Google ACE Practice Exam 52 — 20 Questions

Question 1

A security engineer needs to ensure that all VMs in a subnet use Private Google Access to reach Google APIs without external IP addresses. What must be enabled?

Accepted Answer

Private Google Access on the subnet.. Private Google Access allows VMs without external IP addresses to reach Google APIs and services using internal IP addresses. Enabling it on the subnet is the correct configuration to meet the requirement.

Answer

A firewall rule allowing egress to 0.0.0.0/0.

Answer

VPC Flow Logs on the subnet.

Answer

Cloud NAT on the VPC.

Question 2

An organization needs to run a batch analytics job daily that processes 500 GB of data stored in Cloud Storage. The job runs for 2 hours each day and can tolerate occasional failures. The team wants to minimize compute costs. Which compute option is most cost-effective?

Accepted Answer

Compute Engine with preemptible VMs. Preemptible VMs are correct because they cost up to 80% less than standard VMs and are ideal for fault-tolerant batch jobs that can tolerate occasional failures and run for a bounded 2-hour window. The workload's tolerance for interruption and its daily, non-continuous schedule align exactly with the preemptible VM use case, minimizing compute cost.

Answer

Compute Engine with sole-tenant nodes

Answer

Compute Engine with standard VMs and sustained use discount

Answer

Compute Engine with committed use discount for 1 year

Question 3

You are using Cloud Logging and want to export all logs from a specific Compute Engine instance to BigQuery for long-term analysis. You create a log sink with a filter for the instance's resource type and labels. What additional step is required to complete the export?

Accepted Answer

Create a BigQuery dataset and grant the log sink's service account the BigQuery Data Editor role. A log sink exports logs to a destination, but for BigQuery the destination dataset must exist and the sink's service account must be granted the BigQuery Data Editor role on that dataset. Without this IAM binding, the sink cannot write to BigQuery and the export fails.

Answer

Create a Cloud Pub/Sub topic and configure a push subscription

Answer

Create a Cloud Storage bucket as a staging location

Answer

Enable BigQuery's streaming buffer on the dataset

Question 4

An organization needs to run a batch analytics job on BigQuery every night that processes terabytes of data. The job is critical and must complete within a specific time window. To optimize costs, they are considering using flat-rate pricing but want to minimize commitment risk. Which THREE factors should they evaluate?

Accepted Answer

The cost of on-demand query pricing for the same workload. The organization should evaluate B, the cost of on-demand query pricing for the same workload, because comparing on-demand BigQuery pricing against flat-rate commitment costs is the baseline needed to determine whether a reservation actually saves money for this nightly terabyte-scale job. They should also evaluate D, the number of slots needed to complete the job within the required time window, since flat-rate capacity is measured in slots and the reservation size must be sufficient to finish the batch analytics within the critical window. They should evaluate E, the availability of flex slots for short-term capacity needs, because flex slots provide a low-commitment, short-duration way to obtain dedicated BigQuery capacity, which directly addresses the goal of minimizing commitment risk. Options A and C do not belong: the number of Cloud Storage buckets used for staging is irrelevant to BigQuery flat-rate slot commitment decisions, and reserving dedicated Compute Engine hardware is a different compute service and does not address BigQuery slot capacity or pricing.

Answer

The number of Cloud Storage buckets used for data staging

Answer

The cost of reserving dedicated hardware for Compute Engine

Question 5

A team wants to enable Compute Engine API in their project using gcloud. Which command should they run?

Accepted Answer

gcloud services enable compute.googleapis.com. The correct gcloud syntax for enabling an API is 'gcloud services enable <service-name>', and the Compute Engine API's service name is compute.googleapis.com. So 'gcloud services enable compute.googleapis.com' is the only syntactically valid command that enables the Compute Engine API.

Answer

gcloud compute enable api

Answer

gcloud services list --enabled

Answer

gcloud api enable compute

Question 6

An engineer needs to allow a set of Compute Engine instances (with tag 'web-server') to receive traffic on port 443 from the internet. The VPC has a default network with default firewall rules. Which TWO actions should the engineer take? (Choose TWO)

Accepted Answer

Create a firewall rule allowing ingress from 0.0.0.0/0 on port 443 with target tag 'web-server' and priority 1000.. Option D is correct because a VPC firewall rule must explicitly match the instances it protects via a target tag, so creating an ingress rule from 0.0.0.0/0 on tcp:443 with target tag 'web-server' and a priority (1000) permits the desired HTTPS traffic to exactly those instances. Option E is correct because firewall target tags only apply to instances that actually carry the matching network tag, so the Compute Engine instances must have the 'web-server' tag applied for the rule to take effect. Option A is wrong because its target tag 'https-server' does not match the instances tagged 'web-server', so the rule would not apply to them. Option B is wrong because the default network's default-allow-https rule targets 'https-server', and modifying it to 'web-server' would affect all instances with that tag rather than cleanly scoping the change, and it is not the required action here. Option C is wrong because deleting the default-allow-https rule is unnecessary and would remove existing HTTPS access for instances tagged 'https-server' without solving the tagging mismatch.

Answer

Create a firewall rule allowing ingress from 0.0.0.0/0 on port 443 with target tag 'https-server' and priority 1000.

Answer

Modify the default-allow-https rule to change the target tag to 'web-server'.

Answer

Delete the default-allow-https rule to avoid conflicts.

Question 7

An organization has multiple Google Cloud projects and wants to enforce a policy that all Compute Engine instances must use a specific set of approved machine types. Which tool should be used to implement this constraint?

Accepted Answer

Organization policies. Organization policies in Google Cloud are constraints applied at the organization, folder, or project level that restrict how resources can be configured—including which machine types Compute Engine instances may use. The constraints/compute.restrictMachineTypes constraint directly enforces an approved machine-type list across all projects in scope. This is the purpose-built governance tool for the requirement.

Answer

IAM custom roles

Answer

VPC Service Controls

Answer

Cloud Scheduler

Question 8

A security team wants to ensure that all Compute Engine instances in a project automatically use a custom service account with minimal permissions. What must the engineer do when creating new instances?

Accepted Answer

Use gcloud compute instances create with the --service-account flag pointing to the custom service account.. The --service-account flag on gcloud compute instances create explicitly attaches the specified custom service account to the new instance at creation time, ensuring the VM uses minimal-permission credentials instead of the default Compute Engine service account. This is the correct declarative way to enforce per-instance identity in GCP.

Answer

Create a custom role and assign it to the instance's service account through the instance metadata.

Answer

Set the project-wide default service account to the custom service account in the project settings.

Answer

Create a startup script that configures the instance to use the custom service account after boot.

Question 9

A team is setting up a new project and wants to estimate the monthly cost of running a Compute Engine VM with 4 vCPUs, 16 GB memory, and a 100 GB persistent disk, using the Google Cloud Pricing Calculator. The VM will run for 12 hours every day for a month. Which discount type will automatically apply to reduce the cost based on usage?

Accepted Answer

Sustained use discount. Sustained use discounts (SUDs) are automatic discounts that Google Cloud applies to Compute Engine instances that run for a significant portion of the billing month. Because the VM runs 12 hours per day every day, it accumulates enough usage to qualify for SUDs without any commitment or action from the team. The discount is applied automatically to the invoice.

Answer

Preemptible VM discount

Answer

Committed use discount

Answer

Free tier discount

Question 10

You notice that your Cloud SQL for PostgreSQL instance's `pg_stat_activity` shows many connections in `idle in transaction` state, and the connection count is near the max_connections limit. Application threads are blocking waiting for connections. What is the most effective solution to manage database connections for a GKE-hosted application?

Accepted Answer

Deploy PgBouncer as a sidecar or deployment to pool connections to Cloud SQL in transaction mode.. PgBouncer is a lightweight connection pooler that can be deployed as a sidecar or separate deployment in GKE to manage connections to Cloud SQL for PostgreSQL. By operating in transaction mode, it holds database connections only for the duration of a transaction, not for the entire client session, which drastically reduces the number of concurrent connections to the database. This directly addresses the `idle in transaction` connections and the near-max_connections issue without requiring application code changes.

Answer

Increase `max_connections` in the Cloud SQL PostgreSQL instance flags.

Answer

Switch from Cloud SQL to Cloud Spanner, which has no connection limits.

Answer

Restart the Cloud SQL instance to clear idle connections.

Question 11

Which TWO statements are correct about deploying an application with an HTTP(S) load balancer on Compute Engine?

Accepted Answer

A network load balancer can be used for UDP traffic.. Option A is correct because a network load balancer (TCP/UDP load balancing) operates at Layer 4 and supports UDP traffic, which is essential for non-TCP protocols. Option E is correct because an HTTP(S) load balancer requires a backend service that references instance groups or NEGs, and that backend service must have a health check to determine which backends are healthy and eligible to receive traffic. Option B is incorrect because a TCP proxy load balancer handles TCP traffic, including HTTP/HTTPS, not only non-HTTP traffic. Option C is incorrect because SSL proxy load balancers are specifically designed to terminate SSL/TLS (HTTPS) traffic. Option D is incorrect because internal load balancers do not require a proxy instance; they use backend services and health checks like external load balancers.

Answer

A TCP proxy load balancer can only be used for non-HTTP traffic.

Answer

SSL proxy load balancers cannot terminate HTTPS traffic.

Answer

Internal load balancers require a proxy instance.

Question 12

A developer is deploying an HTTP-triggered Cloud Function for a production application. Which TWO configuration options should be applied to ensure security and control costs? (Choose two.)

Accepted Answer

Set a maximum instances limit. Option B is correct because setting a maximum instances limit caps the number of concurrent function instances, which directly bounds the potential scaling and therefore controls the cost of an HTTP-triggered Cloud Function under heavy or unexpected traffic. Option E is correct because requiring a service account to authenticate invocations enforces IAM-based access control, ensuring only authorized identities (via signed ID tokens) can call the function, which is essential for a production security posture. Option A is incorrect because allowing unauthenticated invocations exposes the function publicly and defeats the security requirement. Option C is incorrect because setting minimum instances to 0 only affects cold-start behavior and cost of idle capacity, not the security or the upper cost bound the scenario demands. Option D is incorrect because a custom domain is a routing/branding convenience and does not by itself provide security or cost control.

Answer

Allow unauthenticated invocations

Answer

Set minimum instances to 0

Answer

Configure a custom domain for the function

Question 13

Which THREE are best practices for monitoring and alerting in Google Cloud?

Accepted Answer

Use Cloud Audit Logs to monitor administrative actions and data access.. Option B is correct because Cloud Audit Logs (Admin Activity, Data Access, System Event, and Policy Denied logs) provide an immutable record of administrative actions and data access, which is essential for security monitoring, compliance, and detecting suspicious activity in Google Cloud. Option D is correct because log-based metrics let you turn specific log entries (for example, matching a severity or a regex pattern) into a metric that Cloud Monitoring can alert on, enabling detection of application-specific error patterns that generic infrastructure metrics would miss. Option E is correct because Cloud Monitoring uptime checks probe external-facing services from multiple global locations and can trigger alerting policies when availability or latency degrades, directly protecting the user-facing SLA. Option A is not a monitoring/alerting best practice in this context because budget alerts in Cloud Billing only notify about cost thresholds and do not monitor service health, performance, or security. Option C is not universally a best practice because VPC Flow Logs generate substantial volume and cost, so they should be enabled selectively on subnets where traffic metadata is actually needed rather than on all subnets by default.

Answer

Configure budget alerts in Cloud Billing to notify when costs exceed a threshold.

Answer

Enable VPC Flow Logs for all subnets to capture all network traffic metadata.

Question 14

Your organization has multiple Google Cloud projects. You want to separate development and production environments. Which resource hierarchy structure is recommended?

Accepted Answer

Use folders under the organization node to separate dev and prod projects.. Using folders under the organization node to separate dev and prod projects is the recommended approach because it aligns with Google Cloud's resource hierarchy, allowing centralized policy management and inheritance. Folders enable logical separation of environments while maintaining a single organization, which simplifies billing and IAM. This structure supports least privilege and environment isolation.

Answer

Create two separate organizations.

Answer

Use labels on projects to differentiate environments.

Answer

Use a single project with separate VPC networks.

Question 15

Your team needs to manage Google Kubernetes Engine clusters across multiple projects. Rather than granting `roles/container.admin` on each project individually, you want a centralized approach. What is the most maintainable solution?

Accepted Answer

Grant `roles/container.admin` to the team's Google Group at the folder level containing all relevant projects.. Granting `roles/container.admin` at the folder level to a Google Group is the most maintainable solution because it centralizes IAM policy management. When new projects are added under that folder, they automatically inherit the role, and team membership changes are handled by updating the Google Group rather than modifying individual project IAM policies. This approach follows Google Cloud's recommended practice of using groups and resource hierarchy for scalable access control.

Answer

Create a service account with `roles/container.admin` and share its key JSON with team members.

Answer

Grant `roles/container.admin` to each team member individually in each project's IAM policy.

Answer

Use the GKE Hub to create a fleet and assign RBAC roles within each cluster.

Question 16

A small business has a single Google Cloud project with a few Compute Engine instances running a web application. The instances are all in the same VPC and subnet. The security team wants to ensure that only HTTP (port 80) and HTTPS (port 443) traffic from the public internet is allowed to the instances, and that all other inbound traffic is blocked. They have already configured Cloud Armor for the load balancer. However, they notice that SSH traffic (port 22) is still reaching the instances from the internet, even though they do not have any explicit firewall rules allowing SSH. The project was just created and uses the default VPC network. What should they do to resolve this?

Accepted Answer

Disable or delete the default-allow-ssh firewall rule in the VPC.. The default VPC network in Google Cloud includes a default-allow-ssh firewall rule that permits SSH (port 22) from 0.0.0.0/0. To block SSH from the internet, they must disable or delete this rule. This is the direct cause of SSH traffic reaching the instances despite no explicit allow rule.

Answer

Create a VPC firewall rule with priority 1000 to deny ingress on port 22 from 0.0.0.0/0.

Answer

Configure a route to drop traffic destined to the instances on port 22.

Answer

Remove the SSH public key from the instance metadata.

Question 17

A developer needs to SSH into a Compute Engine instance that has OS Login enabled. The developer's Google account is already granted the roles/compute.osLogin role. Which command should the developer use to connect?

Accepted Answer

gcloud compute ssh instance-name --zone=us-central1-a. With OS Login enabled and the roles/compute.osLogin role granted, the developer should connect using gcloud compute ssh, which automatically handles OS Login authentication and key management. The gcloud compute ssh command integrates with OS Login to generate short-lived SSH certificates and manage the developer's Google identity, so no manual key file is needed. Specifying the zone ensures the command targets the correct instance.

Answer

ssh -i ~/.ssh/google_key user@instance-ip

Answer

gcloud compute instances get-serial-port-output instance-name --zone=us-central1-a

Answer

gcloud compute connect-to-serial-port instance-name --zone=us-central1-a

Question 18

A company wants to track costs by department and project. They have multiple GCP projects used by different teams. Which feature should they use to categorize costs?

Accepted Answer

Labels. Labels are key-value pairs that can be attached to resources to organize and track costs by department or project. Budgets and alerts notify when spending exceeds thresholds but do not categorize costs. Billing export to BigQuery is for exporting billing data for analysis, not for direct categorization. Custom IAM roles are for managing permissions, not cost tracking.

Answer

Budgets and alerts

Answer

Billing export to BigQuery

Answer

Custom IAM roles

Question 19

An engineer needs to choose a location for a new GCP project's resources to maximize availability and minimize latency for users in Europe and Asia. Which three actions should they take? (Choose THREE)

Accepted Answer

Use a global load balancer to distribute traffic. Option A is correct because a global external Application Load Balancer (or global external proxy Network Load Balancer) uses Google's global anycast edge network to route users to the closest healthy backend, reducing latency and improving availability across Europe and Asia. Option C is correct because deploying resources in multiple regions such as europe-west1 and asia-east1 places compute and data physically near European and Asian users, and multi-region deployment protects against regional failures. Option E is correct because Cloud CDN caches content at Google edge points of presence (over 100+ locations), serving cached responses from the nearest edge to further cut latency for static and cacheable content. Option B is not appropriate because setting the default region to us-central1 would place resources in North America, far from the target European and Asian users, increasing latency. Option D is not appropriate because a single zone in europe-west1 creates a single point of failure and does not serve Asian users with low latency, contradicting the availability and latency goals.

Answer

Set the project default region to us-central1

Answer

Use a single zone in europe-west1 for simplicity

Question 20

A company is migrating a legacy monolithic application to Google Cloud. The application consists of a web frontend, a business logic layer, and a MySQL database. They want to minimise operational overhead and use managed services where possible. Which two services should they choose? (Choose TWO.)

Accepted Answer

Cloud SQL for MySQL to host the database. Cloud SQL for MySQL (option B) is correct because it is a fully managed relational database service that supports MySQL, letting the company lift and shift its existing MySQL database with minimal code changes while offloading patching, backups, and replication to Google. Cloud Run (option C) is correct because it is a fully managed serverless container platform that can host both the web frontend and the business logic layer as containerized services, scaling automatically and requiring no server or cluster management, which directly minimizes operational overhead. Cloud Functions (option A) is not suitable because it is an event-driven FaaS environment best for short, single-purpose functions rather than a full business logic layer of a monolithic application. Compute Engine (option D) is incorrect because managing VMs still requires significant operational effort (OS patching, scaling, capacity), contradicting the goal of minimizing overhead. Cloud Spanner (option E) is incorrect because it is a globally distributed, horizontally scalable database that is overkill and requires schema/application changes, whereas the existing MySQL workload maps directly to Cloud SQL.

Answer

Cloud Functions for the business logic

Answer

Compute Engine to host the frontend and business logic

Answer

Cloud Spanner for the database