Google ACE Practice Exam 51 — 20 Questions

Question 1

A team is creating a managed instance group (MIG) for a stateless web application. They need to ensure that instances are automatically replaced if they become unhealthy and that new instances are rolled out gradually with no downtime during updates. Which set of configurations should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a MIG with a health check configured for autohealing; set rolling update with maxSurge=1 and maxUnavailable=0.. A health check is required for autohealing — without it, the MIG cannot detect unhealthy instances and replace them. For zero-downtime rolling updates, maxSurge=1 allows a new instance to be created before an old one is removed, while maxUnavailable=0 guarantees the desired capacity is never reduced during the update. This combination satisfies both requirements.

Answer

Create a MIG without health check; set rolling update with maxSurge=1 and maxUnavailable=0.

Answer

Create a MIG with a health check for autohealing; set rolling update with maxSurge=0 and maxUnavailable=1.

Answer

Create a MIG without health check; set rolling update with maxSurge=0 and maxUnavailable=1.

Question 2

An organization is designing a VPC network with connectivity to an on-premises network via Cloud VPN. They have multiple projects that need to share the VPN. Which three steps are required to implement this using Shared VPC? (Choose three.)

Accepted Answer

Attach the service project to the host project.. Attaching the service project to the host project is a fundamental step in Shared VPC. This attachment allows the service project to use the host project's VPC network resources, including the Cloud VPN gateway and tunnels, enabling centralized connectivity without duplicating VPN infrastructure.

Answer

Enable the Shared VPC feature in the service project.

Answer

Create a Cloud Router in the service project.

Question 3

Match each BigQuery feature to its description.

Accepted Answer

Clustering: Organizes data based on the contents of one or more columns in a table to improve query performance.. Clustering sorts data by column values to improve filtering performance; Partitioning divides a table into date-based segments to reduce scanned data; Materialized Views store precomputed query results for faster access. Common confusions arise from swapping these definitions, especially between Clustering and Partitioning.

Answer

Clustering: Divides a table into segments based on a date column to reduce data scanned.

Answer

Partitioning: Organizes data based on the contents of columns to improve query performance.

Answer

Materialized Views: Automatically caches query results for frequently run queries without storing data.

Question 4

A developer wants to deploy a containerized application on Google Cloud that automatically scales to zero when not in use and charges only for request processing time. The application is stateless and can be triggered by HTTP requests. Which compute option meets these requirements?

Accepted Answer

Cloud Run. Cloud Run is a fully managed compute platform that runs stateless containers and automatically scales to zero when there is no traffic, charging only for the resources used during request processing. It supports HTTP requests and is ideal for containerized applications that need to scale dynamically. Cloud Functions is for function-based deployments, not containers, and GKE with cluster autoscaling does not scale to zero and charges for node uptime.

Answer

Compute Engine with managed instance groups

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE) with cluster autoscaling

Question 5

A developer receives a "Permission 'cloudfunctions.functions.call' denied" error when trying to invoke a Cloud Function from another service. What is the most likely cause?

Accepted Answer

The service account of the caller lacks the Cloud Functions Invoker role.. The error 'Permission cloudfunctions.functions.call denied' indicates that the Identity and Access Management (IAM) policy does not grant the caller the required permission to invoke the function. The Cloud Functions Invoker role (roles/cloudfunctions.invoker) specifically allows the `cloudfunctions.functions.call` permission, which is necessary for HTTP-triggered functions. Without this role on the caller's service account, any invocation attempt will be denied, regardless of other configurations.

Answer

The function is not deployed to the correct region.

Answer

The Cloud Function has a CORS misconfiguration.

Answer

The VPC connector is not configured correctly.

Question 6

You have a BigQuery table with billions of rows. You need to create a new table with the same schema and copy all data from the original table. Which approach is most efficient?

Accepted Answer

Use bq cp (copy) command.. The bq cp command performs a server-side copy of a table within BigQuery, duplicating both schema and data without exporting or re-importing. It is the fastest and most cost-effective method because no data leaves BigQuery's storage layer. This is the canonical approach for cloning large tables.

Answer

Use bq load with an empty file to create the table, then insert data row by row.

Answer

Export the original table to Cloud Storage as Avro, then load into the new table.

Answer

Use bq query --destination_table mydataset.newtable 'SELECT * FROM mydataset.original'

Question 7

A company manages a production GKE cluster with node auto-upgrade enabled. They want to ensure that during a node upgrade, the workloads are rescheduled gracefully without downtime. What Kubernetes resource should be configured on their Deployments?

Accepted Answer

PodDisruptionBudget. A PodDisruptionBudget (PDB) limits the number of pods of a replicated application that can be voluntarily disrupted at once (via minAvailable or maxUnavailable). During node upgrades, GKE drains nodes by evicting pods, and the PDB ensures enough replicas remain available to serve traffic, preventing downtime.

Answer

HorizontalPodAutoscaler

Answer

ResourceQuota

Answer

Node affinity rules

Question 8

A company's Google Kubernetes Engine cluster has experienced a sudden increase in latency. The team suspects a misconfigured node pool is causing resource contention. They want to verify the node's resource usage. Which command or tool should they use?

Accepted Answer

Run 'kubectl top nodes'.. B is correct because 'kubectl top nodes' directly displays real-time CPU and memory usage for each node in the cluster, which is the fastest way to identify resource contention causing latency. This command leverages the metrics-server to aggregate resource metrics from kubelets, giving immediate insight into node-level utilization without additional overhead.

Answer

Run 'gcloud container clusters describe cluster-name'.

Answer

Use the Cloud Console Monitoring page to view node metrics.

Answer

Run 'kubectl describe node node-name'.

Question 9

A startup wants to host a static website (HTML, CSS, JS) globally with minimal latency and high availability. They expect low traffic initially but want to scale seamlessly. Which solution is most cost-effective and simple?

Accepted Answer

Cloud Storage bucket with Cloud CDN enabled. A Cloud Storage bucket with Cloud CDN enabled is the most cost-effective and simple solution for hosting a static website globally with minimal latency. Cloud Storage natively serves static content (HTML, CSS, JS) without provisioning servers, and Cloud CDN caches content at edge locations worldwide, reducing latency. It scales seamlessly from zero traffic to high demand without manual intervention, and costs are based only on storage and egress, making it ideal for low-traffic startups.

Answer

Compute Engine with nginx

Answer

App Engine standard environment

Answer

Cloud Functions with HTTP triggers

Question 10

A team's Cloud Build jobs are consistently failing with 'quota exceeded' errors. Billing is active and the project has available budget. What should the team do?

Accepted Answer

Request a quota increase for the Cloud Build API in the project settings. Cloud Build quota errors indicate that the project has reached its API rate limit or concurrent build limit, not a billing issue. Quotas are per-project and can be increased by requesting a higher limit from the Cloud Build API quotas page in the Google Cloud Console. Billing being active and having budget means the issue is not financial, so the team must specifically request a quota increase for the Cloud Build API.

Answer

Delete unused projects in the same organization to release global quota

Answer

Upgrade the billing account to a higher payment tier

Answer

Use a larger machine type for Cloud Build worker pools

Question 11

A company wants to grant a contractor read-only access to all Compute Engine instances in a specific project, but no other resources. Which IAM role should be assigned?

Accepted Answer

roles/compute.viewer. roles/compute.viewer is the correct choice because it grants read-only access to all Compute Engine resources, including instances, disks, and snapshots, within the project. It does not include permissions for other services like Cloud Storage or IAM, aligning with the principle of least privilege. This role is predefined by Google Cloud and is specifically designed for viewing Compute Engine resources without modification rights.

Answer

roles/compute.instanceAdmin.v1

Answer

roles/viewer

Answer

roles/iam.securityReviewer

Question 12

An application running on a Compute Engine VM needs to read objects from a Cloud Storage bucket in the same project. What is the recommended authentication approach?

Accepted Answer

Attach a service account with the Storage Object Viewer role to the VM. Attaching a service account with the Storage Object Viewer role to the Compute Engine VM is the recommended and secure method for authenticating to Cloud Storage. The VM automatically obtains OAuth 2.0 access tokens for the service account via the metadata server, eliminating the need to manage or embed credentials in the application code.

Answer

Embed a developer's user account credentials in the application configuration file

Answer

Create an API key and store it as an environment variable on the VM

Answer

Grant the VM's IP address access to the bucket using a VPC firewall rule

Question 13

A company is deploying a GKE cluster in a new VPC. The cluster nodes need to communicate with a Cloud SQL instance that has a private IP address. The company wants to minimize data transfer costs and avoid using public IPs. What is the most cost-effective configuration?

Accepted Answer

Create a VPC-native cluster with private nodes and configure Private Service Access for Cloud SQL.. Creating a VPC-native cluster with private nodes and configuring Private Service Access for Cloud SQL is the most cost-effective configuration because it keeps all traffic within the private network, avoids public IPs, and minimizes data transfer costs. Private Service Access allows direct private connectivity between the GKE cluster and Cloud SQL without additional network components.

Answer

Create a cluster with public nodes and set up a Cloud VPN tunnel to Cloud SQL.

Answer

Create a VPC-native cluster with public nodes and whitelist the node IPs in Cloud SQL authorized networks.

Answer

Create a cluster with public nodes and use Cloud NAT for outbound traffic.

Question 14

A company is deploying a public-facing web application on Compute Engine behind a global HTTP(S) Load Balancer. The company wants to protect the application from common web attacks, such as SQL injection and cross-site scripting (XSS). Which Google Cloud security service should they enable?

Accepted Answer

Cloud Armor. Cloud Armor is Google Cloud's web application firewall (WAF) and DDoS protection service that integrates with global external HTTP(S) Load Balancers. It provides preconfigured WAF rules based on the OWASP ModSecurity Core Rule Set to block SQL injection, XSS, and other common attacks, plus custom rules and adaptive protection. Enabling Cloud Armor on the load balancer's backend service is the correct way to filter malicious HTTP traffic.

Answer

VPC Service Controls

Answer

Cloud IDS

Answer

Identity and Access Management (IAM)

Question 15

A team wants proactive alerting if their public HTTPS endpoint returns a non-2xx HTTP status code or becomes unreachable — before users report it. Which Cloud Monitoring capability provides this?

Accepted Answer

An uptime check with an HTTP status code condition. An uptime check with an HTTP status code condition is the correct choice because Cloud Monitoring’s uptime checks are specifically designed to proactively verify that a public HTTPS endpoint is reachable and returns a successful HTTP status (e.g., 2xx). When the check detects a non-2xx status or a timeout/unreachable condition, it can trigger an alert before users are impacted. This is the only option that directly monitors endpoint availability and HTTP response codes from an external perspective.

Answer

A log-based alert on 5xx error log entries

Answer

A Cloud Armor rule blocking 5xx responses

Answer

A metric alert on instance CPU exceeding 90%

Question 16

A startup wants to run a small, event-driven application that processes files uploaded to Cloud Storage. The function should be triggered by object finalize events and should have a maximum execution time of 10 minutes. Which compute option is most cost-effective and easy to manage?

Accepted Answer

Cloud Functions (Gen 2). Cloud Functions (Gen 2) is the most cost-effective and easy-to-manage option for event-driven applications triggered by Cloud Storage object finalize events, with a maximum execution time of 10 minutes. It provides serverless execution, automatic scaling, and native integration with Cloud Storage events. Gen 2 offers longer execution times (up to 60 minutes) and improved performance compared to Gen 1.

Answer

Compute Engine with a startup script

Answer

App Engine Standard

Answer

Cloud Run jobs

Question 17

An organization wants to run a stateless HTTP-based containerized application that scales to zero when not in use and charges only for request processing time. They do not want to manage any underlying infrastructure. Which compute option should they choose?

Accepted Answer

Cloud Run. Cloud Run is a fully managed serverless platform for containerized HTTP applications that scales to zero when idle and bills only for request processing time (CPU/memory allocated during requests). It requires no infrastructure management and supports any containerized HTTP workload. This matches the requirement exactly.

Answer

Compute Engine with managed instance group

Answer

Cloud Functions

Answer

Google Kubernetes Engine (GKE) Standard

Question 18

A company is migrating a PostgreSQL database to Cloud SQL. They need high availability with automatic failover and a read replica for reporting queries that must not impact the primary. Which Cloud SQL configuration should they choose?

Accepted Answer

High Availability (HA) configuration with a read replica. Cloud SQL High Availability (HA) configuration provides a standby instance in a different zone with automatic failover, satisfying the HA requirement. Adding a read replica offloads reporting queries from the primary, ensuring they do not impact production performance. This combination meets both the HA and read-scaling needs.

Answer

High Availability (HA) configuration with automatic storage increase

Answer

Single zone instance with a failover replica

Answer

Single zone instance with cross-region replication

Question 19

A company has a VPC with a subnet that has Private Google Access enabled. They want their Compute Engine instances to access Google APIs and services through internal IP addresses. Which additional configuration is required?

Accepted Answer

No additional configuration is required.. Private Google Access allows Compute Engine instances with only internal IP addresses to reach Google APIs and services (such as Cloud Storage, BigQuery, and Pub/Sub) using internal IP addresses, without requiring an external IP or Cloud NAT. Once the subnet-level setting is enabled, no additional routing, NAT, or peering configuration is needed because Google APIs are reachable via the default route to the private Google access VIP (199.36.153.8/30 or the restricted.googleapis.com VIPs).

Answer

Configure Cloud NAT to enable access to Google APIs.

Answer

Set up Cloud VPN tunnels to Google APIs.

Answer

Create a VPC peering connection with the Google APIs VPC.

Question 20

An organization wants to use Cloud NAT to allow private Compute Engine instances to access the internet for updates. They have a VPC with a custom subnet and a Cloud Router configured. However, instances cannot reach the internet. What is the most likely cause?

Accepted Answer

The Cloud NAT gateway has not been created on the Cloud Router.. Cloud NAT requires a NAT gateway to be explicitly created and associated with a Cloud Router and a subnet/region. If the Cloud Router exists but no NAT gateway has been configured on it, private instances have no translation path to the internet, which is the most likely cause of the failure. Creating the NAT gateway on the Cloud Router resolves the issue.

Answer

The instances do not have external IP addresses.

Answer

The firewall rules block egress traffic.

Answer

The subnet does not have Private Google Access enabled.