Google ACE Practice Exam 53 — 20 Questions

Question 1

A team is deploying a containerized microservice on GKE. They want to ensure the service is externally accessible via a stable IP address and can automatically scale the number of pods based on CPU utilization. Which TWO actions should they perform?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Expose the deployment using kubectl expose deployment my-service --type=LoadBalancer. Option A is correct because exposing the deployment with `kubectl expose deployment my-service --type=LoadBalancer` creates a Kubernetes Service of type LoadBalancer, which on GKE provisions a Google Cloud external load balancer with a stable external IP address, satisfying the requirement for external accessibility via a stable IP. Option D is correct because `kubectl autoscale deployment my-service --cpu-percent=80 --min=1 --max=10` creates a HorizontalPodAutoscaler that scales the number of pods between 1 and 10 based on a target CPU utilization of 80%, directly fulfilling the automatic scaling requirement. Option B is incorrect because a ClusterIP service only provides an internal cluster-only virtual IP and is not externally accessible. Option C is incorrect because a Cluster Autoscaler scales the number of nodes in the node pool, not the number of pods, so it does not address pod-level scaling based on CPU. Option E is incorrect because a NodePort service exposes the service on a static port on each node's IP, which is not a stable external IP address and is not the recommended approach for external access on GKE.

Answer

Set the service type as ClusterIP

Answer

Create a Cluster Autoscaler on the GKE cluster

Answer

Expose the deployment using kubectl expose deployment my-service --type=NodePort

Question 2

You need to set up an alerting policy to notify your team via email and Slack when a Compute Engine instance's CPU utilization exceeds 80% for 5 minutes. Which two resources must you configure? (Choose two.)

Accepted Answer

A metric threshold condition on the 'compute.googleapis.com/instance/cpu/utilization' metric. Option B is correct because a Cloud Monitoring alerting policy requires an alerting condition, and a metric threshold condition on 'compute.googleapis.com/instance/cpu/utilization' with a threshold of 80% and a duration of 5 minutes directly expresses the required trigger. Option D is correct because notification channels define where alerts are delivered; an 'email' notification channel is needed to notify the team via email (a Slack channel would be configured as an additional notification channel of type Slack). Option A is not required because Cloud Monitoring natively evaluates metrics and sends notifications without a Cloud Function. Option C is not relevant because uptime checks test endpoint availability, not CPU utilization. Option E is not relevant because log-based alerts trigger on log entries, not on a CPU metric threshold.

Answer

A Cloud Function to check CPU and send Slack message

Answer

An uptime check for the external IP of the instance

Answer

A log-based alert for the 'compute.googleapis.com/instance' log

Question 3

A developer wants to use Cloud Shell for managing GCP resources. Which three statements about Cloud Shell are true? (Choose THREE.)

Accepted Answer

It provides a web-based terminal in the GCP Console. Option C is correct because Cloud Shell is a web-based terminal accessible directly from the Google Cloud Console, allowing users to run commands and manage GCP resources without installing local tools. Option D is correct because Cloud Shell provides 5 GB of persistent disk storage mounted at $HOME, which persists across sessions and is tied to the user, not the VM instance. Option E is correct because Cloud Shell images come pre-installed with common tools including gcloud CLI, kubectl, and terraform, so developers can immediately manage GCP resources and Kubernetes clusters. Option A is not correct because Cloud Shell sessions have a timeout (typically 20 minutes of inactivity and a maximum session duration of 12 hours), so sessions are not unlimited. Option B is not correct because Cloud Shell can be used in projects without billing enabled, though some operations may require billing; Cloud Shell itself is free and available to any authenticated user.

Answer

It allows unlimited session duration without any timeout

Answer

It can be used only for projects that have billing enabled

Question 4

A company is deploying a web application on Compute Engine and wants to distribute traffic across multiple instances in different zones for high availability. They also need to terminate SSL/TLS at the load balancer. Which TWO services should they use together?

Accepted Answer

Managed instance group. Option A, a managed instance group, is correct because it provides the pool of identical Compute Engine instances spread across multiple zones that the load balancer distributes traffic to, and it also enables autohealing and autoscaling for high availability. Option B, an external HTTP(S) load balancer, is correct because it is a global, layer 7 load balancer that spreads client traffic across instances in multiple zones/regions and supports SSL/TLS termination at the load balancer via its target HTTPS proxy and SSL certificates. Option C, Cloud CDN, is not required here because it is a content-caching layer that integrates with the HTTP(S) load balancer but does not itself distribute traffic across instances or terminate SSL/TLS. Option D, an internal TCP/UDP load balancer, is wrong because it is a regional, layer 4 load balancer for internal traffic and does not terminate SSL/TLS or serve public web traffic. Option E, Cloud NAT, is wrong because it provides outbound internet access for instances without external IPs and has nothing to do with inbound traffic distribution or SSL/TLS termination.

Answer

Cloud CDN

Answer

Internal TCP/UDP load balancer

Answer

Cloud NAT

Question 5

A DevOps engineer is creating a GKE cluster for a production workload that requires high availability and resilience to zone failures. They also need to deploy a stateless application that can scale based on CPU usage. Which two actions should they take? (Choose two.)

Accepted Answer

Enable horizontal pod autoscaling on the deployment with CPU target utilization. Option E is correct because a regional GKE cluster spreads its control plane and node pools across multiple zones within a region, which provides resilience to zone failures and satisfies the high-availability requirement. Option D is correct because a Horizontal Pod Autoscaler (HPA) targeting CPU utilization automatically adjusts the number of pod replicas based on observed CPU usage, which is exactly what the stateless application needs to scale. Option A is not required for the stated goals: node auto-repair only restarts unhealthy nodes and does not by itself provide zone-failure resilience or CPU-based scaling. Option B is wrong because a zonal cluster in a single zone is a single point of failure and cannot survive a zone outage. Option C is wrong because setting replicas to 1 prevents scaling and creates a single point of failure for the stateless workload.

Answer

Enable node auto-repair on the node pool

Answer

Create a zonal cluster in a single zone

Answer

Set the deployment replicas to 1

Question 6

A company uses Cloud Armor to protect an HTTP Load Balancer. They want to allow traffic only from specific IP ranges (198.51.100.0/24 and 203.0.113.0/24) and block common web attacks like SQL injection and XSS. Which TWO actions should they take?

Accepted Answer

Enable predefined WAF rules (e.g., OWASP Top 10) in the Cloud Armor security policy.. Option D is correct because Cloud Armor security policies are enforced at the HTTP(S) Load Balancer edge, so an allow rule matching source IP ranges 198.51.100.0/24 and 203.0.113.0/24 combined with a default deny rule (priority-based, with the allow rule at a lower priority number) restricts traffic to only those ranges. Option C is correct because Cloud Armor's predefined WAF rules, such as the OWASP Top 10 rule sets (e.g., sqli-v33-stable and xss-v33-stable), detect and block SQL injection and XSS at the load balancer. Option A is incorrect because Cloud NAT only provides outbound internet access for instances without external IPs and does not filter inbound traffic or block web attacks. Option B is incorrect because VPC firewall rules operate at the network/subnet level on instance traffic, not on HTTP(S) Load Balancer traffic, and cannot inspect for SQL injection or XSS. Option E is incorrect because Cloud CDN only caches static content to improve latency and does not enforce IP allowlisting or WAF protections.

Answer

Set up Cloud NAT to provide outbound internet access for the instances.

Answer

Configure VPC firewall rules on the subnet to allow only the IP ranges.

Answer

Enable Cloud CDN to cache static content from the backend.

Question 7

An engineer is using gsutil to upload a large number of files to a Cloud Storage bucket. The upload is proceeding very slowly. Which two actions could improve the upload performance? (Choose two.)

Accepted Answer

Use the gsutil -m option to enable parallel multi-threading.. Option A is correct because gsutil -m enables parallel multi-threaded/multi-processing transfers, which lets many files upload concurrently and dramatically improves throughput when uploading a large number of files. Option D is correct because enabling parallel composite uploads (by setting the threshold below the file size, e.g., gsutil -o GSUtil:parallel_composite_upload_threshold=150M) splits large files into chunks uploaded in parallel and then composed server-side, speeding up large-file uploads. Option B is incorrect because Boto:num_retries only controls how many times failed requests are retried; it does not increase throughput and can even slow things down. Option C is incorrect because storage class affects pricing, availability, and access characteristics, not upload speed. Option E is incorrect because ACLs govern access permissions and have no effect on write performance.

Answer

Increase the number of retries using gsutil -o Boto:num_retries=10.

Answer

Change the storage class of the bucket to Standard.

Answer

Set a custom ACL on the bucket to allow faster writes.

Question 8

A startup wants to control costs across multiple GCP projects. They want to track spending by department and set budget alerts. Which THREE actions should they take?

Accepted Answer

Assign labels to resources indicating department. Option A is correct because labels (key/value pairs such as department:finance) applied to resources are propagated into billing data, allowing spend to be broken down and filtered by department in cost reports and exports. Option C is correct because enabling billing export to BigQuery writes detailed Cloud Billing data (including labels, project, service, and SKU) to a dataset, enabling granular, queryable cost analysis across multiple projects. Option E is correct because budgets are created at the billing-account level and can trigger threshold-based alerts (e.g., at 50%, 90%, 100% of a specified amount) via Cloud Monitoring notification channels, which is exactly how the startup would monitor spending. Option B is not appropriate because Cloud Monitoring tracks metrics, logs, and uptime for resources, not billing costs; cost visibility comes from Cloud Billing reports, budgets, and BigQuery export. Option D is not appropriate because creating separate billing accounts per department adds administrative overhead and fragments payment and reporting rather than enabling cost tracking by department within a shared account.

Answer

Use Cloud Monitoring to track costs

Answer

Create separate billing accounts for each department

Question 9

A Cloud Architect needs to understand the GCP resource hierarchy to set up proper access control. Which three resources are part of the GCP resource hierarchy? (Choose THREE.)

Accepted Answer

Folder. The GCP resource hierarchy is Organization → Folder → Project → Resources, so the three hierarchy nodes among the options are Organization (D), Folder (B), and Project (C). Organization (D) is the root node of the hierarchy and is tied to a Cloud Identity or Workspace domain, serving as the top-level container where organization-wide IAM policies and org policies are applied. Folder (B) sits between the organization and projects, allowing hierarchical grouping of projects so that IAM and org policies inherit down to everything beneath them. Project (C) is the fundamental resource container that holds actual GCP services and resources (VMs, buckets, datasets) and is the level at which APIs are enabled and billing is linked. Billing Account (A) is not part of the resource hierarchy; it is a separate billing construct that can be linked to one or more projects but does not participate in IAM policy inheritance. Cloud Identity (E) is an identity management service/domain that underpins the organization node, not a node in the resource hierarchy itself.

Answer

Billing Account

Answer

Cloud Identity

Question 10

An engineer wants to create a VPC with a custom subnet mode and then create a subnet with Private Google Access enabled. Which two commands should they use? (Choose TWO.)

Accepted Answer

gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24 --enable-private-ip-google-access. Option B is correct because creating a VPC in custom subnet mode requires the command `gcloud compute networks create my-vpc --subnet-mode custom`, which prevents Google Cloud from automatically creating subnets in each region and is the necessary first step for the scenario. Option A is correct because `gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24 --enable-private-ip-google-access` creates the subnet with the `--enable-private-ip-google-access` flag, which turns on Private Google Access so instances without external IPs can reach Google APIs and services. Option C is incorrect because it creates the subnet without the `--enable-private-ip-google-access` flag, so Private Google Access would remain disabled. Option D is incorrect because it creates a firewall rule for HTTP traffic, which is unrelated to subnet mode or Private Google Access. Option E is incorrect because `--subnet-mode auto` creates an auto mode VPC, which contradicts the requirement for a custom subnet mode VPC.

Answer

gcloud compute networks subnets create my-subnet --network my-vpc --region us-central1 --range 10.0.0.0/24

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80

Answer

gcloud compute networks create my-vpc --subnet-mode auto

Question 11

A security engineer wants to audit all attempts to access a specific Cloud Storage bucket, including successful and failed read requests. Which THREE steps should they take? (Choose THREE)

Accepted Answer

Enable Data Access audit logs for the Cloud Storage service.. Option B is correct because Cloud Storage read requests (both successful and failed) are recorded only in Data Access audit logs, which are disabled by default and must be explicitly enabled for the Cloud Storage service. Option C is correct because once Data Access logs are enabled, they can be queried in Log Explorer using filters such as resource.type="gcs_bucket" and the bucket name to isolate the relevant read attempts. Option D is correct because the auditor needs the roles/logging.viewer role (or equivalent) on the project to view and filter those audit logs in Log Explorer. Option A is not needed because BigQuery sinks are for exporting/analyzing logs, not for auditing access attempts directly, and Admin Activity logs do not capture data reads. Option E is incorrect because Admin Activity audit logs are always enabled and record administrative/config changes, not successful or failed object read requests.

Answer

Create a log sink to BigQuery for the bucket's admin activity logs.

Answer

Enable Admin Activity audit logs for the bucket.

Question 12

A company wants to implement a least-privilege security model for a service account that needs to read secrets from Secret Manager and publish messages to Pub/Sub. Which TWO IAM roles should be granted? (Choose TWO)

Accepted Answer

roles/pubsub.publisher. Option A, roles/pubsub.publisher, is correct because it grants exactly the permission needed to publish messages to a Pub/Sub topic (pubsub.topics.publish) without granting administrative capabilities, which fits the least-privilege requirement. Option C, roles/secretmanager.secretAccessor, is correct because it provides the minimal permission to access the payload of a secret (secretmanager.versions.access), which is precisely what the service account needs to read secrets. Option B, roles/secretmanager.viewer, is not appropriate because it allows viewing secret metadata but not accessing the secret payload, so it would not satisfy the read-secrets requirement. Option D, roles/pubsub.admin, is too broad since it grants full control over Pub/Sub resources, violating least privilege. Option E, roles/secretmanager.admin, is also overly permissive, granting full administrative control over Secret Manager rather than just read access.

Answer

roles/secretmanager.viewer

Answer

roles/pubsub.admin

Answer

roles/secretmanager.admin

Question 13

A developer wants to deploy a Cloud Function that is triggered by messages in a Pub/Sub topic. Which TWO flags are required in the gcloud functions deploy command?

Accepted Answer

--runtime. Option A (--runtime) is correct because gcloud functions deploy requires you to specify the language runtime (for example, --runtime=nodejs20 or --runtime=python311) so the platform knows which execution environment to build and run the function in. Option B (--trigger-topic) is correct because it is the flag that configures the function's event trigger as a Pub/Sub topic, binding the function to messages published to that topic. Option C (--timeout) is not required; it only overrides the default function execution timeout. Option D (--memory) is not required; it only adjusts the allocated memory for the function. Option E (--entry-point) is not required for a single-function deployment, since the entry point is only needed when the source contains multiple functions and you must disambiguate which one to deploy.

Answer

--timeout

Answer

--memory

Answer

--entry-point

Question 14

An organization has a VPC with private instances that need outbound internet access for software updates. The instances have no external IP addresses. Which Google Cloud service should be configured?

Accepted Answer

Cloud NAT. To enable outbound internet access for private VM instances that have no external IP addresses, you configure Cloud NAT. Cloud NAT uses a NAT gateway to provide source network address translation (SNAT) so that instances can reach the internet for updates while remaining unreachable from the internet.

Answer

VPC firewall rules

Answer

Cloud Load Balancing

Answer

Cloud VPN

Question 15

An engineer wants to allow HTTP traffic from the internet to a set of Compute Engine instances that have the network tag 'web-server'. Which firewall rule should they create?

Accepted Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-ranges 0.0.0.0/0 --target-tags web-server. To allow HTTP traffic from the internet to instances with the network tag 'web-server', the firewall rule must specify --allow tcp:80, --source-ranges 0.0.0.0/0 (to allow all internet IPs), and --target-tags web-server (to apply to instances with that tag). This correctly defines an ingress rule allowing TCP port 80 from any source to the tagged instances.

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server

Answer

gcloud compute firewall-rules create allow-http --allow tcp:80 --source-tags web-server --target-ranges 0.0.0.0/0

Answer

gcloud compute firewall-rules create allow-http --direction egress --allow tcp:80 --destination-ranges 0.0.0.0/0 --target-tags web-server

Question 16

A company needs to store petabytes of time-series IoT sensor data and query it with single-digit millisecond latency at millions of reads per second. The data has a simple key-value structure with timestamps. Which Google Cloud database is MOST appropriate?

Accepted Answer

Cloud Bigtable. Cloud Bigtable is a fully managed, high-performance NoSQL wide-column database designed for massive analytical and operational workloads. It excels at storing petabytes of data and delivering single-digit millisecond latency for high-throughput reads/writes (millions of ops/sec) when using row-key based access. Its sparse table design and automatic sharding make it ideal for time-series IoT data where the row key can incorporate a timestamp for efficient range scans.

Answer

BigQuery

Answer

Firestore

Answer

Cloud Spanner

Question 17

A developer needs to deploy a containerized web application that experiences unpredictable traffic patterns, including long periods of no traffic. They want to minimize costs and only pay for resources when the application is serving requests. Which Google Cloud compute service is most suitable?

Accepted Answer

Cloud Run. Cloud Run is a serverless container platform that scales to zero when not in use, charging only for resources during request processing.

Answer

Google Kubernetes Engine (GKE) Standard

Answer

Compute Engine with managed instance groups

Answer

Cloud Functions

Question 18

Your team manages a Compute Engine instance group that runs a stateless web application. You need to ensure that instances are automatically repaired if they fail health checks, and that the group scales based on CPU utilization. Which type of instance group should you use?

Accepted Answer

Managed instance group. A managed instance group (MIG) is designed to automate the lifecycle of identical instances. It uses an instance template to create instances and can be configured with autohealing based on health checks, as well as autoscaling based on metrics like CPU utilization. This makes it the ideal choice for a stateless web application that requires automatic repair and scaling.

Answer

Regional managed instance group

Answer

Instance group with autoscaling only

Answer

Unmanaged instance group

Question 19

You are deploying a new version of an application to a Google Kubernetes Engine (GKE) cluster. You want to ensure that the new version is rolled out gradually, and if any issues are detected, the rollout is automatically paused. You also want to be able to easily roll back to the previous version. Which GKE feature should you use?

Accepted Answer

Configure a Kubernetes Deployment with a rolling update strategy and set maxSurge and maxUnavailable parameters.. A Kubernetes Deployment with a rolling update strategy is designed for gradual rollouts, supports pausing and resuming, and allows easy rollback to previous versions. It uses ReplicaSets under the hood and provides declarative updates. The other options are either for different use cases (StatefulSet, DaemonSet) or lack native rollout control (ReplicaSet).

Answer

Use a StatefulSet with pod management policy set to Parallel.

Answer

Create a DaemonSet to ensure the new version runs on all nodes.

Answer

Use a ReplicaSet with a custom controller to manage the rollout.

Question 20

A company is planning to deploy a batch processing workload on Google Cloud. The workload runs for several hours each night, can tolerate interruptions, and must be cost-optimized. The operations team wants to minimize management effort and ensure the workload automatically restarts if a VM is preempted. Which TWO actions should the company take? (Choose two.)

Accepted Answer

Create a managed instance group using Spot VMs as the instance template and configure it to automatically recreate instances.. Spot VMs in a managed instance group deliver the required cost savings for interruptible batch work, and automatic recreation keeps the job running after preemption. Adding Cloud Scheduler for nightly starts and Cloud Storage checkpoints makes restarts efficient, so the workload completes with minimal operational effort.

Answer

Deploy the workload on sole-tenant nodes to guarantee physical isolation from other customers.

Answer

Configure the workload to run on a single large standard VM with a local SSD for temporary data.

Answer

Use standard Compute Engine VMs with committed use discounts for a three-year term.