Google ACE Practice Questions 2 — 50 Questions

Question 1

A team deploys a containerized service to Cloud Run. After deployment, requests are timing out after 60 seconds. The service sometimes needs 3 minutes to process certain long-running requests. What should the team adjust?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the Cloud Run request timeout to at least 180 seconds. Cloud Run has a default request timeout of 60 seconds. Since the service requires up to 3 minutes (180 seconds) for certain long-running requests, the timeout must be increased to at least 180 seconds. This is configured via the `--timeout` flag or the `timeout_seconds` field in the YAML configuration, and the maximum allowed value is 60 minutes (3600 seconds).

Answer

Increase the minimum number of instances to reduce cold starts

Answer

Set concurrency to 1 to ensure each instance handles only one request at a time

Answer

Switch to Cloud Run Jobs instead of Cloud Run Services

Question 2

A team's CI/CD pipeline authenticates to GCP using Application Default Credentials (ADC). The pipeline runs on a GCE VM with a service account attached. Which credential source does the ADC use when running on a GCE VM?

Accepted Answer

The VM's attached service account credentials via the instance metadata server. On a GCE VM, Application Default Credentials (ADC) automatically uses the credentials from the VM's attached service account by querying the instance metadata server at the link-local address 169.254.169.254. This is the default behavior when no environment variable or other credential source is explicitly configured, making option B correct.

Answer

The GOOGLE_APPLICATION_CREDENTIALS environment variable pointing to a JSON key file

Answer

The developer's personal Google account used during `gcloud auth login`

Answer

A randomly selected service account from the project's service accounts list

Question 3

A GKE Deployment runs a web application with 6 replicas across a 3-node cluster. To ensure no two replicas land on the same node (maximizing availability), which Pod spec configuration should be applied?

Accepted Answer

Set podAntiAffinity with requiredDuringSchedulingIgnoredDuringExecution and topologyKey: kubernetes.io/hostname. `podAntiAffinity` with `requiredDuringSchedulingIgnoredDuringExecution` and `topologyKey: kubernetes.io/hostname` forces the scheduler to place each replica on a different node. This ensures that no two pods of the same Deployment run on the same Kubernetes node, maximizing availability by preventing a single node failure from taking down more than one replica.

Answer

Set podAffinity with requiredDuringSchedulingIgnoredDuringExecution and topologyKey: kubernetes.io/hostname

Answer

Set topologySpreadConstraints with maxSkew: 1 and topologyKey: kubernetes.io/hostname

Answer

Set nodeSelector to a specific node for each replica

Question 4

A team discovers their Cloud Logging costs are unexpectedly high. The majority of costs come from verbose DEBUG-level logs from a development service in production. They want to stop storing DEBUG logs without modifying the application. What is the solution?

Accepted Answer

Create a Cloud Logging exclusion filter to discard DEBUG-level log entries from the service. Cloud Logging exclusion filters allow you to discard log entries based on criteria such as severity level, log name, or resource labels before they are ingested and stored. By creating an exclusion filter that matches DEBUG-level log entries from the specific development service, you can stop storing those logs without modifying the application code. This approach directly reduces storage costs because excluded logs are not indexed or retained.

Answer

Set the application's log level to INFO — this is the only way to reduce log volume

Answer

Move the development service to a separate GCP project with a lower logging tier

Answer

Delete old DEBUG log entries manually — Cloud Logging charges for stored volume

Question 5

A web application uses a managed instance group. Traffic spikes sharply between 9 AM and 5 PM and drops to near zero overnight. Which autoscaling metric most directly triggers scale-out before user experience degrades?

Accepted Answer

HTTP load balancing serving capacity (requests per second per instance). HTTP load balancing serving capacity (requests per second per instance) is the most direct metric because it measures the actual user-facing load on each instance. When traffic spikes, this metric rises immediately, triggering scale-out before instances become saturated and response times degrade. CPU utilization can lag behind the spike due to queuing or async processing, making it less responsive for sharp traffic patterns.

Answer

Average CPU utilization of instances in the group

Answer

Pub/Sub subscription queue depth

Answer

Disk I/O throughput

Question 6

Your GKE application's pods are being evicted frequently during periods of high traffic. You notice that pods without resource requests are being evicted first. The nodes are running at ~85% memory utilization. What should you do to reduce pod eviction?

Accepted Answer

Set memory requests and limits for all pods to match their actual memory usage.. Setting memory requests and limits for all pods to match their actual memory usage ensures that the Kubernetes scheduler can accurately allocate resources and make informed scheduling decisions. Without requests, pods are treated as BestEffort QoS class, making them the first candidates for eviction under memory pressure (when nodes exceed ~85% utilization). By defining requests, pods are classified as Burstable or Guaranteed, which gives them higher priority during eviction and prevents unnecessary disruptions.

Answer

Increase the node machine type to have more memory.

Answer

Configure pod disruption budgets (PDBs) to prevent eviction.

Answer

Enable cluster autoscaler to add nodes before memory pressure occurs.

Question 7

A team runs a Kubernetes CronJob that performs nightly database cleanup. The job runs at 2 AM UTC. This morning, the team notices the job failed at 2 AM but no one was alerted. How should the team configure alerting for CronJob failures?

Accepted Answer

Create a log-based metric on CronJob failure events in Cloud Logging and an alerting policy on that metric. Google Cloud Logging captures Kubernetes CronJob failure events, and you can create a log-based metric to count these failures. An alerting policy on that metric then triggers notifications when failures occur, providing a reliable, customizable alerting mechanism that does not depend on job history or restart policies.

Answer

Set `successfulJobsHistoryLimit: 0` — GKE sends an alert when the history is empty

Answer

Set `restartPolicy: Always` on the CronJob's Pod template — it will retry until success

Answer

Enable GKE's built-in CronJob alerting feature in the cluster's Notifications settings

Question 8

You are planning a GCP network for a company with offices in three regions: `us-central1`, `europe-west1`, and `asia-east1`. All three regions must communicate with each other, and traffic must NOT traverse the public internet. Each region has its own subnet. Which network design achieves this with the least management overhead?

Accepted Answer

Use a single global VPC with subnets in each region; traffic between subnets stays on Google's private network.. A single global VPC allows you to create subnets in multiple regions, and traffic between those subnets stays on Google's private backbone network without traversing the public internet. This design requires no additional connectivity configuration, peering, or VPN tunnels, making it the simplest to manage while meeting all requirements.

Answer

Create three separate VPCs (one per region) and connect them with VPC Network Peering.

Answer

Set up Cloud VPN tunnels between each pair of regions.

Answer

Use Cloud Interconnect dedicated connections in each region and configure BGP routing between them.

Question 9

A security team wants to prevent every project in the organization from creating VM instances with external IP addresses — without requiring configuration in each individual project. What is the most scalable solution?

Accepted Answer

Set the organization policy constraint compute.vmExternalIpAccess to Deny All at the organization level. The organization policy constraint `compute.vmExternalIpAccess` can be applied at the organization level to deny all VM instances from having external IP addresses, enforcing this rule across all projects without per-project configuration. This is the most scalable approach as it uses Google Cloud's hierarchical policy engine to centrally control resource creation, overriding any project-level settings.

Answer

Create a firewall rule in every project blocking outbound traffic on port 80 and 443

Answer

Remove the Compute Engine Admin role from all project owners

Answer

Use Cloud Armor to block all traffic destined for public IPs in the organization

Question 10

A GCP project administrator needs to share read-only access to all resources in the project with an external auditor who has a Gmail account (auditor@gmail.com). What should the admin do?

Accepted Answer

Grant the Viewer role to auditor@gmail.com in the project's IAM policy. Granting the Viewer (roles/viewer) role to auditor@gmail.com in the project's IAM policy is correct because it provides read-only access to all resources in the project without requiring a Cloud Identity account. Gmail accounts are supported as Google Accounts and can be added directly to IAM policies, allowing them to authenticate and access resources via the GCP Console or APIs.

Answer

Create a service account for the auditor and share the JSON key file

Answer

Add auditor@gmail.com as a project billing admin to give them read-only access

Answer

Create a Cloud Identity account for the auditor — Gmail accounts cannot access GCP projects

Question 11

A financial trading platform must support globally distributed, strongly consistent SQL transactions at thousands of writes per second, with no downtime for planned maintenance. Which GCP database service meets all these requirements?

Accepted Answer

Cloud Spanner. Cloud Spanner is the only GCP database service that provides globally distributed, strongly consistent SQL transactions with horizontal scaling, supporting thousands of writes per second. It uses synchronous replication across regions and TrueTime-based clock synchronization to ensure external consistency, while also offering 99.999% availability with no planned downtime for maintenance.

Answer

Cloud SQL with synchronous read replicas

Answer

Cloud Bigtable

Answer

Cloud Firestore

Question 12

An e-commerce platform sees a 20x traffic spike every Black Friday. The rest of the year traffic is low and stable. The team wants to minimize costs during normal periods while handling the annual peak without manual intervention. Which architecture achieves this?

Accepted Answer

Managed instance group with autoscaling + scheduled scaling pre-warming before Black Friday. It combines managed instance group autoscaling for normal low-cost operation with scheduled scaling to pre-warm capacity before the Black Friday spike, ensuring seamless handling of the 20x traffic surge without manual intervention. This approach uses the 'autoscaler' and 'scheduled scaling' features in Google Cloud to dynamically adjust resources based on load, while pre-warming prevents cold-start latency during the peak.

Answer

Pre-provision 20x capacity year-round to guarantee Black Friday performance

Answer

Deploy on Cloud SQL — it scales compute automatically for traffic spikes

Answer

Add 20 manual VMs on Black Friday and delete them afterward each year

Question 13

A team's GKE application is running out of memory due to a memory leak. Pods are restarting with OOMKilled status. As an immediate measure before a code fix is available, what kubectl action provides the most insight into which container is leaking?

Accepted Answer

kubectl top pods --containers -n [NAMESPACE]. `kubectl top pods --containers` shows per-container CPU and memory usage for each pod in the namespace. This allows you to identify which specific container within a pod is consuming excessive memory and triggering the OOMKilled status, even before a code fix is deployed. It provides immediate, real-time insight into resource consumption at the container level, which is essential for diagnosing a memory leak in a multi-container pod.

Answer

kubectl get events --field-selector=reason=OOMKilling

Answer

kubectl delete pod [POD_NAME] -- force=true to clear the memory leak

Answer

gcloud container clusters describe [CLUSTER] --memory-usage

Question 14

A company requires that all service account keys be automatically rotated every 90 days. Which two steps should the administrator take to enforce this? (Choose two.)

Accepted Answer

Use the Service Account API to create keys with a custom expiration time.. The Service Account API allows creating keys with a custom expiration time, which enforces automatic rotation by ensuring keys are invalid after 90 days. Option E is correct because a Cloud Function can monitor key age and delete keys older than 90 days, providing a programmatic enforcement mechanism. Both approaches ensure keys are rotated automatically without manual intervention.

Answer

Enable the Service Account Key Rotator in the Google Cloud Console.

Answer

Use IAM to set a condition that keys must have an expiration date.

Answer

Use an Organization Policy to disable service account key creation.

Question 15

An organization with multiple teams needs to provision separate, isolated environments (e.g., development, test, production) while sharing common services like Cloud NAT and VPC firewall rules. Which VPC networking pattern is most suitable?

Accepted Answer

Shared VPC (XPN). Shared VPC (XPN) allows an organization to create a single, centrally managed VPC network that hosts common services like Cloud NAT and firewall rules, while enabling multiple project teams to provision their own isolated environments (dev, test, prod) within that same VPC. This pattern meets the requirement for separate, isolated environments with shared services without needing individual VPCs for each team.

Answer

Network Service Tiers (Premium vs Standard)

Answer

VPC Network Peering between team VPCs

Answer

Single VPC with per-team firewall rules

Question 16

A GKE Deployment must be updated to a new container image version with zero downtime — old Pods should be replaced gradually, not all at once. Which update strategy should be configured?

Accepted Answer

RollingUpdate strategy. The RollingUpdate strategy is correct because it gradually replaces old Pods with new ones while keeping the Deployment available, ensuring zero downtime. By default, it uses a `maxSurge` of 25% and `maxUnavailable` of 25%, allowing a controlled, incremental rollout that matches the requirement of replacing Pods gradually rather than all at once.

Answer

Recreate strategy

Answer

Blue-green deployment using a separate Deployment and Service selector swap

Answer

Canary deployment with a traffic-splitting ingress

Question 17

A public API receives global traffic but has been targeted by both volumetric DDoS attacks and SQL injection attempts in HTTP request parameters. Which single GCP service provides protection against both threats?

Accepted Answer

Cloud Armor security policies on the load balancer. Cloud Armor security policies, when attached to a Google Cloud HTTPS Load Balancer, provide both Layer 7 DDoS protection (via pre-configured WAF rules like 'modsecurity-crs' to block SQL injection) and volumetric DDoS defense (via rate limiting and adaptive protection). This makes it the single GCP service that directly addresses both threats mentioned in the question.

Answer

VPC firewall rules with deny rules for known attacker IPs

Answer

Cloud NAT to hide backend IP addresses

Answer

Identity-Aware Proxy (IAP) to require authentication before accessing the API

Question 18

Your application exposes a REST API that external partners consume. You need rate limiting per partner (API key), usage analytics, and developer portal for onboarding. Traffic is currently 1,000 requests/day but expected to grow to 10M/day within a year. Which GCP service best fits these requirements?

Accepted Answer

Apigee API Management. Apigee API Management is correct because it provides built-in rate limiting per API key (via quota policies), detailed analytics dashboards for usage tracking, and a developer portal for partner onboarding and key management. Unlike simpler API gateways, Apigee is designed for enterprise-grade API management at scale, handling growth from 1,000 to 10M requests/day with features like monetization, traffic management, and security policies.

Answer

Cloud Endpoints with Extensible Service Proxy

Answer

Cloud Armor with rate limiting rules

Answer

API Gateway with a backend Cloud Run service

Question 19

A team needs to export all Cloud Logging entries from a production GCP project to a BigQuery dataset for long-term analysis and compliance. The export must be near-real-time and include future log entries automatically. Which approach achieves this?

Accepted Answer

Create a log sink (Log Router) that routes all logs from the project to the BigQuery dataset. A log sink (Log Router) in Cloud Logging can be configured to route log entries in near-real-time to a BigQuery dataset. This approach automatically includes all future log entries without requiring any scheduled jobs or manual intervention, making it ideal for long-term analysis and compliance.

Answer

Schedule a daily Cloud Function to query the Logging API and write results to BigQuery

Answer

Use BigQuery Data Transfer Service to pull logs from Cloud Logging on a schedule

Answer

Enable VPC Flow Logs and stream them directly to BigQuery

Question 20

A platform engineer is deploying a Kubernetes Job that processes a batch of records. The Job should run 10 parallel workers, each processing a subset of records, and complete when all workers finish successfully. Which Job spec configuration achieves this?

Accepted Answer

Set parallelism: 10 and completions: 10 in the Job spec. In Kubernetes, a Job's `parallelism` field specifies the number of Pods that can run concurrently, and `completions` specifies the total number of successful Pod completions required for the Job to be considered finished. Setting both to 10 ensures exactly 10 Pods run in parallel, each processing a subset of records, and the Job completes only when all 10 have succeeded.

Answer

Set replicas: 10 in the Job spec

Answer

Create 10 separate Job objects — one per worker

Answer

Set concurrency: 10 in the Job spec