Google ACE Practice Test 7 — 10 Questions

Question 1

A security team wants to prevent every project in the organization from creating VM instances with external IP addresses — without requiring configuration in each individual project. What is the most scalable solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the organization policy constraint compute.vmExternalIpAccess to Deny All at the organization level. The organization policy constraint `compute.vmExternalIpAccess` can be applied at the organization level to deny all VM instances from having external IP addresses, enforcing this rule across all projects without per-project configuration. This is the most scalable approach as it uses Google Cloud's hierarchical policy engine to centrally control resource creation, overriding any project-level settings.

Answer

Create a firewall rule in every project blocking outbound traffic on port 80 and 443

Answer

Remove the Compute Engine Admin role from all project owners

Answer

Use Cloud Armor to block all traffic destined for public IPs in the organization

Question 2

A GCP project administrator needs to share read-only access to all resources in the project with an external auditor who has a Gmail account (auditor@gmail.com). What should the admin do?

Accepted Answer

Grant the Viewer role to auditor@gmail.com in the project's IAM policy. Granting the Viewer (roles/viewer) role to auditor@gmail.com in the project's IAM policy is correct because it provides read-only access to all resources in the project without requiring a Cloud Identity account. Gmail accounts are supported as Google Accounts and can be added directly to IAM policies, allowing them to authenticate and access resources via the GCP Console or APIs.

Answer

Create a service account for the auditor and share the JSON key file

Answer

Add auditor@gmail.com as a project billing admin to give them read-only access

Answer

Create a Cloud Identity account for the auditor — Gmail accounts cannot access GCP projects

Question 3

A company has 50+ Compute Engine instances running a stateful application in the us-central1 region. The instances are part of a managed instance group behind an internal load balancer. The application stores data on zonal persistent disks. The company wants to migrate the entire application stack to the europe-west1 region to reduce latency for European users. They have a Cloud VPN tunnel between their on-premises data center and us-central1. They want to extend connectivity to europe-west1 with minimal downtime. The current on-premises router uses BGP to advertise a specific CIDR block (10.0.0.0/8) to Google Cloud. The VPC is in custom mode with subnets in us-central1 and europe-west1 already created. The Cloud VPN gateway in us-central1 is attached to a Cloud Router with a BGP session to the on-premises router. Which course of action should the company take to achieve the migration with minimal downtime?

Accepted Answer

Create a new Cloud VPN gateway in europe-west1, attach it to a Cloud Router, and establish a BGP session with the on-premises router. Use route priority or metrics to gradually shift traffic to europe-west1.. Adding a second Cloud VPN gateway in europe-west1 and configuring a new BGP session to the on-premises router allows the on-premises router to learn routes for europe-west1 subnets and route traffic accordingly. This can be done without modifying existing sessions, and traffic can be shifted gradually by adjusting route priority (MED) or using BGP metrics. Option A is wrong because a second VPN tunnel on the same gateway would still be in us-central1 and might not provide optimal routing. Option B is wrong because VPC Network Peering does not extend on-premises connectivity; it only connects VPC networks, and the on-premises router would still only have a BGP session to the us-central1 Cloud Router. Option D is wrong because Dedicated Interconnect is a dedicated physical connection that requires significant provisioning time and may not be suitable for a quick migration, and it does not inherently allow gradual traffic shifting without additional BGP configuration.

Answer

Create a second Cloud VPN tunnel on the existing Cloud VPN gateway to Europe with a new BGP session, and update the on-premises router to accept the new route advertisement.

Answer

Set up VPC Network Peering between the us-central1 and europe-west1 VPCs to allow cross-region communication.

Answer

Provision a Dedicated Interconnect connection to europe-west1 and attach a new Cloud Router. Remove the existing Cloud VPN gateway.

Question 4

A financial trading platform must support globally distributed, strongly consistent SQL transactions at thousands of writes per second, with no downtime for planned maintenance. Which GCP database service meets all these requirements?

Accepted Answer

Cloud Spanner. Cloud Spanner is the only GCP database service that provides globally distributed, strongly consistent SQL transactions with horizontal scaling, supporting thousands of writes per second. It uses synchronous replication across regions and TrueTime-based clock synchronization to ensure external consistency, while also offering 99.999% availability with no planned downtime for maintenance.

Answer

Cloud SQL with synchronous read replicas

Answer

Cloud Bigtable

Answer

Cloud Firestore

Question 5

Refer to the exhibit. An administrator wants to grant a service account read-only access to all Compute Engine instances in a project, but only those with label 'environment=production'. Which IAM policy configuration should be used?

Accepted Answer

roles/compute.viewer with condition 'resource.labels.environment == "production"'. Roles/compute.viewer provides read-only access to Compute Engine resources, and the condition 'resource.labels.environment == "production"' restricts that access to only instances with the specified label. This satisfies the requirement of granting read-only access to production-labeled instances without granting broader permissions.

Answer

roles/compute.instanceAdmin with condition 'resource.labels.environment == "production"'

Answer

roles/compute.imageUser with condition 'resource.labels.environment == "production"'

Answer

roles/compute.viewer with condition 'request.host == "production"'

Question 6

An e-commerce platform sees a 20x traffic spike every Black Friday. The rest of the year traffic is low and stable. The team wants to minimize costs during normal periods while handling the annual peak without manual intervention. Which architecture achieves this?

Accepted Answer

Managed instance group with autoscaling + scheduled scaling pre-warming before Black Friday. It combines managed instance group autoscaling for normal low-cost operation with scheduled scaling to pre-warm capacity before the Black Friday spike, ensuring seamless handling of the 20x traffic surge without manual intervention. This approach uses the 'autoscaler' and 'scheduled scaling' features in Google Cloud to dynamically adjust resources based on load, while pre-warming prevents cold-start latency during the peak.

Answer

Pre-provision 20x capacity year-round to guarantee Black Friday performance

Answer

Deploy on Cloud SQL — it scales compute automatically for traffic spikes

Answer

Add 20 manual VMs on Black Friday and delete them afterward each year

Question 7

A team's GKE application is running out of memory due to a memory leak. Pods are restarting with OOMKilled status. As an immediate measure before a code fix is available, what kubectl action provides the most insight into which container is leaking?

Accepted Answer

kubectl top pods --containers -n [NAMESPACE]. `kubectl top pods --containers` shows per-container CPU and memory usage for each pod in the namespace. This allows you to identify which specific container within a pod is consuming excessive memory and triggering the OOMKilled status, even before a code fix is deployed. It provides immediate, real-time insight into resource consumption at the container level, which is essential for diagnosing a memory leak in a multi-container pod.

Answer

kubectl get events --field-selector=reason=OOMKilling

Answer

kubectl delete pod [POD_NAME] -- force=true to clear the memory leak

Answer

gcloud container clusters describe [CLUSTER] --memory-usage

Question 8

A company is deploying a multi-region application on Google Kubernetes Engine (GKE) with clusters in us-central1 and europe-west1. They want to route user traffic to the closest healthy cluster using a global load balancer with SSL termination. Which load balancing service should they use?

Accepted Answer

External HTTPS Load Balancer with a global backend service (using NEGs). D is correct because the External HTTPS Load Balancer with a global backend service using Network Endpoint Groups (NEGs) provides global anycast IP, SSL termination, and traffic routing to the closest healthy GKE cluster via Google's global network. This meets the requirement for multi-region GKE clusters with automatic failover and low latency.

Answer

Internal Load Balancer

Answer

SSL Proxy Load Balancer

Answer

External TCP/UDP Network Load Balancer

Question 9

A company requires that all service account keys be automatically rotated every 90 days. Which two steps should the administrator take to enforce this? (Choose two.)

Accepted Answer

Use the Service Account API to create keys with a custom expiration time.. The Service Account API allows creating keys with a custom expiration time, which enforces automatic rotation by ensuring keys are invalid after 90 days. Option E is correct because a Cloud Function can monitor key age and delete keys older than 90 days, providing a programmatic enforcement mechanism. Both approaches ensure keys are rotated automatically without manual intervention.

Answer

Enable the Service Account Key Rotator in the Google Cloud Console.

Answer

Use IAM to set a condition that keys must have an expiration date.

Answer

Use an Organization Policy to disable service account key creation.

Question 10

An organization with multiple teams needs to provision separate, isolated environments (e.g., development, test, production) while sharing common services like Cloud NAT and VPC firewall rules. Which VPC networking pattern is most suitable?

Accepted Answer

Shared VPC (XPN). Shared VPC (XPN) allows an organization to create a single, centrally managed VPC network that hosts common services like Cloud NAT and firewall rules, while enabling multiple project teams to provision their own isolated environments (dev, test, prod) within that same VPC. This pattern meets the requirement for separate, isolated environments with shared services without needing individual VPCs for each team.

Answer

Network Service Tiers (Premium vs Standard)

Answer

VPC Network Peering between team VPCs

Answer

Single VPC with per-team firewall rules