Google ACE Practice Questions 2 — 50 Questions

Question 1

A team runs a Kubernetes CronJob that performs nightly database cleanup. The job runs at 2 AM UTC. This morning, the team notices the job failed at 2 AM but no one was alerted. How should the team configure alerting for CronJob failures?

Accepted Answer

Create a log-based metric on CronJob failure events in Cloud Logging and an alerting policy on that metric. Option B is correct because Google Cloud Logging captures Kubernetes CronJob failure events, and you can create a log-based metric to count these failures. An alerting policy on that metric then triggers notifications when failures occur, providing a reliable, customizable alerting mechanism that does not depend on job history or restart policies.

Answer

Set `successfulJobsHistoryLimit: 0` — GKE sends an alert when the history is empty

Answer

Set `restartPolicy: Always` on the CronJob's Pod template — it will retry until success

Answer

Enable GKE's built-in CronJob alerting feature in the cluster's Notifications settings

Question 2

A team builds a GKE application that processes healthcare data. Regulatory requirements mandate that data in transit between GKE nodes must be encrypted. GKE is running on GCP. What provides encrypted node-to-node traffic within the cluster?

Accepted Answer

GCP automatically encrypts all VM-to-VM traffic in transit within its network. GCP automatically encrypts all VM-to-VM traffic in transit at the network layer, including traffic between GKE nodes, using a combination of MACsec (IEEE 802.1AE) and IPsec. This encryption is enabled by default for all traffic within a VPC and between VPCs, without any configuration required. Therefore, node-to-node traffic within a GKE cluster is already encrypted, satisfying the regulatory requirement.

Answer

GKE node traffic is unencrypted by default — mTLS must be manually configured on every Pod

Answer

Enable VPC Flow Logs — they activate encryption for logged traffic

Answer

Install a TLS termination proxy on each GKE node — it encrypts intranode traffic

Question 3

A Cloud Run service calls external third-party APIs that have rate limits. Under burst traffic, the service spawns many concurrent instances, each making direct API calls, causing rate limit errors. What GCP pattern reduces API call volume without adding infrastructure?

Accepted Answer

Cache third-party API responses in Cloud Memorystore (Redis) with appropriate TTL. Caching third-party API responses in Cloud Memorystore (Redis) with an appropriate TTL reduces the number of outbound API calls by serving cached data to multiple concurrent Cloud Run instances. This directly addresses rate-limit errors without adding new infrastructure, as Memorystore is a managed in-memory cache that integrates seamlessly with Cloud Run via a VPC connector.

Answer

Set Cloud Run max-concurrency to 1 so each instance handles one request

Answer

Enable Cloud CDN on the Cloud Run service to cache outbound requests

Answer

Migrate to Cloud Functions with a lower default concurrency limit

Question 4

A Cloud Run service requires access to a private Cloud SQL instance in the same VPC. The Cloud SQL instance is not publicly accessible. How should the Cloud Run service connect to Cloud SQL without using the Cloud SQL Auth Proxy separately?

Accepted Answer

Configure the Cloud Run service with `--add-cloudsql-instances` to connect via the built-in Auth Proxy. Option B is correct because the Cloud Run service can use the `--add-cloudsql-instances` flag, which automatically deploys a built-in Cloud SQL Auth Proxy sidecar container within the same pod. This proxy establishes a secure, encrypted connection to the private Cloud SQL instance using the instance's private IP, without requiring the instance to have a public IP or the user to manage a separate proxy. The proxy authenticates via the service account attached to the Cloud Run service, enabling seamless and secure connectivity.

Answer

Use the Cloud SQL public IP with SSL required — Cloud Run can reach public IPs

Answer

Deploy a separate Cloud SQL Auth Proxy container in the same Cloud Run service as a sidecar

Answer

Enable Serverless VPC Access connector to route Cloud Run traffic to the private Cloud SQL IP

Question 5

A Cloud Build pipeline builds a container image and pushes it to Artifact Registry. The next step needs to deploy the image to Cloud Run. The pipeline runs as the Cloud Build service account. What minimum permission does the Cloud Build SA need for the deployment step?

Accepted Answer

`roles/run.admin` and `roles/iam.serviceAccountUser` on the Cloud Run runtime service account.. The Cloud Build service account needs `roles/run.admin` to deploy services to Cloud Run, but it also requires `roles/iam.serviceAccountUser` on the Cloud Run runtime service account (the identity the Cloud Run service runs as) because the deployment step impersonates that runtime service account to create or update the service. Without the `iam.serviceAccountUser` permission, the deployment fails with a permission denied error, even if the Cloud Build SA has full Cloud Run admin rights.

Answer

`roles/run.admin` only.

Answer

`roles/owner` to ensure all necessary permissions are covered.

Answer

`roles/cloudbuild.builds.editor` on the Cloud Run project.

Question 6

You have a Cloud Run service configured with `min-instances: 0`. During load testing you notice the first request after a period of inactivity takes 3–5 seconds instead of the normal 100ms. Subsequent requests are fast. What is causing this, and what is the most cost-effective fix?

Accepted Answer

Set `min-instances: 1` to keep a warm instance running and eliminate the cold start latency.. Cold starts occur when Cloud Run needs to spin up a new container instance from zero. The 3–5 second delay is the container startup time. Setting `min-instances: 1` keeps at least one instance warm at all times, eliminating cold starts for the first request. This adds a small cost (one always-running instance) but is the most targeted fix. Increasing memory or CPU doesn't directly address cold start if the issue is container initialization time.

Answer

The Cloud Run service's container image is too large; reduce image size.

Answer

Switch from Cloud Run to GKE, which doesn't have cold starts.

Answer

Increase Cloud Run's request timeout to 30 seconds to accommodate cold starts.

Question 7

A Cloud SQL instance's disk is at 95% capacity. The application is experiencing write failures. You need to resolve this immediately with no downtime. What should you do?

Accepted Answer

Increase the disk size via the Cloud SQL console or `gcloud sql instances patch` — this occurs with no instance restart.. Option B is correct because Cloud SQL supports dynamic disk resizing without requiring an instance restart. When you increase the disk size via the console or `gcloud sql instances patch`, the change takes effect immediately, allowing the database to continue serving writes without downtime. This directly resolves the write failures caused by disk-full conditions.

Answer

Take a snapshot of the instance, create a new larger instance from the snapshot, then update the connection string.

Answer

Delete old database tables to free up space.

Answer

Switch the instance to SSD storage, which has higher throughput and allows more writes.

Question 8

You deploy a Cloud Function (gen1) that calls an external API. During testing you find the function times out after 60 seconds even though you set `--timeout=540`. You also notice the function logs show execution completing in 45 seconds before the timeout. What is the most likely cause of the external timeout?

Accepted Answer

The HTTP client library used in the function has a default 60-second socket/connection timeout.. Option B is correct because the external API call is timing out due to the HTTP client library's default socket/connection timeout, which is often set to 60 seconds. Even though the Cloud Function's overall timeout is configured to 540 seconds, the HTTP request itself has its own timeout that expires before the function completes. The function logs show execution finishing in 45 seconds, indicating the function code completes, but the external API call fails silently or the response is not received within the client's timeout window.

Answer

Cloud Functions gen1 has a hard maximum timeout of 60 seconds regardless of configuration.

Answer

Cloud VPC restricts outbound connections to 60 seconds.

Answer

The function's service account lacks permission to make outbound HTTP calls.

Question 9

A Cloud Storage bucket contains sensitive PII data. You need to ensure that objects in this bucket are encrypted using a key that your security team controls, and that the key can be revoked if needed to render all data inaccessible. Which encryption option should you use?

Accepted Answer

Configure Customer-Managed Encryption Keys (CMEK) using Cloud KMS.. Option B is correct because Customer-Managed Encryption Keys (CMEK) allow you to control and manage the key used for encrypting Cloud Storage objects via Cloud KMS. This enables key revocation, which immediately renders all data encrypted with that key inaccessible, meeting the security team's requirement for revocable control.

Answer

Use Google-managed encryption keys (default).

Answer

Enable Cloud Storage's built-in server-side encryption with AES-256.

Answer

Use Customer-Supplied Encryption Keys (CSEK) by embedding the key in each API request.

Question 10

A team runs `gcloud organizations list` and sees no output even though they know their company has a GCP organization. What is the most likely cause, and how should they resolve it?

Accepted Answer

The user lacks org-level IAM permissions such as Organization Viewer.. The `gcloud organizations list` command retrieves organizations from the GCP Resource Manager API. If no output is returned despite the organization existing, the most likely cause is that the authenticated user lacks the `resourcemanager.organizations.get` permission, which is granted by roles like Organization Viewer (`roles/resourcemanager.organizationViewer`) or Organization Administrator (`roles/resourcemanager.organizationAdmin`). Without this IAM permission at the organization level, the API call returns an empty list rather than an error, which is a common source of confusion.

Answer

The organization does not exist yet; run `gcloud organizations create` to create it.

Answer

The gcloud SDK does not support the organizations command; use the Cloud Console instead.

Answer

The project must be linked to the organization using `gcloud projects move`.

Question 11

A Cloud Run service needs to read secrets from Secret Manager. The service is deployed with a custom runtime service account. Which IAM role should be granted to the runtime service account, and on which resource?

Accepted Answer

Grant `roles/secretmanager.secretAccessor` on the specific secret resource.. The principle of least privilege dictates that the runtime service account should only have the minimum permissions required to access the specific secret. The `roles/secretmanager.secretAccessor` role provides exactly the `secretmanager.versions.access` permission needed to read the secret value, and granting it on the specific secret resource (rather than the project) scopes the permission to that secret only, preventing broader access.

Answer

Grant `roles/secretmanager.admin` on the project.

Answer

Grant `roles/viewer` on the project.

Answer

Grant `roles/secretmanager.secretVersionManager` on the secret.

Question 12

You are reviewing a GCP project's IAM policy and find that the `allUsers` principal has `storage.objectViewer` on a Cloud Storage bucket. The bucket contains internal documentation. What are the security implications, and what should you do?

Accepted Answer

Any person on the internet can read the internal documents; remove the `allUsers` binding immediately and restrict access to authorized identities.. Option B is correct because granting `storage.objectViewer` to `allUsers` makes the bucket's objects publicly readable by anyone on the internet, including anonymous users. This violates the principle of least privilege and exposes internal documentation to unauthorized access. The immediate remediation is to remove the `allUsers` binding and replace it with specific, authenticated identities (e.g., service accounts or Google Groups) that require access.

Answer

This is acceptable if the bucket has Uniform Bucket-Level Access enabled; UBLA encrypts the data.

Answer

This is a read-only permission so it's acceptable — attackers can't modify the documents.

Answer

Enable Cloud Armor on the bucket to restrict access to your corporate IP range.

Question 13

A developer needs to test a Cloud Run service locally before deploying it to GCP. The service is packaged as a Docker container. Which tool allows them to run and test the container locally in a way that closely mimics the Cloud Run execution environment?

Accepted Answer

Run the container using `docker run -p 8080:8080 IMAGE` with the required environment variables.. Option A is correct because `docker run -p 8080:8080 IMAGE` with the required environment variables directly runs the containerized Cloud Run service on your local machine, mapping port 8080 to the container's port 8080 (the default Cloud Run listens on). This approach closely mimics the Cloud Run execution environment because Cloud Run also runs containers in a Docker-like runtime, and you can replicate environment variables, memory limits, and concurrency settings locally for accurate testing before deployment.

Answer

Deploy the service to a staging Cloud Run environment using `gcloud run deploy --no-traffic`.

Answer

Use `gcloud run services describe` to simulate a local run.

Answer

Use Cloud Shell to run the container since Cloud Shell has Docker installed.

Question 14

You need to store application configuration data that changes infrequently (e.g., feature flags, database connection strings). Multiple services need to read this configuration at startup, and values must never appear in application code or container images. Updates to configuration should not require redeploying services. Which GCP service is most appropriate?

Accepted Answer

Use Cloud Secret Manager to store and retrieve configuration at runtime.. Secret Manager is designed exactly for storing sensitive configuration (connection strings, API keys, feature flags with sensitive values). Secrets can be accessed via API or SDK at runtime without being embedded in code or images. Secret Manager supports versioning, automatic rotation triggers, and IAM-controlled access. When a secret value changes, services can be configured to reload it without redeployment using Secret Manager's notification integration.

Answer

Store configuration in environment variables set at deployment time.

Answer

Store configuration in a Cloud Storage bucket readable by all services.

Answer

Use Cloud Firestore to store configuration documents that services read on startup.

Question 15

You are managing a GKE cluster that runs a mixed workload: latency-sensitive web services and batch data processing jobs. The batch jobs run for hours and consume significant CPU/memory. During batch peaks, the web services experience CPU throttling. What is the best configuration to prevent batch jobs from impacting web service latency?

Accepted Answer

Assign web service pods a higher PriorityClass and run batch jobs on a separate node pool with taints.. Option B is correct because it uses PriorityClass to ensure web service pods are scheduled and maintained over batch pods during resource contention, while placing batch jobs on a separate node pool with taints isolates their resource consumption. This prevents batch jobs from causing CPU throttling on latency-sensitive web services by guaranteeing that web pods have priority access to CPU cycles and that batch workloads do not share nodes with web pods.

Answer

Set CPU requests and limits on batch job pods to be lower than web service pods.

Answer

Use Horizontal Pod Autoscaler for batch jobs so they scale down during peak web traffic.

Answer

Enable Cluster Autoscaler so new nodes are added when batch jobs demand more resources.

Question 16

You need to ensure that a Cloud Run service can only be invoked by specific Cloud Scheduler jobs and not from the public internet, while still receiving HTTP requests. The Cloud Run service currently allows unauthenticated invocations. What configuration changes are required?

Accepted Answer

Disable unauthenticated invocations on the Cloud Run service, grant `roles/run.invoker` to the Scheduler SA, and configure Scheduler to use OIDC authentication.. Option B is correct because Cloud Run services that require authentication must have unauthenticated invocations disabled, and the Cloud Scheduler service account must be granted the `roles/run.invoker` role. Additionally, Cloud Scheduler must be configured to use OIDC authentication, which allows it to present an identity token signed by Google to the Cloud Run service, ensuring only authorized scheduler jobs can invoke the service.

Answer

Add a Cloud Armor security policy to the Cloud Run service blocking all IPs except Cloud Scheduler.

Answer

Deploy the Cloud Run service in a VPC and use a VPC firewall rule to block all traffic except Cloud Scheduler.

Answer

Add a secret header to Cloud Scheduler requests and validate it in the Cloud Run application code.

Question 17

You have a GCP organization with hundreds of projects. You need to find all projects that have the `compute.googleapis.com` API enabled. Which approach provides the most efficient way to query this across all projects?

Accepted Answer

Use Cloud Asset Inventory to search for `serviceusage.googleapis.com/Service` assets with state `ENABLED` and name matching `compute.googleapis.com`.. Cloud Asset Inventory provides a scalable, API-driven way to query resources across all projects in an organization without iterating over each project. By searching for `serviceusage.googleapis.com/Service` assets with `state: ENABLED` and `name: compute.googleapis.com`, you can retrieve the exact list of projects with the Compute Engine API enabled in a single, efficient query. This avoids the latency and quota limitations of scripting against each project individually.

Answer

Write a script that runs `gcloud services list --enabled` for each project ID returned by `gcloud projects list`.

Answer

Check the Cloud Console's API library for each project manually.

Answer

Query Cloud Billing export data in BigQuery for projects with Compute Engine line items.

Question 18

You need persistent shared file storage for a legacy application running on multiple Compute Engine VMs that requires POSIX-compliant file system access (NFS). The workload is I/O intensive with files up to 100 GB. Which GCP storage service should you use?

Accepted Answer

Cloud Filestore (NFS). Cloud Filestore provides a fully managed NFS server that supports POSIX-compliant file access, making it the correct choice for a legacy application requiring NFS. It can handle I/O-intensive workloads with large files (up to 100 GB) by offering high throughput and low-latency access from multiple Compute Engine VMs simultaneously.

Answer

Cloud Storage FUSE mounted on each VM

Answer

Persistent Disk attached in ReadWriteMany mode to all VMs

Answer

Local SSD on each VM with rsync synchronization between VMs

Question 19

You are designing a GKE cluster for a workload that requires high-memory instances (768 GB RAM) for in-memory analytics. Standard machine types in GCP don't offer this configuration. Which machine family should you select for the node pool?

Accepted Answer

Memory-optimized (M1 or M2) machine family. The M1 and M2 memory-optimized machine families are specifically designed for workloads requiring large amounts of RAM, such as in-memory analytics, with configurations offering up to 12 TB of memory. Standard machine types like N2 do not provide 768 GB RAM instances, making memory-optimized families the correct choice for this high-memory requirement.

Answer

N2 machine family with custom vCPU and memory configuration

Answer

Compute-optimized (C2) machine family

Answer

Accelerator-optimized (A2) machine family

Question 20

You need to configure a GCP organization so that when new projects are created, a specific set of default IAM bindings is automatically applied (e.g., the security team's group gets Security Reviewer on every new project). Which approach achieves this without requiring manual post-creation steps?

Accepted Answer

Trigger a Cloud Function via Eventarc on project creation audit log events to automatically apply the IAM bindings.. Option B is correct because it uses Eventarc to capture audit log events for 'google.cloud.resourcemanager.v3.CreateProject' and triggers a Cloud Function that programmatically applies IAM bindings to the new project. This ensures the bindings are applied automatically without manual steps, leveraging serverless event-driven architecture.

Answer

Set an org policy constraint that applies default IAM bindings to all new projects.

Answer

Require all project creators to use a Terraform module that includes the IAM binding in its configuration.