Google ACE Deploying and Implementing a Cloud Solution Practice Test 2 — 15 Questions

Question 1

A developer is deploying a containerized application on Cloud Run. The application needs to be invoked by external HTTPS requests without requiring authentication. Which flag should be included in the 'gcloud run deploy' command?

Accepted Answer

--allow-unauthenticated. The --allow-unauthenticated flag makes the Cloud Run service publicly accessible. By default, Cloud Run requires authentication via IAM. Adding this flag grants the 'run.invoker' role to allUsers.

Answer

--invoker=public

Answer

--ingress=internal

Answer

--no-allow-unauthenticated

Question 2

An engineer wants to create a Compute Engine instance with a specific machine type, a custom network subnet, and a startup script. Which gcloud command correctly creates such an instance?

Accepted Answer

gcloud compute instances create my-vm --machine-type=n1-standard-2 --subnet=my-subnet --metadata startup-script='echo Hello'. The 'gcloud compute instances create' command with flags --machine-type, --subnet, and --metadata startup-script is the standard way to create a VM with those specifications.

Answer

gcloud compute instances create my-vm --machine-type=n1-standard-2 --subnet=my-subnet --startup-script='echo Hello'

Answer

gcloud compute instances create my-vm --machine-type=n1-standard-2 --subnet my-subnet --metadata startup-script='echo Hello'

Answer

gcloud compute instances create my-vm --machine-type=n1-standard-2 --network=my-subnet --metadata startup-script='echo Hello'

Question 3

A team is using Terraform to manage infrastructure. They want to store the Terraform state file remotely in a GCS bucket for team collaboration. Which Terraform backend configuration is correct?

Accepted Answer

terraform {
  backend "gcs" {
    bucket = "my-terraform-state"
  }
}. The gcs backend requires the 'bucket' argument. Prefix is optional. The correct syntax uses backend 'gcs' with bucket name.

Answer

terraform {
  backend "gcs" {
    bucket = "my-terraform-state"
    prefix = "terraform/state"
  }
}

Answer

terraform {
  backend "storage" {
    bucket = "my-terraform-state"
  }
}

Answer

terraform {
  backend "gcloud" {
    bucket = "my-terraform-state"
  }
}

Question 4

A Cloud Function needs to be triggered whenever a message is published to a Pub/Sub topic. Which 'gcloud functions deploy' command flag is required to set the trigger?

Accepted Answer

--trigger-topic. The --trigger-topic flag configures a Cloud Function to be triggered by Pub/Sub messages.

Answer

--trigger-http

Answer

--trigger-event

Answer

--trigger-bucket

Question 5

An organization has strict security policies requiring that all Compute Engine instances use OS Login for SSH access instead of metadata-based SSH keys. Which two actions must be taken to enforce this for all new instances? (Choose two.)

Accepted Answer

Remove all SSH keys from project metadata. To enforce OS Login, you enable it at the project level project-wide (enabled by a specific metadata key) and ensure instances have no metadata-based SSH keys. The other options are incorrect.

Answer

Use 'gcloud compute ssh' with the --tunnel-through-iap flag

Answer

Set metadata 'enable-oslogin=FALSE' at the instance level

Answer

Set metadata 'block-project-ssh-keys=TRUE' at the instance level

Question 6

A company wants to deploy a microservice on GKE. The deployment requires 3 replicas, and the service must be accessible via a fixed public IP address. Which Kubernetes resource should be used to expose the deployment?

Accepted Answer

Service of type LoadBalancer. A LoadBalancer service provisions a Google Cloud TCP/UDP Load Balancer with a public IP. NodePort exposes on node ports but not a fixed IP. ClusterIP is internal only. Ingress is a more advanced option but not the simplest for a fixed IP.

Answer

Ingress resource

Answer

Service of type ClusterIP

Answer

Service of type NodePort

Question 7

Which gcloud command creates a regional GKE cluster named 'my-cluster' with 3 nodes per zone in the 'us-central1' region?

Accepted Answer

gcloud container clusters create my-cluster --region us-central1 --num-nodes 3. To create a regional cluster, use --region (not --zone). The --num-nodes flag sets nodes per zone.

Answer

gcloud container clusters create my-cluster --zone us-central1 --num-nodes 3

Answer

gcloud container clusters create my-cluster --zone us-central1-a --num-nodes 3

Answer

gcloud container clusters create my-cluster --region us-central1 --nodes 3

Question 8

An engineer needs to migrate a large on-premises database to Cloud SQL for PostgreSQL. The database is 500 GB and can tolerate a few hours of downtime. The migration must minimize manual intervention. Which approach should the engineer use?

Accepted Answer

Use Database Migration Service (DMS). Database Migration Service supports homogeneous migrations (including PostgreSQL to Cloud SQL) and automates the process. It supports continuous replication and minimal downtime. The others are not ideal: pg_dump requires manual steps and downtime; gcloud sql import is for file import; Compute Engine with pg_dump involves manual steps.

Answer

Use pg_dump to export and pg_restore to import

Answer

Use gcloud sql import to import a dump file

Answer

Set up a Compute Engine instance to run pg_dump and then gcloud sql import

Question 9

A developer is using Cloud Functions with HTTP trigger. The function needs to process a request payload and return a response. What is the correct way to send a JSON response from the function?

Accepted Answer

res.send({ 'status': 'ok' }). In Cloud Functions (Node.js runtime), the response is sent via the res (response) object. The correct method is res.send() or res.json(). res.send() can send JSON directly.

Answer

response.end(JSON.stringify({ 'status': 'ok' }))

Answer

return { 'status': 'ok' }

Answer

context.done(null, { 'status': 'ok' })

Question 10

An organization wants to use Cloud Storage to host a static website. The bucket name must match the domain name. They already own the domain 'example.com' and want to serve the site from 'www.example.com'. Which bucket name should they create?

Accepted Answer

www.example.com. To host a website with a custom domain using Cloud Storage, you must use a bucket name that matches the domain (or subdomain). For 'www.example.com', the bucket must be named 'www.example.com'. For the apex domain, it would be 'example.com'.

Answer

example.com

Answer

www_example_com

Answer

example-com-bucket

Question 11

Which kubectl command is used to view the logs of a specific pod named 'my-pod'?

Accepted Answer

kubectl logs my-pod. The 'kubectl logs' command streams logs from a pod. 'kubectl describe' shows metadata, 'kubectl get' shows status, and 'kubectl exec' runs commands inside the pod.

Answer

kubectl exec my-pod -- logs

Answer

kubectl get pod my-pod

Answer

kubectl describe pod my-pod

Question 12

A company is using a managed instance group (MIG) with autoscaling based on CPU utilization. The application is memory-intensive, and the team notices that new instances are not being created quickly enough during traffic spikes. What should the engineer do to improve responsiveness?

Accepted Answer

Decrease the autoscaling cooldown period. Increasing autoscaling cooldown period slows down scaling. Decreasing it makes scaling more responsive. Changing to a more aggressive metric or using predictive autoscaling can help, but the simplest is to reduce the cooldown period. The other options are wrong.

Answer

Enable predictive autoscaling

Answer

Increase the autoscaling cooldown period

Answer

Use a larger machine type in the instance template

Question 13

A team is deploying a web application on Cloud Run. The application needs to be available globally with low latency, and the team wants to use a custom domain with an SSL certificate. Which TWO actions are required to achieve this?

Accepted Answer

Configure a custom domain mapping on the Cloud Run service. Cloud Run services are regional; to serve globally, you need a global load balancer (e.g., using an external HTTPS load balancer with serverless NEG). Mapping a custom domain to the service is also required.

Answer

Set the --ingress=all flag on the Cloud Run service

Answer

Use Cloud CDN to cache content

Answer

Deploy the service as a Cloud Run for Anthos on GKE

Question 14

An engineer needs to allow an external IP address (203.0.113.5) to access a Compute Engine instance that only has an internal IP. The instance is in a VPC with Cloud NAT. Which TWO steps are necessary to enable this access?

Accepted Answer

Grant the user the roles/iap.tunnelResourceAccessor IAM role on the instance. To access an internal-only instance from the internet, you need an IAP TCP forwarding tunnel (gcloud compute start-iap-tunnel) and the appropriate IAM role (roles/iap.tunnelResourceAccessor) to use IAP. Alternatively, you could use a bastion host, but IAP is cleaner.

Answer

Set a firewall rule allowing ingress from the IP 203.0.113.5 to port 22

Answer

Modify the Cloud NAT to allow the external IP

Answer

Assign a public IP to the instance

Question 15

A company wants to set up a Cloud SQL for MySQL instance with automated backups and a read replica for disaster recovery. Which THREE features or configurations should be enabled?

Accepted Answer

Enable automated backups. Automated backups are enabled by default but must be configured. A read replica requires the binary log to be enabled on the primary. The backup location can be set to multi-regional for DR. Cross-region replication requires a replica in another region. Point-in-time recovery uses binary logs.

Answer

Enable deletion protection on the primary instance

Answer

Assign a public IP address to the read replica