Google ACE Practice Exam 52 — 20 Questions

Question 1

A company has a VPC with two subnets: subnet-a (10.0.1.0/24) and subnet-b (10.0.2.0/24). They want to allow traffic from instances in subnet-a to reach a specific instance in subnet-b only on TCP port 443. What is the most specific firewall rule to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a rule with source range 10.0.1.0/24, allow tcp:443, and target tag 'https-server' applied to the specific instance.. Firewall rules can specify source ranges (IP addresses or CIDR blocks) and target tags or service accounts. The most specific rule would use the subnet-a CIDR block (10.0.1.0/24) as the source, allow TCP port 443, and target the specific instance using a target tag. Using a tag makes the rule apply only to instances with that tag, avoiding impact on other instances in subnet-b.

Answer

Create a rule with source tag 'subnet-a-instances', allow tcp:443, and target tag 'https-server'.

Answer

Create a rule with source range 0.0.0.0/0, allow tcp:443, and target the specific instance.

Answer

Create a rule with source range 10.0.1.0/24, allow tcp:443, and apply to all instances in subnet-b.

Question 2

To meet compliance requirements, a company must encrypt all data at rest in Cloud SQL using customer-managed encryption keys (CMEK). What is required to enable CMEK on a Cloud SQL instance?

Accepted Answer

Specify the key during instance creation using --disk-encryption-key, and ensure the Cloud SQL service account has encryption/decryption permissions on the key. When creating the Cloud SQL instance, you must specify a Cloud KMS key using the --disk-encryption-key flag. The Cloud SQL service account must be granted the Cloud KMS CryptoKey Encrypter/Decrypter role. The key must be in the same region as the Cloud SQL instance.

Answer

Create the instance without encryption, then use gcloud sql instances patch to add CMEK later

Answer

Enable CMEK by setting an organization policy that requires CMEK for all Cloud SQL instances

Answer

Use the default encryption; CMEK is not supported for Cloud SQL

Question 3

A developer created a service account for an application running on a Compute Engine instance. The instance was started without specifying the service account. What must the developer do to make the application use the service account?

Accepted Answer

Stop the instance, update it with the --service-account flag using gcloud compute instances set-service-account, then start it.. If an instance is created without a service account, it uses the default compute engine service account. To use a custom service account, the instance must be created with '--service-account' flag. If already running, the instance must be stopped and the service account can be changed (attached) by updating the instance. The correct approach is to stop the instance, attach the service account, and restart.

Answer

Use gcloud iam service-accounts add-iam-policy-binding to grant the instance access.

Answer

Use gcloud compute instances add-iam-policy-binding to assign the service account to the instance.

Answer

Create a new instance with the service account and migrate the application.

Question 4

A Cloud Run service is experiencing high latency. You suspect one revision is causing the issue. The service is configured to split traffic 90% to revision A and 10% to revision B. You want to gradually shift traffic back to revision A only. Which command should you use?

Accepted Answer

gcloud run services update-traffic my-service --to-revisions=my-service-00001=100. gcloud run services update-traffic allows you to set traffic percentages for revisions. Setting 100% to revision A achieves the goal.

Answer

kubectl set traffic my-service --revision=my-service-00001=100

Answer

gcloud run revisions delete my-service-00002

Answer

gcloud run services update my-service --set-revision my-service-00001

Question 5

A team runs Apache Kafka on self-managed VMs for event streaming but wants to reduce operational overhead. Which GCP-native service is the managed alternative to Kafka for pub/sub messaging at scale?

Accepted Answer

Cloud Pub/Sub — Google's managed pub/sub messaging service. Cloud Pub/Sub is the correct answer because it is Google Cloud's fully managed, scalable pub/sub messaging service that provides at-least-once delivery and supports both push and pull subscriptions, making it the direct managed alternative to self-managed Apache Kafka. It eliminates the operational overhead of managing Kafka clusters on VMs while offering similar event streaming capabilities with automatic scaling and global availability.

Answer

Cloud Bigtable — a managed wide-column store for streaming data

Answer

Cloud Dataflow — the GCP managed streaming processing service

Answer

Cloud Storage — use GCS notification events as a message queue

Question 6

A company needs to run a MongoDB database on Compute Engine. The database requires high-throughput, low-latency storage that can survive VM failures. Which disk type and configuration is most appropriate?

Accepted Answer

SSD persistent disks with snapshots. SSD persistent disks (pd-ssd) provide high IOPS and low latency for databases. For survival of VM failures, the disk should be set to non-deletable or use snapshots. Regional persistent disks replicate data across zones for higher availability, but the question asks for survival of VM failures, which can be achieved with zonal disks if the VM is recreated and the disk is detached. However, regional persistent disks are better for durability across zone failures. The best answer is pd-ssd with snapshots for backup.

Answer

Standard persistent disks with snapshots

Answer

Extreme persistent disks with snapshots

Answer

Local SSDs

Question 7

A security auditor needs to check whether a specific user (user@company.com) currently has sufficient permissions to delete a Cloud SQL instance in project 'prod-db'. Without making any changes, which tool simulates this check?

Accepted Answer

Use the IAM Policy Troubleshooter (Policy Simulator) to check if the permission is granted. The IAM Policy Troubleshooter (Policy Simulator) is the correct tool because it allows you to check whether a specific user has a particular permission (e.g., cloudsql.instances.delete) on a given resource (the Cloud SQL instance in project 'prod-db') without making any changes. It evaluates the effective IAM policy, including all inherited roles and policies, and returns a result indicating whether the permission is granted. This directly addresses the auditor's need to simulate a permission check without executing any action.

Answer

Run the delete command with `--dry-run` flag to simulate without executing

Answer

Inspect the IAM policy with `gcloud projects get-iam-policy` and manually trace inheritance

Answer

Grant the user the permission temporarily, test the delete, then revoke it

Question 8

An organization needs to deploy a microservices application on Google Kubernetes Engine. Each microservice has different resource requirements, and the team wants to optimize costs by using a mix of spot (preemptible) and regular nodes. They also need to ensure that critical services run on regular nodes. Which GKE feature allows this separation?

Accepted Answer

Use node pools with taints and tolerations on the pods. Node pools in GKE allow you to have groups of nodes with different configurations (e.g., machine type, preemptible vs on-demand). You can then use node affinity or taints/tolerations to schedule pods onto the appropriate node pool.

Answer

Use resource quotas to limit namespace resource usage

Answer

Use separate clusters for critical and non-critical services

Answer

Use vertical pod autoscaling

Question 9

You are designing an application that needs to process exactly once each message published to a topic, even if the consumer fails partway through and restarts. Which GCP service provides built-in exactly-once processing semantics with Pub/Sub?

Accepted Answer

Dataflow with Pub/Sub as the source using the Beam SDK.. Dataflow with Pub/Sub as the source using the Beam SDK provides built-in exactly-once processing semantics because it leverages the Beam engine's checkpointing and the Pub/Sub source's snapshot-based deduplication. Dataflow tracks each message's unique ID and ensures that even if a worker fails and restarts, the message is not reprocessed, guaranteeing exactly-once delivery within the pipeline.

Answer

Cloud Functions subscribed to the Pub/Sub topic with idempotent logic.

Answer

BigQuery Subscriptions connected directly to the Pub/Sub topic.

Answer

Cloud Run with a Pub/Sub push subscription and database deduplication table.

Question 10

A GCP organization has 150 projects. A new security policy requires all projects to enable the Security Command Center API. What is the most efficient way to enable this API across all projects without manually visiting each project?

Accepted Answer

Use a gcloud script to iterate over all projects and enable the API for each. The gcloud command-line tool allows you to script the enabling of the Security Command Center API across all projects efficiently. Using `gcloud services enable securitycenter.googleapis.com --project=<project_id>` in a loop over the list of projects automates the task without manual intervention, leveraging the Cloud SDK's programmatic access to the Service Usage API.

Answer

Manually enable the API in each of the 150 projects via the Cloud Console

Answer

Enable the API at the organization level — it inherits down to all projects

Answer

Create an organization policy enabling all APIs on all projects

Question 11

You have a Cloud Run service configured with `min-instances: 0`. During load testing you notice the first request after a period of inactivity takes 3–5 seconds instead of the normal 100ms. Subsequent requests are fast. What is causing this, and what is the most cost-effective fix?

Accepted Answer

Set `min-instances: 1` to keep a warm instance running and eliminate the cold start latency.. Cold starts occur when Cloud Run needs to spin up a new container instance from zero. The 3–5 second delay is the container startup time. Setting `min-instances: 1` keeps at least one instance warm at all times, eliminating cold starts for the first request. This adds a small cost (one always-running instance) but is the most targeted fix. Increasing memory or CPU doesn't directly address cold start if the issue is container initialization time.

Answer

The Cloud Run service's container image is too large; reduce image size.

Answer

Switch from Cloud Run to GKE, which doesn't have cold starts.

Answer

Increase Cloud Run's request timeout to 30 seconds to accommodate cold starts.

Question 12

A company wants to ensure that only users from a specific domain (@example.com) can access Cloud Storage buckets in a project. Which two steps should be taken? (Choose two.)

Accepted Answer

Set an organization policy to restrict allowed domains for IAM.. The organization policy constraint `iam.allowedPolicyMemberDomains` restricts which domains can be used as members in IAM policies across the entire project. This ensures that only principals from @example.com can be granted access to any resource, including Cloud Storage buckets. Option E is correct because a Cloud Identity group containing only @example.com users can be granted IAM roles on the bucket, and membership in the group is controlled by the domain, effectively limiting access to that domain.

Answer

Use VPC Service Controls to restrict access.

Answer

Enable domain restricted sharing in Cloud Storage settings.

Answer

Add an IAM condition to the bucket policy to require that the user's domain is @example.com.

Question 13

A company is using Cloud Run for a stateless application. The application sometimes fails with HTTP 503 errors when traffic spikes. Which action should the team take to improve reliability?

Accepted Answer

Increase the maximum number of container instances.. HTTP 503 errors during traffic spikes indicate that Cloud Run is scaling out but hitting the maximum number of container instances limit, causing new requests to be rejected. Increasing the maximum number of container instances allows Cloud Run to spin up more concurrent containers to handle the burst, directly improving reliability under load.

Answer

Configure a liveness probe with a higher initial delay.

Answer

Use Cloud Functions instead of Cloud Run.

Answer

Enable HTTP load balancing with Cloud CDN.

Question 14

Which THREE actions are recommended to ensure the successful operation of a Compute Engine instance running a production workload?

Accepted Answer

Enable deletion protection on the instance.. Enabling deletion protection (A) prevents accidental deletion of the instance. Configuring snapshots with a retention policy (D) ensures data backup and recovery. Setting up a health check and autohealing policy (B) automatically recreates unhealthy instances, improving availability. Option C (using a custom VPC with a single-zone subnet) reduces fault tolerance, which is not recommended for production workloads. Option E (attaching a GPU) is only needed for specific workloads like machine learning, not a general best practice.

Answer

Use a custom VPC with a subnet in a single zone.

Answer

Attach a GPU for machine learning inference.

Question 15

A company wants to expose a web application running on Compute Engine instances behind a managed instance group. They need a single IP address that distributes incoming HTTP traffic across instances. Which type of load balancer should they use?

Accepted Answer

External HTTP(S) Load Balancer. The External HTTP(S) Load Balancer is a regional or global, proxy-based Layer 7 load balancer that provides a single external IP address for distributing incoming HTTP traffic across Compute Engine instances in a managed instance group. It supports HTTP and HTTPS protocols, health checks, and autoscaling, making it ideal for web applications.

Answer

Internal TCP/UDP Load Balancer

Answer

External TCP/UDP Network Load Balancer

Answer

SSL Proxy Load Balancer

Question 16

A company runs an App Engine Standard application with multiple versions. They want to gradually roll out new features by sending a small percentage of traffic to a new version. How should they implement this?

Accepted Answer

Use App Engine's traffic splitting feature to assign a percentage of traffic to the new version. App Engine Standard provides built-in traffic splitting, allowing you to assign a percentage of incoming requests to different versions of the same service. This is the simplest and most direct way to gradually roll out a new feature by sending a small percentage of traffic to the new version without needing external load balancers or additional services.

Answer

Deploy the new version and delete the old version

Answer

Use Cloud Load Balancing to distribute traffic between versions

Answer

Create a new service for the new version and use a custom domain

Question 17

A team needs a GKE cluster named 'prod-cluster' in the us-central1 region with cluster autoscaling enabled, scaling between 3 and 10 nodes. Which command achieves this?

Accepted Answer

gcloud container clusters create prod-cluster --region=us-central1 --num-nodes=3 --enable-autoscaling --min-nodes=3 --max-nodes=10. It uses the `gcloud container clusters create` command with the `--enable-autoscaling` flag, which enables cluster autoscaler for the GKE cluster. The `--min-nodes=3` and `--max-nodes=10` flags define the scaling range, while `--num-nodes=3` sets the initial node count, ensuring the cluster starts with 3 nodes and can scale up to 10 as needed. The `--region=us-central1` specifies a regional cluster, which is appropriate for production workloads requiring high availability across zones.

Answer

gcloud kubernetes clusters create prod-cluster --location=us-central1 --autoscale=3:10

Answer

gcloud container cluster create prod-cluster --zone=us-central1 --scaling=3-10

Answer

kubectl create cluster prod-cluster --region=us-central1 --autoscale --min=3 --max=10

Question 18

A company has a Cloud Storage bucket that stores sensitive files. They want to ensure that objects are automatically deleted after 30 days to comply with data retention policies. Additionally, they need to keep a copy of all object deletions for audit purposes. Which combination of bucket settings should they use?

Accepted Answer

Enable object versioning and add a lifecycle rule with condition 'Age: 30 days' and action 'Delete' for the current version. Cloud Storage lifecycle management can automatically delete objects after 30 days using a SetStorageClass or Delete action with an Age condition. Object versioning enables keeping deleted or overwritten versions (noncurrent versions). By combining lifecycle rules to delete noncurrent versions after a period (e.g., 0 days) or simply keeping them, you can audit deletions. However, the question says 'keep a copy of all object deletions for audit purposes' – versioning retains noncurrent versions when objects are deleted or overwritten. Lifecycle rules can be set to expire the noncurrent versions after a longer period, but for audit purposes, you would keep them indefinitely or for a long period. The simplest is to enable versioning and set a lifecycle rule to delete objects after 30 days; deleted objects become noncurrent versions and are retained until a lifecycle rule removes them. To keep a copy, you might not delete noncurrent versions. The correct answer: enable versioning and add a lifecycle rule with condition Age:30 and action Delete for current objects. Noncurrent versions will remain unless a separate rule deletes them. For audit, you may also set a rule to delete noncurrent versions after a longer period, but the question asks for 'which combination' – the combination that achieves both requirements is versioning + lifecycle rule to delete current objects after 30 days. The deleted objects become noncurrent versions, which are retained (so audit copy is kept). If they need to keep the deletion records forever, they should not delete noncurrent versions. Among options, the one that includes versioning and a lifecycle rule that deletes objects after 30 days is correct. Option D includes versioning and lifecycle rule: 'Delete object after 30 days' – that's it. Option A is 'Object versioning' only – no deletion. Option B is 'Bucket lock' – not for automatic deletion. Option C is 'Lifecycle rule to delete objects after 30 days' without versioning – then when deleted, there is no version history. So D is best.

Answer

Enable bucket lock and use object holds

Answer

Enable object versioning and set a retention policy with a retention period of 30 days

Answer

Enable a lifecycle rule with condition 'Age: 30 days' and action 'Delete'

Question 19

Your GKE cluster is running a deployment with a container image my-app:v1. You need to update it to my-app:v2 and monitor the rollout progress. Which commands should you use?

Accepted Answer

kubectl set image deployment/my-app my-app=my-app:v2 followed by kubectl rollout status deployment/my-app. kubectl set image updates the deployment, and kubectl rollout status monitors progress.

Answer

gcloud compute instances update-container and kubectl get events

Answer

kubectl edit deployment/my-app and change the image, then kubectl rollout undo if needed

Answer

gcloud container clusters upgrade and kubectl get pods

Question 20

A batch processing job runs on preemptible VMs in a managed instance group. The job frequently fails due to preemption. Which design change would most effectively improve the job's resilience?

Accepted Answer

Use a managed instance group with distribution across multiple zones and enable autoscaling.. Distributing the managed instance group across multiple zones and enabling autoscaling ensures that when preemptible VMs are terminated in one zone, the autoscaler can provision replacement VMs in another zone that still has capacity. This architecture leverages the fact that preemption events are often zone-specific, so multi-zone distribution combined with autoscaling provides resilience without requiring persistent resources.

Answer

Use committed use discounts (1-year or 3-year).

Answer

Add GPUs to the instances.

Answer

Use sole-tenant nodes.