Answer

The GKE cluster automatically generates a self-signed TLS certificate for the domain

Answer

Cloud DNS automatically provisions a TLS certificate when a domain is added

Answer

cert-manager in GKE automatically obtains Let's Encrypt certificates for the Ingress

Question 2

A company is designing a globally distributed application with a web tier and a database tier that requires low-latency communication within the same region but can tolerate eventual consistency across regions. The database must be fully managed and scale globally. Which combination of networking and database is most appropriate?

Accepted Answer

Global VPC with Cloud Bigtable. Cloud Bigtable is a fully managed, globally scalable NoSQL database that provides low-latency access within a region and eventual consistency across regions, making it ideal for the described workload. A Global VPC allows the web and database tiers to communicate privately and with low latency within the same region, while Bigtable's native replication handles cross-region eventual consistency without application complexity.

Answer

Global VPC with Cloud Spanner

Answer

VPC peering with Cloud SQL

Answer

Shared VPC with Cloud Datastore

Question 3

A production GKE service processes payments and must maintain at least 3 replicas running at all times, even during node upgrades or Pod evictions. How should this be enforced?

Accepted Answer

Create a PodDisruptionBudget with minAvailable: 3 targeting the payment service Pods. A PodDisruptionBudget (PDB) with `minAvailable: 3` ensures that at least 3 replicas of the payment service remain available during voluntary disruptions like node upgrades or Pod evictions. The Kubernetes scheduler respects the PDB by blocking evictions that would drop the number of healthy Pods below the specified threshold, guaranteeing continuous service availability even when nodes are being drained.

Answer

Set the Deployment replica count to 6 — node upgrades will only affect half at a time

Answer

Add node affinity rules pinning all 3 replicas to specific long-lived nodes

Answer

Enable cluster autoscaler with minNodeCount=3 — this preserves Pod availability

Question 4

A developer needs to deploy a containerized web application that experiences unpredictable traffic patterns, including long periods of no traffic. They want to minimize costs and only pay for resources when the application is serving requests. Which Google Cloud compute service is most suitable?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero when not in use, charging only for resources during request processing.

Answer

Google Kubernetes Engine (GKE) Standard

Answer

Compute Engine with managed instance groups

Answer

Cloud Functions

Question 5

A Cloud Run service calls external third-party APIs that have rate limits. Under burst traffic, the service spawns many concurrent instances, each making direct API calls, causing rate limit errors. What GCP pattern reduces API call volume without adding infrastructure?

Accepted Answer

Cache third-party API responses in Cloud Memorystore (Redis) with appropriate TTL. Caching third-party API responses in Cloud Memorystore (Redis) with an appropriate TTL reduces the number of outbound API calls by serving cached data to multiple concurrent Cloud Run instances. This directly addresses rate-limit errors without adding new infrastructure, as Memorystore is a managed in-memory cache that integrates seamlessly with Cloud Run via a VPC connector.

Answer

Set Cloud Run max-concurrency to 1 so each instance handles one request

Answer

Enable Cloud CDN on the Cloud Run service to cache outbound requests

Answer

Migrate to Cloud Functions with a lower default concurrency limit

Question 6

A company is planning a lift-and-shift migration of an on-premises monolithic application to Google Cloud. The application runs on a single server and requires a specific kernel module that is not supported by Google Cloud's container-optimized OS. Which compute service should they use?

Accepted Answer

Compute Engine. Compute Engine offers full control over the VM, including choice of OS and kernel modules. GKE and Cloud Run use container-optimized OS, and Cloud Functions is serverless and unsuitable for a monolithic app.

Answer

Google Kubernetes Engine (GKE)

Answer

Cloud Run

Answer

Cloud Functions

Question 7

A team wants to deploy a container image at 'gcr.io/myproject/api:v2' as a Cloud Run service named 'api-service' in us-east1, accessible without authentication. Which command is correct?

Accepted Answer

gcloud run deploy api-service --image=gcr.io/myproject/api:v2 --region=us-east1 --allow-unauthenticated. It uses the `gcloud run deploy` command with the `--image` flag to specify the container image, `--region=us-east1` to target the correct region, and `--allow-unauthenticated` to make the service publicly accessible without authentication. This matches the exact requirements for deploying a Cloud Run service with public access.

Answer

gcloud run create api-service --image=gcr.io/myproject/api:v2 --zone=us-east1 --public

Answer

gcloud cloud-run deploy api-service --container=gcr.io/myproject/api:v2 --region=us-east1

Answer

gcloud run deploy --name=api-service --image=gcr.io/myproject/api:v2 --region=us-east1 --no-auth

Question 8

You are designing an environment where a CI/CD pipeline running in GitHub Actions needs to deploy Cloud Run services without storing any long-lived service account keys. Your organization's security policy prohibits downloading SA keys. Which approach meets these requirements?

Accepted Answer

Use Workload Identity Federation to allow GitHub Actions to impersonate a service account using OIDC tokens.. Workload Identity Federation allows GitHub Actions to exchange OIDC tokens from GitHub's identity provider for Google Cloud service account impersonation, eliminating the need to download and store long-lived service account keys. This approach satisfies the security policy by using short-lived, automatically rotated tokens that are valid for only one hour, and it integrates directly with GitHub's OIDC provider without requiring any secret key material.

Answer

Create a service account key, base64-encode it, and store it as a GitHub Actions secret.

Answer

Grant the GitHub Actions runner VM's default service account the necessary roles.

Answer

Use Cloud Build triggers instead of GitHub Actions to avoid key management.

Question 9

An organization requires that all Compute Engine instances be created with a specific service account. Which organization policy can enforce this?

Accepted Answer

constraints/compute.setServiceAccount. The 'constraints/compute.setServiceAccount' constraint can be used to restrict which service accounts can be used when creating instances. It can be set at the organization or project level. The other constraints are not related to service accounts.

Answer

constraints/compute.vmExternalIpAccess

Answer

constraints/iam.allowedPolicyMemberDomains

Answer

constraints/compute.restrictCreateOnFirewall

Question 10

Your company runs a data processing pipeline on Cloud Dataproc. The pipeline reads data from Cloud Storage, processes it with Spark, and writes results to BigQuery. Recently, the pipeline has been failing with errors indicating insufficient disk space on the worker nodes. The cluster is configured with standard worker nodes with 100 GB of standard persistent disk. The data size being processed has grown from 50 GB to 150 GB. What is the most cost-effective way to resolve the disk space issue?

Accepted Answer

Enable automatic disk resizing for the cluster.. Cloud Dataproc's automatic disk resizing feature dynamically increases the size of persistent disks on worker nodes when disk usage exceeds a threshold (default 90%). This resolves the insufficient disk space issue without manual intervention or additional cost for unused capacity, making it the most cost-effective solution for handling the increased data volume from 50 GB to 150 GB.

Answer

Increase the size of the persistent disks on the worker nodes to 200 GB.

Answer

Use local SSDs instead of persistent disks for temporary storage.

Answer

Increase the number of worker nodes in the cluster.

Question 11

You need to create a dashboard in Cloud Monitoring that shows: (1) Cloud Run request count per second, (2) Cloud Run p99 latency, (3) GKE pod CPU utilization, and (4) Cloud SQL query duration — all on a single screen. Which Cloud Monitoring feature enables this multi-service overview?

Accepted Answer

Create a Cloud Monitoring custom dashboard with chart widgets for each metric across the different services.. Cloud Monitoring custom dashboards allow you to combine chart widgets from multiple monitored services (Cloud Run, GKE, Cloud SQL) into a single screen. This feature supports heterogeneous metric queries using the Monitoring Query Language (MQL) or metric selectors, enabling a unified view without needing separate tools or exports.

Answer

Create four separate alerting policies and pin them to a shared alerting page.

Answer

Use BigQuery to query the metrics export and build a Looker Studio dashboard.

Answer

Use Cloud Logging to create a log-based dashboard with all four metrics.

Question 12

A team deploys a Cloud Run service that must access resources in a private VPC (a private Cloud SQL instance and a Redis instance on Memorystore). The Cloud Run service has no public IP connectivity requirements for these resources. What must be configured?

Accepted Answer

Configure a Serverless VPC Access connector and specify it in the Cloud Run service deployment. Cloud Run is a serverless compute platform that runs in a Google-managed VPC, not the customer's VPC. To access private resources like Cloud SQL and Memorystore (Redis) within a customer VPC, you must configure a Serverless VPC Access connector. This connector bridges the serverless environment to the specified VPC, enabling private, internal IP communication without public internet exposure.

Answer

Enable VPC Service Controls around Cloud Run to connect it to the VPC

Answer

Assign an external IP to the Cloud SQL and Memorystore instances — Cloud Run can reach them via public internet

Answer

Cloud Run automatically connects to any VPC resource in the same project via project-level networking

Question 13

A team runs a Kubernetes Deployment with 3 replicas behind a Service. They want to expose it externally with HTTPS and route traffic based on URL paths (/api → backend service, / → frontend service). Which Kubernetes resource handles path-based routing at Layer 7?

Accepted Answer

A Kubernetes Ingress resource with path rules. A Kubernetes Ingress resource is the native API object designed for Layer 7 (HTTP/HTTPS) routing, including path-based routing. It allows you to define rules that map URL paths (e.g., /api, /) to different backend Services, and it typically works with an Ingress controller (e.g., NGINX, HAProxy) that terminates TLS and performs the routing. This directly meets the requirement for external HTTPS exposure and path-based traffic splitting.

Answer

A LoadBalancer Service with path routing rules

Answer

A NodePort Service with iptables path routing rules

Answer

Multiple ClusterIP Services with DNS SRV records for path routing

Question 14

A Cloud Run service needs to read secrets from Secret Manager. The service is deployed with a custom runtime service account. Which IAM role should be granted to the runtime service account, and on which resource?

Accepted Answer

Grant `roles/secretmanager.secretAccessor` on the specific secret resource.. The principle of least privilege dictates that the runtime service account should only have the minimum permissions required to access the specific secret. The `roles/secretmanager.secretAccessor` role provides exactly the `secretmanager.versions.access` permission needed to read the secret value, and granting it on the specific secret resource (rather than the project) scopes the permission to that secret only, preventing broader access.

Answer

Grant `roles/secretmanager.admin` on the project.

Answer

Grant `roles/viewer` on the project.

Answer

Grant `roles/secretmanager.secretVersionManager` on the secret.

Question 15

Your team is planning a GKE cluster for a microservices application. Some services process sensitive payment data and must run on dedicated nodes that no other workloads can access. The rest of the application can share nodes. How should you configure the cluster?

Accepted Answer

Apply taints to the dedicated node pool and tolerations to payment service pod specs.. Taints on dedicated node pools prevent pods without matching tolerations from being scheduled on those nodes, ensuring that only payment service pods (which include the corresponding tolerations) can run on the dedicated nodes. This isolates sensitive workloads at the node level without requiring separate clusters, which would add operational overhead and complexity.

Answer

Use separate GKE clusters: one for payment services and one for everything else.

Answer

Use Kubernetes NetworkPolicy to restrict network access between payment pods and other pods.

Answer

Set resource requests and limits so payment services consume all resources on their nodes.