Google ACE Practice Exam 51 — 20 Questions

Question 1

A compliance requirement mandates that all VM-to-VM traffic within a GCP project must be encrypted in transit, even for internal VPC traffic. Which feature enforces this for Compute Engine?

Accepted Answer

Mutual TLS (mTLS) enforced at the application layer between VMs. Mutual TLS (mTLS) enforced at the application layer is the correct answer. mTLS requires both client and server to present certificates and establishes a TLS-encrypted session between applications, ensuring encryption in transit for VM-to-VM traffic. In GCP, mTLS must be implemented within the application code or via a service mesh, not as a VPC-level feature. The other options are incorrect: Shielded VMs with Secure Boot protect boot integrity but do not encrypt traffic; VPC firewall rules filter traffic based on IP/port but cannot enforce encryption of the payload; VPC Flow Logs provide network monitoring but no encryption.

Answer

Shielded VMs with Secure Boot enabled

Answer

VPC firewall rules denying all non-encrypted traffic

Answer

Enabling VPC Flow Logs on all subnets

Question 2

A company wants to allow developers to create Compute Engine instances with a specific set of persistent disk types (e.g., only pd-ssd). Which TWO methods can be used to enforce this? (Choose two.)

Accepted Answer

Organization policy with constraint compute.restrictDiskTypes. The `compute.restrictDiskTypes` organization policy constraint allows administrators to define a list of allowed persistent disk types (e.g., pd-ssd) at the project, folder, or organization level. When set, any Compute Engine instance creation request that specifies a disk type not on the allowed list will be denied by the policy engine, enforcing the restriction without requiring changes to individual IAM roles or scripts.

Answer

Organization policy with constraint compute.requireShieldedVm

Answer

VPC custom firewall rules

Answer

Service account permissions

Question 3

A project has the following IAM bindings: User A has `roles/editor` at the project level, and a folder-level policy denies `roles/editor` to User A. Which effective permission does User A have on the project?

Accepted Answer

User A is denied Editor permissions because IAM Deny policies at a parent resource override allow grants at child resources.. In Google Cloud, IAM Deny policies at a parent resource (like a folder) override allow bindings at a child resource (like a project). Even though User A has `roles/editor` granted at the project level, the folder-level Deny policy explicitly denies that role, so the effective permission is denial. This follows the principle that Deny policies are evaluated before Allow bindings and take precedence.

Answer

User A has Editor permissions because project-level IAM takes precedence over folder-level.

Answer

User A has no permissions because conflicting policies result in no access.

Answer

User A has Editor permissions because folder-level policies don't apply to individual projects.

Question 4

A new developer is setting up their first Google Cloud project. They need to perform initial project configuration. Which TWO actions are necessary before they can create any resources? (Choose TWO.)

Accepted Answer

Enable billing for the project.. To create any resources in a Google Cloud project, billing must be enabled for the project. This is the only essential step among the options. Enabling the Cloud Billing API is not required because billing can be enabled through the Cloud Console without API calls. The other options—creating a custom IAM role, setting up Identity Platform, or creating a VPC network—are optional and not prerequisites for initial resource creation. While some resources may require specific APIs, enabling the Cloud Billing API itself is not a necessary step.

Answer

Create a custom IAM role.

Answer

Set up Identity Platform.

Answer

Create a VPC network.

Answer

Enable the Cloud Billing API.

Question 5

A team stores sensitive configuration files in Cloud Storage that internal services download at startup. External partners occasionally need time-limited access to specific files without creating GCP accounts. Which feature grants temporary access without modifying bucket permissions?

Accepted Answer

Generate a Signed URL for the specific files with the required expiration time. Signed URLs provide time-limited, granular access to specific Cloud Storage objects without altering the underlying bucket permissions. The partner receives a URL that embeds authentication information and an expiration time, enabling secure, temporary downloads without requiring a GCP account or IAM role.

Answer

Make the specific files publicly readable and share the direct URL

Answer

Create a temporary GCP service account for the partner and share its JSON key

Answer

Enable uniform bucket-level access and create a public IAM binding for 24 hours

Question 6

An engineer needs to deploy a containerized web application that receives HTTP requests and should scale to zero when not in use. The application is stateless and has a lightweight container image. Which Google Cloud compute service should be used?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform that scales to zero when no requests are coming in, and bills per request. It is ideal for stateless HTTP-triggered container workloads.

Answer

Compute Engine with a single VM

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE) Standard cluster

Question 7

A company is running a stateful application on a Compute Engine instance with a 200 GB persistent disk. They want to reduce costs by moving the disk to a lower-cost storage class, but the disk is currently in use. They plan to take a snapshot of the disk and create a new disk from the snapshot with the new storage class. However, they need minimal downtime. What is the correct approach?

Accepted Answer

Take a snapshot of the disk, create a new disk from the snapshot with the new storage class, then detach the old disk and attach the new disk to the same VM. To change the storage class of a persistent disk, you cannot directly change it; you must create a new disk from a snapshot. To minimize downtime, you can create a snapshot while the VM is running (crash-consistent if on a live instance), then create a new disk with the desired storage class, stop the VM, detach the old disk, attach the new disk, and start the VM. This results in a brief downtime but is the standard method.

Answer

Use the 'gcloud compute disks update' command to change the storage class while the disk is attached to a running VM

Answer

Create a new disk with the new storage class and use rsync to copy data from the old disk while both are attached to the same VM

Answer

Stop the VM, take a snapshot, create a new disk with the new storage class, and start the VM with the new disk

Question 8

An administrator needs to create a Cloud SQL for PostgreSQL instance with 16 vCPUs and 60 GB of memory. Which tier should they specify?

Accepted Answer

db-custom-16-61440. Cloud SQL tiers follow the pattern db-custom-#vcpus-#memoryMB. 16 vCPUs and 60 GB (61440 MB) uses db-custom-16-61440.

Answer

db-custom-16-60

Answer

db-n1-standard-16

Answer

db-custom-16-60000

Question 9

A company wants to use Cloud Run to deploy a containerized API that requires up to 8 GB of memory per request. The API experiences unpredictable traffic spikes. They want to minimize cost while ensuring fast cold starts. Which configuration should they use?

Accepted Answer

Set min-instances to 1 and max-instances to a value that handles peak traffic with CPU throttled. Cloud Run supports up to 8 GB memory per container (as of 2024). Setting min-instances to a small number (e.g., 1) reduces cold starts, while max-instances limits costs during spikes. CPU boost can also speed up cold starts. Using CPU always allocated increases costs, so CPU throttled (default) is fine. The question emphasizes cost minimization, so setting a minimal min-instances is appropriate.

Answer

Use Cloud Run jobs instead of Cloud Run service

Answer

Deploy the container to GKE Autopilot with a single pod

Answer

Set max-instances to a high number and min-instances to 0 with CPU always allocated

Question 10

You need to allow SSH access to a Compute Engine instance. Which method is the recommended way to manage SSH keys for multiple users?

Accepted Answer

Enable OS Login and assign IAM roles to users.. OS Login is the recommended method for managing SSH access to Compute Engine instances, as it links SSH keys to user accounts and integrates with IAM.

Answer

Add SSH keys to the instance metadata.

Answer

Use gcloud compute ssh with the --ssh-key-file flag.

Answer

Create a custom image with preconfigured SSH keys.

Question 11

An organization has strict security policies requiring that all Compute Engine instances use OS Login for SSH access instead of metadata-based SSH keys. Which two actions must be taken to enforce this for all new instances? (Choose two.)

Accepted Answer

Remove all SSH keys from project metadata. To enforce OS Login, you enable it at the project level project-wide (enabled by a specific metadata key) and ensure instances have no metadata-based SSH keys. The other options are incorrect.

Answer

Use 'gcloud compute ssh' with the --tunnel-through-iap flag

Answer

Set metadata 'enable-oslogin=FALSE' at the instance level

Answer

Set metadata 'block-project-ssh-keys=TRUE' at the instance level

Question 12

A company wants to deploy a new application on Google Cloud that requires a regional managed instance group with automatic scaling based on HTTP load. Which two resources must they create? (Choose TWO.)

Accepted Answer

HTTP(S) Load Balancer. To deploy a regional managed instance group (MIG) with autoscaling based on HTTP load, you need an instance template to define the VM configuration for the MIG, and an HTTP(S) Load Balancer to distribute traffic and provide the load metrics for autoscaling. Options C (HTTP(S) Load Balancer) and D (Instance template) are correct. Option A (Cloud Run) is for serverless containers, not for MIGs. Option B (GKE cluster) is for Kubernetes. Option E (Cloud Function) is for serverless functions.

Answer

Cloud Run service

Answer

GKE cluster

Answer

Cloud Function

Question 13

A team is using Terraform to manage Google Cloud resources. They want to store the Terraform state file in a Cloud Storage bucket to enable collaboration. Which Terraform backend configuration should be used?

Accepted Answer

terraform { backend "gcs" { bucket = "my-tf-state" prefix = "prod" } }. The 'gcs' backend in Terraform stores state in a Cloud Storage bucket. The 'bucket' attribute specifies the bucket name, and 'prefix' is optional for folder structure.

Answer

provider "google" { backend "gcs" { bucket = "my-tf-state" } }

Answer

terraform { backend "cloud-storage" { bucket = "my-tf-state" path = "prod" } }

Answer

terraform { backend "gcs" { bucket = "my-tf-state" folder = "prod" } }

Question 14

Which kubectl command lists all pods in the current namespace?

Accepted Answer

kubectl get pods. The command 'kubectl get pods' lists all pods. 'kubectl get all' includes services, deployments, etc. 'kubectl describe pods' shows detailed info. 'kubectl list pods' is invalid.

Answer

kubectl list pods

Answer

kubectl describe pods

Answer

kubectl get all

Question 15

You are troubleshooting a Pub/Sub subscription that is not delivering messages promptly. Which THREE factors should you investigate? (Choose THREE.)

Accepted Answer

The subscription's backlog size. Common causes include backlog, subscriber latency, and ack deadlines.

Answer

The topic's retention duration

Answer

The message ordering key

Question 16

You are configuring an uptime check for an HTTPS endpoint that returns a JSON response. The check should validate that the response contains a specific field "status":"ok". Which uptime check option should you use?

Accepted Answer

Add a content match with a regular expression. Uptime checks can validate response content using content matching.

Answer

Enable SSL hostname verification

Answer

Configure a notification channel

Answer

Create a log-based alert for the endpoint

Question 17

You need to monitor the uptime of an external HTTPS endpoint that is critical to your application. Which Google Cloud service should you use to create an uptime check?

Accepted Answer

Cloud Monitoring. Cloud Monitoring provides uptime checks that can monitor HTTP, HTTPS, and TCP endpoints from multiple locations.

Answer

Cloud Debugger

Answer

Cloud Trace

Answer

Cloud Logging

Question 18

You have a Compute Engine VM instance that is currently running. You need to resize it to a different machine type. What must you do first?

Accepted Answer

Stop the instance, then use gcloud compute instances set-machine-type, then start the instance.. Changing the machine type requires the VM to be in a stopped state. You must stop the instance, change the machine type, then start it.

Answer

Use gcloud compute instances update --machine-type while the instance is running.

Answer

Detach all disks, change machine type, then reattach disks.

Answer

Create a snapshot of the disk and use it to create a new instance with the desired machine type.

Question 19

Which IAM role should be granted to a service account to allow it to access a secret stored in Secret Manager?

Accepted Answer

roles/secretmanager.secretAccessor. The role 'secretmanager.secretAccessor' grants access to read secret versions.

Answer

roles/secretmanager.admin

Answer

roles/iam.serviceAccountUser

Answer

roles/secretmanager.viewer

Question 20

An engineer created a VPC with a subnet in us-central1 and enabled Private Google Access on that subnet. Compute Engine instances in that subnet can reach Google APIs and services using internal IPs. However, the instances cannot reach external IP addresses on the internet. What should the engineer configure to allow internet access while minimizing cost and management overhead?

Accepted Answer

Create a Cloud NAT gateway using a Cloud Router. Since the instances need to access the internet (not just Google APIs), a Cloud NAT is the appropriate solution. It allows outbound internet traffic from private instances without assigning external IPs. Private Google Access only covers Google APIs. A NAT gateway instance would be more expensive and require management. A VPN is unnecessary.

Answer

Disable Private Google Access and assign external IPs to the instances

Answer

Add a NAT instance (a Compute Engine VM configured as a NAT gateway)

Answer

Create a Cloud VPN tunnel to a third-party NAT service