Google ACE Deploying and Implementing a Cloud Solution Practice Test 2 — 15 Questions

Question 1

A company wants to deploy a web application that receives high traffic and requires automatic scaling based on CPU usage, with zero-downtime deployments. The application is containerized. Which TWO services should be considered? (Choose 2 correct answers.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Compute Engine with autoscaling. GKE with Horizontal Pod Autoscaler (HPA) can scale containerized applications based on CPU utilization, and supports rolling updates for zero-downtime deployments. Compute Engine with autoscaling allows running containers on VMs and can autoscale based on CPU usage, with managed instance groups enabling rolling updates. Cloud Run scales based on request concurrency, not CPU, so it does not meet the requirement. App Engine Standard is not for arbitrary containers. Managed Instance Groups are for VMs, not containers directly.

Answer

App Engine Standard Environment

Answer

Cloud Run

Answer

Managed Instance Groups

Question 2

A developer wants to create a Compute Engine instance with the default Debian 11 image, 50 GB boot disk, in the us-west1-a zone, and attach it to the default VPC subnet. Which command should they run?

Accepted Answer

gcloud compute instances create my-instance --zone=us-west1-a --machine-type=e2-medium --image-family=debian-11 --image-project=debian-cloud --boot-disk-size=50 --subnet=default. It specifies all required parameters: zone us-west1-a, machine type e2-medium, Debian 11 image, and a 50 GB boot disk. The --subnet=default flag is optional and defaults to the default VPC subnet. The --boot-disk-size=50 flag interprets the value as GB by default. Option D is also correct because it uses identical settings without the optional --subnet flag. Option A is incorrect because --no-address creates an instance without a public IP, which is not required. Option C is incorrect because it uses image family debian-10 and zone us-west1 (instead of us-west1-a).

Answer

gcloud compute instances create my-instance --zone=us-west1-a --machine-type=e2-medium --image-family=debian-11 --image-project=debian-cloud --boot-disk-size=50GB --no-address

Answer

gcloud compute instances create my-instance --zone=us-west1 --machine-type=e2-medium --image-family=debian-10 --image-project=debian-cloud --boot-disk-size=50GB

Question 3

An administrator needs to create a Cloud Storage bucket in the US multi-region with the 'nearline' storage class. Which command should they use?

Accepted Answer

gsutil mb -c nearline -l US gs://my-bucket. Both gsutil mb and gcloud storage buckets create can be used to create a Cloud Storage bucket. The gsutil command uses -c for storage class and -l for location. The gcloud command uses --storage-class and --location flags, with the storage class value in uppercase (NEARLINE). Both are valid and produce the same result. Option D is therefore also correct.

Answer

gsutil mb -s nearline -l US gs://my-bucket

Answer

gsutil mb -c nearline -l US-CENTRAL1 gs://my-bucket

Question 4

A developer wants to make objects in a Cloud Storage bucket publicly readable. They want to grant access to allUsers with the objectViewer role. Which command should they use?

Accepted Answer

gsutil iam ch allUsers:objectViewer gs://my-bucket. The correct command is gsutil iam ch allUsers:objectViewer gs://my-bucket, which grants the IAM role roles/storage.objectViewer to allUsers via a valid alias. Option B is invalid because gcloud storage bucket URLs require the gs:// scheme, option A uses legacy ACL syntax, and option C uses an invalid role alias.

Answer

gsutil acl ch -u AllUsers:R gs://my-bucket

Answer

gcloud storage buckets add-iam-policy-binding my-bucket --member allUsers --role roles/storage.objectViewer

Answer

gsutil iam ch allUsers:storage.objectViewer gs://my-bucket

Question 5

A team needs to set up autoscaling for a managed instance group based on CPU utilization. They want the average CPU across the group to stay around 60%. Which autoscaling policy configuration should they use?

Accepted Answer

Set the autoscaling policy to use the target CPU utilization of 0.6. The autoscaling policy for CPU utilization in Google Cloud expects a target value between 0.0 and 1.0, where 0.6 represents 60% CPU utilization. Therefore, setting the target to 0.6 is the correct configuration to maintain an average CPU utilization of 60% across the managed instance group.

Answer

Set the autoscaling policy to use the target CPU utilization of 60

Answer

No autoscaling is needed; MIGs automatically scale based on load

Answer

Set the autoscaling policy to use the target HTTP load balancing utilization of 60%

Question 6

A developer wants to deploy a Cloud Run service from source code in a local directory. Which two commands or steps are necessary? (Choose two.)

Accepted Answer

Run gcloud builds submit --tag gcr.io/my-project/my-image .. `gcloud builds submit --tag gcr.io/my-project/my-image .`, builds a container image from the source code, which is a necessary step if you choose to build separately. Option D, `gcloud run deploy --source . --region=us-central1`, is a single command that both builds and deploys the source code directly to Cloud Run, making it the streamlined approach. Both are valid methods for deploying from source. Option B targets Cloud Functions, not Cloud Run. Option C is for App Engine. Option E requires a pre-built image, so it cannot be used directly with source code without a prior build step. Therefore, A and D are the correct choices.

Answer

Run gcloud functions deploy my-function --source . --runtime nodejs16

Answer

Run gcloud app deploy --source .

Answer

Run gcloud run deploy --image=gcr.io/my-project/my-image --region=us-central1

Question 7

A developer created a Cloud Function with HTTP trigger. When they send a POST request to the function's URL, they get a 403 Forbidden error. The function is deployed with --allow-unauthenticated flag? What is the most likely cause?

Accepted Answer

The function does not have the Cloud Functions Invoker role for allUsers. The `--allow-unauthenticated` flag is used to set the IAM policy, granting the `Cloud Functions Invoker` role to `allUsers` for unauthenticated access (this applies to both 1st and 2nd gen functions, though 2nd gen uses Cloud Run Invoker). A 403 Forbidden error for an HTTP-triggered Cloud Function almost always indicates that the caller (in this case, `allUsers`) lacks the necessary `Cloud Functions Invoker` role. Despite the developer's claim of using the flag, the error suggests that this IAM policy was either not successfully applied during deployment or was subsequently removed. Options A, C, and D would typically result in different error codes (e.g., 500, 404) or deployment failures.

Answer

The function uses a runtime that does not support HTTP triggers

Answer

The function is not deployed in the correct region

Answer

The function URL is malformed

Question 8

An organization needs to deploy a regional Cloud SQL MySQL instance with 4 vCPUs and 15 GB of memory. The instance should be highly available within a single region. Which gcloud command should they use?

Accepted Answer

gcloud sql instances create my-instance --tier=db-n1-standard-4 --region=us-central1 --database-version=MYSQL_8_0 --root-password=password123 --availability-type=REGIONAL. It includes the --availability-type=REGIONAL flag, which is required to create a highly available Cloud SQL instance within a single region. The tier, region, database version, and root password are also correctly specified. Option C is incorrect because it omits the --availability-type flag, resulting in a zonal instance without high availability. Option B uses the wrong tier (db-n1-highmem-4 has 26 GB RAM, not 15 GB). Option D is missing the required --database-version and --root-password flags.

Answer

gcloud sql instances create my-instance --tier=db-n1-highmem-4 --region=us-central1 --database-version=MYSQL_8_0

Answer

gcloud sql instances create my-instance --tier=db-n1-standard-4 --region=us-central1 --database-version=MYSQL_8_0 --root-password=password123

Answer

gcloud sql instances create my-instance --tier=db-n1-standard-4 --region=us-central1

Question 9

A company's application running on Compute Engine uses a startup script to install software. The script is failing intermittently. The engineer wants to view the startup script output for a specific instance to debug. How can they access the startup script logs?

Accepted Answer

Check the serial console output in Cloud Console. The original explanation for option A states, 'Cloud Console does not show startup script output directly under VM instances details.' This is factually incorrect. Startup script output is indeed visible in the Cloud Console under the 'Serial port 1 (console)' tab for a VM instance. Both checking the serial console output in Cloud Console (Option A) and using `gcloud compute instances get-serial-port-output` (Option B) are valid and common methods to access startup script output, especially useful if SSH access is problematic or if the script fails early in the boot process. Option C, SSHing into the instance and viewing /var/log/syslog, is also a correct and common method for debugging startup scripts once the instance is running and SSH is accessible. Therefore, options A, B, and C are all valid ways to access startup script logs, leading to multiple correct answers in the question.

Answer

View the instance's logs in Cloud Logging

Question 10

A team is using Terraform to deploy infrastructure. They want to ensure that the Terraform state file is encrypted at rest using a customer-managed encryption key (CMEK). What should they configure?

Accepted Answer

Use a Cloud Storage bucket with CMEK enabled by default; no Terraform configuration needed. To use CMEK with the GCS backend, you have two valid approaches: 1) Use an existing Cloud Storage bucket that already has CMEK enabled by default—no Terraform encryption configuration is needed because the bucket itself enforces encryption. 2) When creating a new bucket via the `google_storage_bucket` resource, set the `encryption` block with a `default_kms_key_name` to specify a CMEK key. The provider block does not have a `kms_key` argument, and the `terraform` backend block does not support a `kms_key` argument for GCS. Both options A and B are correct.

Answer

Set the kms_key argument in the google provider block

Answer

Set the kms_key argument in the terraform backend block

Question 11

A company wants to deploy a stateless web application on Google Cloud. The application should automatically scale based on CPU utilization and distribute traffic across instances. Which TWO services can meet these requirements?

Accepted Answer

App Engine Standard Environment. Compute Engine managed instance groups (MIGs) with autoscaling based on CPU utilization can handle this. Also, GKE with Horizontal Pod Autoscaler scales pods based on CPU. App Engine Standard also scales automatically and can be configured to scale based on CPU utilization (e.g., using `target_cpu_utilization` in `app.yaml`). Cloud Run scales automatically but does not offer CPU-based autoscaling (scales based on request concurrency). Cloud Functions scales based on concurrency.

Answer

Cloud Functions

Answer

Cloud Run

Question 12

An organization needs to deploy a containerized application on GKE that requires persistent storage. The storage must be highly available across zones within a region. Which THREE components are required to achieve this?

Accepted Answer

StatefulSet. To deploy a containerized application on GKE requiring highly available persistent storage across zones, three key components are needed. A **Regional Persistent Disk (PD)** (E) provides the underlying block storage synchronously replicated across zones for high availability. A **PersistentVolumeClaim (PVC)** (C) is the Kubernetes object that an application's pod uses to request and bind to a PersistentVolume backed by the Regional PD, making it essential for consuming the storage. A **StatefulSet** (B) is crucial for managing stateful applications, ensuring stable pod identities and proper volume attachment/detachment across disruptions, which is vital for maintaining state with persistent storage in an HA environment. While a PodDisruptionBudget (D) contributes to overall application availability during voluntary disruptions, the PVC is more fundamental to the application's ability to utilize the persistent storage itself.

Answer

VolumeAttachment

Answer

PodDisruptionBudget (PDB)

Question 13

A company has a managed instance group (MIG) with an autoscaler based on CPU utilization. The MIG is not scaling up even though CPU utilization is consistently above 80%. The instances are running a batch processing workload that takes several minutes to finish. What is the most likely cause?

Accepted Answer

The autoscaler's cooldown period is set too long. If the cooldown period is too long, the autoscaler will wait for this period to expire after any scaling event (up or down) before it can initiate another scaling decision. This delay can prevent the autoscaler from reacting quickly enough to sustained high CPU utilization, making it appear as if it's not scaling up effectively or quickly enough to meet demand, especially with workloads like batch processing that require sustained resource allocation and can be sensitive to scaling delays.

Answer

The autoscaler's cooldown period is set too short

Answer

The health check is failing on the instances

Answer

The maximum number of instances is already reached

Question 14

A company wants to deploy a stateless microservice on GCP. The service experiences unpredictable traffic bursts and must scale to zero when idle to minimize costs. Which two services meet these requirements?

Accepted Answer

Cloud Functions (HTTP trigger). Cloud Run (fully managed) and Cloud Functions (HTTP trigger) both scale to zero when idle and handle burst traffic. Additionally, App Engine Standard environment can also scale to zero when configured with manual or basic scaling, or with automatic scaling and min_idle_instances set to 0. Compute Engine managed instance groups can scale down but not to zero as they require at least one instance. GKE with managed instance groups also requires a minimum number of nodes. Therefore, the correct answers are Cloud Functions, Cloud Run, and App Engine Standard.

Answer

Compute Engine managed instance group with autoscaling

Answer

Google Kubernetes Engine (GKE) with a managed instance group

Question 15

An engineer needs to create a Compute Engine instance with a specific custom subnet, an Ubuntu 20.04 LTS image, and a 50 GB boot disk. The engineer also wants to run a startup script that installs Apache. Which gcloud command should the engineer use to create this instance?

Accepted Answer

gcloud compute instances create my-instance --machine-type=e2-medium --image-family=ubuntu-2004-lts --image-project=ubuntu-os-cloud --boot-disk-size=50GB --subnet=my-subnet --zone=us-central1-a --metadata startup-script='apt-get update && apt-get install -y apache2'. The correct command is option B. It uses the required flags: --machine-type (not --machine), --image-family=ubuntu-2004-lts, --image-project=ubuntu-os-cloud, --boot-disk-size=50GB, --subnet=my-subnet, and --metadata with the startup script. Option A is incorrect because it uses --machine (invalid) instead of --machine-type. Option C is incorrect because it uses the wrong image family (ubuntu-1804-lts). Option D is incorrect because it uses --image instead of --image-family, which is not recommended for specifying an image family.

Answer

gcloud compute instances create my-instance --machine=e2-medium --image-family=ubuntu-2004-lts --image-project=ubuntu-os-cloud --boot-disk-size=50GB --subnet=my-subnet --zone=us-central1-a --metadata=startup-script='apt-get update && apt-get install -y apache2'

Answer

gcloud compute instances create my-instance --machine-type=e2-medium --image-family=ubuntu-1804-lts --image-project=ubuntu-os-cloud --boot-disk-size=50GB --subnet=my-subnet --zone=us-central1-a --metadata=startup-script='apt-get update && apt-get install -y apache2'

Answer

gcloud compute instances create my-instance --machine-type=e2-medium --image=ubuntu-2004-lts --image-project=ubuntu-os-cloud --boot-disk-size=50GB --subnet=my-subnet --zone=us-central1-a --metadata startup-script='apt-get update && apt-get install -y apache2'