Google ACE Practice Exam 53 — 20 Questions

Question 1

An organization has deployed a Compute Engine VM instance running a web server. The web server is not responding to HTTP requests from the internet. The firewall rules allow ingress traffic on port 80 and 443 from any source (0.0.0.0/0). The VM has a public IP address and is in a VPC network with default subnets. What is the most likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The web server service is not running on the VM.. The most likely cause of the web server not responding to HTTP requests, despite correct firewall rules and a public IP, is that the web server service (e.g., Apache, Nginx) is not running on the VM. Firewall rules only control network traffic; they do not ensure that the application process is listening on the specified ports. A simple `sudo systemctl status apache2` or `netstat -tlnp` would confirm whether the service is active.

Answer

The VM does not have an HTTP health check configured.

Answer

The VPC network's default firewall rule blocks ingress traffic.

Answer

The VM is not in the same region as the global load balancer.

Question 2

You are enabling OS Login for a GCP project to manage SSH access to Compute Engine VMs. A developer cannot SSH to a VM despite having `roles/compute.osLogin` granted. The VM has OS Login enabled. What is the most likely missing configuration?

Accepted Answer

The VM metadata `enable-oslogin` is not set to `TRUE` at the VM or project level.. OS Login requires the VM or project metadata key `enable-oslogin` to be set to `TRUE`. Even if the user has the `roles/compute.osLogin` role, OS Login will not function if this metadata is missing or set to `FALSE`. The metadata enables the OS Login agent on the VM to authenticate users via IAM permissions rather than local SSH keys.

Answer

The developer needs `roles/compute.instanceAdmin` in addition to `roles/compute.osLogin`.

Answer

The developer must generate an SSH key pair and upload the public key to the VM's authorized_keys.

Answer

The developer's account needs `roles/iam.serviceAccountTokenCreator` to authenticate via SSH.

Question 3

Which GCP service protects internet-facing applications against SQL injection, cross-site scripting (XSS), and other OWASP Top 10 attacks?

Accepted Answer

Cloud Armor WAF with preconfigured OWASP Core Rule Set. Cloud Armor WAF with the preconfigured OWASP Core Rule Set (CRS) is specifically designed to protect internet-facing applications from web application attacks, including SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. It operates at the edge of Google's network, inspecting HTTP/HTTPS traffic against a set of rules that match known attack patterns, and can be integrated with Cloud Load Balancing to filter malicious requests before they reach the backend.

Answer

Cloud Firewall (VPC firewall rules)

Answer

Security Command Center's Web Security Scanner

Answer

Cloud Identity-Aware Proxy (IAP)

Question 4

A gaming company's GKE cluster uses a mix of node pools: a standard on-demand pool for stateful database pods, and a Spot VM pool for compute-intensive but fault-tolerant game simulation pods. The simulation pods occasionally get preempted. How should the Deployment be configured to route simulation pods to the Spot pool only?

Accepted Answer

Add a nodeSelector: cloud.google.com/gke-spot: 'true' to the simulation Deployment spec. GKE uses the node label `cloud.google.com/gke-spot` to identify Spot VMs. Adding a `nodeSelector` with that exact key-value pair ensures the simulation Deployment is scheduled exclusively on Spot nodes, which is the intended behavior for fault-tolerant, preemptible workloads.

Answer

Set podAffinity to prefer nodes where Spot pods are running

Answer

Set requests.cpu and requests.memory to very high values — GKE will route them to Spot nodes

Answer

Name the simulation Deployment with a 'spot-' prefix — GKE routes prefixed deployments to Spot pools

Question 5

Refer to the exhibit. An application running on this instance is unable to write to a Cloud Storage bucket. What is the most likely cause?

Accepted Answer

The access scopes only allow read access to Cloud Storage. When an instance is created with access scopes, these scopes restrict the API methods that the instance's credentials can use, regardless of the IAM permissions granted to the attached service account. The exhibit shows that the access scopes are set to 'Read Only' for Cloud Storage, which means the application can only call read methods (e.g., storage.objects.get) and cannot perform write operations (e.g., storage.objects.insert). This overrides any IAM role that would otherwise allow write access.

Answer

The application is using the wrong authentication method

Answer

The Cloud Storage bucket is in a different project

Answer

The service account does not have the storage.objectAdmin IAM role

Question 6

A team needs a database backup job to run every day at 2 AM UTC. The job calls an HTTP endpoint to trigger the backup. The endpoint requires no complex orchestration — just a timed HTTP call. Which GCP service handles this most simply?

Accepted Answer

Cloud Scheduler with an HTTP target pointing to the backup endpoint. Cloud Scheduler is the simplest GCP service for a recurring HTTP call because it is a fully managed cron job service that directly supports HTTP targets. You configure a schedule (e.g., '0 2 * * *' for daily at 2 AM UTC) and point it to the backup endpoint URL. No additional code, queue, or orchestration is needed, making it the most straightforward solution for this use case.

Answer

Cloud Tasks with a daily task enqueued by a Cloud Function

Answer

Cloud Composer DAG running at 2 AM UTC

Answer

Cloud Run Jobs triggered by a Cloud Monitoring alert at 2 AM

Question 7

A team stores application log archives in a Cloud Storage bucket. Logs older than 90 days should automatically move to Coldline storage, and logs older than 365 days should be deleted. Which feature automates this?

Accepted Answer

Cloud Storage Object Lifecycle Management rules on the bucket. Cloud Storage Object Lifecycle Management rules allow you to automatically transition objects to Coldline storage after 90 days and delete them after 365 days based on object age conditions. This is a native, serverless feature that requires no external compute or scheduling, making it the most efficient and reliable approach for automating tiering and deletion of log archives.

Answer

Cloud Scheduler jobs that run gsutil rewrite and gsutil rm commands nightly

Answer

Cloud Pub/Sub notifications triggering a Cloud Function on each object creation

Answer

Retention policies that lock objects in Coldline after 90 days

Question 8

A team builds a document processing pipeline: files are uploaded to Cloud Storage, then analyzed by Cloud Vision AI, results stored in Firestore, and a confirmation email sent. Each step depends on the previous. Which GCP service orchestrates these sequential, dependent steps reliably?

Accepted Answer

Cloud Workflows. Cloud Workflows is designed to orchestrate sequential, dependent steps with built-in retry, error handling, and state management. It directly models the pipeline as a series of steps where each step's output feeds the next, without requiring manual chaining or intermediate messaging infrastructure.

Answer

Cloud Pub/Sub with a subscription per step

Answer

Cloud Tasks with per-step queues

Answer

Cloud Functions chained via HTTP calls

Question 9

A company is implementing cost optimization for their Google Cloud resources. Which two practices are recommended? (Choose two.)

Accepted Answer

Use committed use discounts for predictable workloads.. Committed use discounts (CUDs) are recommended for cost optimization because they provide significant discounts (up to 70% for vCPUs and memory) in exchange for a commitment to use a minimum level of resources (e.g., 1-year or 3-year term) for predictable workloads. This aligns costs with actual usage patterns, reducing waste from on-demand pricing. Deleting unused static external IP addresses is also recommended because each static IP incurs a small hourly charge (e.g., $0.005/hour for a regional IP) even when not attached to a resource, so removing them eliminates unnecessary costs.

Answer

Keep all resources in a single region to avoid data transfer costs.

Answer

Always use premium-tier networking for all traffic.

Answer

Use preemptible VMs for all batch jobs irrespective of fault tolerance.

Question 10

You need to ensure that a Cloud Run service can only be invoked by specific Cloud Scheduler jobs and not from the public internet, while still receiving HTTP requests. The Cloud Run service currently allows unauthenticated invocations. What configuration changes are required?

Accepted Answer

Disable unauthenticated invocations on the Cloud Run service, grant `roles/run.invoker` to the Scheduler SA, and configure Scheduler to use OIDC authentication.. Cloud Run services that require authentication must have unauthenticated invocations disabled, and the Cloud Scheduler service account must be granted the `roles/run.invoker` role. Additionally, Cloud Scheduler must be configured to use OIDC authentication, which allows it to present an identity token signed by Google to the Cloud Run service, ensuring only authorized scheduler jobs can invoke the service.

Answer

Add a Cloud Armor security policy to the Cloud Run service blocking all IPs except Cloud Scheduler.

Answer

Deploy the Cloud Run service in a VPC and use a VPC firewall rule to block all traffic except Cloud Scheduler.

Answer

Add a secret header to Cloud Scheduler requests and validate it in the Cloud Run application code.

Question 11

A data warehouse team queries a 10 TB BigQuery table containing billions of events with a date column. Most queries filter by a date range (e.g., last 30 days). Without any partitioning, queries scan the full 10 TB every time. Which BigQuery feature eliminates unnecessary data scanning for date-range queries?

Accepted Answer

Date/timestamp partitioned table on the date column. Partitioning a BigQuery table by the date column allows the query engine to prune entire partitions that fall outside the specified date range, so only the relevant partitions (e.g., last 30 days) are scanned instead of the full 10 TB. This directly reduces data scanned and cost, making option C the correct choice for eliminating unnecessary scanning in date-range queries.

Answer

BigQuery table clustering on the date column

Answer

Creating a materialized view for the last 30 days

Answer

Increasing BigQuery slot reservations for faster full-table scans

Question 12

A team needs to run a containerized HTTP API that scales to zero when idle and requires zero cluster or server management. Which GCP compute platform is the best fit?

Accepted Answer

Cloud Run. Cloud Run is the best fit because it is a fully managed serverless platform that automatically scales your containerized HTTP API to zero when idle, meaning you pay only for resources used during request processing. It requires no cluster or server management, as it abstracts away the underlying infrastructure entirely, unlike other options that still involve some level of node or instance management.

Answer

Compute Engine with a managed instance group

Answer

Google Kubernetes Engine Autopilot

Answer

App Engine Flexible

Question 13

A company is migrating an on-premises MySQL database to Cloud SQL. Which TWO steps are necessary for setting up ongoing replication from on-premises to Cloud SQL? (Choose 2)

Accepted Answer

Enable binary logging on the on-premises MySQL server.. MySQL's native replication relies on binary logs (binlogs) to capture all changes on the primary server. Enabling binary logging on the on-premises MySQL server is essential to generate the change stream that Cloud SQL will read and apply for ongoing replication.

Answer

Set up a Dataflow pipeline to stream changes.

Answer

Use pg_dump to export the database.

Answer

Establish a Cloud VPN connection between on-premises and Google Cloud.

Question 14

A startup creates its first Google Cloud project. Before deploying any paid resources, what must be linked to the project?

Accepted Answer

A billing account. A billing account must be linked to a Google Cloud project before deploying any paid resources because Google Cloud requires a valid payment method to be associated with the project to track and charge for resource usage. Without a billing account, the project is in a 'billing-enabled' state and can only use free-tier or always-free resources, but any paid service will fail to provision.

Answer

A Cloud Identity domain

Answer

An Organization resource node

Answer

A Shared VPC host project

Question 15

An organization is designing a VPC network with connectivity to an on-premises network via Cloud VPN. They have multiple projects that need to share the VPN. Which three steps are required to implement this using Shared VPC? (Choose three.)

Accepted Answer

Attach the service project to the host project.. Attaching the service project to the host project is a fundamental step in Shared VPC. This attachment allows the service project to use the host project's VPC network resources, including the Cloud VPN gateway and tunnels, enabling centralized connectivity without duplicating VPN infrastructure.

Answer

Enable the Shared VPC feature in the service project.

Answer

Create a Cloud Router in the service project.

Question 16

A GKE node pool needs to be upgraded to a new node version. The cluster has 10 nodes. You need to minimize disruption to running workloads — no more than 2 nodes should be unavailable simultaneously. Which upgrade strategy should you configure?

Accepted Answer

Configure surge upgrade with `max-surge: 0, max-unavailable: 2`.. Configuring `max-surge: 0` and `max-unavailable: 2` ensures that during the upgrade, no additional nodes are created (surge), and at most 2 nodes can be unavailable at any time. This directly satisfies the requirement of minimizing disruption by keeping at least 8 nodes available, while allowing the upgrade to proceed in controlled batches.

Answer

Configure surge upgrade with `max-surge: 10, max-unavailable: 10`.

Answer

Manually cordon and drain 2 nodes, upgrade them, then repeat.

Answer

Enable GKE Auto-upgrade with default settings.

Question 17

Match each BigQuery feature to its description.

Accepted Answer

Clustering: Organizes data based on the contents of one or more columns in a table to improve query performance.. Clustering sorts data by column values to improve filtering performance; Partitioning divides a table into date-based segments to reduce scanned data; Materialized Views store precomputed query results for faster access. Common confusions arise from swapping these definitions, especially between Clustering and Partitioning.

Answer

Clustering: Divides a table into segments based on a date column to reduce data scanned.

Answer

Partitioning: Organizes data based on the contents of columns to improve query performance.

Answer

Materialized Views: Automatically caches query results for frequently run queries without storing data.

Question 18

A developer receives a "Permission 'cloudfunctions.functions.call' denied" error when trying to invoke a Cloud Function from another service. What is the most likely cause?

Accepted Answer

The service account of the caller lacks the Cloud Functions Invoker role.. The error 'Permission cloudfunctions.functions.call denied' indicates that the Identity and Access Management (IAM) policy does not grant the caller the required permission to invoke the function. The Cloud Functions Invoker role (roles/cloudfunctions.invoker) specifically allows the `cloudfunctions.functions.call` permission, which is necessary for HTTP-triggered functions. Without this role on the caller's service account, any invocation attempt will be denied, regardless of other configurations.

Answer

The function is not deployed to the correct region.

Answer

The Cloud Function has a CORS misconfiguration.

Answer

The VPC connector is not configured correctly.

Question 19

A company manages a production GKE cluster with node auto-upgrade enabled. They want to ensure that during a node upgrade, the workloads are rescheduled gracefully without downtime. What Kubernetes resource should be configured on their Deployments?

Accepted Answer

PodDisruptionBudget. PodDisruptionBudget (PDB) allows you to specify the minimum available or maximum unavailable pods during voluntary disruptions like node upgrades. Without a PDB, a node upgrade could evict all pods at once, causing downtime. ResourceQuota and HorizontalPodAutoscaler do not control disruption.

Answer

HorizontalPodAutoscaler

Answer

ResourceQuota

Answer

Node affinity rules

Question 20

A company's Google Kubernetes Engine cluster has experienced a sudden increase in latency. The team suspects a misconfigured node pool is causing resource contention. They want to verify the node's resource usage. Which command or tool should they use?

Accepted Answer

Run 'kubectl top nodes'.. B is correct because 'kubectl top nodes' directly displays real-time CPU and memory usage for each node in the cluster, which is the fastest way to identify resource contention causing latency. This command leverages the metrics-server to aggregate resource metrics from kubelets, giving immediate insight into node-level utilization without additional overhead.

Answer

Run 'gcloud container clusters describe cluster-name'.

Answer

Use the Cloud Console Monitoring page to view node metrics.

Answer

Run 'kubectl describe node node-name'.